Release Notes DriveLock SE

Transcription

1

2 Release Notes Table of Contents Introduction 3 Document Conventions 3 Part II Supported Platforms 4 Part III Version History 6 1 DriveLock DriveLock DriveLock DriveLock Known Issues 9 1 DriveLock ios and itunes 9 2 Windows Portable Devices (WPD) 10 3 Installation of Management Components Using Group Policy 10 4 DriveLock Agent Remote Control 10 5 Automatic Updates and Application Launch Filter 10 6 Manual Updates 10 7 DriveLock Disk Protection 10 8 DriveLock File Protection and Microsoft OneDrive 12 9 Antivirus 12 Part I 1 Part IV Part V DriveLock Documentation 12 Part VI Test Installation and Upgrade 12 1 DriveLock Evaluation 12 2 Updating DriveLock Components 13 General Issues Important Changes Automatic Updates DriveLock <= V7.2 Automatic Updates for Windows XP Updating DriveLock Disk Protection

3 Introduction 1 Introduction This document contains important information about the new version of DriveLock and changes from previous DriveLock versions. The DriveLock Release Notes also describes changes and additions to DriveLock that were made after the documentation was completed. For more information visit our website Document Conventions Throughout this document the following conventions and symbols are used to emphasize important points that you should read carefully, or menus, items or buttons that you need to click or select. Caution: This format means that you should be careful to avoid unwanted results, such as potential damage to operating system functionality or loss of data Hint: Useful additional information that might help you save time. Italics represent fields, menu commands, and cross-references. Bold type represents a button that you need to click. A fied-width typeface represents messages or commands typed at a command prompt. A plus sign between two keyboard keys means that you must press those keys at the same time. For eample, ALT+R means that you must hold down the ALT key while you press R. A comma between two or more keys means that you must press them consecutively. For eample ALT, R, U means that you must first press the Alt key, then the R key, and finally the U key. 3

4 Introduction 2 Supported Platforms System Requirements Memory Hard Disk.Net Framework MB +10 MB 50 MB 200 MB 2 GB 350 MB +30 MB 120 MB 120 MB 4 GB XP* W7 SP1 W8.1 W10 Agent Device Control Application Control Encryption2Go File Protection* Disk Protection* Management Console Control Center* Enterprise Server Windows* Server DriveLock 2008 SP2 2008R2 SP R Agent Management Console Control Center Enterprise Server IGEL UDLX WYSE Linu V6 XenApp 6.0 XenApp 6.5* 2008R2 SP R2 DriveLock Agent + Disk Protection* Management Console Control Center* Enterprise Server Windows* / OS X DriveLock DriveLock Virtual Channel ICA RDP OS X Embedded Windows* DriveLock Thin-Client Support ICA (Citri) RDP (Windows TS) 4 XenApp / XenDesktop 7.X 2016

5 Supported Platforms Database Support Microsoft SQL Server* Oracle Database Note *Windows 2008 SP4 2008R2 SP SP SP SP Intel X86 Based (86_32, 86_64, AMD64) Windows 10 is tested and released with the most current version available at release day. DriveLock Disk Protection is not (yet) released for Windows 10 version 1709 (see Known Issues). Windows 7 and 8.1 is tested and released with the most current service pack available at release day. Windows Vista and Windows 8 will no longer be tested with DriveLock 7.6 and newer *Windows XP *Microsoft SQL Epress An additional license for support of legacy OS is required! The functionality of the modules released for Windows XP is restricted to Device Control and Application Control. For installations up to 200 clients *File Protection *Disk Protection Citri Terminal Servers are not supported UEFI and GPT Partitioning is supported with hardisk up to ma. 2 TB for Windows 8 64 bit or newer and UEFI version V2.3.1 or newer. For UEFI on Windows 10 version 1703 Update KB is required. *Control Center For remote connections: Internet Eplorer 11 or newer *Windows Embedded The DriveLock Virtual Channel and DriveLock Agent must not be installed on the same client *XenApp XenApp 6.5 Hotfi Roll Up 4 or newer 5

