topic Re: R80 GUI Admin locked out and unable to unlock in Firewall and Security Management

R80 GUI Admin locked out and unable to unlock

Security_Depart — Tue, 21 Jun 2016 13:33:50 GMT

Does anyone know how to unlock a GUI admin once locked out ? the CLI command seems to be removed and we have no idea how to unlock and admin account once it is locked besides deleting and recreating

Re: R80 GUI Admin locked out and unable to unlock

Timothy_Hall — Thu, 23 Jun 2016 16:01:52 GMT

The R77.XX "fwm lock_admin" command is no longer available in R80 and the unlock-administrator command in the R80 mgmt_cli appears to only be for MDM/Provider-1 as it complains about not being in the System Domain when you try to execute it. This doesn't appear to be possible at all from clish/bash/mgmt_cli.

Only workaround I've been able to find is to uncheck the "Lockout Administrator's Account after X failed authentication attempts" checkbox under Manage & Settings...Permissions & Administrators...Advanced...Login Restrictions in the R80 SmartConsole. Publish the change and any active administrator lockouts will be immediately cleared (an "Install Database" operation is not necessary). Don't forget to recheck that box!

If all administrator accounts are locked out and you can't wait the default 30 minutes for the lockouts to clear, you'll have to run cpconfig on the SMS and create a new GUI Administrator account.

My book "Max Power: Check Point Firewall Performance Optimization"

now available via http://maxpowerfirewalls.com.

Re: R80 GUI Admin locked out and unable to unlock

Alex_Sazonov — Fri, 25 Nov 2016 15:42:41 GMT

Hi Tim Hall

In SMC installation you also has this domain:

cpm=# select name,comments,dtype from domainbase_data where dtype = 'SystemDomain';

name | comments | dtype

-------------+-------------------------------------------------------------------------------+--------------

System Data | This domain holds all the system data such as Administrators, Domains, etc... | SystemDomain

In order to unlock administrator in SMC just type command like this:

mgmt_cli -r true unlock-administrator name "admin" --format json -d "System Data"

{

"message" : "OK"

}

---------------------------------------------

Time: [18:22:19] 25/11/2016

---------------------------------------------

"Publish operation" succeeded (100%)

Re: R80 GUI Admin locked out and unable to unlock

PhoneBoy — Wed, 28 Jun 2017 04:01:30 GMT

This can also be done in SmartConsole by right-clicking on the relevant administrator and selecting Unlock Administrator.

Re: R80 GUI Admin locked out and unable to unlock

Paul_Grigg — Thu, 26 Oct 2017 06:43:54 GMT

When SmartConsole is connected to a security management server
1. Open a command prompt on the management server

2. Login to the system data domain:
mgmt login user <admin name> password <admin password> domain "system data"

3. Use the "mgmt_cli" utility to run the unlock-administrator API command
mgmt_cli -s id.txt unlock-administrator name <name of locked admin>

When SmartConsole is connected to a multi-Domain server, you can run the “unlock-administrator” command directly on the API command line.
unlock-administrator name <name of locked admin>

Re: R80 GUI Admin locked out and unable to unlock

Paul_Grigg — Thu, 30 Nov 2017 04:04:16 GMT

There's also a technical training video:

https://www.youtube.com/watch?v=RJP-GuSGXD0&feature=youtu.be

Re: R80 GUI Admin locked out and unable to unlock

Paul_Grigg — Thu, 01 Mar 2018 08:50:26 GMT

Update: The unlock admin feature (in gui and CLI) only works if "Check Point password" is the method used to authenticate to the security management server.

Re: R80 GUI Admin locked out and unable to unlock

Sung-Lun_Yang1 — Thu, 13 Sep 2018 02:38:43 GMT

Hi all,

You also could refer our Security Management R80.10 Administration Guide Section：Unlocking Administrators

We also provide a video about how to modify the lock configuration.