MacOS - Checkpoint Endpoint Security - Domain compliance check

[olowang]

Hello everyone,

I would like to know if there's any known limitation (that I could not found) about compliance rule bases on MacOS ?

I configured a System check in order to verify that the device belongs to the "example.com" domain.

Unfortunately, I am getting a warning on my checkpoint client, stating that my computer doesn't belong to the domain that I configured, thus I cannot enable RESTRICTION as the check seems unstable.

This is not an isolated issue (over 75% of my devices return a "Warning" as the compliance status).

For instance, I have a COMPLIANT device running MacOS Sonoma 14.0 with Endpoint 87.41.4164. 

My own device which has the same configuration is running MacOS Sonoma 14.2 with Endpoint 87.41.4164 but is NOT COMPLIANT.

I couldn't find any information about HOW the check is performed. Does it checks if the connected user is a domain user ? Hopefully not, because we are not using mobile accounts.

Thanks a lot.

Regards.

[PhoneBoy]

By domain, I think we mean Active Directory domain, not DNS domain.
Which is the case here?

[olowang]

Hello,

Indeed I am talking about an Active Directory Domain.

When I am authenticated on a mobile account, the compliance check succeed. Unfortunately, if a user use a local account, the compliance check fails and thus the client enter in restricted mode.

I just would like to highlight that I tried to upgrade afterward to the recommended version and the issue remains the same.

[PhoneBoy · Accepted solution]

Looks like this is a known bug that is planned to be addressed as part of E88.20.
E88.20 is expected to be delivered during Q1 2024.

[olowang]

Hello PhoneBoy,

Thanks a lot for your feedback. Is there any resource that I can find about E88.20 or is it still only available internally ?

Also, do you know if there's any ETA about the Antivirus compliance check ? It is stated that it does not support Microsoft Defender yet so I am curious to know if this is planned for 2024.

Thanks a lot and have a nice day.

[PhoneBoy]

E88.20 is not released yet, thus there is no public information about it.

@BarYassure any comment on MS Defender support?

[Chris_Atkinson]

Note also that Sonoma requires a newer client version to be officially supported. 

E87.60 (EA)

E87.70 (GA)