Endpoint Security Client Full Disk Encryption 7.0 Revision Tracking

Transcription

1 Endpoint Security Client Full Disk Encryption 7.0 Revision Tracking Copyright Check Point Software Technologies, Ltd. All rights reserved This document contains information on changes and corrections implemented in previous versions Full Disk Encryption (FDE); these versions were named Pointsec for PC and (from version 6.2 and later) Pointsec PC. For new functionality, changes, corrections and the latest information on the current release, see the Endpoint Security Client R70 Release Notes. Contents Pointsec for PC New in Release Changes and Corrections in HFA Changes and Corrections in HFA Changes and Corrections in HFA Changes and Corrections in New in Pointsec PC Changes and Corrections in 6.2 HotFix Accumulator Changes and Corrections in 6.2 HF Changes and Corrections in 6.2 HF Changes and Corrections in New in Changes and Corrections in Hotfix Changes and Corrections in Hotfix Changes and Corrections in Hotfix Changes and Corrections in Hotfix Changes and Corrections in New in Changes and Corrections in Changes and Corrections in Changes and Corrections in New in Changes and Corrections in New in Changes and Corrections in New in Pointsec for PC Changes and Corrections in Changes and Corrections in Changes and Corrections in Changes and Corrections in New in Changes and Corrections in Changes and Corrections in New in

2 Changes and Corrections in Pointsec for PC 4.1 Releases...63 Changes and Corrections in 4.1 SR Changes and Corrections in 4.1 SR Changes and Corrections in 4.1 SR Changes and Corrections in 4.1 SR 2.17b New Functionality in 4.1 SR Changes and Corrections in 4.1 SR New Functionality in 4.1 SR Changes and Corrections in 4.1 SR 2.16FT New Functionality in 4.1 SR Changes and Corrections in 4.1 SR New Functionality in 4.1 SR Changes and Corrections in 4.1 SR Changes and Corrections Made in Release 4.1 SR Changes and Corrections Made in Release 4.1 SR Changes and Corrections Made in Release 4.1 SR Changes and Corrections Made in Release 4.1 SR Changes and Corrections Made in Release Changes and Corrections Made in Patch 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in Patch 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in Patch 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in Patch 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Correction in 4.0 SR 1 and SR Features Introduced in Pointsec Pointsec for PC 4.2 Releases...71 Changes and Corrections in 4.2 SR Changes and Corrections in 4.2 SR 1.7b New Functionality in 4.2 SR Changes and Corrections in 4.2 SR New Functionality in 4.2 SR Changes and Corrections in 4.2 SR 1.6FT New Functionality in 4.2 SR Changes and Corrections in 4.2 SR New Functionality in 4.2 SR Changes and Corrections in 4.2 SR 1.4 build Changes and Corrections in 4.2 SR

3 Changes and Corrections Made in Release 4.2 SR Changes and Corrections Made in Release 4.2 SR Changes and Corrections Made in Release 4.2 SR Changes and Corrections Made in Release 4.2 SR Changes and Corrections Made in Release 4.2 SR Changes and Corrections Made in Release 4.2 SR Changes and Corrections Made in Release Changes and Corrections Made in Patch 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in Patch 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in Patch 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in Patch 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Corrections Made in 4.0 SR Changes and Correction in 4.0 SR 1 and SR Features Introduced in Pointsec

4 Pointsec for PC 6 This section contains information on changes and corrections made in the previous releases of Pointsec for PC (called Pointsec PC from 6.2 onward). New in Release The following new functionality and enhancements are included in Pointsec PC : This Release Notes covers both the EW version and the MI version of Pointsec PC. The way Pointsec PC groups and user account groups inherit the values of settings has changed, and the way specified values, default values, and effective values work has also changed. See the Administrator s Guide for more information. How updates to the recovery file are triggered, and how Pointsec PC writes recovery files locally and to shares has changed. See the Administrator s Guide for more information. Changes and Corrections in HFA3 The following items were corrected in Pointsec PC HFA3: Token removal handling failed intermittently. Token removal handling was not consistent. When unplugging an Aladdin Etoken PRO 32K, the workstation was not locked if the etoken was ejected within less than a minute after its insertion HP Compaq 6910p blue screened intermittently in preboot Unable to tab the cursor to Show Log in the preboot environment Windows Logon User Interface Host crashed upon etoken PRO logon A "Missing" error was displayed in the single sign-on (SSO) dialog The slash special character (/) on the numeric keyboard did not work properly Characters were missing in the French keyboard in preboot. An unrecoverable error occurred intermittently in preboot on HP Compaq 6910p Notebook laptops. After passing preboot authentication, user was unable to tab to 'Show Logs'. An application error occurred, terminating Windows Logon User Interface Host when using PKI Client v4.55 for etoken PRO 32k and Aladdin etoken PRO 32K drivers. When choosing a language that is not a Legacy language and logging in with a user (SSO enabled) you would get a "Missing" error in the SSO dialog instead of the translated text. If you used de-de/sv-se in PBE and typed the a slash (/) on the numeric keyboard, you got a dash (-). If you enable NumLock, you got an underscore (_). Various characters were missing from the French keyboard layout in preboot, and the keys of the virtual keyboard were empty. 4

5 Caps Lock was not available with Japanese keyboard in PBA. When Japanese keyboard was specified in PBA, the user could not activate "Caps Lock" Removing a user failed to trigger the writing of a new recovery file Use of tab key in WebRH Challenge/Response not obvious AES algorithm was used instead of Blowfish Error issued when installing the MSRC.MSI or InstallRRU.msi before the Pointsec PC installation had completed Unable to change/set Windows XP welcome screen after Pointsec PC had been uninstalled License handling - Some Pointsec for PC 4.x license numbers were not accepted in 6.x upgrade profiles The Disable expire date checkbox did not work if the user account had expired Not possible to disable expire date from group level An expired account behaved inconsistently in Windows. Deleting a user would fail to trigger the writing of a new recovery file even though the user had been deleted from the machine. Some customers were confused by the use of the tab key during the challenge/response interaction when receiving remote help. The AES algorithm was used for encryption when Blowfish had been specified in a silent installation profile and an algorithm-specific license was used.. An error was issued if the MSRC.MSI or InstallRRU.msi files were installed before the Pointsec PC installation had completed with a restart of the computer after the Pointsec PC installation. After Pointsec PC was uninstalled, the error message was displayed while trying to change setting in : Control Panel -> User Accounts -> Change the way users log on or off] Error Message: A recently installed program has disabled the welcome screen and fast user switching. To restore these features, you must uninstall the program. The Following file name might help you identify the program that made the change: msgina.dll. Customers were prevented from using their Pointsec for PC 4x license numbers in upgrade profiles. Once a user account had expired, it was not possible to disable the expiration date by selecting the Disable expire date checkbox. It was not possible to remove the expiration date of a user account at the group level. This would have made it impossible to manage users created from temp users on the group level. If you provided remote help to an expired account, the account had access to Windows, but after Windows logon a dialog was displayed saying that the account has expired and the account was logged out of Windows after a couple of seconds or after several minutes. In addition, if you clicked OK on the Your account has expired dialog, you would still be able to logon to the machine to work for 5

