Release Notes DriveLock SE

Transcription

1

2 Release Notes Table of Contents Introduction 3 Document Conventions 3 Part II Supported Platforms 4 Part III Version History 6 1 DriveLock DriveLock Known Issues 8 1 DriveLock ios and itunes 8 2 Windows Portable Devices (WPD) 9 3 Installation of Management Components Using Group Policy 9 4 DriveLock Agent Remote Control 9 5 Automatic Updates and Application Launch Filter 9 6 Manual Updates 10 7 DriveLock Disk Protection 10 8 DriveLock File Protection and Microsoft OneDrive 11 9 Antivirus 11 Self Service unlock 11 Part I 1 Part IV 10 Part V DriveLock Documentation 11 Part VI Test Installation and Upgrade 12 1 DriveLock Evaluation 12 2 Updating DriveLock Components 12 General Issues Important Changes Automatic Updates DriveLock <= V7.2 Automatic Updates for Windows XP Updating DriveLock Disk Protection

3 Introduction 1 Introduction This document contains important information about the new version of DriveLock and changes from previous DriveLock versions. The DriveLock Release Notes also describes changes and additions to DriveLock that were made after the documentation was completed. For more information visit our website Document Conventions Throughout this document the following conventions and symbols are used to emphasize important points that you should read carefully, or menus, items or buttons that you need to click or select. Caution: This format means that you should be careful to avoid unwanted results, such as potential damage to operating system functionality or loss of data Hint: Useful additional information that might help you save time. Italics represent fields, menu commands, and cross-references. Bold type represents a button that you need to click. A fied-width typeface represents messages or commands typed at a command prompt. A plus sign between two keyboard keys means that you must press those keys at the same time. For eample, ALT+R means that you must hold down the ALT key while you press R. A comma between two or more keys means that you must press them consecutively. For eample ALT, R, U means that you must first press the Alt key, then the R key, and finally the U key. 3

4 Introduction 2 Supported Platforms System Requirements Memory Hard Disk.Net Framework MB +10 MB 50 MB 200 MB 2 GB 320 MB +30 MB 130 MB 130 MB 4 GB * XP* W7 SP1* W8.1 W Agent Device Control Application Control Encryption2Go File Protection* Disk Protection Management Console Control Center* Enterprise Server Windows 10 Semiannual channel Win /1607 Win /1709 Win Agent Device Control Application Control Encryption2Go File Protection* Disk Protection Management Console Control Center* Enterprise Server * * Windows* Server DriveLock 2008 SP2 2008R2 SP R Agent Management Console Control Center Enterprise Server DriveLock Agent + Disk Protection* Management Console Control Center* Enterprise Server Windows* / OS X DriveLock 4 OS X 10.9+

5 Supported Platforms DriveLock Virtual Channel ICA RDP IGEL UDLX WYSE Linu V6 Embedded Windows* XenApp 6.0 XenApp 6.5* 2008R2 SP R SP4 2008R2 SP /2014 SP SP2 DriveLock Thin-Client Support ICA (Citri) RDP (Windows TS) XenApp / XenDesktop 7.X Database Support Microsoft SQL Server* Oracle Database Note *Windows Intel X86 Based (86_32, 86_64, AMD64) DriveLock is tested and released with the most current Windows 10 version available at release day. DriveLock is tested and released with the most current Windows 7 and 8.1 service pack available at release day. DriveLock will no longer be tested with Windows Vista and Windows 8..NET Framework 4.0+ is required to display security awareness campaigns *Windows 7 SP1 KB (SHA-2 code signing support) must be installed on W7 64-bit *Windows XP An additional license for support of legacy OS is required! Windows XP ist tested with SP3 fully patched and POSReady 2009 *Microsoft SQL Epress For installations up to 200 clients *File Protection Citri Terminal Servers are not supported 5

