Symantec Endpoint Encryption Device Control Release Notes

Transcription

1 Symantec Endpoint Encryption Device Control Release Notes Symantec Endpoint Encryption Device Control About Symantec Endpoint Encryption Device Control Symantec Endpoint Encryption Device Control addresses the problem of outbound data leakage and incoming malware via storage devices and media. Its granular permissions allow administrators to restrict access to ports and/or devices without impacting productivity. Through its highly detailed auditing and querying, Symantec Endpoint Encryption Device Control provides administrators the ability to see both the impact of their policies on endpoints and user file transfers to storage devices. What s New Localization The client, Auditor, and User Guide are now available in French, German, Spanish, and Japanese. esata Controls New policy options allow administrators to control devices connected to esata ports built into the computer. Wireless Updates Device Control now enforces wireless policy on Windows Vista and Windows 7 clients. Administrators can choose to allow wireless networks that use WPA2 and WPA2-PSK. USB 3.0 Support This release adds support for USB 3.0 ports and devices. Apple ios Device Types Administrators can now control Apple ios devices by type. ExpressCard Management USB policies can be used to control ExpressCards.

2 Removable Storage Encryption You can use Device Control in conjunction with Symantec Endpoint Encryption Removable Storage or PGP Whole Disk Encryption 10.2 to require device encryption. CD/DVD Encryption You can block all CD/DVD burners except the Symantec Endpoint Encryption Removable Storage CD/DVD Burner application, ensuring the enforcement of encryption policy on optical media. Microsoft Excel 2003, 2007, and 2010 Support The Device Control Auditor now supports 32-bit versions of Microsoft Excel 2003, 2007, and Known Issues Compatibility Number Software Description Workaround MA19601 MA13625 Novell edirectory and 8.8 Cisco Aironet Client Utility Device Control Management Server The Device Control Management Server installation concludes with an unhandled win32 exception in slpd.exe. A specific known issue with Cisco Wireless Network adapters (when using the Cisco Aironet Client Utility) allows pre-configured WiFi networks to be accessed even when the Device Control policy restricts it. MA22547 MA19301 MA13630 After installing a Management Server using the option Join a Cluster, the following error may be displayed, Service is not running: Symantec Endpoint Encryption Device Control local service. SQL Server installations configured to utilize a collation other than Latin1_General_BINZ may cause the installation of the Device Control Management Server to fail with error On rare occasions the installation of the Device Control Management Server will fail with the message, Error Could not create password for database root user. Management Console MA23068 The following error may occasionally be displayed after Update Policy is selected from the Clients tab, Unable to contact Management Server. Click OK to restart Management Console. Visit support/viewcontent.do? externalid= Wait a few minutes for the service to start up. Do not configure SQL Server installations to utilize a collation other than Latin1_General_BINZ. Rerun the Device Control Management Server installation. Symantec Endpoint Encryption Device Control Page 2 of 5

3 MA22648 MA22663 MA21894 Device Control Client After failing and reattempting to upgrade the Management Server, the Management Console may throw an error following logon. In rare circumstances, the Clients tab may state incorrectly that the Initial policy is in effect on the client. Should a Windows XP user choose to write a series of individual files to a CD/DVD and include one or more ISO files in that series, none of the files written to the CD/DVD will be logged. MA23739 MA22418 MA23594 MA23958 MA22334 MA22878 MA23070 Device Control recognizes USB 3.0 controllers from certain vendors, such as NEC, as unclassified. GPO installations may fail on clients running Windows Installer 4.5. Third party CD/DVD burning applications may display messages confirming the success of a disk erasure operation even though Device Control policy blocks all CD/DVD burners except the Symantec Endpoint Encryption Removable Storage CD/DVD Burner application. Users with a user policy that allows CD/DVD access cannot access CDs or DVDs if the machine policy blocks CD/DVD access. If the machine policy allows CD/DVDs but a user with a policy that blocks access is logged on, another user with a policy that allows CD/DVD access cannot log on and access CDs or DVDs. On 64-bit editions of Windows 7, end user messages may incorrectly identify iphones as MT USB devices. Virtual volume files on hard drives encrypted using GuardianEdge Device Control Standard Edition cannot be decrypted using Symantec Endpoint Encryption Device Control or later. Devices encrypted by previous versions may occasionally fail to display a lock icon overlay in Windows Explorer. Uninstall the Management Server and reinstall using the Restore option. Reboot the client to refresh the Clients tab data. Set the policy for unclassified devices as desired to either block or allow the devices. Refer to Request and apply the hotfix from Microsoft. Check the disc to confirm that the data was not really erased. If certain users must be able to access CDs and DVDs, the machine policy must also allow access to CDs and DVDs. Reboot the computer. Decrypt encrypted virtual volume files prior to upgrade. Symantec Endpoint Encryption Device Control Page 3 of 5

4 MA21810 MA17039 MA13629 MA13636 Auditor A blank error message will be displayed if an incorrect uninstallation password is provided on a Vista computer. If a user attempts to overwrite a file located on their hard drive or removable storage device and the operation is prohibited by file control, the operation will fail and the file located in the intended destination will be deleted. During the Device Control client installation process, the network connection will get disconnected for a few seconds. If the installation or uninstall of the Device Control client is interrupted (for example, due to a reboot or a power failure), it may cause a corrupted installation of the client. This may leave some devices in a blocked state. MA13649 MA13650 MA13651 MA13653 MA13654 On rare occasions, if an Active Directory OU structure is changed (e.g., a computer is deleted from that OU) at the time that the Auditor is browsing the OU, the Auditor Browse for OU screen may freeze. If the computer on which the Auditor is installed is not connected to the domain, but the Change User option is used to run Auditor on a domain environment with a domain user, then the login will be successful but devices will not be found in the audit results. This is due to an operating system impersonation issue. On rare occasions, aborting a scan repeatedly may corrupt the resulting report, creating an empty report file. On some occasions, when viewing the Auditor Excel summary report, the column that summarizes the number of currently connected devices will be empty. When two devices with the same vendor ID and product ID but with different distinct IDs are connected simultaneously to the same endpoint, only one of the devices will appear in the scan report as being currently connected; the second device will appear as being previously connected. Click OK and try again, with the correct password. Add the appropriate parameters to the Device Control Client configuration file (SCC). See the Device Control Installation Guide. Shut down and restart the Auditor. Rerun the report. Symantec Endpoint Encryption Device Control Page 4 of 5

5 Legal Notice Copyright 2011 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. GuardianEdge is either a registered trademark or trademark of GuardianEdge Technologies Inc. (now part of Symantec) in the U.S. and/or other countries. Other names may be trademarks of their respective owners. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section Commercial Computer Software - Restricted Rights and DFARS , Rights in Commercial Computer Software or Commercial Computer Software Documentation, as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED AS IS AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. Symantec Corporation 350 Ellis Street Mountain View, CA Symantec Endpoint Encryption Device Control Page 5 of 5