topic Re: Identity Collector not receiving events after MS "Defender For Identity" was installed in Hyperscale Firewall (Maestro)

Identity Collector not receiving events after MS "Defender For Identity" was installed

Tecki0815 — Wed, 18 Jun 2025 11:30:22 GMT

Hello,

we have installed Microsoft "Defender For Identity" on Domain Controllers.

Since then, the Check Point Identity Collector, which is used für Identity-Based access rules is not getting login/logout events any more.

Before the Microsoft "Defender For Identity" installation every thing worked fine.

And is it "normal" that the SMO has connected Identity controllers ?

Jut one SGM (we have just 2 and one group) has conneced Identity controllers

[Expert@SMO:0]# pdp idc status
No connected Identity Collectors

[Expert@SMO:0]#

Does any one have any idea how to fix this ?

Thanks

Re: Identity Collector not receiving events after MS "Defender For Identity" was installed

PhoneBoy — Wed, 18 Jun 2025 22:01:15 GMT

Perhaps debugging Identity Collector will provide a clue: https://sc1.checkpoint.com/documents/Identity_Awareness_Clients_Admin_Guide/Content/Topics-IA-Clients-AG/Identity-Collector-Debug.htm

Re: Identity Collector not receiving events after MS "Defender For Identity" was installed

Chris_Atkinson — Wed, 18 Jun 2025 23:35:39 GMT

Which version of IDC is being used in the environment?

Re: Identity Collector not receiving events after MS "Defender For Identity" was installed

Tecki0815 — Thu, 19 Jun 2025 07:26:25 GMT

the IDC version is R82.120

but most probably it is not related to sk183573 as I do not see any log containing "Win32 Error: Thread::Start "
and I have already CPIdentityCollector_R81.120.0291.msi.7z

which is beeing installed soon, but like already stated, this is most probbably not the root cause

Best Regards