> Source: [sk106133](https://support.checkpoint.com/results/sk/sk106133)

# sk106133 - "Group membership of the required account (user or machine) could not be retrieved from the AD" log from Identity Awareness blade in SmartLog / SmartView Tracker

| Property | Value |
|----------|-------|
| Solution ID | sk106133 |
| Date Created | 2015-06-16 |
| Last Modified | 2025-11-09 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |

## Solution

### Introduction

This article describes different scenarios when "**`Group membership of the required account (user or machine) could not be retrieved from the AD. Make sure the account exists in the AD.`** " log is received from Identity Awareness blade in SmartLog / SmartView Tracker. Each Scenario has its own cause and solution.  
See the Table of Contents below.

**Table of Contents:**

* Scenario 1 - Domain names for child/sibling domains are resolved incorrectly
* Scenario 2 - Missing information in the properties of LDAP Account Unit object in SmartDashboard
* Scenario 3 - Mobile Access users do not have correct permissions after successful login
* Scenario 4 - Using Kerberos authentication with Identity Agent for a specific host
* Scenario 5 - RADIUS user with name in "user@domain" format
* Scenario 6 - Domain Controller manual priorities have been changed

Show the Entire Article

### Scenario 1 - Domain names for child/sibling domains are resolved incorrectly {#Scenario 1}

**Symptoms:**

* Log from Identity Awareness blade in SmartLog / SmartView Tracker shows:

  `Authentication Method: User Authentication (Active Directory)`  
  ` Authentication Status: Failed Login`  
  ` Description: Group membership of the required account (user or machine) could not be retrieved from the AD. Make sure the account exists in the AD.`

Show / Hide solution  
**Additional Symptoms:**

* Consider the environment with the following 3 domains:

  * alex.dc
  * te.alex.dc
  * kc.alex.dc

  An event for machine identity from domain "*kc.alex.dc* " (*windowsxp$@kc* ) is received from a domain controller of *te.alex.dc* domain. Output of "*adlog debug*" shows:
  ` [ `*PID*` ...] [ADLOG (TD::Events)] ADLOG::NtEventLogEntry::NtEventLogEntry: CopmuterName = ALEX-WIN2008TE.te.alex.dc`  
  ` [ `*PID*` ...] [ADLOG (TD::Events)] ADLOG::NtEventLogEntry::NtEventLogEntry: Username = windowsxp$@kc`  
  ` [ `*PID*` ...] [ADLOG (TD::Events)] ADLOG::NtEventLogEntry::NtEventLogEntry: InsertionStrings[0] = windowsxp$@kc`  
  ` [ `*PID*` ...] [ADLOG (TD::Events)] ADLOG::NtEventLogEntry::NtEventLogEntry: InsertionStrings[1] = kc `

  The returned FQDN is wrong. Output of "*adlog debug*" shows:
  ` [ `*PID*` ...] [ADLOG_EVENT_PROCESS (TD::Events)] ADLOG::EventManager::processEvent: Creating association: username: machine: windowsxp domain: kc ip: X.X.X.X`  
  ` [ `*PID*` ...] [ADLOG_DOMAIN_NAME_MANAGER (TD::Events)] ADLOG::DomainNameManager::getFQDNbyNetbiosName: looking for te.alex.dc in the database`  
  ` [ `*PID*` ...] [ADLOG_DOMAIN_NAME_MANAGER (TD::Events)] ADLOG::DomainNameManager::getFQDNbyNetbiosName: found FQDN: 'alex.dc' (for confname: 'te.alex.dc', netbioName: 'kc') `

  As a result wrong association is published. Output of "*adlog debug*" shows:
  `[ `*PID*` ...] [TRACKER]: #7 -> INCOMING -> ADQUERY_ASSOCIATION ->`  
  ` Association`  
  ` ip: X.X.X.X`  
  ` user:`  
  ` machine: windowsxp`  
  ` domain: alex.dc`  
  ` reason: 0 `