6 Supported Platforms 3 Version History Even numbered versions are official releases available to all customers, while odd numbered versions are internal or customer specific releases. Only official releases are listed in the version history. 3.1 DriveLock DriveLock is a maintenance release Feature improvements: A computer can be locked after a temporary unlock, when the user logs off A computer can be manually locked by an user, after unlocked temporarily, using the taskbar notification icon contet menu A user notification message can be enabled, informing an user to reconnect an android smart-phone after connecting this device the very first time Application control special rules can now only be configured as whitelist rules Major fies for these issues: DCC could crash when computers are unlocked temporarily using the helpdesk Some known smart-phone devices are deactivated in the device manager, even if they previously have been whitelisted Spectre/Meltdown Windows Update Microsoft published statements that end users need to make sure that their anti-virus (AV) software is up to date and compatible to the fi Microsoft provided in response to the recently disclosed processor vulnerabilities, named Spectre and Meltdown : DriveLock is released and tested with the anti-virus solutions of Cyren and Avira. There are several ways how to update your Cyren or Avira AV solution, so that the Microsoft fi for Spectre and Meltdown can be installed afterward: 1. Update your DriveLock installation to version This version will have a new Cyren and Avira Engine included, which have been tested against the Microsoft fi by both AV-vendors and which will set the appropriate registry value required for the Microsoft fi. If you use DriveLock with Cyren AV, you must update to DriveLock Version If you use DriveLock with Avira, you can also keep your current DriveLock version (7.6.20, or 7.7.8). Your DES Server can download the current Avira AV version from the DriveLock cloud server automatically. Customers, who have the download of new packages from the DriveLock cloud enabled, will already have the current Avira AV Version ( ) 3. If your DES Server is not connected to the Internet, you can use the DriveLock ISO image to get the current Avira AV version and install the Avira package manually, at your DES Server. 3.2 DriveLock DriveLock is a feature release New features: 6

7 Version History Predictive Application Control with machine learning locks down individual computers during an initialization process and keep them secured when software is updated, requiring minimal configuration and resources. Predictive Application Control will be available as new module (DriveLock Smart AppGuard) with separate licensing. o Initial sealing of complete system (machine learning) with local whitelist database o To add updated/new applications to local whitelist database, two options are available: Trusted installer with machine learning During temporary unlock time frame using self-service groups o Application control for DLL files Predictive whitelisting of devices: Eisting devices can be added to a local whitelist database. New devices connected later on will be blocked automatically and users can allow them to be eecuted by confirming a usage policy. Predictive Device Control will also be included in the new module "DriveLock Smart AppGuard". o Machine learning for devices during installation of DriveLock o Only currently attached devices are whitelisted o Used to easily enable known devices while blocking unknown devices connected later on (advanced BadUSB protection) Additional feature for eisting application control: o Administrators can configure applications (identified by whitelist rule, special rule) to be eecuted, after user has manually approved them o User can approve whitelisted applications to be eecuted once or until net reboot Use self-service groups to allow users to unlock devices or applications temporarily by themselves: o Simplified UI to unlock devices or applications o Configure allowed time frame and what can be unlocked precisely o Add users to self-service groups manually or by assigning organization units o Unlock groups of computers o Enable/disable machine learning capabilities during temporary unlock time frame Shadow copies and their meta-data can be encrypted Usage policy are available also for devices Temporarily unlock assistant can be configured Use customer provided computer names in DES, events and help desk AD-Inventory information loading can be manually triggered and uploaded to DES Maimum size of encrypted container can be configured also for enforced encryption Major Fies for these issues: USB device is recognized only once when connected manually Updating DriveLock with DLSetup shows First Start Wizard Eternal fied disks cannot be accessed if enforced encryption is configured 7

