> Source: [sk39139](https://support.checkpoint.com/results/sk/sk39139)

# sk39139 - SecuRemote users connected to permanent network shares prompted to re-authenticate with Active Directory.

| Property | Value |
|----------|-------|
| Solution ID | sk39139 |
| Date Created | 2009-04-14 |
| Last Modified | 2023-03-16 |
| Technical Level | General |

## Symptoms

- * SecuRemote users experience issues with cached credentials. If they try to connect to Microsoft Exchange Server or a Microsoft Network Share immediately after logging into SecuRemote, they will be prompted for their Active Directory logon credentials again. If they wait a few minutes, this does not occur. The systems have persistent drives mapped.  
* **Environment:**   
  * Microsoft Windows XP Pro SP2
  * Securemote NGX R60 HFA_02
  * IPSO 4.2-BUILD069
  * Check Point VPN-1 Power/UTM NGX R65

## Solution

When the user initially logs on, the OS tries to reconnect all drives. As the VPN isn't yet established, these connections timeout as being unreachable and the OS creates a negative DNS cache entry for it. These can be seen by launching a command prompt and typing in:   

**ipconfig /displaydns**  

If you run "**ipconfig /flushdns** " and then launch the SecuRemote client, the user can immediately connect to shared drives and to Exchange. If you don't run the flushdns command, any attempt to reach any of the shared resources will fail.  

The long term fix for this is to disable Negative DNS Caching on each affected system. This can be done by running a logon script for these users. This script calls a registry key and enters it into the local registry. At the next reboot the Negative DNS Caching is disabled.  

Logon Script:

@echo off  
regedit /s \\\\\<servername.local\>\\NETLOGON\\filename.reg  

<br />

<br />

The registry key to be changed is:  

Windows Registry Editor Version 5.00  
\[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters\]  
"MaxNegativeCacheTtl"=dword:00000000  

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content