User-ID Agent Errors on Domain Controllers

[dannon]

I'm getting the following error showing up in event viewer on our Windows domain controller.  We have 4 DC total that have the the user-id agent installed.

As you can see, I am getting a lot of these error.  The IP in question is one from our BYOD subnet, meaning it could be a end-user personal device.  Most of the IPs in the error logs are from this subnet.

I am also seeing the following on the User-Agent logs:

I'm not sure if they are related or not.  When I setup the agent, I left all settings at their defaults, except for adding our service account for start-up and adding the other DCs.

[Mystique · Accepted solution]

Hello Dannon,

The DCOM errors are most probably due to WMI probing for IPs that are not responding. Can you please disable WMI probing under user-ID setup and test to see if the system error messages stopped ?

On PAN User-ID agent, go to setup --> click edit --> client probing --> uncheck WMI probing checkbox

Helpful doc:

User-ID Agent Generating DCOM and Kerberos System Errors

[dannon]

Yes, turning off WMI caused the errors to cease.

My problem now is that I want to have WMI enabled, but my server admin doesn't want all the logs flooded with these entries on the DCs.

What to do?

[dannon]

I've found that we have better results with user-id to ip mapping with having WMI probing enabled.  I turned it on, and told our server admin to calm down.    It's still messy looking and I would like to have Palo put this in a separate application log in event viewer.  I've seen other filtering software do this.

Dannon