Agentless user id issue

[Joshan_Lakhani]

i am facing user id issue  it's show connected but some time is not show not connected. when i check the USER-ID log i find this error. please suggest.

Error: pan_user_id_win_log_query(pan_user_id_win.c:1364): log query for <Server-IP > failed: NTSTATUS: NT code 0xc002001b - NT code 0xc002001b

2020-09-03 13:09:08.934 +0400 Error: pan_user_id_win_get_error_status(pan_user_id_win.c:1055): WMIC message from server <Server-IP > : NTSTATUS: NT code 0xc002001b - NT code 0xc002001b

[Max.Segura]

Do you want to set up a team viewer session? I can take a look if you'd like.

[BPry]

@Joshan_Lakhani,

This is a permission error on the service account.Double check that you've granted the service account used in the WMI configuration the proper permissions on the account.

[Joshan_Lakhani]

@BPry 

I have check the WMI Permission on service account and all the permission are give on service account.

28 17:42:54.567 +0400 Error:  pan_user_id_win_wmic_log_query(pan_user_id_win.c:1588): log query for <Server Name> failed: NTSTATUS: NT code 0xc002001b - NT code 0xc002001b
2020-09-28 17:42:54.567 +0400 Error:  pan_user_id_win_get_error_status(pan_user_id_win.c:1273): WMIC message from server <Server Name>: NTSTATUS: NT code 0xc002001b - NT code 0xc002001b
---
2020-09-28 17:38:19.933 +0400 Warning:  pan_user_id_win_log_parse(pan_user_id_win.c:1458): failed to convert time str 20200928133[wmi/wmic.c:216:main()] ERROR: Retrieve result data.
2020-09-28 17:41:05.187 +0400 Warning:  pan_user_id_win_log_parse(pan_user_id_win.c:1458): failed to convert time str 2020[wmi/wmic.c:216:main()] ERROR: Retrieve result data.
---

Regards,

Joshan Lakhani

[itcsec]

I am having exactly the same issue. I even tested the account permission via wbemtest and it is OK, yet both the Windows User-ID Agent and Integrated User-ID Agent are not able to connect with any of the Active Directory servers except 1. The communication is also 'allowed' via the firewall. Not sure how to troubleshoot this issue.

[itcsec]

Here are some of the reference links that helped me resolve my issue. It was basically two fold solution, (a) proper rights assignment on the AD & (b) right patches on the AD as well as on the UserID Agent server.

INSTALLING MICROSOFT'S JUNE 8TH 2021 NTLM ELEVATION OF PRIVILEGE VULNERABILITY PATCHES MAY BREAK THE USER-ID AGENT'S CONNECTION TO DOMAIN CONTROLLER(S):
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001Vcg

Enable Remote WMI Access for a Domain User Account:
https://martellotech.com/blog/enable-remote-wmi-access-for-a-domain-user-account/

Server Monitoring Not Connected:
https://live.paloaltonetworks.com/t5/general-topics/server-monitoring-not-connected/td-p/257956

This link helps in WMI testing

AGENTLESS USER-ID 'ACCESS DENIED' ERROR IN SERVER MONITOR:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clk0CAC

This link has the resolution of the Access Denied error.