> Source: [sk101524](https://support.checkpoint.com/results/sk/sk101524)

# sk101524 - Access Roles that previously worked suddenly not being enforced

| Property | Value |
|----------|-------|
| Solution ID | sk101524 |
| Date Created | 2014-07-08 |
| Last Modified | 2014-07-10 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Access Roles that previously worked suddenly not being enforced.
* Nothing was changed in the policy.
* The user is identified correctly by Identity Awareness.
* When running '# pdp monitor user \<UserName\> ', the relevant roles are not associated to the user (In the 'Roles' line output).

## Cause

The Access Roles are built from the full DN of the user at the moment of creation. Sometimes, a user or group that is part of a role definition are moved on the LDAP structure (for example, group is moved to another OU in the AD).

Then, the Role will contain the 'old' DN of the ldap object (user\\group), but the actual object DN is different.

When the user authenticates, the ldap response for the user is matched against the existing roles DNs. Consequently, there will be no match.

## Solution

1. Open SmartDashboard.

2. Go to the User's object list.

3. Open the relevant Access Role object.

4. Remove the existing object on a role and add the same object again.

5. Push policy.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content