Dell Endpoint Security Suite Enterprise Technical Advisories v3.9

Advanced Threat Prevention v1.3

• Effective policies from the Dell Server are now automatically exported and stored in C:\ProgramData\Dell\Dell Data Protection\Policy\Policy-xxxxxxxx.xml, where "xxxxxxxx" is the sequence number of the policy. By default, the last 10 policies received from the Server are stored. To change the default number of policies stored, change the value of the following registry key. The valid range is 0 - 100.

  ["HKEY_LOCAL_MACHINE\SOFTWARE\Dell\Dell Data Protection]

  "MaxPoliciesStored" =dword:00000010

  Valid range = 0 - 100

  [DDPC-4583]

Added 05/2018 - An issue resulting with a "Not Protected" message to display until the computer was rebooted has been resolved. [CYL-435]

Added 4/2017 - Resolved Technical Advisories v2.0.1421

The following issues are resolved in v1.3.1421, available when an organization is enrolled for Agent Auto Update on the Dell Server. For instructions on how to enroll, refer to AdminHelp, accessible from the Remote Management Console.

• Fixed an issue where the Agent communicated using SSL 3.0 or TLS 1.0 only.
• Fixed an issue with a Windows device failing to generate a fingerprint.
• Resolved issue with Microsoft Word template file not being recognized when added to the whitelist.
• Fixed an issue with the Windows OS version incorrectly being reported to the Console.
• Fixed an issue with the false detection of Nsight drivers on Windows devices.
• Fixed an issue on Windows x64 devices where a malicious payload detection was causing crashes upon exit.
• Fixed an issue with 64-bit Java applications crashing.
• Fixed an issue where the CPU would spike with integration service on a Windows device.
• Resolved an issue with an inconsistency on start-up on a Windows device.
• Resolved BSOD due to exception issue with Device Control when using display port.
• Resolved an issue with the Auto-Quarantine feature preventing the EventPro application user-interface from launching on a Windows device.
• Resolved an issue with the Agent sending duplicate Syslog events to the Console.
• Fixed an issue where the Agent could cause 32-bit Java applications to crash on Windows devices.
• Fixed Script Control to not block a Microsoft Windows 10 script.
• Fixed an issue where installing the Agent MSI package using the command line without including the installation token resulted in the Agent requiring an uninstall password and the Agent could not be uninstalled.
• Fixed an issue where a USB device was not being blocked upon first use on Windows XP and Windows Server 2003 devices when Device Control was enabled and set to Block.
• Fixed an issue with WMI errors occurring on Windows devices during startup and shutdown.
• Fixed an issue with Device Control events to generate a serial number when a USB mass storage device is disabled then enabled on a Windows device.
• Fixed duplication of Device Control events for iOS USB connection to a Windows device.
• Fixed duplication of Device Control events for Android USB connection to a Windows device.
• Fixed an issue with the event log on a Windows device to include the device serial number for iOS devices.
• Fixed an issue with the Application Control folder exclusions to prevent portable executable (PE) files from manually being moved on a Windows device.
• Fixed an issue that was causing threat files to be quarantined from a macOS Samba SMB mounted drive.
• Fixed an issue with the ability to recognize a trailing backslash in Application Control folder exclusions on a Windows device.
• Fixed an Application Control issue with the ability to copy a file from a non-excluded folder to an excluded folder on a Windows device.
• Fixed an issue with the Optics to only upload Windows logs that have not been uploaded before.
• Fixed an issue with the ability to downgrade the local cloud model on macOS devices.
• Fixed an issue with Device Control events to include the detection of USB floppy drives on Windows devices.
• Fixed an issue with duplicated Device Control events being generated when connecting a USB drive to a Windows device.
• Fixed an issue with the event log on a Windows device to include the device serial number when connecting a USB device to a VMware Workstation instance.
• Fixed an issue with the event log on a Windows device to include the device serial number for an Apple iPad.
• Fixed an issue with the event log on a Windows device to include the serial number for Canon cameras.
• Fixed an issue with scanning folders externally mounted to a macOS device, where the file is not local.
• Fixed an issue with the rate that the Agent checks the status of the cloud model when the Console communication is not responsive.
• Fixed an issue with the Visual Studio App Simulator from being blocked as an exploit on macOS devices.
• Fixed an issue with the timer to add a random buffer for checking in to the Console after a connection is re-established.
• Fixed a Windows issue where memory allocated to fields in DEVFLT_CONTEXT are not freed.
• Fixed an issue where the uploader repeats when the upload limit is reached.
• Updated the localization files to ensure translations work on OS X El Capitan.
• Fixed a Windows boot issue when the Console is unavailable.
• Fixed an issue with the macOS Sierra Beta build crashing the Agent UI.

