topic Re: What information is written in preboot? in Endpoint

What information is written in preboot?

Premysl_Vresky — Mon, 19 Feb 2018 06:56:10 GMT

Re: What information is written in preboot?

PhoneBoy — Tue, 20 Feb 2018 06:20:29 GMT

Each computer has assigned to it the users that can log in at preboot.

I assume, in addition to the username/password, we're also storing the SID of the user.

It sounds like what you did was move the user to a different part of the AD, which may have changed his SID.

In which case, trying to login with the pre-boot credentials would fail.

I think you can fix this by reassigning that user to the computer as allowed for preboot.

Re: What information is written in preboot?

Premysl_Vresky — Tue, 20 Feb 2018 08:14:43 GMT

I have information from colleagues that the SID has not changed 100%
Today I'm going to be part of testing, I'll try to disable SSO on this computer.

I'm trying to understand exactly what happens when I login to windows with preboot data

Re: What information is written in preboot?

Robert_Granlof — Mon, 26 Feb 2018 17:31:32 GMT

The information provided from preboot is domain, username and password. This information is used in the Check Point credential provider to perform a Windows autologon if SSO is enabled.

When the “Welcome” message is shown, the user information has already been set in the credential provider (from preboot data or manually entered) and the sign-in process has been started. Normally when having any kind of problems at sign-in there can be a time-out but it should be followed by an error message (for example if there are problems getting hold of the user SID or using wrong credentials).

I did not manage to reproduce the problem you are facing. If you have not found a solution to the problem I suggest that you open a Service Request so we can do a deeper analysis of the problem.

Re: What information is written in preboot?

Premysl_Vresky — Tue, 27 Feb 2018 05:12:45 GMT

thank you for answer. I have both decrypted and encrypted both computers. Unfortunately, it was not time to investigate more in this case. If there is another such case, I will create a ticket and analyze it.