Login to SC with an AD user in "Protected Users Security Group" not possible

[xiro]

Hi,

as the title says, we currently face the problem that login to SC with AD-authentication is not possible, if the account is member of the group "Protected Users Security Group":

https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/prote...

Customer's admins are now in this group, which makes it impossible to manage the FW. Before implementing a workaround with a second account, I want to check if anyone has faced this before.

Is this known behavior and is there any workaround? 

THX in advance!

[PhoneBoy]

SC = SmartConsole?
What version/JHF version?

[xiro]

yes, SmartConsole.

Server is 80.40 T125

SC was tested with different versions, including newest 80.40 build 425.

This is the configuration of the affected admins:

[PhoneBoy]

Suggest debugging fwm to see why it's failing: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 
You might need a TAC case to get to the bottom of it, though.

[Norbert_Bohusch]

As you are using Radius for authentication the question is how is the Radius server authenticating against AD.

Does this comply with protected users group? E.g. LDAP(S) is not!