topic Re: Event 4719 Triggered After Installing Check Point EDR on Domain Controllers in Endpoint

Event 4719 Triggered After Installing Check Point EDR on Domain Controllers

kiikoo15 — Tue, 03 Dec 2024 15:49:12 GMT

Hello everyone,

I’m experiencing an issue with Check Point’s Endpoint Detection and Response (EDR) solution after deploying it on our Domain Controllers. Since installation, the servers consistently generate Event ID 4719, which logs a change to the audit policy. This event is recurring and happens multiple times a day.

I understand that Event 4719 indicates a modification in the security audit policy, but I’m unsure why the EDR is causing this on domain controllers specifically. Is this behavior expected when installing the Check Point EDR on DCs, or is there a configuration issue at play?

Additionally, I would like to know if there’s a way to fine-tune the EDR settings to prevent this from happening. I’ve reviewed the EDR’s configuration but haven’t pinpointed a way to stop these events from occurring.

Has anyone else encountered this issue? If so, how did you address it? Any guidance on configuring the EDR or audit policy to mitigate these events would be greatly appreciated.

Thanks in advance!

Re: Event 4719 Triggered After Installing Check Point EDR on Domain Controllers

PhoneBoy — Tue, 03 Dec 2024 21:31:40 GMT

What version of client?
Have you looked into the Event logs to see exactly WHAT has changed?

Re: Event 4719 Triggered After Installing Check Point EDR on Domain Controllers

Chris_Atkinson — Tue, 03 Dec 2024 21:32:14 GMT

Which endpoint client version is installed, what blades are deployed and is the server optimisations config used as below?

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Endpoint-Admin-Guide/Topics-HEP/Optimizing-Endpoint-for-Servers.htm

Re: Event 4719 Triggered After Installing Check Point EDR on Domain Controllers

kiikoo15 — Tue, 03 Dec 2024 21:58:34 GMT

My verison is 88.41.1002

The blades deployed are:

Files Protection
Anti ransomware
Anti-exploit (Detect)
Analysis and remediation
And i have a rule with server optimisation (Domain Controller)