topic Re: AD Query does not work with the new domain controller. in General Topics

AD Query does not work with the new domain controller.

Polina_1 — Thu, 08 Aug 2024 08:17:13 GMT

Hello

We are using the Security Gateways on version R77.30 and the Management Server on version R81.20.
We used to have Identity Awareness (AD query) configured. Everything worked fine.
But the domain controller was moved to a different hypervisor. I mean we installed new Windows Server 2016, configured old ip address and old domain name on it.
Now the gateway can not connect to the domain controller.
# adlog a dc
bad credentials or firewall blocks DCOM traffic

In the LDAP Account Unit settings we have entered a new Administrator password. But it didn't work.

Can you please tell me what can be done in this case?
It seems logical to me to delete the LDAP Account Unit and create a new one. But I'm not sure about that, because the ip address and domain name are still the same. Do I need to change anything in the settings on CheckPoint in this case?

Re: AD Query does not work with the new domain controller.

Lesley — Thu, 08 Aug 2024 08:23:52 GMT

Upgrade firewall to supported version. This version is ancient.

Check also this:

https://support.checkpoint.com/results/sk/sk176148

I assume new DC also got software update or something like that.

Also would recommend moving away from ADquery and use IDC collector (explained in above sk).

Final tip make sure Windows firewall is not blocking the traffic on DC.

Re: AD Query does not work with the new domain controller.

Polina_1 — Thu, 08 Aug 2024 08:36:11 GMT

We checked the traffic on the gateway, no blocks were found. Yes, the new domain controller has the CVE-2021-26414 vulnerability patch installed. We can't update the gateways.

Re: AD Query does not work with the new domain controller.

Lesley — Thu, 08 Aug 2024 08:48:15 GMT

Then you are stuck, no firewall update means no patch available. For r77.30 there is no patch.

So you have 2 options move to IDC or upgrade firewall and patch it.