Metalogix ControlPoint 7.6 October 2018 These release notes provide information about the latest Metalogix ControlPoint release. New Features Resolved Issues Known Issues About Us New Features Version 7.6 of introduces the following features: Sensitive Content Manager (SCM) functionality in ControlPoint includes the following enhancements: The Analyze Content action now supports multi-level selection. One new out-of-the-box SCM Profile and several Search Terms have been added, largely targeted towards General Data Protection Regulation (GDPR) compliance. You can now create and manage your own custom SCM profiles and search terms from within ControlPoint. You can now more effectively manage the SCM jobs that have been submitted for content analysis. In addition to being able to filter displayed jobs by status and date range, you can also resubmit and delete jobs. SCM reports have been added that identify content analysis jobs either for a selected scope or by search term(s). When an SCM job is first submitted for analysis, a job-specific ControlPoint Task Audit is generated. ControlPoint maintains Task Audit details over the life of the job. The GDPR Dashboard provides an overview of how your organization is using ControlPoint functionality (Audit Settings, Sensitive Content Manager, Governance Policies, etc.) to manage regulation-sensitive areas of your SharePoint environment. Governance Policies now take effect immediately upon creation instead of waiting for the next run of the ControlPoint Scheduled Job Review timer job. 1
Resolved Issues The following is a list of issues addressed in this release. Work Item Case No. The issue ControlPoint Policy for SCM does not alert users when 356586 00159130 371434 327759 00155148 352129 00160934 346002 00158358 341100 00154547 policy is triggered has been resolved. The issue Compliance Scans Cannot Process a File with an Invalid User as the Author or Editor in SharePoint Online has been resolved. The issue Cannot delete wildcard permissions using custom DB name has been resolved. The issue User with security override (ACTSECOVRW) cannot perform Add User to SharePoint Group action has been resolved The issue User/document activity report returning no results, this appears to be down the SQL query we generate is giving -1 for the partion_id has been resolved. The issue Most/Least Activity Report Least Active Sites does not list all sites correctly has been resolved. 00159965 001608600 016243500 00162184 The issue Delete User Permissions does not delete SharePoint 328869 00154269 352750 00161179 item alerts has been resolved. The issue Governance Policy Manager Scope does not include Children added after Creation has been resolved. 00164466 2
Known Issues The following is a list of issues, including those issues attributed to third-party products, known to exist at the time of release. Installation and Configuration If the Service Account password fails the initial validation, it is not re- 2692 validated after being corrected. Workaround: Abort then restart the installation. If ControlPoint is uninstalled using an account that does not have 3111 sysadmin privileges, any existing ControlPoint Policies cannot be removed. Workaround if you want to delete existing ControlPoint Policies:? Before uninstalling ControlPoint, delete the policies using Manage ControlPoint Policies. OR? Uninstall ControlPoint using an account that has sysadmin privileges. The Launch ControlPoint shortcut is not removed from the desktop when 2694 ControlPoint is uninstalled. Workaround: Delete the shortcut manually. When performing an upgrade, the Upgrade option may be missing 177502 from the Configuration Wizard. Workaround: Run a Manual Install. Contact Quest Support for details. Native 2016 Edition: At the end of the installation process, a pop-up 212519 dialog with the message The system cannot find the file specified displays. Note that this message is benign and can be dismissed. Login and Security Trimming When Firefox or Chrome is used as the browser, the Sign out option 1764) refreshes the page but does not sign the user out. (Work Item Workaround: This is not an issue with Internet Explorer. 3
If a ControlPoint user has permissions to SharePoint sites only through a web application Full Control permission policy, and this permission was granted after the initial run of ControlPoint Discovery, site collections and sites within that web application will not display in Search Hierarchy results if cached data is used. Workaround: Before running Discovery, give the user any level of permissions to any site within each site collection in the web application. Only then will Discovery be able to discover that the user has Site Collection Admin rights via the web application policy. After the next Discovery run has finished, you can remove the sitelevel permissions. Business Administrators Functionality Members of the Business Administrators group can run live permissions 1459 reports even when the ControlPoint Setting "BAPreventRealTime" is set to True. For SharePoint 2010 Claims-enabled web applications, members of the 5009 Business Administrators group cannot access sites to which they have permissions if those permissions are granted via an Active Directory Group. Workaround: Grant the user permissions to the site(s) directly. User Interface The Clone Work Area in the new browser window does not work for 7768 dashboard links due to the Selection tab being empty. For a SharePoint 2013 farm: When Chrome is used as the browser, the SharePoint Hierarchy may not be expandable. Workaround: Refresh the browser or invoke a ControlPoint operation from the left navigation pane (to trigger an event). Note that it is not necessary to actually run the operation. For a SharePoint 2013 farm: The first time ControlPoint is invoked after an upgrade, the dashboard may not display in the main page. Workaround: Refresh your browser. 4
