UserCheck Interaction Objects

Configuring UserCheck

Configuring the Security Gateway for UserCheck

Enable or disable UserCheck directly on the Security Gateway. If users connect to the gateway remotely, set the internal interface of the gateway (on the Topology page) to be the same as the Main URL for the UserCheck portal.

Note - The Main URL field must be manually updated if:

• The Main URL field uses an IP address and not a DNS name
• You change the IPv4 address of the gateway to IPv6 or the opposite

To configure a Security Gateway for UserCheck:

1. In SmartConsole, click Gateways & Servers and double-click the Security Gateway.

   The gateway window opens and shows the General Properties page.

2. From the navigation tree, click UserCheck.
3. Click Enable UserCheck for active blades.
4. In the Main URL field, select the primary URL for the web portal that shows the UserCheck notifications.
5. If the Main URL points to an external interface:
   1. In the Accessibility section, click Edit.
   2. In the Accessibility window, click the applicable setting:
   • Through all interfaces
   • According to the firewall policy
   1. Click OK.
6. If necessary, click Aliases to add URL aliases that redirect different hostnames to the Main URL.

   For example: Usercheck.mycompany.com The aliases must resolve to the portal's IP address on the corporate DNS server.

7. In the Certificate area, click Import to import a certificate that the portal uses to authenticate to the server.
8. In the Accessibility area, click Edit to configure interfaces on the gateway through which the portal can be accessed. These options are based on the topology configured for the gateway. Users are sent to the UserCheck portal if they connect:
   • According to the Firewall policy. Select this option if there is a rule that states who can access the portal.
   • Through all interfaces
   • Through internal interfaces (default)
     • Including undefined internal interfaces
     • Including DMZ internal interfaces
     • Including VPN encrypted interfaces (default)

   Note - If Including VPN encrypted interfaces is selected, add a Firewall rule that looks like this:

   Source	Destination	VPN	Service	Action
   Any	Gateway on which UserCheck client is enabled	Any Traffic	UserCheck	Accept

9. In the UserCheck Client area, select Activate UserCheck Client Support.
   • The UserCheck client enables user interaction notifications.
   • Click Download Client to download the installation file for the UserCheck client.

     Note: The link will not be active until the UserCheck portal is up.

10. Click OK.
11. Install policy.

UserCheck CLI

Usrchk

You can use the usrchk command in the gateway command line to show or clear the history of UserCheck objects.

usrchk [debug] [hits] [incidents]

Parameters

debug

hits

incidents

Examples:

• To show all UserCheck interaction objects, run: usrchk hits list all
• To clear the incidents for a specified user, run: usrchk hits clear user <username>

Notes:

• You can only run a command that contains user <username> if:
  • Identity Awareness is enabled on the gateway.
  • Identity Awareness is used in the same policy rules as UserCheck objects.
• To run a command that contains a specified UserCheck interaction object, first run usrchk hits list all to see the names of the interaction objects. Use the name of the interaction object as it is shown in the list.

Kerberos Single Sign On

The UserCheck agent supports single sign on using the Kerberos network authentication protocol. Kerberos is the default authentication protocol used in Windows 2000 domains and above.

The Kerberos protocol is based on the idea of tickets, encrypted data packets issued by a trusted authority, in this case the Active Directory (AD). When a user logs in, the user authenticates to a domain controller that provides an initial ticket granting ticket (TGT). This ticket vouches for the user’s identity.

When the user needs to authenticate against the DLP gateway through the UserCheck agent, the agent presents this ticket to the domain controller and requests a service ticket (SR) for a specific resource (the DLP gateway). The UserCheck agent presents this service ticket to the gateway.

For more detailed information on Kerberos SSO, see:

• http://web.mit.edu/Kerberos/
• http://technet.microsoft.com/en-us/library/bb742433.aspx

Single Sign-On Configuration

SSO configuration has two steps:

• AD Configuration

  Creating a user account and mapping it to a Kerberos principal name.

• SmartConsole Configuration

  Creating an LDAP Account Unit and configuring it to support SSO.

AD Configuration

The AD configuration involves:

• Creating a New User Account
• Mapping the User Account to a Kerberos Principle Name

Creating a new User Account

1. In Active Directory, open Active Directory Users and Computers (Start > Run > dsa.msc)
2. Add a new user account. You can choose any username and password. For example: a user account named ckpsso with the password 'qwe123!@#' to the domain corp.acme.com.
3. Clear User must change password at next logon and select Password Never Expires.

