topic Re: AD Query failed after upgrading patch KB5014702 on Active Directory in Firewall and Security Management

AD Query failed after upgrading patch KB5014702 on Active Directory

minhhaivietnam — Thu, 23 Jun 2022 09:04:54 GMT

Hi friends,

Has anyone got this problem after uprading patch KB5014702 on AD:

After MS 2016 upgrade above patch, Identity Awareness says "bad credentials" when call to AD

Then I create new password on AD, and update this password on Checkpoint => this alarm disappear.

But then I re-enable blade "Identity Awareness", it says this account is not administrator (but it actually is Domain Admin)

Had anyone got this issue ? and how to overcome it.

Thank you!!

Re: AD Query failed after upgrading patch KB5014702 on Active Directory

Sorin_Gogean — Thu, 23 Jun 2022 08:44:10 GMT

hey,

You have another topic on the same problem, so was at solved or ?

Ty,

Re: AD Query failed after upgrading patch KB5014702 on Active Directory

minhhaivietnam — Thu, 23 Jun 2022 09:00:07 GMT

Hi Mr Sorin,

My previuos post, I create new password for user on AD and checkpoint, and alarm "bad credential " disappears . I post this for error " the user is not administrator account", (but my account is Domain admin actually)

Thank u.

Re: AD Query failed after upgrading patch KB5014702 on Active Directory

PhoneBoy — Thu, 23 Jun 2022 12:29:14 GMT

To debug, we’d probably need a TAC case.
That said, Identity Collector is a better way to go.

Re: AD Query failed after upgrading patch KB5014702 on Active Directory

minhhaivietnam — Mon, 27 Jun 2022 01:30:50 GMT

My Workaroud is uninstalling patch KB5014702 on AD, then everything is fine again.

Thank you!!

Re: AD Query failed after upgrading patch KB5014702 on Active Directory

Raven — Tue, 28 Jun 2022 07:04:29 GMT

This is one of solutions, but for how long... This MS patch covers CVE-2021-26414, So my suggestion is to install it on Windows Server. As response to issue with AD Query you have two options:

Install latest JHF for your version of GW or implement Identity Collector....

More info you will find here:

Solution Title: Check Point response to CVE-2021-26414 - 'Windows DCOM Server Security Feature Bypass'
Solution ID: sk176148
Solution Link:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk176148