6 several minutes (perhaps hours) before the dialog appeared again An old password was accepted after the first authentication PPBE did not respond immediately to space key input 'Set Temporary Lockout Time' became ' ' in a converted installation profile Slaving of a hard disk drive was allowed when the Allow Hard Drive To Be Slaved setting was set to No An update profile based on an installation profile was not imported The word "Credentials" was misspelled in the PCMC Unable to use the keyboard or mouse in PBE on an Acer TravelMate HP 6220 smart card reader not working SSO fails on Vista when using character in the Vista username The volume protection information was missing from an installation profile based on an update profile Centrallog.exe crashed intermittently. If case sensitivity was set to 'No' for a user group, and a new user account was created and the Force change of password at next logon box was selected, the password that was initially used could be used at the next logon. In the preboot authentication when entering a user account name that contains a space character, PPBE did not respond immediately to the space keystroke. It seemed as if nothing occurred. However, when you press another key, the stored space character was displayed. When installing Pointsec PC with a converted installation profile created in Pointsec PC 6.1.3, even though 'Set Temporary Lockout Time' was set to 'Disabled' in the original profile, the temporary lockout time was set to ' ' after conversion. A hard disk drive encrypted with Blowfish could be slaved on an AES-encrypted machine and accessed without the Allow Hard Drive To Be Slaved setting being set to Yes. An update profile based on an installation profile was not imported from the Work folder. No log entry was produced. The word "Credentials" was misspelled in the PCMC s Change credentials dialog. Customers were unable to use the keyboard or mouse in PBE when turning USB = ON in Pointsec PC. No options were available in the BIOS for USB legacy support. The smart card reader built into the HP 6220 did not work when either PCMCIA was enable or when it was disabled. SSO failed on Vista when using character in the Vista username. The operating system seemed to loop. The volume protection information was missing from an installation profile based on an update profile. If the profile was saved, no warning was displayed about volume protection not being set, and if this profile was used to install, it failed with the error: 'Disk Configuration not Supported'. The Centrallog.exe crashed intermittently, and the crash led to corruption of the database after the next reboot. 6

7 Windows Integrated Logon did not shut down the machine in a timely manner. Windows Integrated Logon did not shut down the machine in a timely manner: after a failed logon, the machine would hang if the message box was not acknowledged. Nor would it reboot immediately Problem booting from Bart PE An unhandled exception would occur when creating a new profile The encryption status text in Japanese was confusing when booting from a recovery disk An USBSTOR error, Event ID 6, was logged in the Windows event viewer (system log) every time a user inserted a USB memory stick The Windows event log settings could not be changed or saved due to missing registry entries. When using Bart s PE with a new filter driver for Pointsec PC and booting directly to the Bart disk, the machine would blue screen. An unhandled exception would occur when creating a new profile, immediately after configuring a new set and clicking Finish. The encryption status in Japanese was confusing when booting from a recovery disk. This was an error in the translation from the English. An USBSTOR error, Event ID 6, was logged in the Windows event viewer (system log) every time the user inserted a USB memory stick on a Pointsec PC-protected system. The Windows event log settings could not be changed or saved because all the registry entries that are required for the Windows event log to work properly were not created. N/A Deploying Pointsec PC 6.x with a software deployment tool that installs under the local machine s system context When deploying Pointsec PC 6.x with a software deployment tool that installs under the local machine s system context, a problem could occur when executing the CheckProfile custom action. The problem was specific to XP SP2 because certain changes to DCOM permissions were introduced with XP SP2. The problem was caused by an InstallShield InstallDriver account that was set to run as the interactive user rather than as the launching user. Changes and Corrections in HFA2 The following items were corrected in Pointsec PC HFA2: SSO credentials not cleared after 4 min. When using a Windows legal notice functionality or thirdparty application at logon, the SSO session was not cleared if halted during a process longer than 4 min. This has now been corrected Possible for remote desktop session to use SSO session (Vista). When connecting to a Windows Vista Client with SSO in progress, you were able to logon with SSO credentials via remote desktop. This has been corrected so that a remote desktop must use the normal Windows authentication. 7

8 Changes and Corrections in HFA1 The following items were corrected in Pointsec PC HFA1: Upgrade from Pointsec 5.x to 6.2 HFA1 freezes prior to completion. The following scenario will produce the problem: 1. Before applying the upgrade package make sure that HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Window s NT\CurrentVersion\Winlogon -> "GinaDLL" is set to something other than pssogina.dll, for example, msgina.dll 2. Start the upgrade from Pointsec 5.x to 6.2 HFA1 (set UpdateSSO=0 in precheck.txt in the 6.2 package). 3. During upgrade, Pointsec PC will freeze. Customer environment: - Pointsec PC 5.x - McAfee HIP (Host Intrusion Prevention). McAfee suite to prevent access to McAfee registry keys Certain special characters do not work in the preboot environment with Canadian English language Password history is case insensitive Customer name found in PTD.INF file Installing Pointsec PC on a Dell XT Tablet fails Invalid Profile causes exceptions in PCMC. When the PC is set to English Canada language, you are not able to use some of the special characters in preboot. If you try to type them, it will not show the character you are typing. The following characters do not work {}",/<>=?@ If you use the Virtual keyboard with the en-ca setting, (English Canada) instead of a physical keyboard, the following characters are available and can be used ",/<>=? The same issues is found with DE-AU (German Austrian) keyboards. Environment: The 'Password History' setting is set to greater than 1, and password is set to be case sensitive. When the user changes the password to something which is only a change of case from the previous password (for example, 'password' => 'PASSword'), it is not accepted. It seems to be recognized as an existing password in the password history. However password is set to be case sensitive so it should be treated as a brand new password. The following text has been added to the Administrator s Guide: Pointsec PC s Password History function does not consider case sensitivity when assessing password uniqueness. Thus, if you change a password that is recorded in Password History by changing only the case of one or more of its letters, it will not be accepted as unique, and therefore that altered password will not be allowed. The customer name is erroneously found in a Pointsec PC token driver file, PTD.INF. When installing Pointsec PC on a Dell XT Tablet, the installation stalls when installing the system code. An install profile causes problems after install. The following scenario will produce the problem: 1) Install version with a profile that has an erroneous 8