Mapping the User Account to a Kerberos Principle Name

This step uses the ktpass utility to create a Kerberos principal name that is used by both the gateway and the AD. A Kerberos principal name consists of a service name (for the DLP gateway that the UserCheck agent connect to) and the domain name to which the service belongs.

Ktpass is a command-line tool available in Windows 2000 and higher.

Retrieve the correct executable

You must install the correct ktpass.exe version on the AD. Ktpass.exe is not installed by default in Windows 2003.

• Windows 2003:
  1. Retrieve the correct executable for your service pack from the Microsoft Support site prior to installation. It is part of the Windows 2003 support tools. For example, AD 2003 SP2 requires support tools for 2003 sp2.
  2. Download the support.cab and suptools.msi files to a new folder on your AD server.
  3. Run the suptools.msi.
• ActiveDirectory 2008:

  The ktpass utility is already installed on your server in the Windows\System32 folder and you can run the command line. You need to open the command prompt as an administrator by right clicking it and selecting "run as an Administrator".

Use Ktpass

1. Open a command line to run the ktpass tool (Start > Run > cmd).
2. At the command prompt, run ktpass with this syntax:

   C:> ktpass -princ ckp_pdp/domain_name@DOMAIN_NAME -mapuser username@domain_name -pass password -out unix.keytab –crypto RC4-HMAC-NT

   Important - Enter the command exactly as shown. It is case-sensitive.

   This is an example of running ktpass with these parameters:

   Parameter	Value
   domain_name@DOMAIN_NAME	corp.acme.com@CORP.ACME.COM
   username@domain_name	ckpsso@corp.acme.com
   password	qwe123@#

The AD is ready to support Kerberos authentication for the Security Gateway.

The example above shows the ktpass syntax on Windows 2003. When using Windows 2008/2008 R2 Server, the ktpass syntax is slightly different. Parameters are introduced using a forward slash "/" instead of a hyphen "-".

Example (Windows 2008):

ktpass /princ ckp_pdp/corp.acme.com@CORP.ACME.COM /mapuser ckpsso@corp.acme.com /pass qweQWE!@# /out unix.keytab /crypto RC4-HMAC-NT

Authentication Failure

Authentication will fail if you have used the ktpass utility before for the same principal name (ckp_pdp/domain_name@DOMAIN_NAME) but with a different account.

If you have used the ktpass utility before:

1. On the AD server, run:

   ldifde -f check_SPN.txt -t 3268 -d "dc=corp,dc=acme,dc=com" -l servicePrincipalName -r "(servicePrincipalName=ckp_pdp*)" -p subtree

2. Open the check_SPN.txt file and verify that only one record is present.

   If multiple records exist, you must delete the different account or remove its association to the principal name.

   Remove the association with the principle name by running:

   settspn –D ckp_pkp/domain_name old_account name.

   For example:

   setspn –D ckp_pdp/corp.acme.com ckpsso

Configuring SmartConsole for DLP SSO

Configure the object in SmartConsole for an LDAP Account Unit to support SSO.

To create a host object for the AD server:

1. In SmartConsole, click Objects > Object Explorer (Ctrl+E).
2. Click New > Host.
3. Configure the settings for the host.
4. Click OK and publish the changes.

To configure the LDAP account unit:

1. From the Object Explorer, click New > Server > LDAP Account Unit.
2. In the General tab of the LDAP Account Unit Properties window, enter these settings:
   1. Enter the Name.
   2. In Profile, select Microsoft_AD.
   3. In the Domain field, enter the domain name.

      Best Practice - Configure this field for account units that you want to use for Identity Awareness. This setting does not affect other LDAP Account Units.

   4. Select CRL retrieval and User management.
3. Click Active Directory SSO configuration.
4. In the Active Directory SSO configuration window, configure these settings:
   1. Select Use Kerberos Single Sign On.
   2. Enter the Domain Name.
   3. Enter the Account Name and Password for the AD account.
   4. Do not change the default settings for Ticket encryption method.
   5. Click OK.
5. Configure these settings in the Servers tab:
   1. Click Add.
   2. In Host, select the host object for the AD server.
   3. Enter the Login DN of the user (added in the AD) for LDAP operations.
   4. Enter the Password and confirm it.
   5. In the Check Point Gateways are allowed to section, make sure that Read data from this server is selected.
6. Click the Encryption tab, and configure these settings:
   1. Click Use Encryption (SSL).
   2. Click Fetch.
   3. Click OK.

