User-ID not populating after Microsoft patching - Warning

OtakarKlier — Tue, 15 Jun 2021 16:07:11 GMT

Hello All,

Just wanted to post this in case anyone else ran into it. Microsoft release patches as they normally do, however there is one that might break user-id, June 8, 2021—KB5003671 (Monthly Rollup). There is a warning in the notes:

After installing this or later updates, apps accessing event logs on remote devices might be unable to connect. This issue might occur if the local or remote has not yet installed updates released June 8, 2021 or later. Affected apps are using certain legacy Event Logging APIs. You might receive an error when attempting to connect.

Link to notes and patch: https://support.microsoft.com/en-us/topic/june-8-2021-kb5003671-monthly-rollup-a1359a77-3932-46f9-8c5f-e4d5c06b9dbf

What they are saying is if the server that hosts user-id is patched and the server that the user-id agent reaches out to is not, it might not connect.

In our case we are monitoring Exchange, gets patched manually and the server that hosts the user-id agent gets patches automatically. So our solution was to install the user-id agent onto the Exchange server to get us going in the short term. You'll have to add the agent to the PAN's and make sure security policies are updated as applicable.

Hope this can help someone.

Cheers!

Re: User-ID not populating after Microsoft patching - Warning

OtakarKlier — Tue, 15 Jun 2021 18:46:51 GMT

Official Palo Alto response/notification 🙂

https://live.paloaltonetworks.com/t5/customer-advisories/microsoft-s-june-2021-patches-may-break-the-user-id-agent-s/ta-p/413331

topic Re: User-ID not populating after Microsoft patching - Warning in General Topics

User-ID not populating after Microsoft patching - Warning

Re: User-ID not populating after Microsoft patching - Warning