ProtectDrive Release Notes

Transcription

1 Version: Build 05 Release Notes Issue Date: August 23, 2012 Product Description ProtectDrive Release Notes ProtectDrive is hard disk encryption software for securing sensitive data. ProtectDrive provides pre-boot authentication, and once installed, it can be configured to encrypt and decrypt data transparently. The pre-boot feature prevents unauthorized users from gaining access to the operating system and sensitive information. ProtectDrive is ideally suited for large scale enterprise deployment as it offers centralized management for token, smart card and password users. For maximized protection, the encryption of removable media, such as USB thumb drives, is also supported. ProtectDrive is available in two variants ProtectDrive and ProtectDrive for Servers. ProtectDrive This standard edition is targeted for workstations and laptops. ProtectDrive for Servers This edition is targeted for server operating systems. Servers have unique full disk encryption requirements compared to workstations and laptops. For example, server environments often utilize RAID systems, where multiple parallel disks achieve the highest scalability and continuity requirements. Furthermore, RAID systems permit disk disconnection, while maintaining system operation. ProtectDrive for Servers operates seamlessly with hardware-based RAID systems, rendering removable disks unreadable to unauthorized parties outside of the original (or recovered) server system. Note: ProtectDrive is FIPS compliant. Release Description This is the release submitted for FIPS approval (Level 2 on Windows XP SP2, and Level 1 on Windows XP SP3, and Windows and 64-bit editions) SafeNet, Inc. All rights reserved. Page 1 of 7

2 Released Components ProtectDrive for Windows Server 2003, Windows Server 2008, and Windows 7, XP, and Vista: Supported Platforms for Client Management (on Server) Windows Server 2003, Service Pack 2 (32-bit and 64-bit) Windows Server 2003 R2, Service Pack 2 (32-bit and 64-bit) Windows Server 2008, Service Pack 2 (32-bit and 64-bit) Windows Server 2008 R2, Service Pack 1 Supported Platforms for Client Windows Server 2003, Service Pack 2 (32-bit and 64-bit) Windows Server 2003 R2, Service Pack 2 (32-bit and 64-bit) Windows Server 2008, Service Pack 2 (32-bit and 64-bit) Windows Server 2008 R2, Service Pack 1 Windows XP Professional, Service Pack 2 or 3 (32-bit only) Windows Vista, Service Pack 2 (32-bit and 64-bit) Windows 7, all editions (32-bit and 64-bit) Advisory Notes The Change\Modify functionality is no longer available from the Add\Remove Program Group or Program and Features to remove pre-boot authentication components. It is not recommended to use legacy pre-boot for token authentication on Notebooks using AMD processors. Hibernation On Windows machines, it is not recommended to allow hibernation prior to the first restart after ProtectDrive is installed. On Windows Vista machines, it is not recommended to enable hibernation when pre-boot authentication is deactivated. Virus protection software may cause the ProtectDrive installation to fail. It has been observed that this is due to the quarantining of files in the C:\SECURDSK folder by the AVS. If this occurs, disable virus protection for the duration of the ProtectDrive installation. It is strongly recommended that all machines upgrading ProtectDrive run chkdsk /f and Windows Defrag before upgrading from previous versions of ProtectDrive SafeNet, Inc. All rights reserved. Page 2 of 7

3 It has been observed that BIOS legacy USB support for USB keyboards and mice on some computers interferes with the ProtectDrive USB stack, and can prevent two-factor authentication from completing successfully. If this occurs, disable the legacy support for USB keyboards and mice in the BIOS. On a small number of systems, the default ProtectDrive pre-boot environment configuration may not work, and the system may be unresponsive. If this occurs, simply recycle system power while holding down the [Shift] key to adjust ProtectDrive pre-boot settings. To make this adjustment permanent, contact SafeNet 24-hour Technical Support for instructions. Additionally, Technical Support maintains an extensive list of systems that ProtectDrive has been tested against, which SafeNet has validated that no pre-boot adjustment is necessary. For emergency logon recovery, the Remote Recovery Console (rpadmin.exe) can only be run from a machine that has the PdMaster.cer file located in the Personal Store. It is not recommended to run disk recovery using recovery files from a write-protected media (for example, a CD-ROM). RapidRecovery, using the WinPE iso as described in the documentation, works fine only for machines that have ProtectDrive installed on the system partition that has the value HarddiskVolume1. If the value of the system partition that contains the encryption store information is different than HarddiskVolume1, please contact SafeNet Tech Support for the resolution actions. Modifying a Client Install to include server management components will delete the MSO certificate from the personal certificate store of the machine account. After the modify operation has completed and the Server management components have been installed, the MSO certificate must be installed manually in the machine personal store. The etoken 72K Java is supported when initialized with the PKI Client version 5.1 only. The other etoken Pro versions are supported when initialized with earlier PKI Client versions. ADAM Replication Depending on the replica unavailability pattern, binding attempts may take longer than usual, particularly affecting ProtectDrive Management Console/Local Management Console start and client update during logon. Replica unavailability pattern means how exactly the replica instance is unavailable. For example, if its host machine is up, but the appropriate replica service is down, the process will not take as long as when the host machine itself is down SafeNet, Inc. All rights reserved. Page 3 of 7

