> Source: [sk164832](https://support.checkpoint.com/results/sk/sk164832)

# sk164832 - Security Management and Security Gateway are both sending RPC(TCP/135) traffic to all Domain Controllers

| Property | Value |
|----------|-------|
| Solution ID | sk164832 |
| Date Created | 2020-01-30 |
| Last Modified | 2020-02-02 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- RPC(TCP/135) traffic from Security Management server and Security Gateway is sent to all Domain Controllers and can be seen using traffic captures.

## Cause

Identity Logging is enabled on the Security Management and Identity Awareness is enabled on the Security Gateway.

The Security Management server also tries to fetch User Events from DCs over RPC protocol because Identity Logging is enabled and in order to have the relevant events on the Security Management, a WMI query is sent to the DC from the Security Management as well.

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content