topic Re: Finding endpoints that have not received the 1/1/2021 VPN Patch in Endpoint

Finding endpoints that have not received the 1/1/2021 VPN Patch

Nelson_Custodio — Tue, 05 Jan 2021 15:13:06 GMT

Unfortunately, my organization had to manually install the 80.81 - 81.10 patch to all our endpoints. Now that we are in the new year is there a command I can run to see what clients are still unpatched? Or clients that have attempted to connect but are unable to because they are not patched?

Re: Finding endpoints that have not received the 1/1/2021 VPN Patch

Lior_Arzi — Tue, 05 Jan 2021 15:23:09 GMT

from sk171213:

How to determine if the patch is installed?

There are several recommended options:

Look at the patch logs for success/failure messages when using the EPPatch.msi – For more information, follow sk171275.

Look for the file version of the epklib.sys itself (C:\windows\system32\drivers\) and validate that the version is the same as or higher than 8.60.5.7253

To use Check Point's Compliance blade to examine the outdated driver that needs replacement (by checking the version) – follow sk171279.

Re: Finding endpoints that have not received the 1/1/2021 VPN Patch

Nelson_Custodio — Tue, 05 Jan 2021 15:31:55 GMT

Thanks but I was hoping for something I can pull remotely through the logs. I also don't own the compliance blade

Re: Finding endpoints that have not received the 1/1/2021 VPN Patch

Lior_Arzi — Tue, 05 Jan 2021 15:49:42 GMT

If you have our Endpoint Security you automatically have the license for our compliance.

you can use it to query it remotely as described in sk171279.

Re: Finding endpoints that have not received the 1/1/2021 VPN Patch

rrbranco — Tue, 05 Jan 2021 21:53:48 GMT

Perhaps you could also take a look to this oneliner ...

https://community.checkpoint.com/t5/Scripts/Endpoint-Versions-ONELINER/m-p/106988#M737

Re: Finding endpoints that have not received the 1/1/2021 VPN Patch

ED — Wed, 06 Jan 2021 08:31:07 GMT

@Nelson_Custodio

Open your logs and paste in this query:

action:"Log In" AND ("Endpoint Security") AND (E80.81 or E80.82 or E80.83 or E80.84 or E80.85 or E80.86 or E80.87 or E80.88 or E80.89 or E80.90 or E80.92 or E80.94 or E80.95 or E80.96 or E80.97 or E81.00 or E81.10)

Then you will find all the clients with the old versions still trying to connect. Take a look at 7 days to catch the most recently.