> Source: [sk111293](https://support.checkpoint.com/results/sk/sk111293) # sk111293 - "Unable to get idle-time workstation locking policy" error in SmartConsole GUI clients | Property | Value | |----------|-------| | Solution ID | sk111293 | | Date Created | 2016-05-02 | | Last Modified | 2021-09-01 | | Technical Level | General | | Products | Security Management Server, SmartConsole, Multi-Domain Security Management Server | | Versions | R82.10, R82, R81.20, R82.20 | ## Solution ### Introduction This article describes different scenarios for "***Unable to get idle-time workstation locking policy***" error when connecting with SmartConsole GUI clients (e.g., SmartDashboard, SmartView Tracker, SmartEvent GUI) to Security Management Server / Domain Management Server. Each Scenario has additional details, its own cause and solution. *Example*: ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk111293/SmartDashboard_Error.png) **Table of Contents:** 1. Issue with Security Management Server on Windows OS after downgrade from R77.xx to R76 / R75.xx 2. Issue with launching Domain's SmartDashboard from SmartDomain Manager after upgrade of Multi-Domain Server 3. Issue with R76 SmartEvent Server managed by a lower version Security Management Server 4. Issue with newly created Domain Log Server 5. Issue with R75.45 Security Management Server / Multi-Domain Security Management Server on SecurePlatform OS / Windows OS 6. Issue with Domain Management Server / Domain Log Server 7. Related documents 8. Related solutions Show the Entire Article ### 1. Issue with Security Management Server on Windows OS after downgrade from R77.xx to R76 / R75.xx {#Scenario 1} **Symptoms:** * "`Unable to get idle-time workstation locking policy`" error when connecting with SmartDashboard to Security Management Server on Windows OS after downgrade from R77.xx to R76 / R75.xx. Show / Hide solution **Cause:** > Incorrect path in Windows Registry to the required DLL file(s). **Solution:** > 1. Start the debug of FWM daemon per [sk86186](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk86186). > > 2. Connect with SmartDashboard to Security Management Server. Wait for the error to appear. > > 3. Stop the debug of FWM daemon per [sk86186](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk86186). > > 4. Analyze the *%FWDIR%\\log\\fwm.elg\** files. > > Search for: > ***command 'get-idle-timeout'*** > > *Example of the relevant lines from the debug* : > > > > ``` > > Failed to create instance of {B6D68AAB-1BF9-4EB2-A4BA-5284F2D3792A} > > Failed to get ISrvRequestHandler object for command 'get-idle-timeout' > > Failed to get request handler for command 'get-idle-timeout' > > Failed to execute command 'get-idle-timeout' > > ``` > > 5. If the above failures appear in FWM debug, then correct the relevant path in Windows Registry: > > 1. Start Windows built-in Registry Editor: > > Start menu - ***Run...*** - type ***regedit*** - click OK / press Enter key. > > **Important Note:** Before proceeding, refer to these Microsoft KB articles: > * [kb136393 (How to Modify the Windows Registry)](http://support.microsoft.com/kb/136393) > * [kb256986 (Windows registry information for advanced users)](http://support.microsoft.com/kb/256986) > 2. Go to the following key: > > ***HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\CheckPoint\\Components\\CLSID\\{B6D68AAB-1BF9-4EB2-A4BA-5284F2D3792A}\\InprocServer32*** > 3. In the right pane, check the value that appears in the ***(Default)*** key. > > Pay attention to: > * path > * name of the DLL file > > The correct path and DLL file on R75.40/R75.45/R75.46/R75.47 should be: > ***C:\\Windows\\FW1\\R75.40\\FW1\\lib\\Carbon2Commands.dll*** > > *Example of the issue*: > > The path points to R77 and the DLL file is also from R77 - *C:\\Windows\\FW1\\R77\\FW1\\lib\\FwmCommands.dll* > > [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk111293/Windows_Registry_points_to_R77.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk111293/Windows_Registry_points_to_R77.png "Click the image to see it in full size in a new tab/window") > > > > If the current path / DLL file are not as they should be, then: > > * double-click on the ***(Default)*** key > > * delete the entire current path > > * paste the correct path and file name: > > ***C:\\Windows\\FW1\\R75.40\\FW1\\lib\\Carbon2Commands.dll*** > 4. Close the Registry Editor. > > 5. Restart Check Point services: > > Open Windows Command Prompt (as Administrator). > > Type/paste these commands and press the Enter key: > ***C:\\\> cpstop*** > ***C:\\\> cpstart*** > > **Related solutions:** > > * [sk102166 - FWM and CPSM