> Source: [sk183937](https://support.checkpoint.com/results/sk/sk183937)

# sk183937 - No Login Prompt After Sleep/Hibernation with Implicit SDL and Smart Card Authentication

| Property | Value |
|----------|-------|
| Solution ID | sk183937 |
| Date Created | 2025-09-22 |
| Last Modified | 2025-09-25 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20 |

## Symptoms

- * After a PC wakes from sleep or hibernation, the VPN login prompt does not appear before Windows logon (when using Implicit SDL)
* Implicit Secure Domain Logon (SDL) is configured.
* Smart Card Authentication is used as the authentication method.

## Cause

Implicit SDL and Smart Card authentication are not compatible by design.  

* Implicit SDL relies on Windows cached credentials for functionality.
* Smart Card authentication bypasses Windows cached credentials and uses certificates for authentication.

**Why the Issue Appears Only After Sleep or Hibernation?**   
This behavior is triggered by how the system re-evaluates SDL settings after waking from sleep or hibernation:  

1. **Power Management Events** :  
   When PC resumes after sleep/hibernation, the system re-evaluates SDL configuration and discovers the state mismatch between:
   * **Configuration setting** : `implicit_sdl_enabled` = `true`
   * **Runtime state**: Smart Card logon session, which is incompatible with implicit SDL.
2. **State Conflict** :  
   The system recognizes that implicit SDL is configured but cannot function with the current Smart Card logon session, and hence blocks the VPN prompt from appearing.
3. **Why initial login works sometimes** :  
   When users first log in after reboot, there is a short window before the SDL state management system fully detects the incompatibility.

## Solution

To ensure SDL functions correctly with Smart Card authentication, you need to switch from **implicit** SDL to **explicit** SDL.  
This switches the SDL prompt to appear before the Windows logon screen, allowing SDL to function alongside Smart Card authentication.  

**Configuration Change Required** :  

1. Disable Implicit SDL Mode:  
   Set the following parameter in your configuration file or registry:  
   `implicit_sdl_enabled = false`
2. Enable Explicit SDL Mode:  
   Configure the system to use standard SDL in explicit (before-logon) mode.

This enables Pre-Logon Access Provider (PLAP) functionality and displays the **Network Logon** button on the Windows logon screen.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content