Bitdefender Endpoint Security for Mac uses macOS system extensions (also known as kernel extensions) to ensure protection cannot be tampered with and to provide Content Control and Device Control functionality.

Starting with macOS High Sierra (10.13), user approval is required for loading kernel extensions. Until the user approves the Bitdefender kernel extensions, Endpoint Security for Mac tamper protection, Content Control and Device Control modules will not work. Also, Endpoint Security for Mac user interface will show a critical issue.

Note:
The kernel extensions that were installed before upgrading to macOS High Sierra or that are replacing previously approved extensions do not require approval.

Issue

Immediately after a manual installation or remote deployment of Endpoint Security for Mac on macOS High Sierra (10.13), the operating system shows the System Extension Blocked warning:

If the user does not allow the Bitdefender system extensions to load, the Endpoint Security for Mac user interface shows the You are at risk warning:

Solution

When you receive the System Extension Blocked warning:

1. Click Open Security Preferences (if available). Alternatively, click OK, go to System Preferences in the Dock or in the Apple menu, then click Security & Privacy.
   
2. Click Allow for the blocked system software from Bitdefender.

Note: In some situations, the Allow button may be disabled: When you remotely access the computer. When a remote connection is open or was recently open. To enable the Allow button you may need to restart the computer. If you are using a third-party application to emulate mouse or trackpad, such as MagicPrefs, BetterTouchTool, Synergy. Close the application to enable the Allow button.

If you receive the notification You are at risk in the Endpoint Security for Mac user interface:

1. Click View Issues.
2. Click Fix now to open the Security & Privacy window.
   
3. Click Allow for the blocked system software from Bitdefender.

After allowing kernel extensions from Bitdefender, the Endpoint Security for Mac user interface will inform you that your Mac is safe.

Important: System administrators can use MDM to whitelist specific kernel extensions and thus suppress these warnings. For more details, please refer to these Apple resources: https://support.apple.com/en-us/HT208019 https://developer.apple.com/library/content/technotes/tn2459/_index.html System administrators can whitelist kernel extensions based on the Bitdefender Team ID: GUNFMW623Y. For details about using an MDM tool like Jamf Pro, refer to this article.

GravityZone console does not currently provide information about Mac endpoints with unapproved Bitdefender kernel extensions. It is recommended to disable Silent Mode to make sure users can view the issue if they ignore the system prompt.