Hmmm, this gets tough to answer. I think that if you are getting some AD information, then you are reading security logs. I think I would turn OFF probing entirely (for now), so that you can focus on troubleshooting the UserID issue. I would change the timeout to 1/2 of your DHCP timer (so if DHCP is 8 hours, change cache to 4 hours), you need to effectively make some change to see if it a positive change or no change. I do not know the limits of how many IPs can be probed, but maybe the 201 entries is the max amount. So, I would stop probing. The net effect is that you have not lost any UserID information, because that is what we are troubleshooting. Make sure your UserID has the proper permissions to reach the Security Logs on the AD. Do you have the FW communicating to the LDAP server directly, or are you using the UserID agent in LDAP proxy mode? Is the FW and the DC in the same location (not across a WAN link, etc)? Ultimately, I would not have a problem creating a TAC case in this issue. That is why there are here. We the in the community can provide guidelines to help, but of course TAC will be the best to T-shoot and resolve this. Let me know what you find.
... View more