topic Re: AD query failing for identity Awareness in SASE and Remote Access

AD query failing for identity Awareness

checkpointer — Tue, 02 May 2023 15:39:43 GMT

Hello Team,

We have recently had to rebuild our r77.30 firewall (due to a failed upgrade attempt, SMS is already r81).

We have connectivity from r77.30 gw to our RSA server but get the following error:

We have tried several sets of creds which we know to be correct (i.e. admin level) but continue to get this error message.

Can anyone help please?

Re: AD query failing for identity Awareness

Matt_Ricketts — Tue, 02 May 2023 16:09:25 GMT

For simplicity, the service account you use with the IDA should be a Domain Admin. It is possible to use a non-Domain Admin account, but then you need to start doing schema updates and changes within your Domain. Not familiar with pointing IDA at a RSA server vs a domain/domain controller.

Also do need to point out that R77.30 has been End of Support for a while now. R80.40 is our oldest/supported version with R81.10 being our Recommended version.

Re: AD query failing for identity Awareness

the_rock — Tue, 02 May 2023 18:13:14 GMT

Put it this way...as @Matt_Ricketts said, R77.30 has been unsupported way before Covid-19 I think, but regardless, even if you were on R55 or R81.20 version, you HAVE TO use domain account with full admin privileges to make this work. I spent way too many hours with TAC on the phone going through sk93938 and we could never get that working...ever.

https://support.checkpoint.com/results/sk/sk93938

Andy

Re: AD query failing for identity Awareness

checkpointer — Tue, 02 May 2023 23:00:01 GMT

Thanks Matt, the account we are testing with are both Domain Admin.

Re: AD query failing for identity Awareness

checkpointer — Tue, 02 May 2023 23:22:29 GMT

Thanks Rock, the accounts we are testing with are domain accounts with full admin privileges.

Re: AD query failing for identity Awareness

Matt_Ricketts — Tue, 02 May 2023 23:57:18 GMT

Windows Server 2016 or 2019? Microsoft changed things within Windows Server 2022 and my IDA wouldn't authenticate anymore. I changed to the Identity Collector at that point. IDC is moving towards being the recommended method going forward too.

Re: AD query failing for identity Awareness

PhoneBoy — Wed, 03 May 2023 17:55:30 GMT

In response to various security vulnerabilities, Microsoft has made numerous changes to WMI.
This effectively "breaks" ADQuery and we've been recommending people move to Identity Collector for some time.
For details on Identity Collector, see: https://support.checkpoint.com/results/sk/sk108235
Yes, you can run Identity Collector under R77.30, but it's been End of Support for other three years now.

Re: AD query failing for identity Awareness

the_rock — Wed, 03 May 2023 18:01:18 GMT

Excellent point indeed...I had customer who was hesitant to move to IDC, but once I gave them all the good reasons to and they saw issues with windows updates on their AD server, they finally accepted to move away from AD query and are super content now with identity collector, no issues on 3 months since the change.