6 Supported Platforms *Disk Protection UEFI and GPT Partitioning is supported with hardisk up to ma. 2 TB for Windows 8 64 bit or newer and UEFI version V2.3.1 or newer. For UEFI on Windows 10 version 1703 Update KB is required. DriveLock Disk Protection is released for Windows 10 version 1709 with limitations (see known issues). *Control Center For remote connections: Internet Eplorer 11 or newer *Windows Embedded The DriveLock Virtual Channel and DriveLock Agent must not be installed on the same client *XenApp XenApp 6.5 Hotfi Roll Up 4 or newer 3 Version History Even numbered versions are official releases available to all customers, while odd numbered versions are internal or customer specific releases. Only official releases are listed in the version history. 3.1 DriveLock DriveLock is a major feature release New features: Security awareness features significantly improved In addition to the awareness campaigns you have been familiar with so far, which were shown to users when they logged on, you can now also create and show campaigns for these specific events: - When users connect to eternal drives - When users connect to eternal devices - When users start applications or attempt to use locked applications Select different types of content most suited for your campaign: images, tet, PDF or RTF files, videos or URL content. When you purchase the Security Awareness Content AddOn (as subscription), new multimedia and interactive content is also available as an additional content type (microlearning sessions, security flashes or elearning courses). Signed DriveLock policies (eperimental feature) You can add certificates to DriveLock policies now; they can be automatically parameterized during installation and provide additional protection against manipulation on the clientadditional status information of the DriveLock agents via tray icon and command line provides detailed information on the current configuration of the agent on a client In the DCC's HelpDesk view, you can see information on the status of the agents that are temporarily unlocked; this information is updated with every heartbeat interval 6

7 Version History Now you can collect log files and support information directly from a connected agent with the DCC and send them to DriveLock SE, together with the ticket ID and customer name You can now update the DES and the databases without user interaction, and all tenant databases are also updated during the update process You can now clean up local hash databases, and delete unwanted applications manually A simpler editing mode allows you to manage policy assignments more easily for many or a large number of eisting policies Major fies for these issues: In some cases, the DriveLock Agent loses its assignment to the DES and the assigned tenant during the update Sometimes the warning "Could not resolve CSP" is written to the DES logfile for no reason The MMC crashes when accessing a local whitelist database while the agent is adding to it The permission settings for the "Antivirus" and "Disk Protection" helpdesk views do not work properly in the the DCC The DES does not process Microsoft patch information longer than 32 characters correctly You cannot save the temporary unlock view settings in the MMC without entering a password In some cases, file filter settings are not evaluated correctly in "Access denied" configurations Smartphone whitelist rules are not displayed correctly in DriveLock AgentUI When formatting a USB drive with enforced encryption, an error occurs on thin clients without DriveLock Virtual Channel A confusing UI causes eisting unencrypted data to be deleted by mistake when configuring the advanced settings for enforced encryption with File Protection The panel for the self-service unlock settings is missing in the MMC in the task view You can only change the file filter settings for encrypted media rules in the MMC after saving If you disable application control in the policy, the filter driver remains enabled in certain situations You can format USB media devices, although access permissions are active without write permissions If Machine Learning is enabled, installations installed via msi.dll (e.g. Office 2013) are not handled correctly and their applications are completely added to the local whitelist. Long tets in the self-service usage policy are cut off because the scrollbar is missing 3.2 DriveLock DriveLock is a maintenance release Feature improvements: Remote unlock communication via Self Service is able to communicate through a (linked) DES Remote unlock via SelfService.ee can now ask for user credentials instead of running in current logged on user contet Hide "devices and module" selection in Self Service unlock wizard (automatic background enabling) Use server + port and user + password to log on to DriveLock Control Center 7

8 Version History If smart phones are unlocked via Self Service wizard, MTP devices will be automatically unlocked also Added support for PaloAlto VPN Credential Provider for Full Disk Encryption Major issues that were fied: DLHM register itself as antivirus program and prevents Microsoft Defender on demand scanner to run Certificate based encrypted folder always asks for a certificate renewal DLMobile.ee is deleted during the upgrade if there is not enough free space on the drive The USB ASMedia driver does not support removing filters from the stack after successful connection In some circumstances, USB removable drives can be formatted and accessed even though the drive letter has not yet been assigned The filtering of MTP device files doesn't evaluate user permissions correctly if more than one rule is configured with overlapping configurations for different user groups The command line command that is configured for network location change will be eecuted twice Self Service unlock not working correctly with "local administrators" group After connecting the USB stick, unlocking computers with Windows XP (with or without Self Service) will result in an "Unspecified Error" Administrators cannot edit settings "Encryption -> File Protection Settings" when using GPO and a license containing only device control (including Encryption-2-Go) DLSupportAgent does not work correctly with DNS alias DriveLock Web Security caused CPU to reach 100% in some scenarios Event reports can be opened in DCC, although access was remove for this user Encrypted containers cannot be re-opened using DLPersonal when using passwords with more than 32 characters MMC crashes when application hash database entries are deleted manually The memory leak of DriveLock Agent causes a growing memory usage if the computer has not been restarted for some time Active DriveLock AgentUI window freezes when activating temporary unlock via tray icon MMC crashes sometimes when searching for client computers Imported Self Service group (via CSV) shows values correctly in policy but is not working on clients Scheduled DCC reports with comple time schedule are not always send within the epected time frame 4 Known Issues This chapter contains known issues for this version of DriveLock. Familiarize yourself with the information in this chapter to avoid unnecessary effort during testing and deployment. 4.1 DriveLock ios and itunes DriveLock recognizes and controls current generation Apple devices (ipod, iphone, ipad, ipod Nano, etc.) For older Apple devices that are only recognized as USB drives no granular control of data transfers is available. 8