**Issue:**01459986

**Cause:**
> Domain names for child/sibling domains are resolved incorrectly.
>
> Based on the example above:
>
> ```
> [Expert@HostName]# cat adlog_domainname.dbida 
> (DomainNamesDB
>     : (alex.dc
>         :alex (alex.dc)
>         :kc (alex.dc)
>         :te (alex.dc)
>     )
>     : (kc.alex.dc
>         :alex (alex.dc)
>         :kc (kc.alex.dc)
>         :te (alex.dc)
>     )
>     : (te.alex.dc
>         :alex (alex.dc)
>         :kc (alex.dc)
>         :te (te.alex.dc)
>     )
> )
> ```

**Solution:**
> This problem was fixed. The fix is included in:
>
> * [Check Point R77.30](http://supportcontent.checkpoint.com/solutions?id=sk104859)

### Scenario 2 - Missing information in the properties of LDAP Account Unit object in SmartDashboard {#Scenario 2}

**Symptoms:**

* Log from Identity Awareness blade in SmartLog / SmartView Tracker shows:

  `Authentication Method: User Authentication (Active Directory)`  
  ` Authentication Status: Failed Login`  
  ` Description: Group membership of the required account (user or machine) could not be retrieved from the AD. Make sure the account exists in the AD.`
* AD query was working successfully, but suddenly stopped working.

Show / Hide solution  
**Additional Symptoms:**

* Output of "*adlog a dc*" command shows that the DC is connected and the number of events is increasing.

* Debug of PDP process ('`pdp debug on`') shows:

  ` [AUTH (TD::Surprise)] pdp::UserPasswordAuthenticator::GetUserShortName: failed to get username data from user auth object`  
  ` [AUTH (TD::Events)] pdp::UserPasswordAuthenticator::GetUserFullName: called`  
  ` [AUTH (TD::Surprise)] pdp::UserPasswordAuthenticator::GetUserFullName: failed to get user full name data from user auth object`  
  ` [AUTH (TD::Events)] pdp::UserPasswordAuthenticator::GetUserEmail: called`  
  ` [AUTH (TD::Surprise)] pdp::UserPasswordAuthenticator::GetUserEmail: failed to get user's email from user auth object`  
  ` ... ... ...`  
  ` AUTH (TD::Important)] pdp::UserPasswordAuthenticator::DoneFetchAsync: failed to fetch authentication data for XXX. Request ID:XXX . external error: 7 external Error Description: Group membership of the required account (user or machine) could not be retrieved from the AD.`  
  ` Make sure the account exists in the AD. `
* Traffic capture and debug show a mismatch:

  * the events are coming from: *'test.domain.com'*
  * the LDAP fetch is being sent to: *dn = 'DC=DOMAIN,DC=COM'*

**Cause:**
> * Missing information in the properties of LDAP Account Unit object in SmartDashboard.

**Solution:**
> 1. In SmartDashboard, open the LDAP Account Unit object.
>
> 2. Go to the *Objects Management* tab.
>
> 3. Enter the missing branches.
>
>    *For example, change*:
>
>    from: *DC=DOMAIN,DC=COM*
>
>    to: ***DC=TEST,**DC=DOMAIN,DC=COM*
> 4. Click on OK to apply the changes.
>
> 5. Install policy on the Identity Awareness Gateway.

### Scenario 3 - Mobile Access users do not have correct permissions after successful login {#Scenario 3}

**Symptoms:**

* Mobile Access users successfully authenticate in Mobile Access portal, but are unable to access any resources.

