User Mapping - AD access denied

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

User Mapping - AD access denied

L3 Networker

Hello all, 

You are using Microsoft Active Directory, but you receive the following error log:

 

Useridd.log 
>

  • Error:  pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603): log query for AD_3 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
  • 2023-02-08 06:54:00.114 +0900 Error:  pan_user_id_win_get_error_status(pan_user_id_win.c:1288) : WMIC message from server AD_3: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
  • 2023-02-08 06:54:01.111 +0900 Error:  pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603): log query for AD_2 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
  • 2023-02-08 06:54:01.111 +0900 Error:  pan_user_id_win_get_error_status(pan_user_id_win.c:1288): WMIC message from server AD_2: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
  • 2023-02-08 06:54:02.114 +0900 2023-02-08 06:54:02.114 +0900 Error:  pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603): log query for AD_3 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
  • 2023-02-08 06:54:02.114 +0900 Error:  pan_user_id_win_get_error_status(pan_user_id_win.c:1288): WMIC message from server AD_3: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
  • Error:  pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603): log query for AD_1 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
  • 2023-02-08 06:54:02.114 +0900 Error:  pan_user_id_win_get_error_status(pan_user_id_win.c:1288): WMIC message from server AD_1: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
  • 2023-02-08 06:54:03.114 +0900 Error:  pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603): log query for AD_2 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
  • 2023-02-08 06:54:03.114 +0900 Error:  pan_user_id_win_get_error_status(pan_user_id_win.c:1288): WMIC message from server AD_2: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
  • 2023-02-08 06:54:04.115 +0900 Error:  pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603): log query for AD_1 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
  • 2023-02-08 06:54:04.115 +0900 Error:  pan_user_id_win_get_error_status(pan_user_id_win.c:1288): WMIC message from server AD_1: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied

These issues occur even if AD settings are checked and changed based on the link below.
>https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGGCA0

Has anyone experienced and solved these issues?

4 REPLIES 4

Cyber Elite
Cyber Elite

Hi @JoHyeonJae ,

 

You need to look at the security event viewer on your AD server to see the specific reason the access is denied.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

L3 Networker

@TomYoung 

I have looked through the security event viewer on the Server side. 

But, there was no evidence to cause it. Is there anything else I can check?

And I found the following article while tracking the error log that occurred. Is it not related to the issue that occurred?

https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-...

Cyber Elite
Cyber Elite

Hi @JoHyeonJae ,

 

So you see the DCOM error on the server?  It will be in the system event viewer.  Thank you for that URL.  It has been updated since I last looked.  It looks like this issue -> https://live.paloaltonetworks.com/t5/general-topics/user-identification-and-winrm-on-http/m-p/481674.  It sounds like if you apply the patch you will be good, but it may be disabled next month.  I think PANW will need to provide a fix by then.  Please let me know what you find.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

@TomYoung

After I went through the log, the error log number generated by the customer PA is 1288,1603 and the error log number written in the URL is 1587,1272.

  • 2023-02-08 06:54:00.114 +0900 Error:  pan_user_id_win_get_error_status(pan_user_id_win.c:1288) : WMIC message from server AD_3: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
  • 2023-02-08 06:54:01.111 +0900 Error:  pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603😞 log query for AD_2 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
    Screenshot 2023-02-14 at 9.23.00 AM.png
    Can the same issue occur in this case?

    Additionally, the customer is using the KB5015808.
  • 2524 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!