9 Known Issues DriveLock and itunes use similar multicast DNS responders for automatic device discovery in networks. When installing both DriveLock and itunes the installation order is important: If DriveLock has not been installed yet you can install itunes at any time. DriveLock can be installed at any later time without any special considerations. If DriveLock is already installed on a computer and you later install itunes you have to run the following command on the computer before you start the itunes installation: drivelock -stopdnssd. Without this step the itunes installation will fail. After an update of the ios operating system on a device, itunes will automatically start a full synchronization between the computer and the device. This synchronization will fail if DriveLock is configured to block any of the data being synchronized (photos, music, etc.). 4.2 Windows Portable Devices (WPD) Locking Portable devices prevented, that some Windows Mobile Devices could be synchronized via "Windows Mobile Device Center", although the special device was released in a whitelist. The reason was, that Windows Vista and higher used a new "User Mode Driver Framework" for these types of devices, which - caused by malfunctions could not be influenced by DriveLock. The synchronization did only work, if the device class was temporarily or in general released (not controlled be DriveLock). A new DriveLock driver managing portable devices the same way as other drives could not be released in earlier versions caused by the malfunctions. Now, for Windows 7, for Windows 8.1 by hotfi KB and for Windows 10 Version 1511 Microsoft corrected the malfunction. For Windows 8 and earlier versions of Windows 10 there is no fi available. With DriveLock and the DriveLock WPD driver is active on Windows 7 and Windows 8.1 but is inactive for Windows 8 and Windows 10. With DriveLock and the DriveLock WPD driver is active on Windows 10 Version 1511 too. Whitelisting for Windows Portable Devices will work only, if the DriveLock WPD driver is activated. Shadow copies are not yet supported for WPDs. 4.3 Installation of Management Components Using Group Policy Installing the DriveLock Management Console or the DriveLock Control Center by using Group Policy is not possible. Instead, use the DriveLock Installer to install these components as described in the Installation Guide. 4.4 DriveLock Agent Remote Control In DriveLock 7 the maimum number of Agents that can be displayed in the DriveLock Management Console for remote control is 500. To view a larger number of Agents, use the DriveLock Control Center instead to perform remote management tasks. 4.5 Automatic Updates and Application Launch Filter If the Application Launch Filter is configured for whitelist mode and a rule with the setting Allow automatic updates eists, updates may not install properly under certain conditions. As a workaround, create application rules for updates that don t use the program update.ee. 9