When running ControlPoint on a SharePoint 2013 farm using Internet Explorer 8, Charts for the Top Site Collections By Size and Sites Created In the Last 30 Days are not displayed correctly in the Dashboard. This is not an issue with other versions of Internet Explorer or with Chrome or Firefox. Reports do not render on SP 2010 w/ie11 or SP 2007 w/ie 10 and 6008 Compatibility View off. (Work Item 3740, Work Item 4200, Work Item 5851, Work Item 5713 Workaround: Turn Compatibility View on or use different browser. When using Internet Explorer build 11.0.9600.18617, report results do 274025 not fill the entire results section. Workaround: Use a different build of Internet Explorer or a different browser ControlPoint Policies SP2007: When using the Control File Upload by Type policy, excluded 10316 extensions are being uploaded and the policy is not enforced. (Work Item ) When using IE with Compatibility View turned off, when the policy rule 9576 Control Document/Item deletion is selected, the Allow Attachments to be Deleted checkbox is disabled. (Work Item ) Workaround: Turn Compatibility View on or use a different browser. Permissions Operations When a Set SharePoint Group Permissions action is run with the 133981 parameter Propagate to all items with unique permissions checked, the permissions level is not propagated to the items. The Manage Permissions Inheritance action fails to restore inheritance at 188506 the list item level. 5
Copy/Move When a Move action is run in real time, the Delete Site action is not created at the source. Workaround: Run the action as a scheduled job. 2013 Native Edition: An issue was reported with copying a Site Collection 4089 to a new location. 2016 Native Edition: The Move Site Collection to Another Content 212514 Database action cannot be completed and an exception is raised. Operations Involving Workflows Reusable workflows are not being migrated during the following 1596 ControlPoint operations: Copy/Move Site, Copy/Move List, and Duplicate Workflow Definition. In a SharePoint 2010 Native Edition installation, a cross-farm Copy/Move 8008 List operation fails with access denied error when including workflows. Operations Involving Managed Metadata In a SharePoint 2010 environment, when a ControlPoint Managed Metadata operation (such as Create Managed Metadata or Set Metadata Value) is run. Managed Metadata terms that were selected in the Parameters section may not be validated, and the message There was an error processing the request may display. Workaround: Make sure that the SharePoint August 2013 Cumulative Update has been applied. Site Provisioning When running SQL Server 2012, you may not be able to create a custom 5108 template for a site collection using a 2013 Experience. Workaround: Install Microsoft SQL Server 2012 SP1 Reporting Services Add-in for Microsoft SharePoint, which can be found at http://www.microsoft.com/en-us/download/details.aspx?id=35583 6
Site Provisioning errors when using an https url. 190522 Compliance Functionality (Sensitive Content Manager) Native Editions: When a ControlPoint Compliance Action is created and 263018 the Alert Users box is checked and a user is selected, a Now exact match was found message displays. ( Workaround: Make sure you select the version of the user name that includes the Claims prefix. The Analyze Content grid does not always accurately reflect the status of 264120 a scan job. Workaround: Re-invoke the Manage Quarantined Documents page from the SharePoint Hierarchy. After a rule is applied to a scan, the page is refreshed and the scan 133975 details are not visible. 2013 Standard Edition: When Chrome is used as the browser and a 226272 member of the Compliance Administrators group attempts to initiate a Compliance action, a pop-up message displays that the user must be a member of the Compliance Administrators group. Workaround: Either try logging out and logging back in or use a different browser. The Detailed Actions Taken Analysis Search function does not filter 263014) results properly. Unable to Classify files display as Undetectable in the exported file. 232918) When a ControlPoint Policy to scan content is created, the compliance 259933 action is to remove content, and the ControlPoint Setting Add Scan Results Column to Scanned SharePoint List is set to true, an error is logged when the remove content and add column activities conflict The ControlPoint Policy Scan item for sensitive data when content is 262609 added fails when "Require documents to be checked out " is enabled. If a file is rescanned after its name has changed and Scanned Files by 372208 Scope is run using real-time data, the file displays twice in report results, with both the old and new name. 7
ControlPoint Sentinel for Anomolous Activity The ControlPoint Anomalous Activity Detection timer job is not created in 10447 Central Administration upon an upgrade. (Work Item ) Workaround: To add the timer job, re-run the ControlPoint Installer as a Repair. OR Have Anomalous Activity detection performed as part of the ControlPoint Scheduled Job Review. Refer to the topic Preparing Your Environment for Using ControlPoint Sentinel in the ControlPoint User Guide for details. Reports When a report is run on real-time data, only the first page of results that 314973 are visible in the UI is exported. Workaround: If you schedule the report, full results will be included in the output file. If the ControlPoint Setting Display URL Instead of Site Name in 371973 SharePoint Hierarchy (SHOWURLASTITLE) is enabled, the site collection/site name is also replaced by the URL in reports using real-time (non-cached) data. When running a Duplicate Files report, subsites might not be considered 9424 in the results. SP2013: The site link in the site properties report does not correspond to 9579 the correct site. SP2010/2013 Standard and Native: When running a Site Activity 9995 Analysis with default parameters, i.e. Farm Scope, the report only displays sites with activity. Existing sites without activity are not included. If a ControlPoint Task Audit is run, the expand/collapse option for the report will not work correctly. The report will be displayed in expanded format, no matter if that option was checked or not. Change Log analyses return a maximum of 2000 results. 9412 9409 1455) Workaround: Run the analysis on smaller scopes 8