9 Set Max Failed Logons value. 2) In Windows, start PCMC and go to Local. 3) You will receive a error. 4) Press OK and you will get access to the Local settings but both buttons on bottom right are blank It is possible to find the encryption key in RAM after system shutdown (if done within x minutes.) Driver may overrun memory at startup SideBySide errors are listed in the event viewer during installation If USB is enabled in Pointsec PC, the computer will hang after the Pointsec PC progress bar is displayed Remote Help (RH) challenge code becomes <invalid>. Data in DRAM actually fades out gradually over a period of seconds to minutes after the system shuts down. This enables an attacker to read the full contents of memory by cutting off power and then rebooting into a malicious operating system. When the memory content has been dumped, it can be analyzed; and by using a known algorithm it is possible to find the expanded partition key in memory. When a probable key is found, it could be used to try to decrypt a sector from the encrypted disk, and since this can be automated with a tool there is a high risk that the correct encryption key can be found. When the system boots (from scratch or from hibernation), the driver may be interacting with memory which is not within the driver s scope. This can cause unexpected behavior such as a stop error (BSOD). SideBySide errors appear in the event viewer during Pointsec PC installation. They are caused by a Microsoft Visual Studio Manifest bug. Workaround: install the latest Visual Studio Service Pack on the client machine before installing Pointsec PC. If USB is enabled in Pointsec, the computer will hang after Pointsec progress bar is displayed. Even if USB legacy support is disabled in the BIOS, it will still hang with a black screen after the Pointsec PC progress bar is displayed. The following scenario will produce the problem: 1. Install Pointsec PC 6.2 HFA1 with smart card drivers (set USB to Yes). 2. Reboot, then get the Pointsec PC system code installation, then do a second reboot. 3. The progress bar will appear and load. 4. After it is loaded, it will halt with a black screen. Environment: Toshiba Tecra M9, but the problem has also been reported on other Toshiba models such as the A200 and the A8. Pointsec PC 6.2 HFA1 If the name of a Remote Help (RH) helper account is identical to one of the group names, the challenge code becomes <invalid>. Example 1: System Group :SYSTEM User account 1 : SYSTEM (helper account) User account 2 : ADMIN 9

10 User Group: USER User account 1 : POINTSEC (RH recipient) --> challenge code becomes <invalid> Example 2: System Group :SYSTEM User account 1 : USER (helper account) User account 2 : ADMIN User Group: USER User account 1 : POINTSEC (RH recipient ) --> challenge code becomes <invalid> NOTE: This problem occurs only when the group name is all in uppercase. If the group name is "System" or "User", RH works Prevent duplicate GUIDs when saving profiles AcvtivIdentity ActivKey V2 is not recognized in PBA The Smart Card Triggers Windows SSO logon setting fails to work. It is possible to create two (or more) users with the same GUID when creating profiles. This is now prevented in the sanity check dialog prior to writing the profile to disk. The following scenario will produce the problem: 1. Install the elements listed below, and ensure that the smart card is recognized in Windows and in Pointsec PC. 2. Define a smart card user account and choose the certificate. 3. Reboot with the smart card inserted. 4. There is no PIN dialog; the smart card does not work in PBA. Environment: XPSP2 ActivClient_5.4_bn457 ActivIdentity Device Installer 2.1 x86 (BN 12) Pointsec PC HFA1 (1226) Smart card: ActivIdentity ActivKey V2 Axalto Cyberflex Access 64K V1 SM 2.1 Pointsec PC drivers installed: Ac_p11.bin ActivKey.bin The Smart Card Triggers Windows SSO logon setting does not work. Enabling the setting should trigger SSO for the smart card user account, but it does not. The following scenario will produce the problem: 1. Install Pointsec PC 6.2 HFA1. 2. Create a smart card account and confirm that it works. 10

11 3. Enable the "Smart Card Triggers Windows SSO logon" setting for the smart card user account. 4. Reboot the machine. When logging on to Windows, the user will be asked to enter account/password. SSO does not work Upgrade from Pointsec for PC 4.x not aborted when the MSI is executed manually. Upgrade from 4.x/5.x is normally performed via the 4.x/5.x upgrade functionality. In this case the upgrade is triggered by storing an upgrade package in the work folder/software update folder on an installation. It should not be possible to perform an upgrade by executing the Pointsec PC MSI package (which is part of upgrade packages) manually. When this is done on a 5.x installation, the upgrade is aborted with an MSI error dialogue. However, on a 4.x installation the upgrade progresses quite far (at least if an upgrade profile is available), for example, the upgrade fails during the recovery file handling (10341) USB keyboards do not work when Legacy USB Support is enabled on Hewlett Packard Compaq dc7700 Small Form Factor PCs. When Legacy USB Support is active in the BIOS on a Hewlett Packard Compaq dc7700 Small Form Factor PC, USB keyboards do not work. Workaround: (1) Disable USB Legacy Support in the BIOS, or (2) use a PS/2 keyboard, or (3) connect a USB keyboard and a PS/2 keyboard (and both will work) 'Record New Credentials' dialog box is not displayed when SSO is re-enabled. When SSO is disabled and then enabled again, a 'Record New Credentials' dialog box should be displayed. But under Windows Vista it is not displayed. The following scenario will produce the problem: 1. Install P4PC 6.2 on Windows Vista. 2. Enable SSO for a user account. 3. Restart the PC, and login as the user account with SSO box selected. 4. At Windows startup, the SSO welcome screen is displayed. 5. After logging onto Windows, restart the PC. 6. Login at PBA as the same user, account but this time with the SSO box cleared. 7. After logging into Windows, restart the PC. 8. Login as the same user account, selectng the SSO check box again to re-enable SSO. 9. The 'Record New Credentials' dialog box should be displayed, but it is not. The- user account is logged onto Windows directly Logs are one hour behind in PCMC. When viewing logs in management console (PCMC), the logs are incorrectly an hour behind the correct time. But if the logs are exported to a CSV file they are correct. 11

