> Source: [sk161972](https://support.checkpoint.com/results/sk/sk161972)

# sk161972 - User Awareness account is locked out

| Property | Value |
|----------|-------|
| Solution ID | sk161972 |
| Date Created | 2019-09-03 |
| Last Modified | 2019-09-04 |
| Technical Level | General |
| Products | Spark Firewall (Locally Managed) |
| Versions | R82.00.X, R81.10.X |
| Platform | 910 |

## Symptoms

- * Remote access VPN users cannot log in with their AD accounts.
* Reports are empty, or do not show user data.

## Cause

The account used for queries to the DC has been locked out because of incorrect credentials.

To confirm this, take a packet capture and filter for the DC IP address.

Review the packet capture in Wireshark and filter for DCERPC. You will see an additional `/`.

![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1567516453113/wrongslash1909030634.png)

Look through the security logs in the Event Viewer on the DC. You will see "Unknown user name or bad password" for event ID 4625:

![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1567516453113/eventid46251909030637.png)

## Solution

This is not a Check Point issue.

To fix this issue:

1. Open the Local Group Policy Editor from the DC: **Windows key** + **R**.

2. Type **gpedit.msc** and click on **OK**.

3. Go to **Security Settings** \> **Local Policies** \> **Security Options**.

4. Find the key LAN Manager authentication level. If it is set to "NTVLM2 only", change it to LM and NTVLM and V2 if negotiated or Not Defined.

![](https://sc1.checkpoint.com/sc//SolutionsStatics/NEW_SK_NOID1567516453113/NTLM_settings1909030645.png)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content