Before You Configure Smart Card Authentication; Smart Card Scenarios; Scenario 1: Moving From Password To Smart Card - Check Point HARMONY R81 Administration Manual

Before You Configure Smart Card
Authentication
Make sure the environment is set up correctly to use Smart Card authentication before you
configure it.
To use Smart Card authentication, you must have these components and requirements:
n Smart Card authentication is only supported on Endpoint Security clients of version
E80.30 or higher. Make sure all users have a supported version.
You can see which versions users have in the Endpoint Security Management Console
> Monitoring tab > Versions in Use.
n Users must have the physical Smart Card in their possession.
n Users' computers must have a Smart Card reader driver and token driver installed for
their specific Smart Card. Install these drivers as part of the global Pre-boot
Authentication Settings.
n Each user must have a certificate that is active for the Smart Card.
The Directory Scanner can scan user certificates from the Active Directory.
l
Configure this in the global Pre-boot Authentication Settings.
You can manually import a certificate for a user in User Details > Security Blades
l
> OneCheck User Settings.
n In a Full Disk Encryption Policy rule, open the Authenticate user before OS loads
action. Click on Advanced Pre-boot Settings and make sure that Enable USB devices
in pre-boot environment is selected.

Smart Card Scenarios

Below are scenarios of how to implement Smart Card authentication in organizations with
different needs.

Scenario 1: Moving from Password to Smart Card

Scenario
Your organization uses Check Point Endpoint Security with username and password
authentication for Full Disk Encryption Pre-boot. You want to move all users to Smart Card
authentication for even greater security. Your organization uses Active Directory.

Before You Configure Smart Card Authentication

R81 Harmony Endpoint Server Administration Guide | 241