# Policy install lock: the admin who left a session Source: https://ai.techclick.in/blog_checkpoint_policy_install_lock Markdown: https://ai.techclick.in/blog_checkpoint_policy_install_lock.md Publisher: Techclick Infosec Pvt Ltd Install Policy fails because another session holds a lock, not because the rule is wrong. Publish, discard, fwm. Dummy admin leftover. ## The ticket Change window. You click Install. Error about lock / unpublished / another administrator. Night shift left SmartConsole on a jump box overnight. Quick interview answer R80+ uses sessions. You Publish to commit to the database, then Install Policy to push to gateways. A leftover session or lock blocks install. Discard or take over that session. This is not SIC Not Trusted. Lab data · dummy only SMS sms-lab 10.10.10.5 · cluster VIP 10.10.10.1 ( cp-gw-01 10.10.10.2 / cp-gw-02 10.10.10.3 ) · external 203.0.113.25 · internal LAN 10.20.30.0/24 · HR PC 10.20.30.80 TECHCLICK\priya.hr · HR app 10.20.30.41 hr.techclick-lab.in . Not a live customer. ## Sessions and locks Security Management install topics: Menu → Publish session → Verify → Install Policy. Two people can edit; they must not sit on unpublished conflicting changes forever. If SmartConsole crashed, the session can remain on the SMS. The next installer sees a lock. ## Publish vs discard vs SIC Error flavour Do Do not Unpublished changes / session Publish yours or discard theirs (if allowed) Reset SIC Not Trusted / SIC Lesson 3 Discard random sessions Verify failed (object) Read the verify line Force install twice smartconsole://sms-lab/manage/sessions Training mock · not live SmartConsole · lab Gateways & Servers Security Policies Logs & Monitor Manage & Settings Manage & Settings → Sessions ### Connected sessions admin You — unpublished 2 changes ops-night Idle 11 hours — lock Action Disconnect / discard (change-control) Cancel OK Security Management — sessions, publish, install. Training mock. ## Unlock runbook - #### Side A — read the exact toast Screenshot the error. SIC vs lock vs verify. - #### Side B — sessions Manage & Settings → Sessions (or the session pane). Publish your work. Discard/disconnect the stale admin per your change policy. - #### Side C — verify + install Verify Policy. Install Access Control (and TP if needed). fw stat on the gateway shows new timestamp. SMS expert · only if GUI cannot · dummy # Prefer SmartConsole Sessions UI. # If a documented SK for your train shows a session/lock CLI, use that SK — # do not invent fwm kill commands from memory on production. cpwd_admin list | grep FWM # FWM executing is required to install at all. ## Four lock failures ### 1 · Stale GUI Jump box still has SmartConsole. Disconnect that session. ### 2 · You forgot Publish Install pushes last published DB, not your editor buffer. Publish first. ### 3 · Verify object error Empty group, missing VPN community, bad IP. Fix the object named in verify. ### 4 · Treated as SIC Resetting SIC during a lock makes two problems. ## How to prove it Close the ticket only when 1) Sessions list is clean. 2) Publish done. 3) Install succeeded. 4) fw stat time updated. 5) SIC still Communicating. ## Traps Symptom Story Wrong fix Install locked Leftover session SIC reset Install ok, change missing Never published New gateway object Verify fail Bad object Force twice ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Leftover SmartConsole session. First move? Sessions UI: publish/discard/disconnect cp_conf sic init fwaccel off cphastop Correct: a . Runbook. Q2 Publish does what? Commits the session to the management database Pushes packets to Priya Resets Gaia Enables SecureXL Correct: a . Concept. Q3 Install Policy does what? Pushes the published policy to gateways Only saves clish Creates AD users Formats logs Correct: a . Concept. Q4 Not Trusted vs lock. How do you tell? Read the exact error; SIC is Communication status They are the same Always reset both Reboot SMS first always Correct: a . Choose table. Q5 Your rule is invisible after a “successful” install. Likely? You never Published Hide NAT deletes rules CoreXL hides them Implied rules ate Publish Correct: a . Failure 2. Q6 Why not reset SIC for a lock? You add a trust outage on top of a session problem SIC always fixes locks Locks require new certificates FWM is SIC Correct: a . Failure 4. Check answers Reset Check Point class series: Architecture · Gaia first day · SIC reset · Objects + first match · Policy layers · Hide vs Static NAT · Identity Awareness · HTTPS Inspection · Threat Prevention · Find the drop · fw monitor · SecureXL · ClusterXL · VPN Community · Policy install lock · vs PA vs Forti · CCSA / CCSE interview ## Sources - R81 Security Management — Installing the Access Control Policy (Publish, Verify, Install). - SmartConsole session management help for your train. Related: Check Point evidence desk · session factory · next lesson in the series above. --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt