topic Re: Detecting Check Point Disk Encryption with NAC in Endpoint

Detecting Check Point Disk Encryption with NAC

Mike-H — Tue, 23 Apr 2024 07:20:56 GMT

Hello,

We're in the process of deploying a NAC solution, and would it to flag machines with/without check point disk encryption, installed via Check Point Endpoint.

Are there any "markers" we could check for to confirm the disk is encrypted? (Reg keys, services, log files in folders etc)

Thanks

Mike

Re: Detecting Check Point Disk Encryption with NAC

PhoneBoy — Tue, 23 Apr 2024 14:26:28 GMT

There are two ways to encrypt the disk: with Bitlocker or with our own implementation.
Our own implementation will have a unique boot partition (our pre-boot environment).

Re: Detecting Check Point Disk Encryption with NAC

Mike-H — Tue, 23 Apr 2024 14:31:05 GMT

Thanks,

We're migrating away from Bitlocker, and over to the CP Implementation. I'll see if we can do something to check for the partition.

Re: Detecting Check Point Disk Encryption with NAC

yuris — Wed, 24 Apr 2024 10:57:13 GMT

Hello Mike,
Encryption status easy to see in Endpoint UI on client and on management server as well.
Can you please clarify your request?
What exactly you mean when you say "markers"? Are you want to check for encryption status programmatically or from script?
Thanks,
Yuri

Re: Detecting Check Point Disk Encryption with NAC

Mike-H — Thu, 25 Apr 2024 12:41:50 GMT

Hi Yuris,

You're correctly, we're aiming to check encryption status pragmatically via a script. This is to surface any devices which are not yet encrypted and flag them as at risk.

Thanks

Mike

Re: Detecting Check Point Disk Encryption with NAC

yuris — Thu, 25 Apr 2024 13:21:41 GMT

Hi Mike,

One of the possible options is to run client side utility called fdecontrol.exe and get-status command line parameter and check output for encryptionState value which will contain 3 when the disk is encrypted.

Thanks,
Yuri

Re: Detecting Check Point Disk Encryption with NAC

Mike-H — Fri, 26 Apr 2024 08:28:23 GMT

Thank you Yuris,

We will give that a go and feedback.

Re: Detecting Check Point Disk Encryption with NAC

Valerio5286 — Mon, 10 Jun 2024 20:42:48 GMT

Hi Yuris.

Is there documentation where I can consult the meaning of each of the get-status responses?

Thanks.