12 Changes and Corrections in The following items were corrected in Pointsec PC 6.3.1: SSO chain is lost while logging on in NOVELL in offline mode. When a user attempts to use SSO functionality in offline mode in NOVELL, the entire SSO chain is lost. First, the user receives verification that the SSO chain is working while connected to NOVELL. But if a user then unplugs the network cable and tries to log on in offline mode, the SSO chain is lost for the online mode, and SSO does not work at all in offline mode. The scenario that produces the error is: 1. Install Novell 4.90 SP2. 2. Install Pointsec for PC 6.2 HFA1. 3. Enable SSO and set 'Synchronize Windows Password' to Yes. 4. Verify that you have a working SSO chain when the network cable is plugged in. 5. While in Windows and connected to Novell, press Ctrl+Alt+Delete and change the password. 6. Shut down the computer. 7. Unplug the network cable. 8. Start the computer, enter credentials in Pointsec, and verify that SSO is selected. 9. The system halts at the NOVELL log on; choose to log on with a local account. 10. A Pointsec message appears prompting for 'Enter Pointsec password to Sync with Windows password'. 11. Enter the password. 12. Windows loads, and the SSO chain should be saved (but no message confirming this is displayed). 13. Restart the computer, and log on to Pointsec. 14. The system now halts at the NOVELL log on, thus SSO is not working. The same is true if you plug in the network cable and reboot, the SSO chain has been lost (see ) The "Don't show this message again" checkbox in the PPBE WIL message dialog box is active even when it has not been checked. If the user enables the "Bypass PPBE WIL Message" setting in the PCMC, the PPBE WIL message dialog will not be displayed during the next PBA even if the user has not selected the "Don't show this message again" checkbox in the PPBE WIL message dialog box during the previous preboot authentication (PBA). 12

13 (see ) PPBE Failure WIL Message continues to be displayed. The scenario that produces the error is: 1. Set the following. Windows Integrated Logon: "Enabled". Set PPBE Failure WIL Message to: "Test!". Enable Network Locational Awareness: "Yes". Set Network Locations: "with an IP". 2. Reboot the PC and see that WIL is working. 3. Disconnect the PC from the network. 4. Reboot the PC --> After Windows authentication, PC shut down. 6. Reboot the PC 7. PPBE Failure WIL Message is displayed at PBA --> Login. 8. Check that WIL is disabled and reboot the PC. 9. PPBE Failure WIL Message continues to be displayed Intermittent Error code 0x leading up to tray-crash. Intermittently after Windows authentication, the customer gets an error message, code 0x , and the P95Tray crashes right after that. In the Windows Event Viewer, there is only one error logged: plantage de P95tray : (French) > Faulting application P95tray.exe, version faulting module > [...] fault address 0x0004F WIL - One-time logon does not enable WIL. The "Enable WIL" switch does not work with one-time logon. The scenario that produces the error is: 1) Set "Max failed logon attempts" to 5. 2) Fail to login to Windows 5 times (the computer will shutdown). 3) Boot up machine, PPBA will be enabled. 4) Select the "Enable WIL" switch; then provide one-time logon remote help to the user. Outcome: WIL will still be disabled after next reboot. 13

14 If changing UVP after upgrade to HFA1, profiles are not accepted. The scenario that produces the error is: if you upgrade 2 machines having the same UVP, to HFA1, open up the PCMC, you are then prompted to set your UVP. If you set the UVP to a NEW password, and don't reuse the old UVP, the profiles created will not be accepted. Machine A and B are installed with same UVP Machine A and B are upgraded from to 6.2 HFA1. PCMC is opened on machine A. Admin gets prompted to set a UVP. If the password is a brand new one, machine B will not accept the update profiles from machine A. Machine B will only accept profiles from machine A if the UVP is set to the UVP Slow keyboard in PreBoot Authentication. Keyboard response is slow in PreBoot Authentication, and this results in the user entering the wrong credentials. This problem has been reported as occurring on the following computers: - OEM / Manufacturer: Dell - Model: D620 - Processor: Intel Centrino Duo - Graphics: Nvidia Quadro NVS 110M - Memory: 2048 MB - BIOS Version: A08 and IBM/Lenovo T Pointsec PC installation failure on Sony Vaio. On certain hardware, it has been found that, after installation of Pointsec PC, the system can crash during Vista s start sequence. The unrecoverable error occurs: 1. On the first reboot after Pointsec PC installation, or 2. After several (less than 10) reboots after Pointsec PC installation, or 3. On the 6th reboot after Pointsec PC finishes encrypting the HDD 100%. Environment: Hardware model: SONY VGZ-SZ94NS and SONY VGZ- SZ93NS Number of disk: 1 14

