topic Re: At least one DC is currently disconnected > Bad Credentials in Firewall and Security Management

At least one DC is currently disconnected > Bad Credentials

cyberluke365 — Mon, 20 Jun 2022 07:28:29 GMT

Hello,
I have an issue regarding AD Queries for Identity Awareness.

Environment: Check Point R81 + Take 56 (active/passive cluster)

The monitor shows a warning related to Identity Awareness: Error: At least one DC is currently disconnected; the AD Query Status shows Bad Credentials.

I double-checked credentials (they didn't expire); I also changed the password, test LDAPs (636 port) with ldp.exe tool and it is working.

Any advice ? Is there any specific log I can check to better understand the issue ?

Thank you.

Re: At least one DC is currently disconnected > Bad Credentials

Ave_Joe — Mon, 20 Jun 2022 15:17:57 GMT

I suspect that MS KB500442 was installed on the domain controllers. I would check that first.

Re: At least one DC is currently disconnected > Bad Credentials

cyberluke365 — Mon, 20 Jun 2022 15:46:40 GMT

Hello,
yes, you are completely right.
It seems a June 2022 enables hardening changes on DCOM.

There is this Check Point article Check Point response to CVE-2021-26414 - "Windows DCOM Server Security Feature Bypass".

The best way to solve it, instead of disabling the behavior introduced by KB via registry key, is to install latest Check Point R81 take (Take 60 solves the issue).

Thank you,
Luca

Regards,
Luca

Re: At least one DC is currently disconnected > Bad Credentials

Paul_Kazzi — Tue, 05 Jul 2022 01:44:09 GMT

Yes indeed the latest HF resolved it 🙂