Dell Security Explorer 9.6

Transcription

1 Dell June 2015 These release notes provide information about Dell. About New features Resolved issues Known issues System requirements Product licensing Getting started with Security Explorer Globalization Third-party contributions About Dell About Security Explorer provides a single console for managing access controls, permissions, and security across Microsoft platforms that span multiple servers. The product provides a broad array of security enhancements including the ability to identify who has rights to resources across the entire organization. It also provides the ability to grant, revoke, clone, modify, and overwrite permissions quickly and from a central location. Unlike native tools, Security Explorer provides the ability to back up and restore permissions only, ensuring the integrity of data. To help meet auditing requirements, Security Explorer provides convenient reports that can be generated at your convenience. Lastly, the product s cleanup capabilities address common post-migration security issues. is a minor release, with enhanced features and functionality. See New features. New features New features in : Additional supported platforms for NTFS Security, Share Security, and Group & User Management: Dell Fluid File System (FluidFS) NetApp 8.3 EMC Isilon EMC Celerra EMC VNX 1

2 New licensing For, you must have a Dell license file (.dlv) or a Site Administrator QLL license file (*asc). Your previous licenses will not be recognized by version 9.6. The license utility that updated old licenses has been removed from the Autorun. Add alternate credentials for NAS devices Security Explorer Tools Options now has a NAS devices tab where you can set alternate credentials for network-attached storage (NAS) devices. Use alternate credentials to specify additional accounts that have administrative privileges to various NAS devices on your network. Each account in the list is tried in the order listed until an account is found with sufficient privileges. If no account is found with administrative privileges, Access Denied is displayed. Search Active Directory for users and groups The Active Directory tree is now part of the Search Scope in the Group and User Management module. You can select organizational units and containers to search the computers for local groups and users, or you can select individual computers. To search for domain users and groups, use the Network node. Use multiple wildcards when restoring In the NTFS Security module, you can use multiple wildcards when restricting the permissions to restore. Use commas to separate multiple wildcards. Use the * wildcard to match any number of characters. Use the? wildcard to match a single character. Set new advanced restore options The Advanced Restore Settings option is redesigned. To help you find and select parts of the backup file to restore, you can filter the path and the accounts. If the backup file is exceptionally large, you can filter the backup file to load only a portion of the file. You also can choose to apply the path filters to root paths only, which is useful if you have a large number of root paths in your backup file. Alternatively, you can apply the path filters to all paths except the root paths, which is useful if you have a large backup in a more complicated tree-like structure. Filtered out permissions do not display and are not restored. With the new restore mode, you can overwrite all permissions, restore permissions only for accounts from the backup file, or add permissions from the backup file to the existing permissions. In any case, the restore process skips paths for which no permissions are loaded from the backup, so those permissions remain unchanged. With the new scope mode, you can restore permissions for only the paths and subpaths that are visible and selected in the tree, or for all subpaths of the paths selected in the tree, including those that are filtered out or not selected. Search by SID When defining search criteria in the NTFS Security module, you can now include the SID. Type a full or partial SID on the Group and user search criteria tab. You can use the * wildcard to match any number of characters and the? wildcard to match a single character. The comparison is not case sensitive. Searching by SID is helpful for locating deleted accounts by pair the SID search with Search for unknown accounts. You also can pair the SID search with Include group results, Include user results, Search for permissions (DACL), and Search for owner to help you find accounts. Revoke permissions using SID history When searching for permissions to revoke, you can choose to include the SID history search. Since there may be more than one SID associated with the selected account, selecting to include the SID history search adds all existing SIDs to the List of users and groups to revoke list so that all existing permissions are revoked. Filter the display of modules You can choose to filter the list of modules that display. Select View Filters, and point to Filters to view the filter selections. You can choose All, None, or select specific modules to display. Skip subfolders and files when processing This Folder Only permissions By default, child items under the parent folder are processed when granting or deleting the This Folder Only permission. On the Tools Options Advanced tab, you can now choose to skip processing child items when granting or deleting the This Folder Only permission, which may speed up the process. Note that if you do choose to skip subfolder processing, any existing inheritance issues are not corrected automatically as part of the processing. Manage SMTP addresses for mailbox users Security Explorer provided management of SMTP addresses for contacts, mail users, and distribution groups. With version 9.6, mailbox users are also included. You can add many addresses, but only one address is designated as the primary address. Restore to different path in SharePoint Security module In, you now can restore permissions to a different path even if the site structures are different. Permissions are restored only for site items that are identical. Site items that do not match are ignored. Remove Remote Registry service You no longer need to start the Remote Registry service on remote servers running SQL Server to manage permissions. 2

