GlobalProtect Machine account exists with device serial number config

[CHOE-KyungJun]

Dear Team,

I'm trying to set up GlobalProtect's 'Serial Number Check' feature, but I'm having a hard time.

GlobalProtect is already being used in conjunction with LDAP.

So, when I do not use the function, I log in normally.

I want to control by matching the serial number to the LDAP user.

Is it correct that the serial number mentioned here means the device ID of Windows/Mac?

And in the firewall, there seems to be nothing to set other than changing the function to 'yes'.

I tried entering the device ID in Serial Number among the LDAP properties, but it doesn't work.

If anyone has done the above setup or knows how to do it, please let me know.

Thank you

[SCantwell_IM]

In looking at the help for this section.

Machine account exists with device serial number

Configure matching criteria based on whether the endpoint serial number exists in the Active Directory.

I think it will be to tie to the device (not the user) to LDAP.
So I think GP can get confirmation that the device belongs in AD (as long as AD responds back).
I am not sure of the mechanism, but it is best to open a TAC case to get confirmation on the solution. 

[SCantwell_IM]

I read additional information that the Serial number check is used by the Cloud Identity Engine for registering endpoints.

If you are using GlobalProtect and you have enabled Serial Number Check, select the Endpoint Serial Number option to allow the Cloud Identity Engine to collect serial numbers from managed endpoints. This information is used by the GlobalProtect portal to check if the serial number exists in the directory for verification that the endpoint is managed by GlobalProtect.