4 An etoken PRO Anywhere token that is initialized and enrolled with TMS is not detected at pre-boot authentication. If it is initialized and enrolled using either RTE or SAC, the token is enrolled like any other 72k Java token without issue. ProtectDrive Management Console Limit the number of users/groups to 600. Removable Media When ProtectDrive is installed on Windows Vista, and removable media is inserted, a prompt to format displays. Ignore this prompt. Partial List of Issues Resolved in this Release Severity Classification Definition C Critical No reasonable workaround exists H High Reasonable workaround exists M Medium Medium level priority problems L Low Lowest level priority problems Issue Severity Synopsis M H H H These issues involved several ACS error messages that occurred, which involved inappropriate handling of EFS access- processing errors produced by contention for access to the physical disk. (For example, this would occur if PhysicalDrive0 is concurrently opened by the Windows dskprobe utility.) In previous versions of ProtectDrive, an EFS_Format was undertaken in response to these errors. Now, disk contentions are tolerated without attempting to format SafeNet, Inc. All rights reserved. Page 4 of 7

5 Known Issues and Workarounds in this Release Issue Synopsis Summary: The Aladdin smart card and DKR830 are not PBA compatible. Workaround: Upgrade the firmware on the reader to version Summary: Systems with the C: drive on Disk1 does not support ProtectDrive install. Workaround: Ensure the C: drive is on Disk0 prior to ProtectDrive installation Summary: On some systems, inserting encrypted removable media may result in a prompt to format the device. Workaround: This prompt can be safely ignored. The device can be unlocked as usual Summary: Unable to install ProtectDrive after ProtectDrive Admin Tools have been installed on a server. Workaround: Uninstall ProtectDrive Admin Tools. Perform a custom reinstall of the Client and Admin Tools Summary: Using the wrong CAC smart card with a correct PIN results in the appropriate error, but then switching to the correct smart card and using the correct PIN results in the same error (Omnikey 3121 card readers only). Workaround: Enter the correct PIN a second time with the correct smart card Summary: Single Sign-on to Windows does not work when using PIN at pre-boot for a biometrics-enabled smart card. Workaround: Use the standard Windows GINA for PIN logon Summary: Single Sign-on to Windows does not work when using fingerprint login at preboot. Workaround: Use the standard Windows GINA for PIN logon Summary: Vista Cannot click Change option in Uninstall or change programs. Workaround: Open a command line window (run as administrator), launch the MSI file using MsiExec.exe, and specify the change option Summary: Unsuccessful GPO uninstall of ProtectDrive for clients in an ADAM configuration. Workaround: Uninstall ProtectDrive manually Summary: Unnecessary error messages in Windows Application Event Logs after ProtectDrive server installation. Workaround: Ignore these messages Summary: Pre-boot fails to detect USB devices used in SuperSpeed 3.0 ports Workaround: Use alternative USB 2.0 ports SafeNet, Inc. All rights reserved. Page 5 of 7

6 Issue Synopsis Summary: HP Z400 Workstation fails to load 32-bit pre-boot authentication when USB device(s) are attached. Workaround: Detach all USB devices (typically, only the mouse and keyboard will need to be detached) Summary: Uninstallation of ProtectDrive on 64-bit Vista leaves residual files on the system. Workaround: Remove residual "C:\Program Files\SafeNet ProtectDrive" folder after ProtectDrive de-installation under 64-bit Windows Vista Summary: Java etoken (72k) is not recognized if it remains in the USB slot after rebooting from Windows. Workaround: Shut down or power off the machine completely, and then try using the token again Summary: Installation may report "License Manager failed to initialize system" on 64-bit Windows Vista system. Workaround: Install with msiexec /i <*.msi> /qb. The message will still display, but the installation will complete Summary: ProtectDrive performs double prompting to encrypt in case of empty SD card reader insertion Workaround: Ignore the duplicate prompt Summary: ProtectDrive repeatedly performs XML importing after installation with invalid PDConfig.XML. Workaround: Ensure that the PDConfig.XML is valid. If installed with an invalid XML, delete the PDConfig.XML from the folder where ProtectDrive is installed Summary: Uninstall fails to remove PBA when the MSI file is run directly, permissions/uac problem. Workaround: Use the Remove option rather than the Change option in Control Panel > Add/Remove Programs or Programs and Features. Summary: Users are not added to the PD Users tab when logging in using Dell Wave tile. Workaround: Remove the Dell ControlPoint Security Manager via Programs and Features SafeNet, Inc. All rights reserved. Page 6 of 7

7 Publications The publications associated with this release are: ProtectDrive Standard Documentation ProtectDrive Enterprise Version Administration Guide, (Rev E, August 2012) ProtectDrive User Manual, (Rev E, August 2012) ProtectDrive for Servers Documentation ProtectDrive for Servers Administration Guide, (Rev E, August 2012) ProtectDrive for Servers User Manual, (Rev E, August 2012) ProtectDrive and RapidRecovery are SafeNet, Inc. trademarks. Rev A 2012 SafeNet, Inc. All rights reserved. Page 7 of 7