3 Support automatic and manual triggered starts The Service Security module now supports automatic and manual triggered starts. Remove Security Explorer settings When uninstalling Security Explorer, you now have the option of removing the folders that contain saved settings, such as search criteria, alternate credentials, favorites, and enterprise scopes. Use context-sensitive help When you access Security Explorer help, you now see a help page that is pertinent to the dialog box you are inquiring about. See also: Resolved issues Resolved issues The following is a list of issues addressed in this release. Table 1. General resolved issues Path and Applies to columns are parsed incorrectly for saving search results When printing with the option Use column widths from main window display checked, you receive Error: Index out of range Cannot grant Replace permissions from Windows context menu Table 2. NTFS Security resolved issues The Progress window goes through all subfolders and files when permissions are granted and the This folder only checkbox is selected Permissions are not restored for NAS devices if local account permissions exist Table 3. Group & User Management resolved issues User description disappears after pre-windows 2000 name was edited Impossible to display user memberships after pre-windows 2000 name was edited Table 4. SQL Security resolved issues It is necessary to restart the Remote Registry service, if it was not used for more than several minutes, to see SQL Server instances installed on Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R Table 5. Exchange Security resolved issues 3

4 The Revoke Disabled and Revoke Unknown tasks do not work for Public Folders Table 6. SharePoint Security resolved issues Restore to different path does not work for lists Cannot change Active Directory permissions under alternate credentials Restoring permissions to a different path can work only if the source and target sites are identical. If one site item is different, permissions cannot be restored to all site items. Table 7. Task Management resolved issues Cannot set Active Directory group accounts to task user accounts Cannot copy tasks configured to run with group accounts Table 8. Dell Fluid FS support resolved issues Security Explorer cannot get the local groups list in all modules Cannot see Group Contents for local groups Group and User Management: Cannot create new local users and groups Group and User Management: Cannot delete local users Group and User Management: Cannot see the local groups list in the Select account dialog box. Group and User Management: Domain Group appears in Group Properties dialog box Group and User Management: Error occurs in the Clear Local Admin task Group and User Management: Memberships list is empty NTFS Security: Cannot see Group Contents for local groups NTFS Security: Cannot see Memberships for local users after selecting a container NTFS Security: Cannot rename local accounts NTFS Security: Cannot search for permissions on the root NTFS Security: In the Search function, an error occurs after selecting a local user and enabling the Include all group memberships checkbox NTFS Security: An error occurs after attempting to create a share NTFS Security and Share Security: It is impossible to add any user (domain or local) into a local group NTFS Security: Cannot back up security when the Include SACL checkbox is selected NTFS Security and Share Security: Cannot search for disabled accounts Table 9. NetApp support resolved issues 4

5 Command line utilities cannot work with NetApp users PowerShell commandlets cannot work with NetApp shares in Clustered mode PowerShell commandlets cannot work with NetApp users Known issues The following is a list of issues, including those attributed to third-party products, known to exist at the time of release. Table 10. Known issues Known issue NTFS Security: The Revoke Disabled/Unknown task doesn't work for files Cannot create a mailbox for a new user if Exchange 2013 is in the mode: Active Directory split permission security model to the Exchange organization SharePoint Security: Permission levels cannot be renamed SharePoint Security: Permission level is not created when restoring permissions using subpath (list, folder, item) as source and target. SharePoint Security: Domain users and groups cannot be set as owner for SharePoint groups. NTFS Security: For Isilon and Dell Fluid File System (FluidFS), there is an error in Search after enabling the Include nested group memberships check box. NTFS Security: SACL is not restored to different path or when using the Add restore mode. NTFS Security: Search by logon name without domain name cannot return permissions for accounts in child domain of trusted forest. NTFS Security: In the Advanced Restore options, the scope mode works incorrectly for files. Group and User Management: Cannot simultaneously grant/revoke/add to group two users if the logon name of one matches the full name of the other. PoweShell Cmdlets and CmdUtils: Impossible to Grant/Revoke/Clone permissions for account names without the domain name for accounts in trusted domain. NTFS Security: For NetApp 8.3, cannot search permissions with the device as search scope System requirements Before installing, ensure that your system meets the following minimum hardware and software requirements. Hardware requirements Software requirements Supported platforms for Security Explorer User privilege requirements 5

