Search for old KB kA10g00000PLW6

[wuj]

I am looking for a this KB that I bookmarked in 2022.

https://knowledgebase.paloaltonetworks.com/KCSArtcleDetail?id=kA10g00000PLW6

Can you someone point me to the new KB?

Thanks,

Jay

[kiwi]

Hi @wuj ,

Do you know what the topic of the KB was ?

Kind regards,

[wuj]

Thanks for your reply! 

It was about a KB to resolve the 10036 error messages from the PAN switches, and the AD account doesn't allow to activate DCOM server. "Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application."

[kiwi]

Hi @wuj ,

Is it possible this is related to a transport method change (from WMI to WinRM)  ?

When the firewall was set to use WMI as a transport method, the "client probing feature" is also set to provide the WMI probing to the server side. The "Client Probing" feature uses WMI queries. When you migrate to WinRM, despite the fact that the client probing feature is no longer needed for WinRM tasks, it can persist on the firewall configuration.

In order to avoid the server getting the error message "10036" from any user from the firewall side, after a transport method change ( from WMI to WinRM ). Administrators must manually uncheck the "Client Probing" feature functionality.

Path: Device > User Identification > User Mapping  : Palo Alto Networks User-ID Agent Setup: Client Probing

For the error ID 10036|KB5004442. of Microsoft DCOM, it is suggested to migrate to WinRM to avoid the same,
Option 3: Switch to WinRM transport protocol in this KB:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004MI6
However, in some scenarios after changing to WinRM the error message persists on the server side.

Palo Alto Networks strongly recommends disabling client probing because it is not a recommended method of obtaining User-ID information in a high-security network:

https://docs.paloaltonetworks.com/ngfw/administration/user-id/user-id-concepts/user-mapping/client-p...

I hope these help,

[wuj]

Hi Kiwi,

Thank you for your reply!

I will check it out.

thanks,

-Jay