10 Known Issues 4.6 Manual Updates If other policy deployment than GPO is used, on Windows 8 and higher, a manual update of the DriveLock Agent will not finish properly, if you start the DriveLock Agent.msi from the Windows Eplorer (e.g. by double clicking). Run the MSI from an administrative command window with msieec or use DLSetup.ee. 4.7 DriveLock Disk Protection Antivirus protection software may cause the DriveLock Disk Protection installation to fail if the antivirus software quarantines files in the C:\SECURDSK folder. If this occurs please disable your antivirus protection for the duration of the Disk Protection installation and re-enable it after the installation is completed. We recommend that you configure your virus scanner with an eception for the C:\SECURDSK folder. When Installing DriveLock Disk Protection we strongly recommend that you deactivate the application control if they are active in the whitelist modus. This will prevent the blocking of programs that are necessary for the installation. On a small number of computer models the default DriveLock Disk Protection pre-boot environment configuration may not work correctly and cause the computer to become unresponsive. If this occurs turn off the computer and restart it while pressing the [Shift] key. When prompted select the option to use the 16-bit pre-boot operating environment. Hibernation will not work while a disk is encrypted or decrypted. After complete encryption or decryption windows has to be restarted once to make hibernate work again. UEFI mode Not all hardware vendors implement the complete UEFI functionality. We recommend not to use the UEFI mode with UEFI versions less than The full functionality of the Pre-Boot-Authentication (PBA) for UEFI is not yet available as for BIOS. Touchscreen is not supported. A hardware keyboard (USB or PS/2) is required. Mouse operation is not yet supported. Some PS/2 keyboards may work improperly. The PBA GUI is only available in English. Additional topics: Secure Boot must be deactivated up to version DriveLock and higher supports UEFI secure boot. Firmware updates may delete NVRAM values which are required by DriveLock. A 32 bit Windows operating system or 32 bit DriveLock cannot be installed on 64 bit capable hardware. Please use a 64 bit version of a Windows operating system and DriveLock instead. There is still a limitation to disks up to a maimum of 2 TB disk size. On some HP PCs Windows always will be set to position one again in the UEFI boot order and the DriveLock PBA has to be selected manually from the UEFI boot menu. In this case fast boot has to be switched off in UEFI to keep the DriveLock PBA at position one. Windows 10 Version 1703 (Creators Update) can remove the DriveLock boot entry from the UEFI boot menu while shutting down or when hibernating. Therefore the DriveLock PBA will no longer boot at the net startup and Windows cannot boot from the encrypted system hard disk. In August 2017 Microsoft released Update KB which resolves this issue. Update KB will be installed automatically by Windows or can be downloaded manually. 10

11 Known Issues Check if update KB or any later update that replaces KB is installed before you install DriveLock Disk Protection for UEFI. When upgrading to Windows 10 Version 1703 where DriveLock Disk Protection for UEFI is already installed, add update KB to the Creators Update before you upgrade. Due to an issue in Windows 10 Version 1709 and newer, DriveLock Disk Protection for BIOS cannot identify the correct disk if more than one hard disk is connected to the system. Therefore Disk Protection for BIOS is not yet released for Windows systems with more than one hard disk attached until Microsoft provides a fi for this issue. 4.8 DriveLock File Protection and Microsoft OneDrive With Microsoft OneDrive, Microsoft Office may synchronize directly with OneDrive instead of writing the file to the local folder first. Then the DriveLock encryption driver is not involved and the Office files will not be encrypted in the Cloud. To switch off the Office synchronization, uncheck Use Office 2016 to sync Office files that I open or similar settings in OneDrive. It must be assured, that Office files as other files always are stored locally. 4.9 Antivirus Antivirus generally Since DriveLock 7.8, the on-demand scanner (Cyren) will not be included any more. Customers with a valid Avira license/subscription can use the Avira scanner to scan eternal drives, until the subscription terminates. Avira Antivirus In the Windows Taskbar there may be shown two Avira icons. One of them comes from Avira Connect aka Avira Launcher which is not part of DriveLock with Avira Antivirus Self Service unlock Self Service unlock and Apple iphones If you use the Self Service wizard to unlock connected iphone devices, it will still be possible to copy pictures manually from the connected iphone after the unlock period ended. 5 DriveLock Documentation The DriveLock Documentation consists of the following manuals: DriveLock QuickStart Guide The QuickStart Guide describes the required steps to setup DriveLock using the DriveLock QuickStart setup wizard.the DriveLock QuickStart setup wizard can be used to simplify the installation and configuration of a basic DriveLock environment. DriveLock Installation Guide The Installation Guide describes the available installation packages, the system requirements and the steps for installing each DriveLock component. This is the first document a DriveLock administrator should read. DriveLock Administration Guide The Administration Guide describes the DriveLock architecture and components. It contains detailed 11

