Which domain permissions are required by the User-ID Agent for WMI Authentication on a Windows...

For the User-ID Agent to perform WMI (Windows Management Instrumentation) Authentication on a Windows Server, the following domain permissions are required:

Domain Administrators: This group has the highest level of privileges in the domain and can perform any action within the Active Directory domain.

Distributed COM Users: This group allows members to launch, activate, and use Distributed COM objects on the server.

Event Log Readers: This group provides read access to the event logs, which is crucial for the User-ID Agent to collect security events necessary for user identification​ (Palo Alto Networks)​​ (Palo Alto Networks)​.