Resolving Posture Check Failures
Posture checks help ensure that your device meets your organization’s security requirements before it can connect to a protected location. In addition to verifying your user account, Defguard may check device properties such as the operating system version, disk encryption status, antivirus status, system integrity, security update age, or Defguard client version. If your device does not meet the required posture policy, the connection will be blocked and Defguard will show which checks failed so you can resolve them or contact your administrator for help.

When a posture check fails, the device does not meet one or more requirements defined for the location it is trying to access. This section explains how to identify the failing checks, understand what they mean, and resolve the most common issues so the device can connect successfully.
operating system is not allowed
The posture check has no rule for the device’s operating system. For example, the policy defines Windows and macOS only, but the device is Linux.
Fix: Contact your administrator.
client version is too old
client version is too oldThe Defguard client version is below the minimum version required by the posture check.
Fix: Update your Defguard client to the latest version.
pre-release client versions are not allowed
pre-release client versions are not allowedThe device is using a pre-release Defguard client version, but the posture check does not allow pre-release clients.
Fix: Update your Defguard client to the latest full version.
OS version is too old
OS version is too oldThe device OS version is below the minimum configured for that operating system. Applies to Windows, macOS, iOS, and Android OS version rules.
Fix: Upgrade your operating system / contact your administrator.
kernel version is too old
kernel version is too oldThe Linux kernel version is below the minimum configured kernel version.
Fix: Upgrade your system/kernel to the latest stable version.
disk encryption is required
disk encryption is requiredDisk encryption is required by the posture check, but the device reported that disk encryption is not enabled.
Windows
On windows disk encryption can be turned on by enabling BitLocker. Find the "Manage BitLocker" item in menu start:

Then click the "Turn on BitLocker" option:

Once you complete the BitLocker wizard, your device should be ready to connect to Defguard.
Linux
On Linux, disk encryption is most commonly implemented using LUKS/dm-crypt for full-disk or volume encryption, often together with LVM for managing encrypted volumes. Setting up encrypted Linux storage is outside the scope of this documentation, so refer to the official documentation for your distribution:
antivirus is required
antivirus is requiredAntivirus is required by the posture check, but the device reported that antivirus is not present or active.
Fix: Enable windows real-time protection or install a 3rd party antivirus software.
Find the "Virus & threat protection" item in Menu Start:

Click "Manage settings" below "Virus & threat protection settings" section:

Turn on the "Real-time protection":

Active Directory domain join is required
Active Directory domain join is requiredThe posture check requires Windows Active Directory domain membership, but the device is not joined to an Active Directory domain.
Fix: Join active directory.
To join a Windows device to Active Directory you'll need Windows Pro,
Enterprise or Education. Windows Home cannot join an AD domain.
First set the DNS to your domain controller or AD DNS server.
Go to Settings -> Network & internet
Click "Edit" next to "DNS server assignment".

Select "Manual" DNS setting
Enable "IPv4" (IPv6 if you want to configure IPv6)
Type in the IP address of your AD DNS server into "Preferred DNS" input.
Save

Configure the domain
Settings -> System -> About -> Domain or workgroup
Click "Change" next to "Rename this computer or change its domain or workgroup"

Enter the domain and configure credentials:

Once the domain is configured, you should be able to connect to Defguard.
last Windows security update is X days old
last Windows security update is X days oldThe Windows device has not received a security update within the maximum allowed age configured in the posture check.
Fix: Update your system.
device integrity check failed
device integrity check failedDevice integrity is required, but the device did not pass the integrity check. This applies to supported platforms such as macOS and Android.
MacOS
Restart your computer in Recovery mode.
Launch Terminal from the Utilities menu.
Run the command
csrutil enable.Restart your computer.
posture data is missing
posture data is missingThe client did not send any posture data. This usually means the client does not support posture checks or failed to collect/send the posture payload.
Fix: Update your Defguard client to the latest version.
Last updated
Was this helpful?