When a Most/Least Activity report is scheduled with one or more (but 2481 not all) Include Report: options selected, and the Output Type is SharePoint List, a separate list is created for each Include Report option. Empty lists are created for options that were not selected. Trend analysis for Activity returns results only when Discovery is run on 134560 one or more targeted site collections. All users listed as "Inactive" in a 2010 ADFS Environment. ControlPoint s 3409 Inactive Users report essentially compares results of two other reports. The total users list generated by a Site Permissions report is run against the total list of users with activity, as determined by Activity by User. An environment with only 2010 ADFS users is erroneously reporting all users inactive. In a SharePoint 2007 environment, Active Directory group users Display 134372 Names are not listed in the Inactive Users report. The Site Collection Properties lists only site-level features, and lists no 134238 features when the Limit reports to site collections with the following features filter is applied. ControlPoint for Office 365 (ControlPoint Online) If a Permissions analysis is run with the Show External Users Only option 292366 selected, both internal and external users are included in analysis results. NOTE: This issue generally occurs only when the logged in user is not an Office 365 Global Administrator. In SharePoint Hierarchy Report results, subsites of a site in one site 300422 collection may show the results of other sites on a different site collections. If the server on which ControlPoint is installed is rebooted, results of analyses (including the ControlPoint Task Audit) that are run in real time fail to render in the ControlPoint application interface. Instead, the message An unanticipated error has occurred displays. Workaround: On the server on which ControlPoint is installed, open IIS Manager and recycle the MetalogixOnline Application Pool. Users specified in the ControlPoint Setting ExculdedUsersAudit are not 1450 actually being excluded from the Audit Log analysis. 9
When you open an item in the ControlPoint Configuration Setting list for editing, a blank Title field displays and will not allow you to save your changes until it is populated. Workaround: Copy the Parameter Name to Title field before saving or use the ControlPoint Settings page in the application interface. Sites migrated from BPOS (pre Office365) are not visible in ControlPoint. 7977 About Us We are more than just a name We are on a quest to make your information technology work harder for you. That is why we build community-driven software solutions that help you spend less time on IT administration and more time on business innovation. We help you modernize your data center, get you to the cloud quicker and provide the expertise, security and accessibility you need to grow your data-driven business. Combined with Quest s invitation to the global community to be a part of its innovation, and our firm commitment to ensuring customer satisfaction, we continue to deliver solutions that have a real impact on our customers today and leave a legacy we are proud of. We are challenging the status quo by transforming into a new software company. And as your partner, we work tirelessly to make sure your information technology is designed for you and by you. This is our mission, and we are in this together. Welcome to a new Quest. You are invited to Join the Innovation. Our brand, our vision. Together. Our logo reflects our story: innovation, community and support. An important part of this story begins with the letter Q. It is a perfect circle, representing our commitment to technological precision and strength. The space in the Q itself symbolizes our need to add the missing piece you to the community, to the new Quest. Contacting Quest For sales or other inquiries, visit www.quest.com/contact. Technical Support Resources Technical support is available to Quest customers with a valid maintenance contract and customers who have trial versions. You can access the Quest Support Portal at https://support.quest.com The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. The Support Portal enables you to: Submit and manage a Service Request View Knowledge Base articles 10
Sign up for product notifications Download software and technical documentation View how-to-videos Engage in community discussions Chat with support engineers online View services to assist you with your product 11
Copyright This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Quest Software Inc. The information in this document is provided in connection with Quest Software products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest Software products. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST SOFTWARE ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. IN NO EVENT SHALL QUEST SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST SOFTWARE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest Software makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Quest Software does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Quest Software Inc. Attn: LEGAL Dept. 4 Polaris Way Aliso Viejo, CA 92656 Refer to our Web site (https://www.quest.com) for regional and international office information. Patents Quest Software is proud of our advanced technology. Patents and pending patents may apply to this product. For the most current information about applicable patents for this product, please visit our website at https://www.quest.com/legal. Trademarks Quest, the Quest logo, and Metalogix are trademarks and registered trademarks of Quest Software Inc. and its affiliates. For a complete list of Quest marks, visit https://www.quest.com/legal/trademark-information.aspx. All other trademarks and registered trademarks are the property of their respective owners. 12
Metalogix ControlPoint Updated October 2018 Version 7.6 13