Agentless User-ID issue problem - AD Local Security Policy incompatibility

[B.Porcelli]

Hi, I was trying to set up an agentless User-ID configuration when I ran into this issue: my AD Local Security Policy has deny log on locally for Event Log Readers and Distributed COM users set up. For company security reasons, I cannot change this policy. What I want to know is if there's any other way I can set User-ID synchronization to avoid this problem. Thanks!

[arusharma]

You need to have proper account and permission to set this up: https://live.paloaltonetworks.com/t5/general-topics/agentless-user-id-agent-permissions/td-p/427399

https://knowledgebase.paloaltonetworks.com/kcSArticleDetail?id=kA10g000000ClGG

[CosminM]

Hello @B.Porcelli 

If you are trying to connect to your AD using WMI, this may not work for some months ago because of Windows patch KB5014692.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clk0CAC 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkkfCAA 

If that is the case, and are using Server Monitor, you need to configure WinRM-HTTP or WinRM-HTTPS.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/user-id/map-ip-addresses-to-users/configu...