8 Version History Apple devices recognized with different IDs Basic rule applied although higher prioritized device rule is present Recovery wizard is not starting during container recovery procedure with DLMobile.ee Installation of FDE and Cyren simultaneously might crash Win732 systems DLDevFlt is not running after Windows upgrade has been installed 3.3 DriveLock DriveLock is a feature release New features: Download of Antivirus Definitions: The DriveLock Enterprise Service (DES) and the Linked DriveLock Enterprise Service (LDES) both can download the Antivirus Definitions directly and incrementally from the DriveLock Cloud. Then they can distribute them to their connected DriveLock Agents. This improves scenarios where branch offices don't have a performant network connection in-between their locations. The DES and the LDES also can download the definitions from another DES/LDES servers. This can be used for eample if the DES has no direct internet connection. The LDES then can be used as proy placed in the DMZ. High performance improvements if large event reports are shown: The event database has been restructured to be able to create large and/or comple event reports much faster. As soon as the new DES is running all new events (also from Agents older than DriveLock 7.7) are stored in the new format. Eisting events are converted to the new structure in the background. Depending on the capacity of the database server this may have minor impact on the database performance. As soon as the conversion has completed the full performance improvement is achieved. Oracle Database: DriveLock no longer requires an Oracle System account to setup new table spaces (e.g. for new tenants). Now the Oracle administrator has to create the users and table spaces in advance. DriveLock will create the database scheme using the DriveLock database account. With the Intel Skylake Architecture Intel stopped the native USB 2.0 support in the legacy BIOS. DriveLock Disk Protection V7.7 for BIOS (32-bit PBA) now supports native USB 3.0. In principle all CCID conform smart card readers work also in the PBA for UEFI. The OMNIKEY USB 3121/3122 USB Card Reader has been eplicitly tested. Smartcards Gemalto IDPrime MD 3810 and IDPrime MD 830/831 are supported in both PBA for BIOS (32-bit PBA) and PBA for UEFI SafeNet etoken NG-OPT (CardOS), SafeNet etoken NG-OPT 72k/Java, SafeNet etoken 5105, SafeNet etoken 5110 are supported in both PBA for BIOS (32-bit PBA) and PBA for UEFI The help view is available in the UEFI PBA too. Additionally a policy can be opened in read only mode if another admin is editing it at the same time. Older versions of centrally stored policies can be deleted from the history. Additionally to License is not configured in this policy an option for the Antivirus (Avira or Cyren) module to be configured can be set. In section Entities in the DriveLock Control Center there is a license report to show the number of computers, the total number of users and the number of terminal service users, who used a DriveLock license per month. Major Fies: 8

9 Version History DriveLock includes all fies and improvements of release DriveLock DriveLock DriveLock is a maintenance release. Major improvements: Windows 10 Version 1703 is supported (DriveLock Disk Protection for UEFI requires Windows Update KB to be installed, see chapter Known Issues regarding Disk Protection for UEFI). DriveLock Disk Protection is prepared to upgrade Windows 10 to Windows 10 Version 1607 (Anniversary Update) or Version 1703 (Creators Update) if the system disk is encrypted. To do the Windows 10 upgrade a special Windows 10 setup will be required which includes the DriveLock encryption driver. A guide and a tool to create this special Windows 10 Setup can be downloaded from the DriveLock Self-Service Center / Release Notes & Releases. In some cases, the Windows 10 Version 1703 upgrade removed some DriveLock filter drivers. DriveLock now checks and repairs the DriveLock installed drivers when started. Device Control includes temporarily unlock for Windows Portable Devices. Application Control supports SHA256 code signing certificates. Includes Avira Antivirus Major Fies: If the DriveLock Enterprise Service (DES) was installed on Windows Server 2016 HTTPS communication between the DriveLock Agent and the DES did not work if some client PCs tried to fall back to SSL 3.0. Now SSL 3.0 is no longer supported. TLS 1.0 is mandatory on all supported platforms. Therefore the DES must be updated to before updating the Agents. Important: For security reasons it is strongly recommended to update the DES to or newer in any case, also if the Agents will be updated later. In some cases after DriveLock has been updated, Full Disk encryption did not install or update until the deployment settings has been committed again and the policy has been published. 4 Known Issues This chapter contains known issues for this version of DriveLock. Familiarize yourself with the information in this chapter to avoid unnecessary effort during testing and deployment. 4.1 DriveLock ios and itunes DriveLock recognizes and controls current generation Apple devices (ipod, iphone, ipad, ipod Nano, etc.) For older Apple devices that are only recognized as USB drives no granular control of data transfers is available. DriveLock and itunes use similar multicast DNS responders for automatic device discovery in networks. When installing both DriveLock and itunes the installation order is important: If DriveLock has not been installed yet you can install itunes at any time. DriveLock can be installed at any later time without any special considerations. If DriveLock is already installed on a computer and you later install itunes you have to run the following command on the computer before you start the itunes installation: drivelock -stopdnssd. Without this step the itunes installation will fail. 9

