> Source: [sk180232](https://support.checkpoint.com/results/sk/sk180232)

# sk180232 - AD Query cannot access DC server when AD Query is configured for non-admin user

| Property | Value |
|----------|-------|
| Solution ID | sk180232 |
| Date Created | 2022-11-03 |
| Last Modified | 2025-10-21 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * When AD Query is configured for a user who is not an admin on the Domain Controller (DC), AD Query cannot access the DC.
* The DC is a Windows Server 2016 with KB5018411 installed, **or** Windows Server 2019 with KB5018419 installed.
* In Smart Console, an error message shows "`At least one DC is disconnected`".
* On the Security Gateway, output of the command `adlog a dc` shows: "*Disconnected, WMI permission error \[ntstatus = 0x80041003\]*"

## Cause

In the October Windows update ([KB5018411](https://support.microsoft.com/en-us/topic/october-11-2022-kb5018411-os-build-14393-5427-a59be55a-b368-4284-a643-28fc0b9b8314)/ [KB5018419](https://support.microsoft.com/en-us/topic/october-11-2022-kb5018419-os-build-17763-3532-ca62cca7-b599-44c4-a2a6-347996662623)), Microsoft made changes to read privileges that affect AD Query from an Identity Awareness Gateway to a DC.  

If AD Query is configured for a DC user who is not an admin (see [sk93938](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk93938)), AD Query cannot access the DC.  

If AD Query is configured for a DC admin, there is no issue. A DC admin can read all Event Logs, including the Internet Explorer logs, after the Windows update.

<br />

## Solution

Check Point recommends to **use Identity Collector instead of AD Query** .  

For more information about Identity Collector, see:  

* [Identity Awareness Clients Administration Guide](https://sc1.checkpoint.com/documents/Identity_Awareness_Clients_Admin_Guide/Content/Topics/Introduction.htm) \> "Identity Collector" section
* [sk179544 - Identity-Based Access Control and Threat Prevention - Design Guidelines - Identity Collector](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk179544)

For customers who prefer to continue using AD Query, these workarounds are available for Check Point appliances and open servers:  

**Workaround 1 - Change the Query Type to non-Admin**   
**Important Notes** - This workaround is suitable only for environments without forwarded events configured. This workaround is not supported for Quantum Spark SMB appliances.  

Follow the relevant procedure to change the query type to non-admin (see [sk104900](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk104900&partition=Advanced&product=Identity)):  

**For an Identity Awareness Gateway / Cluster**   

1.
   1. In the CLI of the Security Gateway / all Cluster members, run:   
      `# adlogconfig a`
   2. Enter `31 - WMI Query Type`
   3. Enter `3 - Non admin query`
   4. Enter `33 - Exit and save`
   5. Run:  
      `# adlog a control reconf`

**For a Management Server / Multi-Domain Server with Identity Logging Configured**   

1. In the CLI of the Management Server / all relevant Management Domains, run:  
   `# adlogconfig l`
2. Enter `31 - WMI Query Type`
3. Enter` 3 - Non admin query`
4. Enter `33 - Exit and save`
5. Run:  
   `# adlog l control reconf`  

**Workaround 2 - Make the DC user an admin**   

On the DC, add the user that is in the Account Unit object for AD Query to the "Domain Admins" group.

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content