About parkerjr2

My earlier comment was our initial reaction. Not saying it is/was the right move. Disabling the alert sounds more like the right move unless it has been fixed on the backend as mentioned.  ... View more

We just turned this off.   Settings  >  Configurations  >  Cortex XDR   - Analytics  ,and in the  Featured in Analytics  section, DISABLE  Identity Analytics. ... View more

We are suddenly being flooded with "A Successful login from TOR" events in our org. Anyone else? ... View more

Yesterday before any resolution was provided, I observed restarting the server did nothing but restarting the services did work. Don't ask me why. ... View more

Here's the link. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wlJGCAY ... View more

Here's what got my backup working. I added the necessary services here that the original script was not restarting. net stop "System Event Notification Service" /y net start "System Event Notification Service" net stop "Background Intelligent Transfer Service" /y net start "Background Intelligent Transfer Service" net stop "COM+ Event System" /y net start "COM+ Event System" net stop "Microsoft Software Shadow Copy Provider" /y net start "Microsoft Software Shadow Copy Provider" net stop "Volume Shadow Copy" net start "Volume Shadow Copy" net start "System Event Notification Service" net start "DFS Replication" ... View more

On a hunch, rather than re-registering all the files, I just plucked out the service names and did a stop/start on each of them.  Next I tried the backup and it worked. Having said that, it looks like the regsvr32 portion of this is not required. Also, the stop/start didn't work automatically on all of them. I ran them one at a time and some said they weren't even running. Some also stopped other services. After trying to stop/start them all, I sorted the services by startup type and manually started any that weren't restarted from my stop/start. After I did that, I tried the backup and success. ... View more

I tried disabling Cortex on a DC via cytool as I mentioned earlier but the backups still failed. ... View more

My DC backups usually take less than 2 minutes each so I have contemplated trying to disable the tool for that time and run the backup. "c:\program files\palo alto networks\traps\cytool.exe" protect disable then after the backup "c:\program files\palo alto networks\traps\cytool.exe" protect enable   ... View more

We are also seeing this problem all domain controllers this morning. I may whitelist and wait for a response from PA on whether a new content update will allow me to undo a whitelist entry. ... View more