10 Known Issues After an update of the ios operating system on a device, itunes will automatically start a full synchronization between the computer and the device. This synchronization will fail if DriveLock is configured to block any of the data being synchronized (photos, music, etc.). 4.2 Windows Portable Devices (WPD) Locking Portable devices prevented, that some Windows Mobile Devices could be synchronized via "Windows Mobile Device Center", although the special device was released in a whitelist. The reason was, that Windows Vista and higher used a new "User Mode Driver Framework" for these types of devices, which - caused by malfunctions could not be influenced by DriveLock. The synchronization did only work, if the device class was temporarily or in general released (not controlled be DriveLock). A new DriveLock driver managing portable devices the same way as other drives could not be released in earlier versions caused by the malfunctions. Now, for Windows 7, for Windows 8.1 by hotfi KB and for Windows 10 Version 1511 Microsoft corrected the malfunction. For Windows 8 and earlier versions of Windows 10 there is no fi available. With DriveLock and the DriveLock WPD driver is active on Windows 7 and Windows 8.1 but is inactive for Windows 8 and Windows 10. With DriveLock and the DriveLock WPD driver is active on Windows 10 Version 1511 too. Whitelisting for Windows Portable Devices will work only, if the DriveLock WPD driver is activated. Shadow copies are not yet supported for WPDs. 4.3 Installation of Management Components Using Group Policy Installing the DriveLock Management Console or the DriveLock Control Center by using Group Policy is not possible. Instead, use the DriveLock Installer to install these components as described in the Installation Guide. 4.4 DriveLock Agent Remote Control In DriveLock 7 the maimum number of Agents that can be displayed in the DriveLock Management Console for remote control is 500. To view a larger number of Agents, use the DriveLock Control Center instead to perform remote management tasks. 4.5 Automatic Updates and Application Launch Filter If the Application Launch Filter is configured for whitelist mode and a rule with the setting Allow automatic updates eists, updates may not install properly under certain conditions. As a workaround, create application rules for updates that don t use the program update.ee. 4.6 Manual Updates If other policy deployment than GPO is used, on Windows 8 and higher, a manual update of the DriveLock Agent will not finish properly, if you start the DriveLock Agent.msi from the Windows Eplorer (e.g. by double clicking). Run the MSI from an administrative command window with msieec or use DLSetup.ee. 4.7 DriveLock Disk Protection Antivirus protection software may cause the DriveLock Disk Protection installation to fail if the antivirus software quarantines files in the C:\SECURDSK folder. If this occurs please disable your antivirus protection for the duration 10

