> Source: [sk185003](https://support.checkpoint.com/results/sk/sk185003)

# sk185003 - Endpoint Client disconnected or not registered to Endpoint Server due to Authentication failures

| Property | Value |
|----------|-------|
| Solution ID | sk185003 |
| Date Created | 2026-05-27 |
| Last Modified | 2026-06-15 |
| Technical Level | Advanced |
| Products | Endpoint Security |
| Versions | E89.X, E88.X, R81.20 |

## Symptoms

- * Customer may begin to see failure in registration and connection to the management server in new deployments of clients
* Server Authentication.log shows failures for each authentication attempt:

  ```
  [Authentication #### ]@[DD Month HH:MM:SS] [DoAuth] ERROR: DoAuthentication procedure failed
  [Authentication #### ]@[DD Month HH:MM:SS] [CPauth_doAuth] ERROR: CPauth_DoAuth: DoAuth failed for device with IP:XXX.XXX.XXX.XXX
  ```

* Client cpda.log show failure to authenticate:

  ```
  YYYY-MM-DD HH:MM:SS.SSS p:####  t:####  root       [error] Unexpected HTTP response code: 403 [CHTTPCall_curl::sendReq_internal]
  YYYY-MM-DD HH:MM:SS.SSS p:####  t:####  root       [error] Response without escape chars (possible truncated): 
  <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">&lthtml>&lthead>&lttitle>403 Forbidden</title></head>
  &ltbody>&lth1>Forbidden</h1>&ltp>You don't have permission to access this resource.</p></body></html>
  [CHTTPCall_curl::sendReq_internal]
  ```

* cpda.log can show this failure to authenticate also:

  ```
  [error] Response without escape chars (possible truncated):
  <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>401 Unauthorized</title></head>
  <body><h1>Unauthorized</h1><p>This server could not verify that you are authorized to access the document requested. 
  Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.</p></body></html>
  ```

## Cause

From January 2026, Microsoft has begun a process to deprecate RC4 encryption type, which was the default encryption type for Kerberos. As of April 2026, the new default encryption type for Kerberos is set to AES-SHA1. Any service account that is not defined with an explicit encryption type within the attribute "msDS-SupportedEncryptionTypes" will use the default encryption type.  

Additional details available at [What Changed in RC4 with the January 2026 Windows Update and Why it's important](https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/what-changed-in-rc4-with-the-january-2026-windows-update-and-why-it-is-important/4504732)

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content
