User-ID Integration with AD Failing (Access Denied / Kerberos Errors – Event ID 10036)

[M.R107318]

Hi Team,

I'm working on integrating my Active Directory (Windows Server 2016) with a Palo Alto PA-450 firewall to enable User-ID functionality. While setting up the server monitoring configuration, I'm running into issues when using both WMI and WinRM-based authentication.

Issue Details:

• When using WMI: The firewall shows Access Denied under Server Monitoring.

• When using WinRM with Kerberos Http: The firewall shows Kerberos error.

In the AD event viewer, I’m seeing the following message:

The server-side authentication level policy does not allow the user <username> from address <firewall IP> to activate the DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in the client application.
Event ID: 10036

✅ Troubleshooting Done So Far:

• Verified that the AD user account has local admin rights on the domain controller.

• Confirmed WinRM is enabled and configured correctly on the AD server.

• Ensured the correct encryption types (AES128, AES256) are enabled.

• Verified the firewall can resolve the FQDN and ping the domain controller.

• Checked time synchronization between firewall and AD.

Also verified as mentioned in the below procedure
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGGCA0
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clk0CAC

Despite this, the firewall still fails to authenticate and collect user-to-IP mappings.

---

❓Request for Help:

Can someone please help clarify the following:

• What specific DCOM or WinRM permission changes are needed on the domain controller to allow this integration?

• How to ensure RPC_C_AUTHN_LEVEL_PKT_INTEGRITY is accepted by the AD server for connections coming from the Palo Alto firewall?

• Any Group Policy or registry changes required on the domain controller to allow Kerberos to work with the firewall?

Any insight or guidance would be greatly appreciated!