topic Enable SCV in Remote Access VPN client for macOS in Mobile

Enable SCV in Remote Access VPN client for macOS

Vanness_Chen — Tue, 14 Oct 2025 03:50:01 GMT

Hi Experts,

My customer would like to restrict macOS devices that are not joined to the AD domain from connecting to VPN through Endpoint Agent.

According to SK182226, I understand that it’s possible to configure relevant rules to achieve this control. However, I’m not sure which parameter specifically corresponds to the AD domain membership check.

If anyone has experience with this configuration, I’d really appreciate your guidance or advice.

Thank you in advance!

Re: Enable SCV in Remote Access VPN client for macOS

the_rock — Tue, 14 Oct 2025 23:15:30 GMT

Not sure if this makes sense, but here is AI response.

Andy

*****************

To achieve the desired control of restricting macOS devices that are not joined to the AD domain from connecting to the VPN through Endpoint Agent, you are on the right track by referencing the rules described in SK182226. This document outlines how to configure policies to enforce device compliance.

The key parameter you are looking for in this context is the "Domain Membership" check. Specifically, you're aiming to check whether the macOS device is joined to your Active Directory domain, and if it's not, deny access to the VPN.

Here’s a rough outline of what you might need to do:

Configure Endpoint Agent Rules:
- Within the Endpoint Security profile, you will configure rules to check the system's domain membership status.
- The AD Domain Membership check is generally based on the presence of specific domain-joined attributes (such as the domain, organizational unit, or computer name) on the device. This can be defined within the security policy settings.
Custom Rule Configuration:
- In the relevant rule set, you can define a custom "Domain Membership" condition that ensures that only devices joined to the AD domain can pass the VPN authentication.
- The AD Domain check will typically use the device’s hostname or domain information as a condition, ensuring that the endpoint meets the necessary domain membership requirement.
Testing and Validation:
- After configuring the rules, make sure to test with devices that are both domain-joined and non-domain-joined to verify the behavior.
- You can also leverage system logs on the Endpoint Agent to confirm that the domain membership check is correctly being enforced.

If your specific setup involves third-party VPN solutions or additional security layers, the exact parameter name or configuration might differ. That being said, I would recommend reviewing the most recent VPN and Endpoint Agent documentation from your vendor (if applicable) for any updates or specific syntax required.

Re: Enable SCV in Remote Access VPN client for macOS

Vanness_Chen — Wed, 15 Oct 2025 02:36:28 GMT

Hi Andy,

I’ve reviewed SK182226, which mentions that the SCV feature for macOS is supported, but it is disabled by default and requires the client to manually enable it (as described in Step 2).

Given this behavior, does it mean that we cannot use SCV to block unmanaged or unknown macOS devices in the current situation?

Also, does the SCVGlobalParams parameter — specifically "allow_non_scv_clients (false)" — apply to macOS clients as well?

According to this discussion thread:
👉 How to enable Secure Client Verification
https://community.checkpoint.com/t5/Remote-Access-VPN/How-to-enable-Secure-Client-Verification/td-p/131860

it seems there isn’t a clear or definitive answer.

Re: Enable SCV in Remote Access VPN client for macOS

the_rock — Wed, 15 Oct 2025 02:41:35 GMT

Yes, not 100% clear...I woukd definitely confirm with TAC.

Andy

Re: Enable SCV in Remote Access VPN client for macOS

Ruan_Kotze — Wed, 15 Oct 2025 10:46:07 GMT

Hi Vanness,

I did a write up on how to enable domain membership checks via SCV for Windows Clients - I know you mentioned Macs but this should provide a good starting point. I know when I did it the first time I was wishing for slightly clearer documentation.

https://namitguy.blogspot.com/2020/04/implementing-secure-client-verification.html

-Ruan

Re: Enable SCV in Remote Access VPN client for macOS

the_rock — Thu, 16 Oct 2025 06:14:38 GMT

Wow...EXCELLENT!