topic Re: Harmony Endpoint intefering with MS Active Directory Web Services ADWS in Endpoint

Harmony Endpoint intefering with MS Active Directory Web Services ADWS

Gro_Tea — Fri, 28 Oct 2022 08:38:36 GMT

Hi all,

we are running our directory services in a private cloud environment as a service. In the beginning of the year we introduces Harmony Endpoint on all of our clients. After installing it on 4 Domain Controllers it began, that the operator of the ad controllers claimed, that one of the ad controllers (the PDC) sometimes starts to behave abnormal. This leads to crashin directory services and he makes the Check Point Endpoint security responsible for it.

We investigated several weeks with tac pulling memory dumps during crash time, without good results.

Yesterday I deep dived into the eventlog and created a sequence of eventlog messages that uccure every time this strange behavoiur happens.

The sequence is always the same:

25.09.2022 (Sunday)

8:04 AM: Active Directory Web Services was unable to determine if the computer is a global catalog server. --> EventID 1206 in Application and Services Logs / Active Directory Web Services
8:26 AM: The time service has stopped advertising as a time source because the local clock is not synchronized
8:47 AM:

An error occurred when Active Directory Web Services attempted to connect to the directory instance. Verify that the directory instance is running.
Directory instance: NTDS
Directory instance LDAP port: 389
Directory instance SSL port: 636
Caller identity: S-1-5-21-4209190200-2177038297-167172362-20457

9:45 AM: Restart (Eventid 6005)

The first message with EventID 1206 occurs the first time one day after installing Check Point Harmony Endpoint which, in my eyes, makes it the cause of all this trouble.

Any Ideas of what could be the cause?

Thanks

Frank

Re: Harmony Endpoint intefering with MS Active Directory Web Services ADWS

Chris_Atkinson — Sat, 29 Oct 2022 02:10:28 GMT

Which client version and what blades are deployed here?

Likely you will need to revisit with TAC but some additional info may help to correlate with any issues encountered by others.

Re: Harmony Endpoint intefering with MS Active Directory Web Services ADWS

Anna_Suhanov — Sun, 30 Oct 2022 13:40:35 GMT

Hi Frank,

Check Point now provides the ability to automatically configure Threat Prevention policy for selected Windows Server profiles in EA program.

The starting profiles used in the EA are for:

Microsoft Exchange Server
Microsoft SQL Server
SharePoint Server
Active Directory Server
Terminal Server

Additional profiles will be defined during the EA program

Prerequisites

Willing to deploy a new endpoint client version E86.60 or later
Using the Endpoint Management on the cloud

If you are interested in participating this EA please contact me by email (annas@checkpoint.com)

Re: Harmony Endpoint intefering with MS Active Directory Web Services ADWS

Gro_Tea — Wed, 14 Dec 2022 12:20:07 GMT

Hello Anna,

I think this feature is right now no loger in EA, right? I use it for Terminal Servers and SQL already. The case above could not e solved, so we changed the EDR to the vebdor supported by our private cloud provider.

Are there any transparent informations about what is included in the predefined server profiles?

Thanks

Frank