Operational Defect Database
BugZero found this defect 992 days ago.
Data sources
All data on this page is proprietary to BugZero® or gathered from public sources
WatchGuard Technologies | kA16S000000SN1HSAW
TDR Host Sensor does not remain installed on macOS Big Sur devices joined to Active Directory
Last update date:
8/31/2021
Affected products:
TDR
Affected releases:
All
TDR
Fixed releases:
All
Description:
Issue
For accounts that use AD Helper, Host Sensors installed on devices that run macOS Big Sur might not appear in the list of installed Host Sensors in WatchGuard Cloud and might uninstall themselves.This issue occurs when an undetected OS version is uploaded to the cloud during the AD Helper sync. When AD Helper syncs device information from Active Directory, it creates placeholder records for macOS devices. When the TDR Host Sensor is installed on these macOS devices, the cloud automatically detects and links the manually installed Host Sensor with the record created by AD Helper. Because AD Helper created the host record with the incorrect OS type, the cloud identifies the installed Host Sensor as a duplicate, rejects it, and forces an uninstall.
Workaround/Solution
To workaround this issue, manually set the operating system type to Mac in WatchGuard Cloud before you install the Host Sensor on devices that run macOS Big Sur. In WatchGuard Cloud, select Monitor > Threat Detection.Select Devices / Users > Hosts. Configure a filter with these settings: Type: UnknownInstall State: Not Installed Locate the host name of the device that runs macOS Big Sur.In the right column, click the gear icon, and select Edit Device.In the Edit Device dialog box, from the Type drop-down list, select Mac. If the IP Address text box is empty, type the IP address of the host device.Click Save & Close.After you change the operating system type to Mac, install the Host Sensor on the device. The device should connect and remain connected. The Type setting will remain as Mac while the Host Sensor is installed or until the next AD Helper sync runs.