   Note - LDAP over SSL is not supported by default. If you have not configured your domain controller to support LDAP over SSL, either skip step 6 or configure your domain controller to support LDAP over SSL.

7. Click the Objects Management tab, and configure these settings:
   1. In the Manage objects on field, select the host object for the AD server
   2. Click Fetch Branches to configure the branches in use.
   3. Set the number of entries supported.
8. Click the Authentication tab, and configure these settings:
   1. In the Users's default values section, click Default authentication scheme.
   2. Select Check Point Password.
9. Click OK and publish the changes.

UserCheck Page

On the UserCheck page, you can create, edit, and preview UserCheck interaction objects and their messages. It has these options:

These are the default UserCheck messages:

Ask and Inform pages include a Cancel button that users can click to cancel the request.

You can preview each message page in these views:

• Regular view - How the message shows in a web browser on a PC or laptop
• Mobile Device - How the message shows in a web browser on a mobile device
• Email - How the message shows in email
• Agent - How the message shows in the agent

Creating UserCheck Interaction Objects

Create a UserCheck Interaction object from the Rule Base or from the UserCheck page of the DLP tab. The procedure below shows how to create the object from the Rule Base in SmartDashboard.

Note - You can only edit DLP UserCheck objects in SmartDashboard. You cannot create or edit them in SmartConsole.

To create a UserCheck object that includes a message:

1. In SmartConsole, select Security Policies > Shared Policies > DLP and click Open DLP Policy in SmartDashboard.

   SmartDashboard opens and shows the DLP tab.

2. From the navigation tree, click Policy.

   The Action column uses these interaction modes:

   • Inform user - Show an informative message users. Users can continue to the application or cancel the request.
   • Ask user - Show a message to users that asks them if they want to continue with the request or not. To continue with the request, the user is expected to supply a reason.
   • Prevent - Show a message to users and block the application request.
3. Right-click the cell for the rule and select the interaction mode > New.

   You can also double-click an existing interaction mode to edit it.

   The UserCheck Interaction window opens on the Message page.

4. Enter a name for the UserCheck object and, optionally, a comment.
5. Select a language (English is the default) from the Languages tabs.
6. Click Add logo to add a graphic, such as company logo.

   Note - The graphic must have a height and width of 176 x 52 pixels.

7. Click the text box adjacent to the picture and enter title text for the message.
8. In the page title, message subject, and message body text boxes, enter the message content. You can:
   1. Use the formatting toolbar to change text color, alignment, add or remove bullets.
   2. Insert field variables for:
      • Username
      • Original URL
      • Source IP
      • Incident ID
      • Violation protocol
      • Email subject / File name
      • Matched Rules Notifications

      Variables are replaced with applicable values when the (Prevent, Ask, Inform) action occurs and the message shows. The Username can only be displayed if the Identity Awareness blade is enabled.

   3. Use the Insert User Input variable to add a:
      • Confirm checkbox - Users select a checkbox to continue
      • Textual Input - Users can enter an explanation for their activity or other text according to the instructions. Edit the default text in the Textual Input box based on your business needs.
      • Wrong report category - Users can click a link to report that an incorrect category was included in the message. Use this field with the Category variable.
9. Optional: Click Preview in browser to see the results in your default browser.
10. Click OK.
11. Click Save and then close SmartDashboard.
12. From SmartConsole, Install Policy.

Plain Text Email Notifications

Not all emails clients can handle emails in rich text or HTML format. To accommodate such clients, you can configure the gateway to send emails without images.

To configure emails without images:

1. On the DLP gateway, open this file for editing:

   $FWDIR/conf/usrchkd.conf

2. Locate the send_emails_with_no_images entry.
3. Change the value to true.
4. Save and close the file.
5. Kill the userchkd process.

   The process is automatically restarted by the gateway. The new configuration will survive a gateway reboot.

   Email notifications are now sent in both plain text and HTML formats. The user's email clients decides which format to show.

More UserCheck Interaction Options

For each UserCheck Interaction object you can configure these options from the UserCheck Interaction window:

• Message - Modify the message text.
• Languages - Select a default language for the message.
• Fallback Action - For DLP, the fallback action is derived from the original action. If the original action is:
  • Ask - The fallback is Block
  • Inform - The fallback is Detect
• Conditions - Select actions that must occur before users can access the application. Select one or more of these options:
  • User accepted and selected the confirm checkbox - This applies if the UserCheck message contains a checkbox (Insert User Input > Confirm Checkbox). Users must accept the text shown and select the checkbox before they can access the application.
  • User filled some textual input - This applies if the UserCheck message contains a text field (Insert User Input > Textual Input). Users must enter text in the text field before they can access the application. For example, you might require that users enter an explanation for use of the application.

