In order to use WinRM-HTTP, you need to make sure your PA service account in AD has been added to the "Remote Management Users" group. You also have to configure a Kerberos Server Profile on the device tab in the PA. Just create a new Kerberos profile, and add the FQDN of all of your domain controllers to it. Once that is done, you have to apply that Kerberos Server Profile by clicking the 'gear' icon in the Palo Alto Networks User-ID Agent Setup area under Device > User Identification. (select it using the drop-down) Once you commit those changes, your DCs under Server Monitoring should show "Connected" instead of "Connection Refused".
... View more