KB44938 - Host Checker fails for some security solutions through Browsers but succeeds with Pulse Desktop Client.

This article describes the reasons why for some security products Host Checker fails when using Browser. 

Host Checker is a functionality provided by Ivanti Pulse Secure to perform security checks such as Anti-Virus, Process, OS, Encryption etc., to make sure the end points meet the security policies configured on PCS/PPS.

In some cases, it is observed that Host Checker fails on Windows/macOS endpoints for some security solutions when used via browsers but works just fine when used with the Pulse Desktop Client.

Note -> In some security solutions, this problem may show up in the later versions.

This is due to the security solution such as Anti-Viruses needing Admin privileges to function. 
When it comes to browser, even if the logged in user is Admin, the Pulse Components are run without elevation.

To figure out if you are impacted by this issue, please follow the steps below,

1.    Check if the security Product and its version being used are supported (Software & Technical Documentation | Ivanti Product Documentation-> Pulse Secure ESAP -> (Version Used) ESAP List of Products Supported for OPSWAT v4 SDK
2.    If this specific product/version is not supported, please raise a case to request its support.
3.    If it is supported, then the Pulse client log would show entries similar to the one below with which you can confirm that you are impacted. 

Note: The Required Admin Privilege column in the ESAP List of Products Supported for OPSWAT v4 SDK also clearly mentions if Admin Privilege is required for the security solution in question. 

00519,09 2021/07/01 14:36:24.952 3 User123 dsHostChecker.exe OpswatIMC p24084 t27EC OpsAntiVirusClientV4.cpp:279 - 'OpswatImcColData' Result of Antivirus data to monitor(Successfully called: CheckRTPState : Time Taken:3.0948, Call failed: GetDataFileDetails : Time Taken:30.0927 : Error Code: : Error Desc : WAAPI_ERROR_ACCESS_DENIED, Call failed: GetDataFileSignatures : Error Desc : Not supported, Call failed: IsUpdateInProgress : Error Desc : Not supported, Successfully called: IsFullScanInProgress : Time Taken:89.065, )

PulseClient log location:

1.    If Pulse client is installed: C:\ProgramData\Pulse Secure\Logging\PulseClient
2.    If Pulse client is not installed: C:\Users\Profile\AppData\Local\Pulse Secure\Logging

This is Working as Designed.

Workaround – Please use Pulse Desktop Client as it is installed in the system context.