12 DriveLock Documentation instructions for configuring DriveLock using the DriveLock Management Console. This document is intended for DriveLock administrators who need to become familiar with all available DriveLock functionality. DriveLock Control Center User Guide This manual describes how to configure and use the DriveLock Control Center. This document is intended for administrators and users who will use DriveLock Control Center for reporting and forensic analysis. DriveLock User Guide The DriveLock User Guide is aimed at end users. It describes how to request the temporary unlocking of a computer, how to use DriveLock Encryption 2-Go and how to use Network Profiles. 6 Test Installation and Upgrade 6.1 DriveLock Evaluation You can install the DriveLock - the Agent, the Management Console, the Control Center, the Enterprise Service and Microsoft SQL Epress - on the same computer. This topology makes it easy to evaluate DriveLock s central reporting features using minimal hardware. If you downloaded the DriveLock software from the Web site ( a 30-day trial license is included. To evaluate DriveLock on a single computer, you don t need to perform any license configuration. If you install the DriveLock Agent on multiple client computers and configure DriveLock settings using Microsoft Group Policy, a Centrally Stored Policy or a configuration file or if you want to tests the Disk Protection too, you have to add a license key to the configuration. You can use the evaluation license key that is installed with DriveLock Management Console (by default, C:\Program Files\CenterTools\DriveLock MMC\Tools\AgentTrial.lic). 6.2 Updating DriveLock Components General Issues The DriveLock Installation Manual describes all steps that are required to update DriveLock to the current version. In addition, the Release Notes contain some important point to consider when performing an update Important Changes The DriveLock Management Console and the DriveLock Control Center are now installed in separate directories. This will prevent installation issues on computers when auto updating these components. The DriveLock Control Center uses some of the components of the DriveLock Management Console for the remote control functions. Always install identical versions of both Automatic Updates DriveLock <= V7.2 Before starting an automatic update from DriveLock <= 7.2, select the following two compatibility options for CDROM drives: 12

13 Test Installation and Upgrade Ensure that all Agents have applied this configuration change before publishing a new version of the DriveLock Agent. If you fail to apply this change, certain CD/DVD drivers may cause the computer to crash during an automatic update Automatic Updates for Windows XP Windows XP is not supported with DriveLock 7.5 to DriveLock As soon as DriveLock 7.5 or newer installation packages are published on the DriveLock Enterprise Service, the old (all DriveLock versions less than ) DriveLock Agent would download the DriveLock 7.5 installation package and start it, again and again, but would never succeed. Thus the automatic update must be switched off for Windows XP running DriveLock versions less than in this case With DriveLock installed on XP the update service will not download and start any installation package, if DriveLock 7.5 or newer installation packages are published. Thus the automatic update to V7.5 may be switched on and be used for the non XP platforms. Updates form DriveLock 7.3 to DriveLock 7.7 are not supported Updating DriveLock Disk Protection After the DriveLock Agent has been updated, an eisting DriveLock FDE installation will be updated automatically and without re-encryption to the most current version. After updating the FDE components, a reboot may be required. 13

14 Release Notes Die in diesen Unterlagen enthaltenen Angaben und Daten, einschließlich URLs und anderen Verweisen auf Internetwebsites, können ohne vorherige Ankündigung geändert werden. Die in den Beispielen verwendeten Firmen, Organisationen, Produkte, Personen und Ereignisse sind frei erfunden. Jede Ähnlichkeit mit bestehenden Firmen, Organisationen, Produkten, Personen oder Ereignissen ist rein zufällig. Die Verantwortung für die Beachtung aller geltenden Urheberrechte liegt allein beim Benutzer. Unabhängig von der Anwendbarkeit der entsprechenden Urheberrechtsgesetze darf ohne ausdrückliche schriftliche Erlaubnis der DriveLock SE kein Teil dieser Unterlagen für irgendwelche Zwecke vervielfältigt oder übertragen werden, unabhängig davon, auf welche Art und Weise oder mit welchen Mitteln, elektronisch oder mechanisch, dies geschieht. Es ist möglich, dass DriveLock SE Rechte an Patenten bzw. angemeldeten Patenten, an Marken, Urheberrechten oder sonstigem geistigen Eigentum besitzt, die sich auf den fachlichen Inhalt dieses Dokuments beziehen. Das Bereitstellen dieses Dokuments gibt Ihnen jedoch keinen Anspruch auf diese Patente, Marken, Urheberrechte oder auf sonstiges geistiges Eigentum, es sei denn, dies wird ausdrücklich in den schriftlichen Lizenzverträgen von DriveLock SE eingeräumt. Weitere in diesem Dokument aufgeführte tatsächliche Produktund Firmennamen können geschützte Marken ihrer jeweiligen Inhaber sein. Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the eample companies, organizations, products, domain names, addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. DriveLock and others are either registered trademarks or trademarks of DriveLock SE or its subsidiaries in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.