processes are down on Security Management Server after downgrade from R77.xx to R75.47](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102166) ### 2. Issue with launching Domain's SmartDashboard from SmartDomain Manager after advanced upgrade of Multi-Domain Security Management Server {#Scenario 2} **Symptoms:** * "`Unable to get idle-time workstation locking policy`" error when launching Domain's SmartDashboard from SmartDomain Manager after advanced upgrade of Multi-Domain Security Management Server. Show / Hide solution **Additional Symptoms:** * "`Failed to obtain Configuration DB data`" error when trying to synchronize Domain Management Servers in High Availability configuration. **Cause:** > During synchronization attempt, Primary Domain Management Server notes a mismatch between the *db_last_update_times.C* files on Domain Management Servers, and cannot resolve the conflict. **Solution:** > If the Secondary Multi-Domain Security Management Server is the functional server, then promotion of the Secondary Multi-Domain Security Management Server to Primary state is recommended. > > This procedure is predicated on the Primary Multi-Domain Security Management Server being clean and functional. > > Follow these steps on the Primary Multi-Domain Security Management Server: > > 1. Make sure that the Primary Domain Management Server is accessible and defined correctly. > > 2. Delete the Secondary Domain Management Server in SmartDomain Manager. > > 3. On the Primary Multi-Domain Security Management Server: > > 1. Stop the Primary Domain Management Server: > > ***\[Expert@HostName:0\]# mdsstop_customer \*** > 2. Switch to the context of the problematic Domain Management Server: > > ***\[Expert@HostName:0\]# mdsenv \*** > 3. Delete the *$FWDIR/conf/db_last_update_times.C* file: > > ***\[Expert@HostName:0\]# mv -v $FWDIR/conf/db_last_update_times.C $FWDIR/conf/db_last_update_times.C_BACKUP*** > 4. Start the Primary Domain Management Server: > > ***\[Expert@HostName:0\]# mdsstart_customer \*** > 4. Rebuild the Secondary Domain Management Server in SmartDomain Manager. > > 5. Connect with SmartDashboard to Primary Domain Management Server. > > 6. Go to ***Policy*** menu - click on ***Management High Availability...*** - manually synchronize the databases from the Primary Domain Management Server to the Secondary Domain Management Server. > > 7. Close the SmartDashboard connected to the Primary Domain Management Server. > > 8. Connect with SmartDashboard to Secondary Domain Management Server. > > 9. Check that the policy / objects were synchronized to the Secondary Domain Management Server (do not save any changes). > > 10. Close the SmartDashboard connected to the Secondary Domain Management Server. > > 11. Connect with SmartDashboard to Primary Domain Management Server. > Note: If the Domain Management Servers are out of synchronization, then re-synchronize from Primary to Secondary. **Related solutions:** > * [sk92911 - "Failed to obtain Configuration DB data" for CMA HA created with imported configuration](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92911) ### 3. Issue with R76 SmartEvent Server managed by a lower version Security Management Server {#Scenario 3} **Symptoms:** * "`Unable to get idle-time workstation locking policy`" error when connecting with SmartEvent GUI client to R76 SmartEvent Server after performing 'Install Database' operation from Security Management Server that has a version lower (e.g., R75.40/R75.45/R75.46) than the SmartEvent server version. Show / Hide solution **Issue ID:** * 01131360 **Cause:** > 'Install Database' operation has been performed from the older Security Management Server to R76 SmartEvent Server and has overwritten an essential value. > **Note:** User never needs to perform 'Install Database' on a SmartEvent Server. **Solution:** > This problem was fixed. The fix is included in: > > * [Check Point R77.X](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92965) > * [Jumbo Hotfix Accumulator for R76](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk96191) - since *Take_15* > > For **R76** , [Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) can supply a **Hotfix**. > > * For R76 SmartEvent server running on Gaia, SecurePlatform, Linux OS: > > 1. Connect to command line on the R76 SmartEvent server. > > 2. Log in to Expert mode. > > 3. Stop Check Point services: > > ***\[Expert@HostName:0\]# cpstop*** > 4. Transfer [this hotfix package](https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=24319) to the R76 SmartEvent server (into some directory, e.g., */some_path_to_fix/*). > > 5. Extract the hotfix