we also have had this problem too for ages, somehow seems to have resolved itself. We ended up having to give our Helpdesk VDI systems so they could run Active Directory no problems for supporting the users remotely when oncall since couldn't over VPN. Now that we are all remote these days, glad it resolved itself. we debugged this for days with PAN TAC support, no dice. multiple packet captures, wiresharks, you name it we debugged this with Microsoft support, they said its Palo Alto. We captured packets from the domain controllers and the client and the firewalls.. definitely was related to DNS at times and related to how they do their interfaces it seemed. We also were seeing traffic going out the wrong interfaces, thanks to Microsoft and their dual network send out packets, DNS was seen going both ways. Really wish I knew what resolved itself, so I could share. we are updated to v1903 of Windows 10, not sure if that changed anything, also running newer GlobalProtect v5.0.8 now, so those two changes we did since we last really debugged. We were on 4.1.x previously and Win10 v1709.
... View more