* Log from Identity Awareness blade in SmartLog / SmartView Tracker shows:

  `Authentication Method: User Authentication (Active Directory)`  
  ` Authentication Status: Failed Login`  
  ` Description: Group membership of the required account (user or machine) could not be retrieved from the AD. Make sure the account exists in the AD.`

Show / Hide solution  
**Additional Symptoms:**

* Debug of PDP daemon ('`pdp debug`') shows lines similar to these:

  `[AUTH (TD::Events)] pdp::UserWithDomainWrapper::Init: input: CN=lastName\, firstName,OU=container,DC=domain,DC=com`  
  ` [AUTH (TD::Events)] pdp::UserWithDomainWrapper::Init: domain marker found`  
  ` [AUTH (TD::Events)] pdp::UserWithDomainWrapper::Split: domain name: CN=lastName`  
  ` [AUTH (TD::Events)] pdp::UserWithDomainWrapper::Split: user name: , firstName,OU=container,DC=domain,DC=com`
* The same user does not have any issues when connecting with Endpoint Security client.

**Issue:**01786660, 01786753, PRHF-994

**Cause:**
> The LDAP/Active Directory schema was changed so that the username was displayed in a "`lastName, firstName`" format. This prevents PDP from locating the user in the directory, and therefore the user does not match any rules.

**Solution:**
> [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) to get a Hotfix for this issue.  
> A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
> For faster resolution and verification, please collect [CPInfo files](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) from the Security Management Server and Security Gateways involved in the case.
>
> **Important Notes about the hotfix:**
>
> * The same hotfix has to be installed on both Security Gateway and Management Server
> * The *$FWDIR/conf/identity_awareness_custom_settings.C* on the Management Server has to be edited manually
> * If the version of the Security Gateway is different from the version of the Management Server:
>   * A fix for this issue was integrated from R80.10 jumbo hotfix take 132 and above
>   * Otherwise please [contact Check Point support](http://www.checkpoint.com/support-services/contact-support/index.html) to get a Hotfix for this issue
>
> <br />
>
> **Hotfix installation instructions:**
>
> 1. Hotfix has to be installed on ***Identity Awareness Gateway***.
>
>    **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster.
> 2. Procedure:
>
>    * Using CPUSE - On Gaia OS:
>
>      Make sure to install the [latest build of the CPUSE Agent](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest build of CPUSE and What's New).
>
>      Refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE):
>      * Section "[(4-A-c)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Portal)" / "[(4-A-d)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Clish)" - refer to import instructions for *Offline procedure*
>      * Section "[(4-B-a)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to install a CPUSE package - Installing a Hotfix package / Minor Version package)" - refer to installation instructions for *Hotfixes*
>
>      You can also use the [sk111158 - Central Deployment Tool (CDT)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111158) to install this hotfix on Security Gateways.
>
>      **Note:** Reboot is required.
>    * Using Legacy CLI - On Gaia/SecurePlatform/XOS/IPSO OS:
>
>      Note: You must be connected either over Console, or LOM card (SSH session will be disconnected).
>      1. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*).
>
>      2. Unpack and install the hotfix package:
>
>         ***\[Expert@HostName\]# cd /some_path_to_fix/***   
>         ***\[Expert@HostName\]# tar -zxvf fw1_wrapper_\<HOTFIX_NAME\>.tgz***   
>         ***\[Expert@HostName\]# ./fw1_wrapper_\<HOTFIX_NAME\>***
>         **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen.
>      3. Reboot the machine.
>
> **Hotfix configuration instructions:**
>
> 1. Connect to the command line on the Security Management Server / Multi-Domain Security Management Server.
>
> 2. Log in to the Expert mode.
>
> 3. On Multi-Domain Security Management Server, switch to the context of the relevant Domain Management Server:
>
>    **`[Expert@HostName:0]# mdsenv <Name or IP address of Domain Management Server>`**
> 4. Backup the current *$FWDIR/conf/identity_awareness_custom_settings.C* file:
>
>    **`[Expert@HostName:0]# cp -v $FWDIR/conf/identity_awareness_custom_settings.C{,_ORIGINAL}`**
> 5. Edit the current *$FWDIR/conf/identity_awareness_custom_settings.C* file:
>
>    **`[Expert@HostName:0]# vi $FWDIR/conf/identity_awareness_custom_settings.C`**
> 6. Go to the following section:
>
>    **`[user_at_domain_whitelist]`
>    ` #In this section you can add special escape chars to be white listed not as domain marker ('\')`
>    ` #Each special sequence should be written in new line`**
> 7. Edit the following line (remove the # character):
>
>    from: **#`\,`**   
>    to: **`\,`**
> 8. Save the changes in the file and exit from Vi editor.
>
> 9. In SmartDashboard, install policy on this Security Gateway.