6 Required software for Microsoft Exchange 2013 for Security Explorer Setting up Microsoft Exchange for Security Explorer Upgrade and compatibility Hardware requirements Table 11. Hardware requirements Requirement Details Processor Pentium 600MHz or faster Memory 1 GB for Windows Vista and later Hard Disk space 150 MB Monitor 1024 x 768 screen resolution Operating System Windows Vista Windows 7 Windows 8 Windows 8.1 Windows Server 2008 Windows Server 2008 R2 Windows Server 2012 Windows Server 2012 R2 Software requirements Table 12. Software requirements Requirement.Net Framework v.4.0 or later Details Install either the Full or Standalone version. Do not install just the Client Profile. 6

7 Supported platforms for Security Explorer Table 13. Supported platforms for Security Explorer Security Explorer Module NTFS Security Share Security Registry Security Printer Security Service Security Task Management Group & User Management NTFS Security Share Security Group & User Management Supported Platform Windows NT 4.0 Windows 2000 Professional or Server Windows XP Windows Vista Windows 7 Windows 8 Windows 8.1 Windows 2000 Server Windows Server 2003 Windows Server 2008 Windows Server 2008 R2 Windows Server 2012 Windows Server 2012 R2 Dell Fluid File System (FluidFS) EMC Isilon EMC Celerra EMC VNX NetApp 8.2 (7-Mode and Clustered Mode) NetApp 8.3 SQL Security SQL Server 2014 SQL Server 2012 SQL Server 2008 R2 SQL Server 2008 SQL Server 2005 SharePoint Security SharePoint 2013 SharePoint 2010 SharePoint Foundation SharePoint 2007 SharePoint Services 3.0 Exchange Security Exchange 2013 Exchange 2010 Exchange 2007 Exchange 2003 NOTE: Security Explorer supports CIFS volumes. Mixed CIFS/UNIX volumes are supported if the volume root owner is a Windows account. NOTE: For NetApp Clustered mode, to see changes after a permission action, such as Grant, Revoke, or Modify, on folders and shares, you must refresh the tree in the Navigation pane. 7

8 User privilege requirements To start Security Explorer, a user must be a member of the local Administrators, otherwise error messages display. Each module in Security Explorer has additional requirements to enable permission management. Table 14. Requirements to enable permission management Module NTFS Security Share Security Registry Security Printer Security Service Security Task Management Group and User Management SharePoint Security SQL Server Security Exchange Security Requirement To manage permissions on folders and files on remote computers, the file and printer sharing option must be enabled on the firewall on the computer with Security Explorer installed and on the remote computer. To manage permissions on shares on remote computers, the file and printer sharing option must be enabled on the firewall on the computer with Security Explorer installed and on the remote computer. To manage permissions on registry keys on remote computers: The Remote Registry service must be running on the target computer. The file and print sharing option must be enabled on the firewall on the computer with Security Explorer installed and on the remote computer. To manage permissions on printers on remote computers: The Printer Spooler service must be running on the target computer. The file and printer sharing option must be enabled on the firewall on the computer with Security Explorer installed. To manage permissions on services on remote computers, the file and printer sharing option must be enabled on the firewall on the computer with Security Explorer installed and on the remote computer. To manage tasks on remote computers, the file and printer sharing option must be enabled on the firewall on the computer with Security Explorer installed and on the remote computer. To manage groups and users on remote computers, the file and printer sharing option must be enabled on the firewall on the computer with Security Explorer installed and on the remote computer. To manage permissions on SharePoint servers, the SharePoint site must be on the same network as the computer on which Security Explorer is installed. To manage SharePoint sites exposed over SSL ( add the SharePoint server s certificate to the Trusted Root Certification Authorities store on the computer with Security Explorer installed. To manage permissions on SQL Servers: Current user must be a member of the Administrators local group on the SQL server. Windows Firewall on the SQL server must be configured to allow SQL and WMI. For more information please refer to: Configure the Windows Firewall to Allow SQL Server Access at To manage permissions on the Exchange organization, the Exchange organization must be on the same Active Directory forest as the computer on which Security Explorer is installed. 8

