Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
degrotef
Contributor

Harmony Endpoint intefering with MS Active Directory Web Services ADWS

Hi all,

we are running our directory services in a private cloud environment as a service. In the beginning of the year we introduces Harmony Endpoint on all of our clients. After installing it on 4 Domain Controllers it began, that the operator of the ad controllers claimed, that one of the ad controllers (the PDC) sometimes starts to behave abnormal. This leads to crashin directory services and he makes the Check Point Endpoint security responsible for it.

We investigated several weeks with tac pulling memory dumps during crash time, without good results.

Yesterday I deep dived into the eventlog and created a sequence of eventlog messages that uccure every time this strange behavoiur happens.

The sequence is always the same:

25.09.2022 (Sunday)

  • 8:04 AM: Active Directory Web Services was unable to determine if the computer is a global catalog server.  --> EventID 1206 in Application and Services Logs / Active Directory Web Services
  • 8:26 AM: The time service has stopped advertising as a time source because the local clock is not synchronized
  • 8:47 AM:
    • An error occurred when Active Directory Web Services attempted to connect to the directory instance. Verify that the directory instance is running.
    •  Directory instance: NTDS
    • Directory instance LDAP port: 389
    • Directory instance SSL port: 636
    • Caller identity: S-1-5-21-4209190200-2177038297-167172362-20457
  • 9:45 AM: Restart  (Eventid 6005) 

 

The first message with EventID 1206 occurs the first time one day after installing Check Point Harmony Endpoint which, in my eyes,  makes it the cause of all this trouble.

Any Ideas of what could be the cause?

Thanks

Frank

 

 

0 Kudos
3 Replies
Chris_Atkinson
Employee
Employee

Which client version and what blades are deployed here?

Likely you will need to revisit with TAC but some additional info may help to correlate with any issues encountered by others.

0 Kudos
Anna_Suhanov
Employee
Employee

Hi Frank,

Check Point now provides the ability to automatically configure Threat Prevention policy for selected Windows Server profiles in EA program.

The starting profiles used in the EA are for:

  • Microsoft Exchange Server
  • Microsoft SQL Server
  • SharePoint Server
  • Active Directory Server
  • Terminal Server

Additional profiles will be defined during the EA program

 

Prerequisites

  • Willing to deploy a new endpoint client version E86.60 or later
  • Using the Endpoint Management on the cloud

If you are interested in participating this EA please contact me by email (annas@checkpoint.com)

More info about this feature on link.

Thanks.

Anna.

degrotef
Contributor

Hello Anna,

 

I think this feature is right now no loger in EA, right? I use it for Terminal Servers and SQL already. The case above could not e solved, so we changed the EDR to the vebdor supported by our private cloud provider.

Are there any transparent informations about what is included in the predefined server profiles?

Thanks

Frank

0 Kudos