Localizing and Customizing the UserCheck Portal

After you set the UserCheck interaction object language, you can translate the Portal OK and Cancel buttons to the applicable language. For more information, see: sk83700.

The DLP UserCheck predefined notifications are in only English by default. If necessary, you can add more languages manually.

To support more languages for UserCheck:

1. In SmartConsole, select Security Policies > Shared Policies > DLP and click Open DLP Policy in SmartDashboard.

   SmartDashboard opens and shows the DLP tab.

2. From the navigation tree, click UserCheck.
3. Select a UserCheck interaction object and click Edit.
4. In the Message pane, click Languages.
5. From the list, select the applicable language.
6. Click OK.

   A tab for the language is added.

7. Enter the necessary text and click OK.

UserCheck Client

UserCheck Client Overview

The UserCheck client is installed on endpoint computers to communicate with the gateway and show UserCheck interaction notifications to users.

It works with these Software Blades:

DLP - Notifications of DLP incidents can be sent by email (for SMTP traffic) or shown in a popup from the UserCheck client in the system tray (for SMTP, HTTP and FTP).

• UserCheck client adds the option to send notifications for applications that are not in a web browser, such as Skype, iTunes, or browser add-ons (such as radio toolbars). The UserCheck client can also work together with the UserCheck portal to show notifications on the computer itself when:
• The notification cannot be displayed in a browser, or
• The UserCheck engine determines that the notification will not be shown correctly in the browser.

Users select an option in the notification message to respond in real-time.

For DLP, administrators with full permissions or the View/Release/Discard DLP messages permission can also send or discard incidents from the SmartConsole Logs & Monitor Logs view.

Workflow for installing and configuring UserCheck clients:

1. Configure how the clients communicate with the gateway and create trust with it.
2. Enable UserCheck and the UserCheck client on the gateway.
3. Download the UserCheck client MSI file.
4. Install the UserCheck client on the endpoint computers.
5. Make sure that the UserCheck clients can connect to the gateway and receive notifications.

UserCheck Requirements

See UserCheck Client Requirements in the R80.10 Release Notes.

Enabling UserCheck Client

Enable UserCheck and the UserCheck client on the gateway in the Properties window of the gateway object in SmartConsole. This is necessary to let clients communicate with the gateway.

To enable UserCheck and the UserCheck client on the gateway:

1. In SmartConsole, click Gateways & Servers and double-click the Security Gateway.

   The gateway window opens and shows the General Properties page.

2. From the navigation tree, click UserCheck.
3. Select Enable UserCheck for active blades.

   This enables UserCheck notifications from the gateway.

4. In the UserCheck Client section, select Activate UserCheck Client support.

   This enables UserCheck notifications from the client.

5. Click OK and Install Policy.

Client and Gateway Communication

In an environment with UserCheck clients, the gateway acts as a server for the clients. Each client must be able to discover the server and create trust with it.

To create trust, the client makes sure that the server is the correct one. It compares the server fingerprint calculated during the SSL handshake with the expected fingerprint. If the server does not have the expected fingerprint, the client asks the user to manually confirm that the server is correct.

Here is a summary of the methods that you can use for clients to discover and trust the server. More details are described later in this section.

• File name based server configuration – If no other method is configured (default, out-of-the-box situation), all UserCheck clients downloaded from the portal are renamed to have the portal machine IP address in the filename. During installation, the client uses this IP address to connect to the gateway. Note that the user has to click Trust to manually trust the server.
• AD based configuration – If client computers are members of an Active Directory domain, you can deploy the server addresses and trust data using a dedicated tool.
• DNS SRV record based server discovery – Configure the server addresses in the DNS server. Note that the user has to click Trust to manually trust the server.
• Remote registry – All of the client configuration, including the server addresses and trust data reside in the registry. You can deploy the values before installing the client (by GPO, or any other system that lets you control the registry remotely). This lets you use the configuration when the client is first installed.

Option Comparison

File Name Based Server Discovery

This option is the easiest to deploy, and works out-of-the-box. It requires that users manually click Trust to trust the server the first time they connect. You can use this option if your deployment has only one Security Gateway with the relevant Software Blades.

