Domain Credential Phishing - LDAP fails to bind

[MichaelWrigh]

Hi all,

I have been setting up the domain credential phishing with a colleague and we have run into an issue where the service account is unable to bind to the LDAP on the RODC. We have followed the troubleshooting guidelines in the following document but unfortunately we still hit the same issue. Has anyone else experienced this issue or knows how to remedy it?  

Troubleshooting document - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLaXCAW

07/23/20 15:36:35:366 [ Info 2057]: ---------------Service is stopped---------------

07/23/20 15:36:35:366 [ Info 1917]: Service stopped.
07/23/20 15:36:36:694 [ Info 2038]: ------------Service is being started------------
07/23/20 15:36:36:710 [ Info 2045]: Os version is 6.2.0.
07/23/20 15:36:36:710 [ Info 389]: Load debug log level Info.
07/23/20 15:36:36:710 [ Info 247]: Service version is 9.1.1.8.
07/23/20 15:36:36:710 [ Info 392]: Product version is 9.
07/23/20 15:36:36:710 [ Info 313]: Named pipe for UaService created.
07/23/20 15:37:11:069 [Error 542]: ldap_connect(AD service account) return(49) : ÀÝA

07/23/20 15:37:11:069 [Error 1073]: pan_ldap_bind() failed

07/23/20 15:37:11:069 [Error 1861]: ldap connect failed: 8ÝA

[OtakarKlier]

Hello,

Like the article suggests, try running the service as Local System. If that doesnt work, use a Domain Admin account and run the service with it.

Regards,

[MichaelWrigh]

Thank you for the response. My colleague said he tried doing this but there was nothing in the logs for the local system account attempting to make the ldap bind. I am guessing the services were not stopped while the attempt was made.

Will be working on this later today and will post an update after.