> Source: [sk184948](https://support.checkpoint.com/results/sk/sk184948)

# sk184948 - AD users are not identified on Maestro Security Group Members

| Property | Value |
|----------|-------|
| Solution ID | sk184948 |
| Date Created | 2026-05-24 |
| Last Modified | 2026-05-24 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20 |

## Symptoms

- * On Maestro Security Group Members running R81.20, Active Directory (AD) users are not identified and therefore do not match Identity Awareness Access Roles.

* The `$FWDIR/log/pdpd.elg` file indicates that the PDPD process restarted and does not work correctly:

  > `[initial pdpd process ID xxxx]@security gateway name[Date and Time][TRACKER]: #8627 -> INTERNAL -> FINI -> `  
  > `
  > T_event_fdclr_epoll: failed to clear socket: 41 from epoll set: Bad file descriptor
  > httpMime_destroy_db: Destroying the MIME database. `  
  > `
  > [new pdpd process ID xxxx]@security gateway name[Date and Time][worker_1] Warning: Message ID 3 processing blocked on function for 1835 milliseconds. `  
  > `
  > [new pdpd process ID xxxx]@security gateway name[Date and Time][worker_1] Warning: Messages processing blocked for 1835 milliseconds. `  
  > `
  > fwasync_create_socket_bindopt: failed to bind to a reserved port: Address already in use `  
  > `
  > [new pdpd process ID xxxx]@security gateway name[Date and Time][TRACKER]: #1 -> INTERNAL -> INIT -> 
  > fwasync_create_socket_bindopt: failed to bind to a reserved port: Address already in use `
* The `$FWDIR/log/fwd.elg` file contains many entries similar to the following, indicating that the FWD process restarted the PDPD process.

  > `fwd: restarting pdpd `  
  > `
  > restarting in 4 seconds `
  > `[FWD xxx]@security gateway name[Date and Time] CCplogLogConfig::LoadGlobalLogConfig: Unable to load the custom file cplog_conf_extended.C. The file may not exist or be accessible, and the override configuration cannot be loaded `  
  > `
  > FwKluInitUnificationEngine: high level log is: 1 `  
  > `
  > QHolder::Instance: Q basic size is: 40000 `  
  > `
  > QHolder::Instance: Q basic size is: 40000 `  
  > `
  > QHolder::Instance: Q basic size is: 40000 `  
  > `
  > initSharedMemoryExporter::status shared memory initiated `  
  > `
  > FireWall-1 Daemon is running `  
  > `
  > Unable to open '/vs0/dev/fw6v0': Connection refused `
* In some cases, a core dump from the fw_full process is generated at the same time the PDPD process restarts.

## Cause

The FWD process terminated due to an overflow condition encountered while parsing CPlog kernel log fragments.

As a result, the FWD process triggered the unexpected termination of the initial PDPD process. This sequence led to a deadlock within the pdpd daemon.

Consequently, the `pdpd.elg` file recorded the error: `failed to bind to a reserved port: Address already in use`.

Because of this condition, a new PDPD daemon instance could not start. The FWD watchdog then repeatedly attempted to restart the daemon, resulting in the observed crash loop.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content