topic Login to SC with an AD user in "Protected Users Security Group" not possible in General Topics

Login to SC with an AD user in "Protected Users Security Group" not possible

xiro — Mon, 13 Dec 2021 10:32:03 GMT

Hi,

as the title says, we currently face the problem that login to SC with AD-authentication is not possible, if the account is member of the group "Protected Users Security Group":

https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group

Customer's admins are now in this group, which makes it impossible to manage the FW. Before implementing a workaround with a second account, I want to check if anyone has faced this before.

Is this known behavior and is there any workaround?

THX in advance!

Re: Login to SC with an AD user in "Protected Users Security Group" not possible

PhoneBoy — Mon, 13 Dec 2021 20:46:58 GMT

SC = SmartConsole?
What version/JHF version?

Re: Login to SC with an AD user in "Protected Users Security Group" not possible

xiro — Mon, 13 Dec 2021 21:04:38 GMT

yes, SmartConsole.

Server is 80.40 T125

SC was tested with different versions, including newest 80.40 build 425.

This is the configuration of the affected admins:

Re: Login to SC with an AD user in "Protected Users Security Group" not possible

PhoneBoy — Mon, 13 Dec 2021 21:53:35 GMT

Suggest debugging fwm to see why it's failing: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk86186
You might need a TAC case to get to the bottom of it, though.

Re: Login to SC with an AD user in "Protected Users Security Group" not possible

Norbert_Bohusch — Tue, 14 Dec 2021 06:49:00 GMT

As you are using Radius for authentication the question is how is the Radius server authenticating against AD.

Does this comply with protected users group? E.g. LDAP(S) is not!