How does it work?

When a user downloads the UserCheck client, the address of the Security Gateway is inserted in the filename. During installation, the client finds if there is a different discovery method configured (AD based, DNS based, or local registry). If no method is configured, and the gateway can be reached, it is used as the server. In the UserCheck Settings window, you can see that the server you connect to is the same as the Security Gateway in the UserCheck client filename.

Users must manually make sure that the trust data is valid, because the filename can be easily changed.

Renaming the MSI

You can manually change the name of the MSI file before it is installed on a computer. This connects the UserCheck client to a different gateway.

To rename the MSI file:

1. Make sure the gateway has a DNS name.
2. Rename the MSI using this syntax: UserCheck_~GWname.msi

   Where GWname - is the DNS name of the gateway.

   Optional: Use UserCheck_~GWname-port.msi

   Where port is the port number of notifications. For example, UserCheck_~mygw-18300.msi.

Active Directory Based Configuration

If your client computers are members of an Active Directory domain and you have administrative access to this domain, you can use the Distributed Configuration tool to configure connectivity and trust rules.

The Distributed Configuration tool has three windows:

• Welcome - Describes the tool and lets you enter different credentials that are used to access the AD.
• Server configuration – Configure which Security Gateway the client connects to, based on its location.
• Trusted gateways – View and change the list of fingerprints that the Security Gateways consider secure.

To enable Active Directory based configuration for clients:

1. Download and install the UserCheck client MSI on a computer.

   From the command line on that computer, run the client configuration tool with the AD utility.

   For example, on a Windows 7 computer:

   "C:\Users\<user name>\Local Settings\Application Data\Checkpoint\UserCheck\UserCheck.exe" -adtool

   The Check Point UserCheck - Distributed Configuration tool opens.

2. In the Welcome page, enter the credentials of an AD administrator.

   By default, your AD username is shown. If you do not have administrator permissions, click Change user and enter administrator credentials.

3. In the Server Configuration page, click Add.

   The Identity Server Configuration window opens.

4. Select Default and then click Add.
5. Enter the IP address or Fully Qualified Domain Name (FQDN) and the port of the Security Gateway.
6. Click OK.

   The identity of the AD Server for the UserCheck client is written in the Active Directory and given to all clients.

Server Configuration Rules

If you use the Distributed Configuration tool and you configure the client to Automatically discover the server, the client fetches the rule lists. Each time it must connect to a server, it tries to match itself against a rule, from top to bottom.

When the tool matches a rule, it uses the servers shown in the rule, according to the priority specified.

The configuration in this example means:

1. If the user is coming from ‘192.168.0.1 – 192.168.0.255’, then try to connect to US-GW1. If it is not available, try BAK-GS2 (it is only used if US-GW1 is not available, as its priority is higher).
2. If the user is connected from the Active Directory site ‘UK-SITE’, connect either to UK-GW1 or UK-GW2 (choose between them randomly, as they both have the same priority). If both of them are not available, connect to BAK-GS2.
3. If rules 1 and 2 do not apply, connect to BAK-GS2 (the default rule is always matched when it is encountered).

Use the Add, Edit and Remove buttons to change the server connectivity rules.

Trusted Gateways

The Trusted Gateways window shows the list of servers that are trusted - no messages open when users connect to them.

You can add, edit or delete a server. If you have connectivity to the server, you can get the name and fingerprint. Enter its IP address and click Fetch Fingerprint in the Server Trust Configuration window. If you do not have connectivity to the server, enter the same name and fingerprint that is shown when you connect to that server.

DNS Based Configuration

If you configure the client to Automatic Discovery (the default), it looks for a server by issuing a DNS SRV query for the address of the gateway (the DNS suffix is added automatically). You can configure the address in your DNS server.

To configure DNS based configuration on the DNS server:

1. Go to Start > All Programs > Administrative Tools > DNS.
2. Go to Forward lookup zones and select the applicable domain.
3. Go to the _tcp subdomain.
4. Right click and select Other new record.
5. Select Service Location, Create Record.
6. In the Service field, enter CHECKPOINT_DLP.
7. Set the Port number to 443.
8. In Host offering this server, enter the IP address of the Security Gateway.
9. Click OK.

To configure Load Sharing for the Security Gateway, create multiple SRV records with the same priority.

To configure High Availability, create multiple SRV records with different priorities.

