Harmony Endpoint intefering with MS Active Directory Web Services ADWS

[Gro_Tea]

Hi all,

we are running our directory services in a private cloud environment as a service. In the beginning of the year we introduces Harmony Endpoint on all of our clients. After installing it on 4 Domain Controllers it began, that the operator of the ad controllers claimed, that one of the ad controllers (the PDC) sometimes starts to behave abnormal. This leads to crashin directory services and he makes the Check Point Endpoint security responsible for it.

We investigated several weeks with tac pulling memory dumps during crash time, without good results.

Yesterday I deep dived into the eventlog and created a sequence of eventlog messages that uccure every time this strange behavoiur happens.

The sequence is always the same:

25.09.2022 (Sunday)

• 8:04 AM: Active Directory Web Services was unable to determine if the computer is a global catalog server.  --> EventID 1206 in Application and Services Logs / Active Directory Web Services
• 8:26 AM: The time service has stopped advertising as a time source because the local clock is not synchronized
• 8:47 AM:
• An error occurred when Active Directory Web Services attempted to connect to the directory instance. Verify that the directory instance is running.
•  Directory instance: NTDS
• Directory instance LDAP port: 389
• Directory instance SSL port: 636
• Caller identity: S-1-5-21-4209190200-2177038297-167172362-20457

• 9:45 AM: Restart  (Eventid 6005) 

The first message with EventID 1206 occurs the first time one day after installing Check Point Harmony Endpoint which, in my eyes,  makes it the cause of all this trouble.

Any Ideas of what could be the cause?

Thanks

Frank

[Chris_Atkinson]

Which client version and what blades are deployed here?

Likely you will need to revisit with TAC but some additional info may help to correlate with any issues encountered by others.

[Anna_Suhanov]

Hi Frank,

Check Point now provides the ability to automatically configure Threat Prevention policy for selected Windows Server profiles in EA program.

The starting profiles used in the EA are for:

• Microsoft Exchange Server
• Microsoft SQL Server
• SharePoint Server
• Active Directory Server
• Terminal Server

Additional profiles will be defined during the EA program

Prerequisites

• Willing to deploy a new endpoint client version E86.60 or later
• Using the Endpoint Management on the cloud

If you are interested in participating this EA please contact me by email (annas@checkpoint.com)

More info about this feature on link.

Thanks.

Anna.

[Gro_Tea]

Hello Anna,

I think this feature is right now no loger in EA, right? I use it for Terminal Servers and SQL already. The case above could not e solved, so we changed the EDR to the vebdor supported by our private cloud provider.

Are there any transparent informations about what is included in the predefined server profiles?

Thanks

Frank