Microsoft AD under Server Monitoring is showing as 'not connected.'
We would like to use the PAN-OS Integrated User-ID Agent
Output from debug commands show UserID Debug Log is enabled but nothing is logging.
Anyone encountered similar issue?
Solved! Go to Solution.
Today applications produced with the help of Java programming language online is being used for, desktop, gaming, database, web, business, and other applications. Initially, it was designed to look and work like C++ language and therefore manifest most of its syntax from C/C++. Java is a platform independent language that follows the concept of WORA (Write once, Run Anywhere), which means that the developers have to write the code only once and can make them run on multiple platforms that are supported by java. Moreover, it allows the developers to execute multiple statements rather than executing them sequentially.
did you follow this guide?:https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGGCA0
Yes...PA TAC assisted us in resolving the issue. Below is the case notes.
> less mp-log useridd.log
Looking at User-ID logs, there were repeated logs:
2019-04-23 12:36:36.704 +1000 Error: pan_user_id_win_log_query(pan_user_id_win.c:1364): log query for sydcwdc01.mainstreambpo.local failed: NTSTATUS: NT code 0x80041003 - NT code 0x80041003
2019-04-23 12:36:36.704 +1000 Error: pan_user_id_win_get_error_status(pan_user_id_win.c:1055): WMIC message from server sydcwdc01.mainstreambpo.local: NTSTATUS: NT code 0x80041003 - NT code 0x80041003
WMI error code 0x80041003 indicates the account does not have permission.
Please check that the service account (mainstreambpo\palocw) is member of Event Log Readers and Distributed COM Users
Some useful commands related to User-ID:
- Restart User-ID service: debug software restart process user-id
- View server monitor statistics: show user server-monitor statistics
Other than the group membership of service account, kindly also check the WMI permission in every DC server being used under Server Monitoring. This WMI permission is local configuration (not replicated).
Agentless User-ID 'Access Denied' Error In Server Monitor
We checked that we have given all the correct permissions on the WMI side for all our DCs.
We asked for a trace to run to figure out what exactly its failing on when it accesses the AD side of things.
PA TAC provided us the following.
Provided that the WMI permissions are set, can you test to do WMI remote connection using wbemtest?
1. In any windows client (domain member), run wbemtest
2. Default namespace is 'root\cimv2', please change to '\\<dcservername>\root\cimv2'
3. Provide username and password (firewall service account), then click Connect
4. Observe if there is error message when wbemtest is trying to connect to DC server
This fixed the issue!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!