Troubleshooting DNS Based Configuration

To troubleshoot issues in DNS based configuration, you can see the SRV records that are stored on the DNS server.

To see SRV records on the DNS server:

Run:

C:\> nslookup
> set type=srv
> checkpoint_dlp._tcp

The result is:

> 

Remote Registry

If you have a way to deploy registry entries to your client computers, for example, Active Directory or GPO updates, you can deploy the Security Gateway addresses and trust parameters before you install the clients. Clients can then use the deployed settings immediately after installation.

To configure the remote registry option:

1. Install the client on one of your computers. The agent installs itself in the user directory, and saves its configuration to HKEY_CURRENT_USER.
2. Connect manually to all of the servers that are configured, verify their fingerprints, and click Trust on the fingerprint verification dialog box.
3. Configure the client to manually connect to the requested servers (use the Settings window).
4. Export these registry keys (from HKEY_CURRENT_USER):
   1. SOFTWARE\CheckPoint\UserCheck\TrustedGateways (the entire tree)
   2. SOFTWARE\CheckPoint\UserCheck\
      1. DefaultGateway
      2. DefaultGatewayEnabled
5. Import the exported keys to the endpoint computers before you install the UserCheck client.

Getting the MSI File

To get the MSI file:

1. In SmartConsole, in the Gateways & Servers view, open the General Properties window of the gateway object.
2. From the navigation tree, select UserCheck.
3. In the UserCheck Client section, click Download Client.

   Important - Before you can download the client msi file, the UserCheck portal must be up. The portal is up only after a Policy installation.

Distributing and Connecting Clients

After configuring the clients to connect to the gateway, install the clients on the user machines. You can use any method of MSI or EXE mass deployment and installation that you choose. For example, you can send users an email with a link to install the client. When a user clicks the link, the MSI file automatically installs the client on the computer.

Alternatively, users can download the installation package from the regular DLP UserCheck notifications.

To install the client for all user accounts on a Windows computer, see sk96107.

The installation is silent and generally, no reboot is required.

When the client is first installed, the tray icon indicates that it is not connected. When the client connects to the gateway, the tray icon shows that the client is active.

The first time that the client connects to the gateway, it asks for verification from the user and approval of the fingerprint.

Best Practices:

• Let the users know this will happen.
• Use a server certificate that is trusted by the certificate authority installed on users' computers. Then users do not see a message that says: Issued by unknown certificate authority.

If UserCheck for DLP is enabled on the gateway, users are required to enter their username and password after the client installs.

Example of message to users about the UserCheck client installation (for DLP):

Dear Users,

Our company has implemented a Data Loss Prevention automation to protect our confidential data from unintentional leakage. Soon you will be asked to verify the connection between a small client that we will install on your computer and the computer that will send you notifications.

This client will pop up notifications if you try to send a message that contains protected data. It might let you to send the data anyway, if you are sure that it does not violate our data-security guidelines.

When the client is installed, you will see a window that asks if you trust the DLP server. Check that the server is SERVER NAME and then click Trust.

In the next window, enter your username and password, and then click OK.

UserCheck and Check Point Password Authentication

You can see and edit Check Point users from Users and Administrators in the navigation tree.

To enable Check Point password authentication:

SmartConsole Configuration

1. Open SmartConsole and open the Manage & Settings view.
2. Click Permissions & Administrators > Administrators, and select an existing user or create a new user.
3. In the General Properties page of the user, make sure that an email address is defined.
4. In the Authentication Properties page of the user, set Authentication Scheme to Check Point Password and enter the password and password confirmation.
5. Click OK.

UserCheck Client Configuration

Ask your users to configure their UserCheck client:

1. On the UserCheck client computer, right click the UserCheck icon in the Notification Area (next to the system clock).
2. Select Settings.
3. Click Advanced.
4. Select Authentication with Check Point user accounts defined internally in SmartConsole.

Helping Users

If users require assistance to troubleshoot issues with the UserCheck client, you can ask them to send you the logs.

To configure the client to generate logs:

1. Right-click the UserCheck tray icon and select Settings.

   The Settings window opens.

2. Click Log to and browse to a pathname where the logs are saved.
3. Click OK.

To send UserCheck logs from the client:

1. Right-click the UserCheck tray icon and select Status.

   The Status window opens.

2. Click Advanced and then click the Collect information for technical support link.

   The default email client opens, with an archive of the collected logs attached.