topic Re: MacOS - Checkpoint Endpoint Security - Domain compliance check in Endpoint

MacOS - Checkpoint Endpoint Security - Domain compliance check

olowang — Wed, 17 Jan 2024 15:36:31 GMT

Hello everyone,

I would like to know if there's any known limitation (that I could not found) about compliance rule bases on MacOS ?

I configured a System check in order to verify that the device belongs to the "example.com" domain.

Unfortunately, I am getting a warning on my checkpoint client, stating that my computer doesn't belong to the domain that I configured, thus I cannot enable RESTRICTION as the check seems unstable.

This is not an isolated issue (over 75% of my devices return a "Warning" as the compliance status).

For instance, I have a COMPLIANT device running MacOS Sonoma 14.0 with Endpoint 87.41.4164.

My own device which has the same configuration is running MacOS Sonoma 14.2 with Endpoint 87.41.4164 but is NOT COMPLIANT.

I couldn't find any information about HOW the check is performed. Does it checks if the connected user is a domain user ? Hopefully not, because we are not using mobile accounts.

Thanks a lot.

Regards.

Re: MacOS - Checkpoint Endpoint Security - Domain compliance check

PhoneBoy — Wed, 24 Jan 2024 22:48:27 GMT

By domain, I think we mean Active Directory domain, not DNS domain.
Which is the case here?

Re: MacOS - Checkpoint Endpoint Security - Domain compliance check

Chris_Atkinson — Thu, 25 Jan 2024 03:22:28 GMT

Note also that Sonoma requires a newer client version to be officially supported.

E87.60 (EA)

E87.70 (GA)

Re: MacOS - Checkpoint Endpoint Security - Domain compliance check

olowang — Thu, 25 Jan 2024 16:26:52 GMT

Hello,

Indeed I am talking about an Active Directory Domain.

When I am authenticated on a mobile account, the compliance check succeed. Unfortunately, if a user use a local account, the compliance check fails and thus the client enter in restricted mode.

I just would like to highlight that I tried to upgrade afterward to the recommended version and the issue remains the same.

Re: MacOS - Checkpoint Endpoint Security - Domain compliance check

PhoneBoy — Fri, 26 Jan 2024 17:48:07 GMT

Looks like this is a known bug that is planned to be addressed as part of E88.20.
E88.20 is expected to be delivered during Q1 2024.

Re: MacOS - Checkpoint Endpoint Security - Domain compliance check

olowang — Thu, 01 Feb 2024 12:51:42 GMT

Hello PhoneBoy,

Thanks a lot for your feedback. Is there any resource that I can find about E88.20 or is it still only available internally ?

Also, do you know if there's any ETA about the Antivirus compliance check ? It is stated that it does not support Microsoft Defender yet so I am curious to know if this is planned for 2024.

Thanks a lot and have a nice day.

Re: MacOS - Checkpoint Endpoint Security - Domain compliance check

PhoneBoy — Fri, 02 Feb 2024 03:25:14 GMT

E88.20 is not released yet, thus there is no public information about it.

@BarYassure any comment on MS Defender support?