package: > > ***\[Expert@HostName:0\]# cd /some_path_to_fix/*** > ***\[Expert@HostName:0\]# gtar xzvf Check_Point_R76_Hotfix_BASE_041_sk111293.tgz*** > 6. Install the hotfix package: > > ***\[Expert@HostName:0\]# ./fw1_wrapper_HOTFIX_GIZMO_HF_HA_BASE_041_989041001_2*** > 7. Start Check Point services: > > ***\[Expert@HostName:0\]# cpstart*** > * For R76 SmartEvent server running on Windows OS: > > 1. Open Windows Command Prompt. > > 2. Stop Check Point services: > > ***cpstop*** > 3. Transfer [this hotfix package](https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=24320) to the R76 SmartEvent server (into some folder, e.g., *C:\\some_path_to_fix\\*). > > 4. Install the hotfix package - double-clicking on it and follow the instructions on the screen: > > ***Check_Point_R76_Hotfix_BASE_041_sk111293.exe*** > 5. Start Check Point services: > > ***cpstart*** ### 4. Issue with newly created Domain Log Server {#Scenario 4} **Symptoms:** * "`Unable to get idle-time workstation locking policy`" error when connecting with SmartView Tracker to a newly created Domain Log Server. Show / Hide solution **Cause:** > Object of Domain Log Server is missing from the *$FWDIR/conf/objects_5_0.C* file in the context of Domain Log Server. > During initial creation of the Domain Log Server object, the *$FWDIR/conf/objects_5_0.C* file was not updated / synchronized over to the Multi-Domain Log Module. **Solution:** > 1. Connect with SmartDashboard to the relevant Domain Management Server (that stores the logs on the problematic Domain Log Server). > > 2. Go to ***Policy*** menu - click on ***Install Database...*** - select ***only*** these objects: > > * object of Domain Log Server > * object of Domain Management Server ### 5. Issue with R75.45 Security Management Server / Multi-Domain Security Management Server on SecurePlatform OS / Windows OS {#Scenario 5} **Symptoms:** * "`Unable to get idle-time workstation locking policy`" error when connecting with SmartDashboard to freshly installed R75.45 Security Management Server on SecurePlatform OS or Windows OS. * "`Unable to get idle-time workstation locking policy`" error when connecting with SmartDomain Manager to freshly installed R75.45 Multi-Domain Security Management Server on SecurePlatform OS. Show / Hide solution **Issue ID:** * 01078173 **Cause:** > * In Security Management Server, some plug-ins were not installed during the installation process. > * In Multi-Domain Security Management Server, the SmartDomain Manager cannot connect since the "Management Enhancements" plug-in was not activated properly. **Solution:** > This problem was fixed. The fix is included in: > > * [Check Point R75.46](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk90960) > * [Check Point R76](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk91140) > > Check Point recommends to always upgrade to the most recent version ([upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=184) / [upgrade Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166) / [upgrade SmartConsole](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=191)). > > For **R75.45**, follow these steps: > > |-----------------------------------------|----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| > | Server | OS | Instructions | > | Security Management Server | SecurePlatform | Install the missing plug-ins manually: 1. On the problematic machine, go to the directory with relevant packages: ***\[Expert@HostName\]# cd /sysimg/CPwrapper/linux/MiniWrapper/*** 2. Run the installation script: ***\[Expert@HostName\]# ./UnixInstallScript*** 3. Reboot the machine: ***\[Expert@HostName\]# reboot*** | > | Security Management Server | Windows | Install the "*Management Enhancement*" plugin: 1. Open the elevated Windows Command Prompt: Start - Programs - Accessories - right-click on the ***Command Prompt*** - select '*Run as administrator*' 2. Paste the following command and press Enter (double-quotes are part of the syntax): ***"C:\\Program Files\\CheckPoint\\CPMgmtrfes\\bin\\uacRunner.exe -p PICPmgmtrfes -install"*** Note: On some machines, the plugin name could be *PICPmgmtrfesR75* 3. Reboot the machine. | > | Multi-Domain Security Management Server | SecurePlatform | [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) to get an updated version of R75.45 SmartDomain Manager. 1. Uninstall the current R75.45 SmartDomain Manager. 