Poll Active Directory issue after installed the Windows Server update KB5004948

[clicerioneto]

Hi,

After applied Windows cumulative update KB5004948 in my environment, the Poll Active Directory is appearing the following error:

# diagnose debug fsso-polling detail 1 AD Server Status(err: server can not be accessible):

The Fortigate is running with FortiOS 6.2.9.

I have opened a ticket with Fortinet support, but I didn't receive yet a reply about the solution to fix this issue.

Someone is with this same issue or has a solution to solve it?

[judit]

I have upgraded from 6.4.6 to 6.4.7 and the local fsso connectors are up now. But the fortigate still cannot read the event logs and the I don't see any authenticated users on the fortigate.

I see this error:

smbcd: rpc_cmd_eventlog_read:944 init=0, eof=1, timestamp=1634545128, Mon Oct 18 08:18:48 2021 status=0 smbcd: smbcd_process_request:981 got cmd id: 6 smbcd: smbcd_process_request:994 got rpc log field. smbcd: smbcd_process_request:1006 got rpc username: Fortigate smbcd: smbcd_process_request:1012 got rpc password: XXXXXXXX smbcd: smbcd_process_request:1016 got rpc port: 0 smbcd: smbcd_process_request:1022 got rpc logsrc: security smbcd: smbcd_process_request:1000 got rpc server: 10.1.1.1 smbcd: smbcd_process_request:1049 got VFID, 0 smbcd: smbcd_process_request:1182 got rpc eventlog read command smbcd: rpccli_eventlog_open:203 /code/FortiOS/fortinet/daemon/smbcd/smbcd_eventlog.c-203: evenglog handle get failed.nt_status:-1073741790. Retry to open pipe with auth. smbcd: eventlog_read:574 id= 4769, r.TimeGenerated=1634545128, Mon Oct 18 08:18:48 2021 , curren time=1634545119, Mon Oct 18 08:18:48 2021 , time_after=1. smbcd: eventlog_read:574 id= 4769, r.TimeGenerated=1634545128, Mon Oct 18 08:18:48 2021 , curren time=1634545119, Mon Oct 18 08:18:48 2021 , time_after=1. smbcd: eventlog_read:622 loop=4, timestamp=1634545129, Mon Oct 18 08:18:49 2021

Does anyone has an idea? Support ticket is open yet. Thanks and kind regards, Judit

[xsilver_FTNT]

That looks like FortiGate with patched FSSO poller, trying to poll your DCs which are not patched.

https://support.microsoft.com/en-us/topic/june-8-2021-kb5003646-os-build-17763-1999-81e2ff5a-0769-4e...

Microsoft one-sidedly changed how external apps can access WinSec and broke the FSSO polling on FGT and FAC.

As they did so to fix security vulnerabilities we do assume those fixes will be applied sooner or later to every Windows DC. And so newer FortiOS does count with that. Unfortunately the access cannot be made working for both patched and unpatched as well. Either one is the only option. And that's why FortiOS versions 6.2.10 , 6.4.7 , 7.0.2 do have patched FSSO poller version.

[Swapnil_Rane]

Do we have any update on the rsolution of this issue?? We are facing it and need help to resolve.

Thanks in advance

SwapnilR 

[Debbie_FTNT]

Hey Swapni,

as mentioned multiple times in the thread above - Microsoft updated how the event logs may be accessed, in the process breaking polling mode.

FortiOS 6.2.10, 6.4.7 and 7.0.2 contain fixes to the local FortiGate poller to take into account the Microsoft patches.

However, the changes in FortiGate are NOT backward compatible - if you have a FortiGate operating on those versions (or higher), your DCs need to be patched sufficiently to include the mention changes to Security Event logging.
If some of your DCs are patched, and some are not, then depending on the FortiGate firmware version it can either poll the patched or the unpatched ones, but not both.
I would suggest that you ensure your FortiGate is at one of the mentioned versions at least, and your domain controllers have all available updates applied.
If you are looking for additional information or assistance on the FortiGate side of things, please open a Technical Support case.

Cheers!

[Philippe]

I"ve this problem now... i'm investigating it. 

now updating all windows dc's. 

did you fix it ? 

[xsilver_FTNT]

Hi Phillippe,

Yes FORTINET did fix what Microsoft updates messed up.

Kindly investigate how do you poll DCs (from FGT, through standalone Collector Agent, through Collector on FortiAuthenticator).
Then read this thread for all the details which being said here before.
And apply solution based on your polling method.

In short:

if you have latest Microsoft patches on DCs,

then you need latest versions of poller/FOS using those DCs.

[Philippe]

KB5009472 
 KB4535680

 KB4577586 
 KB4580325 
KB4589208 
 KB5000859 
 KB5003711 
 KB5010427 
 KB5009642

thos KB are installed fw upgrade to 6.2.10 

no result :( 

the polling connector keeps down : 

AD Server Status(err: server can not be accessible): 

[Debbie_FTNT]

Hey Philippe,

that's not the ususal error we see if the issue is with the Windows patches/FortiGate version not matching. That error looks a bit more like a network issue or something blocking access from FortiGate completely.

I'm not sure how familiar you are with an AD environment and what goes on communication wise. If you feel confident to interpret what you might see, you can gather this debug:

- packet capture between FortiGate and the domain controller it is trying to poll (look for nca_s_access_denied, for example)
- this debug on the FortiGate:
#dia de reset
#dia de app smbcd -1
#dia de en
-> wait a few minutes
#dia de dis
#dia de reset

And then go from there.
If you're a bit uncertain what you might need to look for, I would suggest a ticket with Technical Support for more dedicated assistance in your troubleshooting.