Windows Server 2003 with Agentless User ID

[codemsittc]

Hi guys,

I am setting up agentless user-id with Windows Server 2003 Active Directory. My PAN-OS version is 8.1.16.

For the setup, i've followed the guide here:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGGCA0

Currently i am being hit by this error message:

When I looked up for NT error code 0xc002001b, it shows that RPC had failed.

Requesting for any experts for help on this error.

Below are some configurations screenshots that i've done following the guide mentioned above.

1) Creation of service account on the AD with the correct members:

2) Because it is Windows Server 2003, and does not have "Event Log Readers" in the member group, the panagent service account was added to the group policy below:

3) Panagent permission:

4) Basic config on the palo alto for the agentless user id:

5) I've also permitted related firewall rules to allow the connection to pass successfully. I do not see any traffic being blocked for traffic between these two IPs. TCP 135, 4266, 389 were permitted.

6) Other configurations that i've done (forgotten to capture screenshots):

- Service route for User ID set to Eth 1/1 (where AD is located)

- Enable User ID identification for the Zone.

- Tried resetting passwords for the panagent and trying again but still not working.

With all these configurations, i am still unable to get the "Status" to show "Connected".

NOTE: I've tried WBEMTEST to test the WMI connection towards the Windows Server 2003 Active Directory (AD) server and it connects without any issue.

PS: apologies for the blur screenshots.

[BPry]

@codemsittc,

The WMIC error you are getting is almost always permissions related on the account being used to read the logs, but 2003 can also run into a memory allocation error that you'll want to watch for even when you get this working. You really shouldn't be setting this up on a machine that hasn't been supported for years.

There's a specific process you need to go through to give non-admin accounts in 2003 the ability to read event logs, I don't think it's as easy as simply plugging them into some GPO. If memory serves properly you actually need to go in and modify some registry settings and the like to get it to function properly. 

[codemsittc]

@BPry 

Thanks for the inputs.

Any idea what registry setting we are looking at? Or maybe where can i find these information? 

Totally agree with not setting it up with old and unsupported servers. However, auditors are tight on us, and justifications just got pushed down.

Would still need to get this set up done regardless.