### Scenario 4 - Using Kerberos authentication with Identity Agent for a specific host {#Scenario 4}

**Symptoms:**

* Log from Identity Awareness blade in SmartLog / SmartView Tracker shows:

  ` Type: Log`  
  ` Action: Reject Information: `**Authentication trial: this is a reauthentication for session *N***   
  ` Product: Identity Awareness`  
  ` Authentication Method: Machine Authentication (Kerberos)`  
  ` Authentication Status: Failed Login`  
  ` Description: Group membership of the required account (user or machine) could not be retrieved from the AD. Make sure the account exists in the AD.`  
  ` Identity Type: machine`  
  ` Product Family: Network`  
  ` Identity Source: Identity Agent `

Show / Hide solution  
**Cause:**
> The Security Gateway is contacting the LDAP server in order to authorize the host, authenticated through Kerberos SSO authentication, but this host is not found in any account unit.

**Solution:**
> Make sure the domain of the host (which is not necessarily the same domain as the logged-on users) is properly configured on an account unit on the Security Management, and that a computer object related to this host exists on the Active Directory environment.
>
> If the domain is properly configured and the relevant host exists on Active Directory, but you still experience the issue, [contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.   
> A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.   
> For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case.
>
> Alternatively, if "machine" authentication for this host is not required, Kerberos authentication on the specific host can be disabled. In order to disable the machine Kerberos authentication attempts, the following registry keys should be set to "1" in Windows Registry on the device that runs as an Identity Agent:
>
> * If '`HKEY_LOCAL_MACHINE\Software\CheckPoint\IA\GlobalConfigEnabled`' is present and set to "1", then add/edit the '`HKEY_LOCAL_MACHINE\Software\CheckPoint\IA\MachineKerberosAuthDisabled`' key and set its value to "1".
>
> * If this registry key is not present, it can be created as a '`DWORD`'.
>
> * If '`HKEY_LOCAL_MACHINE\Software\CheckPoint\IA\GlobalConfigEnabled`' is not present, then create/edit the '`HKEY_CURRENT_USER\Software\CheckPoint\IA\MachineKerberosAuthDisabled`' key and set its value to "1".

### Scenario 5 - RADIUS user with name in "user@domain" format {#Scenario 5}

**Symptoms:**

* Log from Identity Awareness blade in SmartLog / SmartView Tracker shows:

  ` Authentication Method: User Identity Propagation`  
  ` Authentication Status: Failed Login`  
  ` Description: Group membership of the required account (user or machine) could not be retrieved from the AD. Make sure the account exists in the AD.`  
  ` Identity Source: Radius Accounting `

Show / Hide solution  
**Additional Symptoms:**

* Output of "*pdp monitor all* " command shows the involved user with name in "*user@domain* " format.  
  No indication that PDP has associated the RADIUS Accounting information to the AD account.

**Cause:** By default, Identity Awareness (PDP daemon) expects RADIUS server to send the "`sAMAccountName`" in format "`domain/user`", and not in format "`user@domain`".