15 Number of partition: 1 OS: Windows Vista Timing of error: while Windows is loading The Windows Screen Saver Timeout setting is enforced although it is set to disabled in management console (PCMC) Converting a temporary user account to a normal user account whose name consists of only a single space Changing 'Name and Authentication' of an upgraded legacy account causes an unhandled exception. This issue seems to occur only in Windows XP. It does not occur in Windows Vista. The scenario that produces the error is: 1. Install P4PC. 2. Set 'Allow Windows Screen Saver' to Yes in the Local settings. 3. Check that by default, Set Screen Saver Timeout is set to 10 minutes for the logged in user. 4. Select 'Disabled' in the check box in the 'Set Screen Saver Timeout' window, in order to disable the timeout setting. 5. In Windows, change screen saver to 'Windows XP' and set the timeout to 9 minutes. 6. Reboot the PC. 7. Even though Set Screen Saver Timeout setting is disabled, 'Windows XP' screen saver timeout is reset to 10 minutes. When converting a temporary account to a normal account, the new user account name can consist of only a single space character, even though a space is not one of the special characters that is allowed. This user account that is created is unable to receive remote help. The scenario that produces the error is: 1. Install 6.2 HFA1 and create a temporary account. 2. Login as the temporary account, and when prompted for a new username set it as a single space character (space is not visible on the screen, but it is accepted). 3. From next reboot, logging in as this user is possible if a single space is entered in the username filed. A customer has P4PC installed on their client PCs, and they are trying to upgrade to version 6.2. They want to control individual legacy user accounts in PCMC after the upgrade. And they want to deploy an update profile that changes the authentication method of an upgraded legacy account. The scenario that produces the problem is: 1. Create an upgrade profile in 6.2 PCMC. 2. In this upgrade profile, add a legacy account giving it the same account name as the v5.2.3 user account. Set upgrade action as 'upgrade'. 3. Create an update profile based on this upgrade profile. 4. Right-click on the legacy account, and choose 'Name and Authentication' in order to change authentication 15

16 method. 5. Unhandled exception occurs. 6. Therefore it is not possible to change the authentication method of an upgrade legacy account using an update profile The Management Console (PCMC) displays English, even though "operating system" is selected on Japanese OS. The scenario that produces the error is: 1 Install Pointsec PC 6.2 on a Japanese Windows XP machine. 2 Select "Operating System" as language (it is selected by default). 3 Open the Management Console, and all menus are in English. Environment info: VMware workstation Windows XP SP2 Japanese Token removal and Novell client issue. Description: A token user is logged on with SSO from preboot and Lock computer is selected under Token Removal Handling. When the token is removed from the computer, two lock screens appear. Pointsec PC s and Novell s. The active window changes 10 times a second so it is difficult to enter the token PIN. The scenario that produces the error is -Install Pointsec 6.2 and Novell Client 4.91 SP3. -Setup a token user that uses SSO. -Enable Token Removal Handling and choose lock computer when token is removed. -Remove the token. - Now two lock screens appear. Environment info: Windows XP SP2 Alladin E-Token 32 Novell Client 4.91 SP P95tray.exe error when enable export of status to file in Install settings on Win2k. The scenario that produces the error is: Enable export of status to file in the Install settings, (the user has administrator privilege to the log path). At the next reboot, an application error message is displayed immediately after desktop is displayed. The status file is not created. 16

17 (The above scenario works fine with Windows XP and Vista.) Environment info: Pointsec PC 6.2 Windows 2000 SP4 Japanese + UR Memory leak. The psutil.dll leaks memory when logs are fetched PC does not shut down by WIL (Windows Integrated Logon) when a user exceeds the max failed logon attempts if this value is set to 1 or to 255. When WIL'S Max Failed Logon Attempts is set to the value 1 or to 255, the machine will not shut down when user exceeds the specified maximum number of logon attempts. The scenario that produces the error is 1 Enable WIL. 2 Set "Set Max Failed Windows Logon Attempts" to 1. 3 Try to fail 2 times when logging on to Windows. 4 Machine will not shut down. This issue ONLY occurs when the value is set as 1 or PC does not reboot when the WIL Max Windows Logon Attempts limit is exceeded after resuming from hibernation. Environment info: Windows XP SP2 Japanese version [Japan support] NEC VERSAPRO VJ17F/RF-X [Partner's environment] Hitach ILIOS F8000II. The scenario that produces the error is 1. Install Pointsec PC Wait until all volumes are fully encrypted. 3. Open the PCMC and enable WIL. 4. Reboot the machine. Confirm that WIL works. 5. Hibernate the machine. 6. Turn on the machine again to resume the OS. 7. Keep trying to fail when logging on Windows. It will not reboot or shutdown even if it exceeds the limit for Windows Logon Attempts (default is 5) 'Helper Challenge' field is not cleared by Refresh button. Environment info: Windows XP SP2 Japanese NEC versapro VF17F/RF-X. In the Pointsec PC 6.2 Management Console Remote Help window: If the helper uses a dynamic token to authenticate, the 'Helper Challenge' and 'Helper Response' fields are 17

18 displayed in 'Step Three'. The value in 'Helper Challenge' field is not cleared when the Refresh button is clicked. All other fields are correctly cleared when navigating to and from other tabs and when the Refresh button is clicked. Environment info: VMware Workstation 6.0 Windows XP SP Click Create Recovery Media in the Set Information window triggers an unhandled exception message Japanese characters in the PPBE WIL failure message are not displayed correctly. If you click Create Recovery Media in the Set Information window, you will get unhandled exception message. You can continue or close the application from this dialog. Japanese characters in the specified WIL message are not displayed correctly. The following scenario reproduces the problem: 1 Open the PCMC. 2 Navigate to Local > System Settings > Windows Integrated Logon. 3 Edit the Set PPBE Failure WIL message, entering Japanese characters. 4 Click OK and close PCMC. 5 Open PCMC and navigate to the same setting again. 6 The characters in the Japanese WIL message are not displayed correctly. Environment info: VMware workstation build Windows XP SP2 Japanese version. 18

19 After updating a temporary smart card account with the relevant smart card and certificate, the user cannot log on. After a temporary smart card user has updated the account in Windows using his/her smart card and certificate, that user is no longer able to log on. The following scenario produced the error: 1. Create temp smart card user. 2. Logon in PPBE using temp smart card user. 3. Change credentials and get the confirmation that the certificate has been updated. 4. Reboot and try to log on in Pre-boot. 5. Depending on the card you get "invalid logon" or "trouble accessing the card". Works fine for normal smart card users. Environment info: Pointsec PC & Windows XP SP1 Oberthur 5.2/AuthentIC Manager Aladdin etoken Pro 32-bit/CRT Upgrading from an Upgrade Path fails intermittently when using a service start account Legacy user accounts with the authority level Admin are not removed during upgrade from 4.x/5.x. When upgrading Pointsec PC 6.2 to Pointsec PC from a share specified in the Upgrade path, the upgrade fails intermittently when using a service start account. If inline editing is used to set the parameter Upgrade Action to Remove in the PCMC, legacy user accounts with the authority level Admin are upgraded instead of being removed. The problem is caused by errors in the language files for the PCMC. Note: legacy user accounts with the authority levels Sysadmin and User are not affected by this issue. The following three workarounds are available: 1. Double click on the parameter Upgrade Action and select Remove in the dialog that is displayed. When the dialog is closed, the value will be displayed as Ignored. However, the actual value set in the profile will remove the user accounts during upgrade. 2. Use French in the PCMC. This works because the issue is not present in the French language files. 3. Use an update profile to remove the legacy user accounts that have the authority level Admin after the upgrade. 19