2. Install the improved R75.45 SmartDomain Manager. | ### 6. Issue with Domain Management Server / Domain Log Server {#Scenario 6} **Symptoms:** * "`Unable to get idle-time workstation locking policy`" error when connecting with SmartView Tracker to a Domain Management Server / Domain Log Server. Show / Hide solution **Cause:** > When connecting with SmartConsole GUI clients (e.g., SmartView Tracker), the FWM daemon tries to relay "`get-idle-timeout`" to MDS level, but the MDS details are empty. **Solution:** > This problem was fixed. The fix is included in: > > * [Check Point R77.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97617) > > Check Point recommends to always upgrade to the most recent version ([upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=184) / [upgrade Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166) / [upgrade SmartConsole](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=191)). > > For **other [supported](http://www.checkpoint.com/support-services/support-life-cycle-policy/index.html) versions** , [Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) can supply a **Hotfix** . > A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. > For faster resolution and verification, please collect [CPinfo file](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) from the Multi-Domain Security Management Server / Domain Management Servers / Domain Log Servers involved in the case. > > 1. Hotfix has to be installed on ***Multi-Domain Security Management Server***. > > **Note:** In Management HA environment, this procedure must be performed on *both* Management Servers. > 2. Procedure: > > * Using CPUSE on Gaia OS: > > Refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE): > * Section "[(4-A-c)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Portal)" / "[(4-A-d)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Clish)" - refer to import instructions for *Offline procedure* > * Section "[(4-B-a)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to install a CPUSE package - Installing a Hotfix package / Minor Version package)" - refer to installation instructions for *Hotfixes* > * Using Legacy CLI on Gaia/SecurePlatform OS: > > 1. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*). > > 2. Unpack the hotfix package: > > ***\[Expert@HostName:0\]# cd /some_path_to_fix/*** > ***\[Expert@HostName:0\]# tar -zxvf fw1_wrapper_\.tgz*** > 3. Install the hotfix: > > ***\[Expert@HostName:0\]# ./fw1_wrapper_\*** > **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen. > 4. Reboot the machine. ### 7. Related documents {#Related documents} * Security Management Server Administration Guide ([R70](http://downloads.checkpoint.com/dc/download.htm?ID=8745), [R70.20](http://downloads.checkpoint.com/dc/download.htm?ID=10510), [R71](http://downloads.checkpoint.com/dc/download.htm?ID=10315), [R75](http://downloads.checkpoint.com/dc/download.htm?ID=11667), [R75.20](http://downloads.checkpoint.com/dc/download.htm?ID=12277), [R75.40](http://downloads.checkpoint.com/dc/download.htm?ID=13953), [R75.40VS](http://downloads.checkpoint.com/dc/download.htm?ID=16301), [R76](http://downloads.checkpoint.com/dc/download.htm?ID=22920), [R77.X](http://downloads.checkpoint.com/dc/download.htm?ID=24830)) * Multi-Domain Security Management Administration Guide ([R70](http://downloads.checkpoint.com/dc/download.htm?ID=8741), [R71](http://downloads.checkpoint.com/dc/download.htm?ID=10311), [R75](http://downloads.checkpoint.com/dc/download.htm?ID=11683), [R75.20](http://downloads.checkpoint.com/dc/download.htm?ID=12273), [R75.40](http://downloads.checkpoint.com/dc/download.htm?ID=13950), [R75.40VS](http://downloads.checkpoint.com/dc/download.htm?ID=16201), [R76](http://downloads.checkpoint.com/dc/download.htm?ID=22916), [R77.X](http://downloads.checkpoint.com/dc/download.htm?ID=24807)) * Command Line Interface Reference Guide ([R70](http://downloads.checkpoint.com/dc/download.htm?ID=8713), [R71](http://downloads.checkpoint.com/dc/download.htm?ID=10324), [R75](http://downloads.checkpoint.com/dc/download.htm?ID=11657), [R75.20](http://downloads.checkpoint.com/dc/download.htm?ID=12264), [R75.40](http://downloads.checkpoint.com/dc/download.htm?ID=13944), [R75.40VS](http://downloads.checkpoint.com/dc/download.htm?ID=16262), [R76](http://downloads.checkpoint.com/dc/download.htm?ID=22909), [R77.X](http://downloads.checkpoint.com/dc/download.htm?ID=24833)) ### 8. Related solutions {#Related solutions} * [sk86186 - How to debug FWM daemon](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk86186) * [sk33207 - How to debug FWM daemon on Provider-1 CMA / Domain Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk33207) * [sk33208 - How to debug FWM daemon on Provider-1 / Multi-Domain MDS](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk33208) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content