Upgrade DCs to W2019 stop working Palo Alto agentless

[BigPalo]

Hi,

We upgraded all ours DCs to W2019server and now the Palo Alto can not monitor the users. We use Agentless UserID.

So how can we fix it? 

[TomYoung]

Hi @BigPalo ,

You may be running into this issue -> https://live.paloaltonetworks.com/t5/general-topics/user-identification-and-winrm-on-http/m-p/481674.

There is no fix to my knowledge for WMI.  For me, configuring WinRM-HTTP or HTTPS was too complicated, and migrating to the Windows User-ID agent was easy.  https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/map-ip-addresses-to-users/configu...

Thanks,

Tom

[BPry]

@BigPalo,

WinRM-HTTPS isn't that difficult to setup, but it is dependent on some back-end configuration that you're environment may or may not already be setup to utilize depending on how you're managing your Windows fleet. Personally the change took minutes to get configured, but it was primarily because WinRM was already setup and properly configured.

There are benefits of using the agent instead of agentless, but in general I personally find it a bit overkill for simple environments. Which method is utilized in deployments personally tends to be more of a conversation about the working dynamic between the server operations group and the group managing the firewall. Agentless is a bit more set and forget if those groups are confrontational versus maintaining the agent. 

[BigPalo]

The PanOS version is 9.1.x. Its a device in EoS. So i dont know if that has anything to do with Windows 2019.

Why stop working upgrading to W2019 DCs?  What is the change? Its documented?

[TomYoung]

Hi @BigPalo ,

Here is the PAN-OS documentation.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkkfCAA

What probably happened is that your previous servers did not have the patch.  MS announced that this security fix will be built into future releases.  You can find more details by following the 1st URL trail I posted.

Thanks,

Tom

[BigPalo]

Its possible to rollback the patch to work? Doing WinRM is quite annoying