20 Cannot open a profile in 6.2. A Pointsec for PC profile cannot be opened in Pointsec PC 6.2. But Pointsec for PC 6.1.1, 6.1.2, and profiles can all be opened in Pointsec PC 6.2. Workaround: open the profile in Pointsec for PC 6.1.1, 6.1.2, or 6.1.3, save it; and then open it in Pointsec Windows Integrated Logon does not work together with Hardware Hash on certain machines Pointsec crashes when installing on a computer which has multiple HDDs of different types. Windows Integrated Logon does not work together with Hardware Hash on IBM T60 or IBM T42 computers. Pointsec does not support multiple HDDs of different drive types (ex. IDE + SCSI). Pointsec for PC crashes (Error code:0x5000d2d) at the initial reboot after P4PC 6.1.3FH1 installation on a machine with multiple HDDs of different drive types (for example,. IDE and SCSI). Without the SCSI, Installation and Encryption complete without a problem. Environment: Machine: Built-in IDE disk and SCSI HDD (connected with SCSI board) Drives C: Boot protect only?@(ide) D: Boot protect and Encryption (IDE) E: Boot protect and Encryption (SCSI) Machine: Built-in IDE disk and SCSI HDD (connected with SCSI board) (7677) Wake on LAN does not work on NEC VersaPro VJ17. Wake on LAN does not work on NEC VersaPro VJ Only a maximum total of 10 volumes can be protected by Pointsec for PC. Currently only a maximum of ten volumes can protected with Pointsec for PC (395533) Wake on LAN does not work on NEC VersaPro VJ17. Wake on LAN does not work on NEC VersaPro VJ17. New in Pointsec PC 6.2 The following new functionality and enhancements are included in Pointsec PC 6.2. For more information on the new functionality, please refer to the Administrator s Guide. Upgrade from Pointsec for PC 4.x & Pointsec for PC 5.x o It is now possible to upgrade from versions 4.x.x and 5.x.x to Pointsec PC Extended operating system support. Pointsec PC supports the following operating systems: o Microsoft Vista 32-bit support 20

21 o Microsoft Windows XP tablet edition o Microsoft Windows Server 2003 (on workstation hardware only). Support for virtual keyboard in PPBE o Authentication to the Pointsec PC preboot environment is now possible by means of a pointing device. Token removal and re-insertion handling o It is now possible to configure Pointsec PC actions to be taken if a smart card is removed by the user. Token and certificate uniqueness handling o Pointsec PC can differentiate between Aladdin E-tokens even if the certificate on the tokens is identical. Log protection with authentication o The option to enforce password authentication to view logs now exists. Pointsec Service account o It is now possible to configure a Pointsec Service start account from within PCMC. Password synchronization (both ways) o Password synchronization now works in both directions. Windows to Pointsec PC preboot Pointsec PC preboot to Windows. System setting password policy o Password policy for passwords used on system level (i.e Update Validation Password) implemented. Group Authority Level o Group Authority Level allows you to control what settings/permissions are granted to a group and the users bellowing to that group. Windows Integrated Logon Tampering awareness o Pointsec PC can now be configured to require preboot authentication if hardware changes on a system running Windows Integrated Logon are detected. Windows Integrated Logon Localization awareness o Pointsec PC can now be configured to require preboot authentication based on available IP addresses. New localized languages o Polish, Thai, and Hungarian are now available in the Pointsec PC preboot authentication. Key Import o It is now possible to import seed for the creation of partition keys. Certificate creation tool o Pointsec PC self-signed certificate capability is now available. Improved set configuration management o Improved usability in connection with set configuration. Pointsec PC supports using the Tablet PC pen in preboot on the following systems: o IBM X41 o HP TC 1100 o HP TC 4200 o Toshiba Portégé M200. Changes and Corrections in 6.2 HotFix Accumulator 1 The following items were corrected in Pointsec PC 6.2 HotFix Accumulator 1: 21

22 10619 P95_tray.exe can crash in Win 2000 After installing Pointsec PC 6.2 using a profile, the P95_tray.exe will crash in Windows Machine randomly crashes when PME, McAfee software, and Pointsec PC are installed on the same system Temporary smart card user is not able to logon after associating with a certificate Double-byte characters in a temporary user default username cause a crash when installing Usernames that contain a space character cause an unhandled exception in the PCMC Group settings and user settings could be changed even without the required permissions being specified Checkpoint start kit license was not working Smart card differentiation does not work with temp smart card users An upgrade from Pointsec for PC 6.x to 6.2 fails with critical system error Uninstallation is possible with only one account and one etoken Upgrade from 6.x version crashes with 27 or more groups When PME, McAfee software, and Pointsec PC are installed on the same system, the machine randomly crashes with Blue screen 0x When the setting Token Insertion/Removal Handling is enabled, the following happens: a temporary smart card user logs on in PPBE, changes credentials, and receives confirmation that the certificate has been updated. But when the user reboots attempts to logon in PPBE, depending on the smart card used, logon fails; and the user receives Invalid logon or Trouble accessing the card messages. If P4PC is installed with a user whose Window username contains double-byte characters characters, Pointsec PC can crash during the Temporary user conversion process. If you upgrade from an earlier P4PC version and have users whose usernames contain one or more space characters, an unhandled exception occurs if you try to editing name and authentication for these users in the PCMC. A user with Create User Accounts or Create Group permission could change even other user account and group settings. Start kit license was not working with Pointsec PC 6.2. Smart card differentiation does not work when creating temporary smart card users. A critical system error occurs and renders the PC unbootable, when P4PC HF4 is upgraded to 6.2 in a Windows 2000 environment. Now upgrade requirements (for example, UR1 for Windows 2000) are checked before the Windows files are upgraded, and, if any checks fail, the upgrade is aborted. In P4PC 6.2, uninstallation is possible with only one system administrator's account if a smart card is inserted. The MSI crashes during upgrade when the PPBE files are upgraded. This happens only if the sum of all groups and 22

