topic Re: Unable to add users to users access rule after upgrade of AD server from 2008 to 2016 in General Topics

Unable to add users to users access rule after upgrade of AD server from 2008 to 2016

007_mjn — Wed, 10 May 2023 09:12:58 GMT

Hi checkmate Team,

I am unable add users to new users access rule after upgrade of AD server from 2008 to 2016.

what's the solution of this kindly please help me?

I have on premise appliance 6200 and 3600 and both have identity awareness activated. My IT team scheduled a activity on sunday and upgraded AD server from 2008 to 2016. After this I can't see users when I added them to new access rule.

Re: Unable to add users to users access rule after upgrade of AD server from 2008 to 2016

the_rock — Wed, 10 May 2023 12:15:47 GMT

Hey @007_mjn

Some questions...

1) Are you using on prem mgmtr or S1C (smart-1 cloud)?

2) Can you send an actual screenshot of the issue you are facing?

3) Are you able to actually fetch the branches inside the actual LDAP unit?

Cheers,

Andy

Re: Unable to add users to users access rule after upgrade of AD server from 2008 to 2016

RS_Daniel — Wed, 10 May 2023 12:39:17 GMT

Hello,

The problem description doesn't provide a very clear context, a scrennshot of the error would help, do you see "Error retrieving results" on access role when searching users? if so a couple of possible options are sk176849 or sk147332.

As problem starte after the upgrade, does your account have admin permissions? or did you use sk93938 to create an account with specific permission? i would try with any admin user.

Regards

Re: Unable to add users to users access rule after upgrade of AD server from 2008 to 2016

the_rock — Wed, 10 May 2023 12:43:51 GMT

Good advice @RS_Daniel

Re: Unable to add users to users access rule after upgrade of AD server from 2008 to 2016

PhoneBoy — Wed, 10 May 2023 17:20:14 GMT

Some basic information would be helpful, like:

Version/JHF of the gateways
The integration method with Active Directory (ADQuery, Identity Collector)

If you are using ADQuery, you should move to Identity Collector ASAP.
Microsoft has significantly changed how WMI works and ADQuery is no longer recommended to use.
See: https://support.checkpoint.com/results/sk/sk108235