> Source: [sk180305](https://support.checkpoint.com/results/sk/sk180305)

# sk180305 - AD Query does not authenticate a user account that is in the Account Unit in SmartConsole

| Property | Value |
|----------|-------|
| Solution ID | sk180305 |
| Date Created | 2022-11-27 |
| Last Modified | 2025-10-27 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * AD Query does not authenticate an Active Directory user account that is in the Account Unit in SmartConsole.
* Output of the command `# pdp monitor user ` does not show the Active Directory admin user.
* Output of the command `# adlog a query user ` does not show the Active Directory admin user.

## Cause

AD Query runs pattern filters for the parsed information from the Logon Events.  
AD Query checks if the username in the Logon Event matches the username defined in the Account Unit in Smart Console.  

Example:  
`[ADLOG_EVENT_PROCESS (TD::Events)] ADLOG::EventRejectRegExpFilter::matchField: Testing filter field (username) pattern (^cp-admin$) on value (cp-admin)`  

Because the pattern was matched, ADlog rejects the logon event.

## Solution

This is expected behavior.  
Make the "Domain Admin" user for AD Query a service account, and not a personal user account that is used for other purposes.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content