23 and user accounts. users is or has been larger than During upgrade to 6.2, PME stops functioning. When an upgrade from Pointsec Pc 5.x to 6.2 is performed, PME stops working. Changes and Corrections in 6.2 HF2 The following items were corrected in Pointsec PC 6.2 HF2: Pointsec PC installation failure on Sony Vaio. On certain hardware, it has been found that, after installation of Pointsec PC, the system can crash during Vista s start sequence. The unrecoverable error occurs: 1. On the first reboot after Pointsec PC installation, or 2. After several (less than 10) reboots after Pointsec PC installation, or 3. On the 6th reboot after Pointsec PC finishes encrypting the HDD 100%. Environment: Hardware model: SONY VGZ-SZ94NS & SONY VGZ- SZ93NS Number of disk: 1 Number of partition: 1 OS: Windows Vista Timing of error: while Windows is loading. How to Implement This Hotfix Pointsec PC 6.2 HF2 must be installed on Pointsec PC 6.2 HFA1. You must have local administrator permission to install Pointsec PC 6.2 HF2. To implement HF2: Install Pointsec PC HFA1. To make sure the Pointsec PC HFA1 installation is complete, check the return code from the Pointsec PC.msi package if the installation was successful, the return code will be zero and you should proceed to the next step before rebooting the machine after the installation of Pointsec PC HFA1. Deploy and install this hotfix (HF2), see below. This hotfix can be implemented in the following two ways: Silent Implementation and Verification of Pointsec PC HF 2 1. Run the P4PC_620_HF2.exe with the command flag [/s]. 2. Restart the machine. 3. Verify the implementation by checking that the DWORD value Hotfix in registry key *HKEY_LOCAL_MACHINE\SOFTWARE\Pointsec Mobile Tech\Pointsec for PC is two (2). 23

24 Manual Implementation and Verification of Pointsec PC HF 2 1. Click the [Apply] button in the window displayed after clicking P4PC_620_HF2.exe. 2. A message box is displayed. 3. Restart the machine. 4. Verify the implementation by checking that the DWORD value Hotfix in registry key *HKEY_LOCAL_MACHINE\SOFTWARE\Pointsec Mobile Tech\Pointsec for PC is two (2). Changes and Corrections in 6.2 HF1 The following items were corrected in Pointsec PC 6.2 HF1: Heavy IO could cause a machine to crash with a blue screen. Changes and Corrections in 6.2 The following items were corrected in Pointsec PC 6.2: 9364 Only a maximum total of 10 volumes can be protected by Pointsec for PC. This problem has now been addressed by pre-allocating memory. Currently only a maximum of ten volumes can protected with Pointsec for PC P95Tray.exe crashes during uninstall on multidisk machine on which the volume on the first hard disk has only boot protection (no encryption) Resuming from hibernation malfunctions on a machine with both an SATA AHCIenabled hard disk and a SCSI hard disk Removing a group by using an update profile (.upp) causes the p95tray application on the local machine to crash. The P95Tray.exe crashes during uninstallation when Pointsec for PC HF1 has been installed on a multidisk machine and the volume on the first hard disk has only boot protection (no encryption). When uninstalling, the P95Tray.exe crashes after the first reboot. The tray icon displays decryption as 0% before the P95Tray.exe crashes. Uninstallation will not continue from this point. Workaround: it is possible to recover the encrypted volumes using recovery media, and the remaining Pointsec for PC components can be removed using Windows Add/Remove programs. Resuming from hibernation malfunctions on a machine with both an SATA AHCI-enabled hard disk and a SCSI hard disk. Such a machine was hibernated with text documents and image files left open on the Windows desktop. (Hibernation was enabled in Pointsec for PC, and the PC was rebooted once before hibernation was attempted.) But when the machine was resumed, Windows booted; and the files left open on the desktop were closed. Note: when AHCI is not enabled, hibernating and resuming work correctly. The user account name of the deployed user on the local system is not known, so the only thing the administrator wants to do is to remove the group. The following scenario reproduces the error: 1. Create local group X. 24

25 2. Create the user account in the local group X. 3. Create an update profile that removes group X. 4. Run the profile in the local "Work" folder Aladdin etokens will not work together with 2048-bit certificates Missing Pointsec for PC message stating that hibernation is not allowed Logs that are not deleted after uninstalling Pointsec for PC 5.x are not overwritten. The profile is deployed, and the group together with its user(s) is deleted; but the P95tray application on the local system crashes with an error message. Aladdin etokens will not work together with 2048-bit certificates in Pointsec for PC If hibernation is enabled in Windows only, not in Pointsec for PC, you should get a Pointsec for PC message when trying to hibernate the PC. The message "Hibernation not allowed" is no longer displayed. Only the Windows message is displayed. Logs that are not deleted after uninstalling Pointsec for PC 5.x are not overwritten after installing Pointsec for PC 6.x., rather they are appended to the 6.x logs. Note that the 5.x logs cannot be read in 6.x PCMC. The following scenario will produce the problem: 1) Install Pointsec for PC 5.x. 2) Logs for version 5.x are written to your recovery share. 3) Uninstall Pointsec for PC version 5 (the logs are left on the share). 4) Computer name is not changed. 5) Install Pointsec for PC v6. 6) The logs for 6.x are written, but the 5.x logs are appended "Ctrl+ALT+Del" required to reaccess machine after installing and waiting ca. 10 minutes to reboot. Workaround: Remove the central log and restart P95tray. The following scenario produces this problem: 1) Install Pointsec for PC by running the Pointsec for PC.msi. 2) Click "No" to the question "Do you want to reboot now?". 3) Wait about 5-10 min Invalid challenge lengths allowed in the PCMC for The error message "Error code: 0x5000d6e" appears, and when dismissed, an empty screen is displayed. You must press "Ctrl+ALT+Del" to be able to access the PC again. Note that once you have pressed "Ctrl+ALT+Del" and again can access the machine, there are no problems with the installation. When adding or changing a dynamic token user account in the PCMC, the challenge length can be up to 16 characters long. The PCMC allowed Invalid challenge lengths for 25

