search cancel

Sender/User based on a Directory Server Group policy condition does not detect on macOS DLP Endpoint Agents

book

Article ID: 243315

calendar_today

Updated On:

Products

Data Loss Prevention Core Package Data Loss Prevention Endpoint Prevent Data Loss Prevention

Issue/Introduction

The Sender/User based on a Directory Server Group policy condition does not detect on macOS DLP Endpoint Agents. 

Cause

This issue is caused when the Mac Computer hasn't been joined to the Active Directory domain and the user is logging in with their local Mac account and not their AD account. You may see the following message in the Mac Endpoint Agent logs if they are in FINER logging level or higher with mac_machine_name\local_user replaced with the respective user's local machine and user name:

05/23/2022 12:36:42 | 946848 | FINER | AgentServices.UserGroupResolver | User [mac_machine_name\local_user] is not validated as an AD user.

Environment

DLP Mac Endpoint agents on 15.x and later

Resolution

The Mac computer needs to be joined to the Active Directory domain and the user needs to login to the Mac with their Active Directory account.

Refer to official documentation: 

1. Configuring the Sender/User based on a Directory Server Group condition:

The condition Sender/User based on a Directory Server Group matches policy violations based on message senders and endpoint users synchronized from a directory group server. You can implement this condition in a policy group (identity) rule or exception.
NOTE: If the identity being detected is a user, the user must be actively logged on to a DLP Agent-enabled system for the policy to match.

2. Overview of Mac agent detection technologies and policy authoring features:

Mac DLP Agents support Described Content Matching (DCM), which includes detection through data identifier, regular expression, and keyword rules. Mac DLP Agents support Indexed Document Matching (IDM). Mac DLP Agents support Directory Group Matching (DGM) for User Group-based policies, limited to the condition Sender/User based on a Directory Server Group rule. The agent also supports various response rules for Endpoint Prevent and Endpoint Discover.

Additional Information

Join your Mac to a network account server

Allow network users to log in to your Mac