11 Known Issues of the Disk Protection installation and re-enable it after the installation is completed. We recommend that you configure your virus scanner with an eception for the C:\SECURDSK folder. When Installing DriveLock Disk Protection we strongly recommend that you deactivate the application control if they are active in the whitelist modus. This will prevent the blocking of programs that are necessary for the installation. On a small number of computer models the default DriveLock Disk Protection pre-boot environment configuration may not work correctly and cause the computer to become unresponsive. If this occurs turn off the computer and restart it while pressing the [Shift] key. When prompted select the option to use the 16-bit pre-boot operating environment. Hibernation will not work while a disk is encrypted or decrypted. After complete encryption or decryption windows has to be restarted once to make hibernate work again. UEFI mode Not all hardware vendors implement the complete UEFI functionality. We recommend not to use the UEFI mode with UEFI versions less than The full functionality of the Pre-Boot-Authentication (PBA) for UEFI is not yet available as for BIOS. Touchscreen is not supported. A hardware keyboard (USB or PS/2) is required. Mouse operation is not yet supported. Some PS/2 keyboards may work improperly. The PBA GUI is only available in English. Additional topics: Secure Boot must be deactivated up to version DriveLock and higher supports UEFI secure boot. Firmware updates may delete NVRAM values which are required by DriveLock. A 32 bit Windows operating system or 32 bit DriveLock cannot be installed on 64 bit capable hardware. Please use a 64 bit version of a Windows operating system and DriveLock instead. There is still a limitation to disks up to a maimum of 2 TB disk size. On some HP PCs Windows always will be set to position one again in the UEFI boot order and the DriveLock PBA has to be selected manually from the UEFI boot menu. In this case fast boot has to be switched off in UEFI to keep the DriveLock PBA at position one. Windows 10 Version 1703 (Creators Update) can remove the DriveLock boot entry from the UEFI boot menu while shutting down or when hibernating. Therefore the DriveLock PBA will no longer boot at the net startup and Windows cannot boot from the encrypted system hard disk. In August 2017 Microsoft released Update KB which resolves this issue. Update KB will be installed automatically by Windows or can be downloaded manually. Check if update KB or any later update that replaces KB is installed before you install DriveLock Disk Protection for UEFI. When upgrading to Windows 10 Version 1703 where DriveLock Disk Protection for UEFI is already installed, add update KB to the Creators Update before you upgrade. Windows 10 Version 1709 (Fall Creators Update) - the fi from KB has not been taken to Windows 10 Version 1709 by Microsoft. DriveLock Disk Protection is not (yet) released for Windows 10 Version

12 Known Issues 4.8 DriveLock File Protection and Microsoft OneDrive With Microsoft OneDrive, Microsoft Office may synchronize directly with OneDrive instead of writing the file to the local folder first. Then the DriveLock encryption driver is not involved and the Office files will not be encrypted in the Cloud. To switch off the Office synchronization, uncheck Use Office 2016 to sync Office files that I open or similar settings in OneDrive. It must be assured, that Office files as other files always are stored locally. 4.9 Antivirus Avira Antivirus In the Windows Taskbar there may be shown two Avira icons. One of them comes from Avira Connect aka Avira Launcher which is not part of DriveLock with Avira Antivirus. 5 DriveLock Documentation The DriveLock Documentation consists of the following manuals: DriveLock QuickStart Guide The QuickStart Guide describes the required steps to setup DriveLock using the DriveLock QuickStart setup wizard.the DriveLock QuickStart setup wizard can be used to simplify the installation and configuration of a basic DriveLock environment. DriveLock Installation Guide The Installation Guide describes the available installation packages, the system requirements and the steps for installing each DriveLock component. This is the first document a DriveLock administrator should read. DriveLock Administration Guide The Administration Guide describes the DriveLock architecture and components. It contains detailed instructions for configuring DriveLock using the DriveLock Management Console. This document is intended for DriveLock administrators who need to become familiar with all available DriveLock functionality. DriveLock Control Center User Guide This manual describes how to configure and use the DriveLock Control Center. This document is intended for administrators and users who will use DriveLock Control Center for reporting and forensic analysis. DriveLock User Guide The DriveLock User Guide is aimed at end users. It describes how to request the temporary unlocking of a computer, how to use DriveLock Encryption 2-Go and how to use Network Profiles. 6 Test Installation and Upgrade 6.1 DriveLock Evaluation You can install the DriveLock - the Agent, the Management Console, the Control Center, the Enterprise Service and Microsoft SQL Epress - on the same computer. This topology makes it easy to evaluate DriveLock s central reporting features using minimal hardware. If you downloaded the DriveLock software from the Web site ( a 30-day trial license is included. To evaluate DriveLock on a single computer, you don t need to perform any license configuration. 12