26 dynamic token users Authentication of smart card user account via Remote Help is inhibited during uninstallation Remote Help: PCMC one-time logon does not work when using an ActivIdentity V2C smart card Unable to enter the desired password when installing Pointsec for PC on a US English Windows operating system with the requisite Regional settings for Chinese (Taiwan) The PCMC does not grey out groups that are marked for removal Pointsec for PC field in Novell login dialog does not display Japanese No info in logs about what kind of Remote Help is performed 6916 Central log contains strange entries 6912 Sony Vaio hangs after logon in PPBE with certain USB smartcard readers. dynamic token users. Note: The valid challenge length has been changed to be from 1-8 characters. During the uninstallation of P4PC via add/remove programs, it is not possible to authenticate a smart card user account via Remote Help. The 'Next'-button is never activated after the Second response has been entered, so it is not possible to continue the authentication session. Remote Help: when using an SC: ActivIdentidy V2C smart card, one-time logon to the PCMC does not work because the OK button is grayed out. When installing Pointsec for PC on a US English Windows operating system with the requisite Regional settings for Chinese (Taiwan), the following problem occurs: when entering the system administrator s user account name and password, the display of the second keystroke in the password is delayed, and the character entered is not the character of the key you pressed. Thus, when you enter these credentials in the PPBE, your validation fails. Workaround: 1. Access [Regional and Language Options] setting -- [Advanced] tag. 2. Change [Language for non-unicode programs] to "English (United states)" 3. Reboot the machine. If you select a user account for removal in an update profile, it is grayed out after saving and reopening the profile. But, if you select a group for removal, it is not grayed out after saving and reopening the profile although all user accounts in the group are grayed out. The complete group is however grayed out when you choose mark for removal before saving the profile, but not after it has been saved and reopened. The Pointsec for PC authentication field in the Novell login dialog does not display Japanese even though Japanese was chosen from the Pointsec for PC tray icon, and menus and dialogs in Windows were set to display Japanese. After giving/receiving Remote Help, it is not possible to see in the client log viewer or in the local logs what kind of Remote Help that has been given. The Central log contains entries called "Configuration setting changed". When examined, they contain the text "Unknown was set to [number]". Often several "Configuration setting changed" entries are logged in a row. Sony Vaio SZ1 may hang after logon in PPBE with USB smartcard reader SCR331 and RSA

27 6895 Black screen with hanging cursor after logon with SC in PPBE on certain machines 6884 Invalid character using PSLOGEXP.EXE 6872 The password length of a user account can be reduced to a length shorter than the length specified for the group to which the user account belongs A profile installation fails for clients when using Windows 2000 and Internet Explorer 5.x. After logon with a smart card account in PPBE on certain machines, and a successful authentication, the screen may turn black with a hanging cursor. The same scenario occurs after an upgrade or a new installation. Workaround: Disable the USB Legacy Support in BIOS. You will then avoid the black screen. Same issue occurs on a Fujitsu Siemens 7020 If the log parser tool "pslogexp.exe" is used to export log events as XML("/xml"), the output may be invalid if any event contains an XML Entity Reference (e.g. "&", "<" or ">"). It is possible to reduce the password length of a user account to a length shorter than the length specified for the group to which the user account belongs. Scenario to reproduce the problem: 1. Create a new group and create a fixed password account. 2. Change the minimum length for the user account to be shorter than for the length specified for the group (if the minimum password length for the group is set to six, set the user account s password minimum length to four). 3. Reboot and change the password in preboot. A profile installation fails for Clients using Windows 2000 and Internet explorer 5.x. An installation error is logged with following text: "The profile could not be loaded". In a pure Windows 2000 SP4 (with Internet Explorer 5.x) the required functionality for the installation is missing P4PC prevents hibernation on memory card adapters Certificate view is not updated when running Pointsec for PC (P4PC) in VMware and the network is Workaround: install Internet Explorer 6.0 /6.0SP1 and the msxml3.msi (Sp5) package on the clients. The msxml3.msi package is available via The Sony VAIO has a removable Memory Card Adapter (VGP-MCA20) for xd/sd/mmc compatible cards. This adapter is interpreted as an HDD by the OS and P4PC. This will prevent the system from hibernating, since P4PC does not support hibernation with multiple HDDs in the system. Note: The Sony VAIO also has some internal nonremovable memory card readers that are interpreted as HDDs whether or not the actual memory card is inserted. If these are enabled, they could prevent hibernation as well. Workaround: To be able to hibernate the PC, either physically remove the card adapter from the PC or disable the device from within the OS. Also disable any other internal memory card readers that are interpreted as HDDs. Here is the scenario: 1. Install P4PC in VMware. 2. Create a temporary smart-card user. 3. Disconnect the network cable from the computer (do not disable the network connection in VMware; rather unplug 27

28 unavailable Creating a new profile with the same name as an existing profile overwrites the existing profile Profiles without names. the physical cable). 4. Insert an Aladdin etoken 5. Reboot, and log on as the temporary user. 6. After logging on to Windows, the certificate selection window appears; but the etoken is not displayed in the list for selection. This behavior occurs very rarely. See Error! Reference source not found. on page Error! Bookmark not defined., above. Note that if you create a new profile that has the same name and type as an existing profile, the existing profile will be overwritten by the newly created profile. It is possible to create profiles that do not have profile names, even though creating such nameless profiles is not recommended. These profiles are listed under Profiles but the name field is empty, for example, the nameless Install Silent profile above the install 1 profile shown here: 5451 Problems unlocking the recovery file when authenticating with a smart card When using 3DES, intermittent errors occur when encrypting four or more volumes on certain machines. Nameless profiles can be selected, edited, etc. like any other profile. If you use a smart card when using the recovery utility to unlock a recovery file, the utility will try to use the smart card used for the first user account authentication for the second user account authentication. As long as a smart card is in the reader, the utility will try to use that card for authentication. Workaround: Do the first authentication with a fixed password or dynamic password user account, and then do the second user account authentication with the smart card. Or remove the smart card before the second authentication window is displayed. The following errors occurred: Encrypting four or more volumes using 3DES often results in the problems described below. They have been reproduced unpredictably on the PCs below, and the outcome cannot be predicted. HP D530c: Event A) Decryption doesn't start at all. Rebooting doesn't help. 28