Windows User-ID Agent Access is denied

[jonathanb]

I'm setting up User-ID.

1. i have a windows server 2012r2 domain controller, and a windows server 2019 domain member for the agent software.
2. I have configured a service account with user rights assignment to allow logon as a service on the agent host.  i have configured permissions to the install directory and to the registry key for the software.
3. I have added the account to the Event Log Readers and Distributed COM Users groups.
4. I have created a firewall rule on the DC to allow all connections from the agent host server.

The debug logs indicate that OpenEventLog failed.

[S.Cantwell]

Hello there

This has been well documented since Aug 2019 (or 2020) when MS decided to release a patch that no longer allows the agentless UserID agent to function, and MS servers respond back with Access Denied.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkkfCAA&lang=en_US%E2%80%A...

Please de provision the agentless version, and instead, utilize either than StandAlone UserID agent (can be downloaded from their support site) or consider toward cloud based authentication, using PANW CIE (Cloud Identity Engine)

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/identity-features/cloud-identity-e...

[jonathanb]

Thanks.  If it wasn't clear, the windows agent host is in use because i'm using the windows agent.

[S.Cantwell]

Thank you.  I guess I did miss that important detail.
As a test, can you try installation and implementation as a Domain Admin account (just for confirmation)

If this works fine, then you know that this is a permission issue on the AD side and not from the PANW UserID agent side.

Usually, this becomes the root cause of errors.

Please advise.