13 Test Installation and Upgrade If you install the DriveLock Agent on multiple client computers and configure DriveLock settings using Microsoft Group Policy, a Centrally Stored Policy or a configuration file or if you want to tests the Disk Protection too, you have to add a license key to the configuration. You can use the evaluation license key that is installed with DriveLock Management Console (by default, C:\Program Files\CenterTools\DriveLock MMC\Tools\AgentTrial.lic). 6.2 Updating DriveLock Components General Issues The DriveLock Installation Manual describes all steps that are required to update DriveLock to the current version. In addition, the Release Notes contain some important point to consider when performing an update Important Changes The DriveLock Management Console and the DriveLock Control Center are now installed in separate directories. This will prevent installation issues on computers when auto updating these components. The DriveLock Control Center uses some of the components of the DriveLock Management Console for the remote control functions. Always install identical versions of both Automatic Updates DriveLock <= V7.2 Before starting an automatic update from DriveLock <= 7.2, select the following two compatibility options for CDROM drives: 13

14 Test Installation and Upgrade Ensure that all Agents have applied this configuration change before publishing a new version of the DriveLock Agent. If you fail to apply this change, certain CD/DVD drivers may cause the computer to crash during an automatic update Automatic Updates for Windows XP Windows XP is not supported with DriveLock 7.5 to DriveLock As soon as DriveLock 7.5 or newer installation packages are published on the DriveLock Enterprise Service, the old (all DriveLock versions less than ) DriveLock Agent would download the DriveLock 7.5 installation package and start it, again and again, but would never succeed. Thus the automatic update must be switched off for Windows XP running DriveLock versions less than in this case With DriveLock installed on XP the update service will not download and start any installation package, if DriveLock 7.5 or newer installation packages are published. Thus the automatic update to V7.5 may be switched on and be used for the non XP platforms. Updates form DriveLock 7.3 to DriveLock 7.7 are not supported Updating DriveLock Disk Protection After the DriveLock Agent has been updated, an eisting DriveLock FDE installation will be updated automatically and without re-encryption to the most current version. After updating the FDE components, a reboot may be required. 14

15 Release Notes Die in diesen Unterlagen enthaltenen Angaben und Daten, einschließlich URLs und anderen Verweisen auf Internetwebsites, können ohne vorherige Ankündigung geändert werden. Die in den Beispielen verwendeten Firmen, Organisationen, Produkte, Personen und Ereignisse sind frei erfunden. Jede Ähnlichkeit mit bestehenden Firmen, Organisationen, Produkten, Personen oder Ereignissen ist rein zufällig. Die Verantwortung für die Beachtung aller geltenden Urheberrechte liegt allein beim Benutzer. Unabhängig von der Anwendbarkeit der entsprechenden Urheberrechtsgesetze darf ohne ausdrückliche schriftliche Erlaubnis der DriveLock SE kein Teil dieser Unterlagen für irgendwelche Zwecke vervielfältigt oder übertragen werden, unabhängig davon, auf welche Art und Weise oder mit welchen Mitteln, elektronisch oder mechanisch, dies geschieht. Es ist möglich, dass DriveLock SE Rechte an Patenten bzw. angemeldeten Patenten, an Marken, Urheberrechten oder sonstigem geistigen Eigentum besitzt, die sich auf den fachlichen Inhalt dieses Dokuments beziehen. Das Bereitstellen dieses Dokuments gibt Ihnen jedoch keinen Anspruch auf diese Patente, Marken, Urheberrechte oder auf sonstiges geistiges Eigentum, es sei denn, dies wird ausdrücklich in den schriftlichen Lizenzverträgen von DriveLock SE eingeräumt. Weitere in diesem Dokument aufgeführte tatsächliche Produktund Firmennamen können geschützte Marken ihrer jeweiligen Inhaber sein. Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the eample companies, organizations, products, domain names, addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. DriveLock and others are either registered trademarks or trademarks of DriveLock SE or its subsidiaries in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.