**Solution:**
> This problem was fixed. The fix is included in:
>
> * [Check Point R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122485)
> * [Jumbo Hotfix Accumulator for R80.10 (R80_10_jumbo_hf)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380) from Take 142
>
> Check Point recommends to always upgrade to the most recent version ([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=435) / [upgrade Cluster](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=428) / [upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=184) / [upgrade Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166)).
>
> Note: For R80.30 - please refer to [sk147417](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk147417).
>
> Also the following workarounds are available:
>
> * For environments with RADIUS user directory, in which all RADIUS messages are sent with the "`user@domain`" format:
>
>   > 1. Connect with SmartDashboard to Security Management Server / Domain Management Server.
>   >
>   > 2. Go to ***File*** menu - click on ***Database Revision Control...*** - create a revision snapshot.
>   >
>   > 3. Close all SmartConsole windows (SmartDashboard, SmartView Tracker, SmartView Monitor, etc.).
>   >
>   > 4. Connect with [GuiDBedit Tool](http://supportcontent.checkpoint.com/solutions?id=sk13009) to Security Management Server / Domain Management Server.
>   >
>   > 5. In the upper left pane, go to ***Table*** - ***Network Objects*** - ***network_objects***.
>   >
>   > 6. In the upper right pane, select the relevant Security Gateway / Cluster object.
>   >
>   > 7. Press CTRL+F (or go to ***Search*** menu - ***Find*** ) - paste ***identity_radius_accounting*** - click on ***Find Next***.
>   >
>   > 8. In the lower pane, in the section "***identity_radius_accounting***":
>   >
>   >    1. Scroll to the ***directory***
>   >    2. Right-click on the ***UserLoginAttr*** - select ***Edit...*** - select "***userPrincipalName***".
>   >    3. Click on ***OK***.
>   >
>   >    Note: This configures Identity Awareness to accept the "*sAMAccountName* " from RADIUS server in format "*user@domain*".
>   >    [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk103579/UserLoginAttr.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk103579/UserLoginAttr.png "Click the image to see it in full size in a new tab/window")
>   > 9. Save the changes: go to ***File*** menu - click on ***Save All***.
>   >
>   > 10. Close the GuiDBedit Tool.
>   >
>   > 11. Connect with SmartDashboard to Security Management Server / Domain Management Server.
>   >
>   > 12. Install the policy onto the relevant Security Gateway / Cluster object.
>   >
>   > **Note:** This behaviour has been observed and resolved in cases that involved the following network devices:
>   > * Aruba Mobility Controller
>   > * Cisco Wireless LAN Controller
> * For environments with LDAP user directory:
>
>   > [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) to get a Hotfix (Issue ID 01500409).  
>   > A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
>   > For faster resolution and verification, please collect [CPInfo files](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) from the Security Management Server and Security Gateways involved in the case.
>   >
>   > Note: This fix is only applicable for customers running an LDAP user directory, and should NOT be applied in environments using a RADIUS server as the users directory (from which users groups membership is extracted).
>   >
>   > Hotfix should be installed on Identity Awareness Gateway.

### Scenario 6 - Domain Controller manual priorities have been changed {#Scenario 6}

**Symptoms:**

* Log from Identity Awareness blade in SmartLog / SmartView Tracker shows:

  ` Authentication Method: User Authentication (Active Directory)`  
  ` Authentication Status: Failed Login`  
  ` Description: Group membership of the required account (user or machine) could not be retrieved from the AD. Make sure the account exists in the AD.`
* `Error: Unknown Directory object: DOMAIN.LOCAL__AD get_account_unit_by_domain: No specific LDAP object for domain: domain.local`  
  ` Did not find AU for domain: domain.local au_realm_fetchuser_by_domain_ex: Error: Domain domain.local does not exist in any of gateway's or Realm's AUs`

* Manual Priorities for Domain Controllers are defined under gateway object -\> User Direcotry -\> Selected Account Unit List.

Show / Hide solution  
**Cause:**
> Due to upgrade or some other race condition the manual priorities for some of the domain controllers have been changed to '0' and causing a corruption.

**Solution:**
> 1. Remove the problematic Domain Controller hosts from the LDAP account unit.
>
> 2. Delete the problematic Domain Controller hosts from the dashboard and re-create those objects.
>
> 3. Re-add the hosts to the LDAP account unit and set manual priorities if needed.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content