9 Setting up Microsoft Exchange for Security Explorer Client access server configuration 1 Check that all Exchange Windows services with Automatic startup are started. 2 Check that IIS Admin Service and World Wide Web Publishing Service IIS Services are started. 3 Check that the Exchange Web Application is configured correctly in IIS: Authentication: Windows Authentication is Enabled SSL Settings: Require SSL is switched on 4 Exchange Server 2010 and 2013 only: Enable PowerShell Remoting on the Exchange Server by running the PowerShell command: Enable-PSRemoting force. Client Configuration 1 Open port 443 on the firewall. 2 Install an Exchange Server SSL certificate. Upgrade and compatibility Security Explorer 9 does not require that you uninstall version 5, version 6, version 7, or version 8. You can install side-by-side with all of these previous versions. Product licensing For, you must have a Dell license file (.dlv) or a Site Administrator QLL license file (*asc). Your previous licenses will not be recognized by version 9.6. To activate a trial or purchased commercial license 1 Start Security Explorer. When you start Security Explorer, a license check is performed. If you are installing Security Explorer for the first time, you are asked to update the license. 2 Click Update License, and locate the license file. The license file is approximately 1 KB in size and has a.dlv or.asc file extension. To update a license 1 Start Security Explorer. 2 Select Help About Security Explorer. To view the applied licenses, click Licenses. To update a selected license, click Update License. 9

10 Getting started with Installation instructions Additional resources Installation instructions IMPORTANT: If you are running Active Administrator on the same computer as Security Explorer, exit Active Administrator and stop all Active Administrator services before upgrading to Security Explorer. Use the autorun to install Security Explorer. To install Security Explorer 1 Launch the autorun. 2 On the Welcome screen of the Install Wizard, click Next. 3 Click View License Agreement. 4 Scroll to the end of the license agreement. 5 Click I accept these terms, and click OK. 6 Click Next. 7 Enter customer information, and click Next. 8 To change the location of the program files, click Change, or click Next to accept the default installation directory. 9 Click Install. 10 Click Finish. Additional resources Additional information is available from the following: Online product documentation ( What s New Guide Installation Guide Upgrade Guide User Guide 10

11 Globalization This section contains information about installing and operating this product in non-english configurations, such as those needed by customers outside of North America. This section does not replace the materials about supported platforms and configurations found elsewhere in the product documentation. This release is Unicode-enabled and supports any character set. In this release, all product components should be configured to use the same or compatible character encodings and should be installed to use the same locale and regional options. This release is targeted to support operations in the following regions: North America, Western Europe and Latin America, Central and Eastern Europe, Far-East Asia, Japan. Third-party contributions This product contains the third-party components listed below. For third-party license information, go to Source code for components marked with an asterisk (*) is available at Table 15. List of third-party contributions Component Renci SSH.NET Library Beta License or Acknowledgement Copyright (c) 2010, RENCI All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of RENCI nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 11

12 About Dell Dell listens to customers and delivers worldwide innovative technology, business solutions and services they trust and value. For more information, visit Contacting Dell Technical support: Online support Product questions and sales: (800) Technical support resources Technical support is available to customers who have purchased Dell software with a valid maintenance contract and to customers who have trial versions. To access the Support Portal, go to The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. In addition, the portal provides direct access to product support engineers through an online Service Request system. The site enables you to: Create, update, and manage Service Requests (cases) View Knowledge Base articles Obtain product notifications Download software. For trial software, go to Trial Downloads. View how-to videos Engage in community discussions Chat with a support engineer 12

13 2015 Dell Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Dell Inc. The information in this document is provided in connection with Dell products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Dell products. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, DELL ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL DELL BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF DELL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Dell makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Dell does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Dell Inc. Attn: LEGAL Dept 5 Polaris Way Aliso Viejo, CA Refer to our web site (software.dell.com) for regional and international office information. Trademarks Dell, and the Dell logo are trademarks of Dell Inc. Microsoft, Windows, Windows Server, Windows Vista, SharePoint, SQL Server, Windows PowerShell, and Active Directory are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Pentium is a trademark of Intel Corporation in the U.S. and/or other countries. NetApp and the NetApp logo are trademarks or registered trademarks of NetApp, Inc. in the United States and/or other countries. EMC, Isilon, Celerra, and VNX are either registered trademarks or trademarks of EMC Corporation in the United States and/or other countries. Other trademarks and trade names may be used in this document to refer to either the entities claiming the marks and names or their products. Dell disclaims any proprietary interest in the marks and names of others. Legend CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING icon indicates a potential for property damage, personal injury, or death. IMPORTANT NOTE, NOTE, TIP, MOBILE, or VIDEO: An information icon indicates supporting information. 13