topic Unable to add new AD users to user access role after upgrade to R80.10 in General Topics

Unable to add new AD users to user access role after upgrade to R80.10

Wang — Mon, 04 Mar 2019 06:05:16 GMT

Hello, which engineer has encountered this problem, can you help to solve it?

Re: Unable to add new AD users to user access role after upgrade to R80.10

Mark_Mitchell — Mon, 04 Mar 2019 06:43:30 GMT

Hi Zhen,

Have you tried re-entering the password for the account you are using under the LDAP account unit configuration?

Also the account you are using to access AD is the account unlocked?

Regards

Mark

Re: Unable to add new AD users to user access role after upgrade to R80.10

Wang — Mon, 04 Mar 2019 07:04:37 GMT

Hi,Mark

Hello, the current password is the password of the account being used, and the account has been unlocked. I can use the remote desktop of windowns to connect to the AD domain server

Regards

Zhen

Re: Unable to add new AD users to user access role after upgrade to R80.10

Mark_Mitchell — Mon, 04 Mar 2019 07:18:42 GMT

Hi Zhen,

Have you tried re-entering the password into the configuration? Only reason I ask is that I have had similar experiences when pasting a password into the password fields. It populates the field, but actually keeps locking the account out.

It may be worth a shot? Another thing I would look for is the correct entry on the "Login DN" for the account you are using

It may be worth presenting your LDAP account unit config so we can take a look.

From what you have said the account you are using is a domain admin?

Regards

Mark

Re: Unable to add new AD users to user access role after upgrade to R80.10

Wang — Mon, 04 Mar 2019 07:45:13 GMT

Hi,Mark

Hello, is this way of writing correct?

Regards

Zhen

Re: Unable to add new AD users to user access role after upgrade to R80.10

Mark_Mitchell — Mon, 04 Mar 2019 08:00:24 GMT

Hi Zhen,

The login DN looks correct. Although I would recommend not using the built in administrator account. I would always create a "service account" for this purpose. That doesn't have more permissions than are needed for the account role.

Did you attempt to re-enter the password?

Regards

Mark

Re: Unable to add new AD users to user access role after upgrade to R80.10

Wang — Mon, 04 Mar 2019 08:16:14 GMT

Hi,Mark

The password has been reentered,Now this account has been upgraded to have administrator privileges, there is still an error

Regards

Zhen

Re: Unable to add new AD users to user access role after upgrade to R80.10

Mark_Mitchell — Mon, 04 Mar 2019 08:26:36 GMT

Thanks Zhen. Are there any errors within the logs using the below query.

Blade:"Identity Awareness".

Regards

Mark

Re: Unable to add new AD users to user access role after upgrade to R80.10

Wang — Mon, 04 Mar 2019 08:58:16 GMT

Hi,Mark

Regards

Zhen

Re: Unable to add new AD users to user access role after upgrade to R80.10

Maarten_Sjouw — Mon, 04 Mar 2019 09:59:59 GMT

Is there a FW between the management server and the AD server?

Second to that do you have a rule allowing the gateway to access the AD server? As the log says check SK58881.

Last question, is your management a Multi Domain server?

Re: Unable to add new AD users to user access role after upgrade to R80.10

Mark_Mitchell — Mon, 04 Mar 2019 10:04:16 GMT

Can you confirm that you can perform a native ldap query against the DC outside of Check Point with the account that you are performing the action with?

If you can, this confirms that your AD Domain Controller and account are adequate for LDAP. If the ldap bind fails outside of Check Point, this may indicate an issue with the domain controller.

Regards

Mark

Re: Unable to add new AD users to user access role after upgrade to R80.10

Wang — Tue, 05 Mar 2019 01:30:23 GMT

Hello, there is no FW between them. Secondly, there are rules that allow gateway to access AD server. Secondly, instead of multi-domain server, a DNS is set up on the server

Re: Unable to add new AD users to user access role after upgrade to R80.10

Maarten_Sjouw — Tue, 05 Mar 2019 06:08:31 GMT

Has this ever worked?

Does the user have full admin rights? Did anyone change anything there?

Re: Unable to add new AD users to user access role after upgrade to R80.10

Sukru_isik — Tue, 05 Mar 2019 07:28:37 GMT

Can you check the time,are DC and checkpoint times same?

Re: Unable to add new AD users to user access role after upgrade to R80.10

Wang — Tue, 05 Mar 2019 08:31:31 GMT

The user has administrative rights, and nothing else has changed

Re: Unable to add new AD users to user access role after upgrade to R80.10

Mark_Mitchell — Tue, 05 Mar 2019 08:39:30 GMT

Hi Zhen,

If everything checks on from an Active Directory domain controller point of view and the Check Point configuration is also correct (time, DNS servers, domain) etc. It then may be quicker to raise a call with TAC to investigate further.

Regards

Mark

Re: Unable to add new AD users to user access role after upgrade to R80.10

Wang — Thu, 07 Mar 2019 07:50:27 GMT

Thank you very much

Re: Unable to add new AD users to user access role after upgrade to R80.10

Karel_Mate — Wed, 22 Jul 2020 08:46:56 GMT

Hi,

Have you resolve this issue? Can you share the solution you have made? My client is experiencing this issue also.

Thanks,

Karel