Added 4/2017 - Resolved Technical Advisories v1.2.1411

The following issues are resolved in v1.3.1411, available when an organization is enrolled for Agent Auto Update on the Dell Server. For instructions on how to enroll, refer to AdminHelp, accessible from the Remote Management Console.

Resolved Technical Advisories v1.2.1401.84

The following issues are resolved in v1.2.1401.84, available when an organization is enrolled for Agent Auto Update on the Dell Server. For instructions on how to enroll, refer to AdminHelp, accessible from the Remote Management Console.

• Increased the detail available in the debug logs.
• Fixed an issue to properly waive files contained within archives.
• Fixed an issue where files whitelisted by certificate were incorrectly labeled as "catalog."
• Fixed an issue where a portable executable (PE) file was able to be copied onto a device with Application Control enabled.
• Fixed an issue where threats are blocked but not properly terminated (killed) in some OS X environments.
• Updated Memory Protection to include support for Metro Apps.
• Fixed an issue that caused a crash on the Windows Vista operating system.
• Fixed an issue where the user-interface notifications were not properly working for archived files.
• Fixed an issue with updating the Agent.
• Fixed an issue where Alternate Data Streams (ADS) filenames were not properly handled.
• Fixed an issue where some Memory Protection and Script Control events were not properly sent to the Console..
• Fixed an issue where the Agent UI would display erroneous text caused by the localization language folders not deploying correctly to the Cylance directory and being absent from the directory.

Added 4/2017 - Resolved Technical Advisories - Auto-Updates

For information about additional periodic Advanced Threat Prevention updates for enterprises enrolled for Agent Auto Update on the Dell Server, see http://www.dell.com/support/article/us/en/19/SLN305419/dell-data-protection-endpoint-security-suite-enterprise-and-dell-data-protection-threat-defense-release-notes?lang=EN. Select the Saas Updates tab.

For instructions on how to enroll for Agent Auto Update on the Dell Server, refer to AdminHelp, accessible from the Remote Management Console.

Encryption Client v8.12

• Debug-level logging is improved. [DDPC-2307]
• Administrative Download Utility (CMGAd) and Administrative Unlock Utility (CMGAu) are now functioning as expected with non-domain users. [DDPC-4109]
• Upgrade to Windows 10 now proceeds as expected when the installation media is stored in a folder that is encrypted with the User or Common key. [DDPC-4146]
• The Secure Windows Hibernation File and Prevent Unsecured Hibernation policies are now enforced after upgrade. [DDPC-4786]
• The WSScan Unencrypted file in Violation option now initiates a sweep of unencrypted files as expected, without the files having to be selected or accessed. [DDPC-4790]
• An issue is resolved that resulted in Windows Update failures with Office and Windows 10 feature updates. [DDPSUS-1323]

Resolved Customer Issues

• An issue is resolved that resulted in a long delay after pressing Ctrl+Alt+Del on a computer running Dell Desktop Authority. [DDPC-500]
• An issue is resolved that resulted in multiple restart prompts. [DDPC-4484, DDPC-4535]

Advanced Authentication v8.12

• The Enroll Credentials window no longer occasionally displays after a computer with fingerprint or smart card enrolled credentials resumes from sleep. [DDPC-4269]

• Effective policies from the Dell Server are now automatically exported and stored in C:\ProgramData\Dell\Dell Data Protection\Policy\Policy-xxxxxxxx.xml, where "xxxxxxxx" is the sequence number of the policy. By default, the last 10 policies received from the Server are stored. To change the default number of policies stored, change the value of the following registry key. The valid range is 0 - 100.

  ["HKEY_LOCAL_MACHINE\SOFTWARE\Dell\Dell Data Protection]

  "MaxPoliciesStored" =dword:00000010

  Valid range = 0 - 100

  [DDPC-4583]

Preboot Authentication v8.12

• Amended 4/2017 - Preboot Authentication is supported only with UEFI mode (with and without SecureBoot) on the following computers:

  • OptiPlex 3050 All-In-One
  • OptiPlex 5250 All-In-One
  • OptiPlex 7450 All-In-One
  • OptiPlex 3050 Tower, Small Form Factor, Micro
  • OptiPlex 5050 Tower, Small Form Factor, Micro
  • OptiPlex 7050 Tower, Small Form Factor, Micro
  • Latitude 3180
  • Latitude 3189
  • Latitude 3380
  • Latitude 3480
  • Latitude 3580
  • Latitude 5285
  • Latitude 5289
  • Precision 7520
  • Precision 7720
  • Precision 5720 All-in-One
• When the Dell Latitude 7370 with PBA activated is docked, the user is now prompted at the PBA login screen for the authentication method set by policy rather than the access code. [DDPC-2693]
• An issue with smart card single sign-on that resulted in an error, "User did not sync with PBA," is now resolved. [DDPC-3539]
• An issue is resolved that resulted in brief and intermittent PBA login screen unresponsiveness on a UEFI computer. [DDPC-3753]
• The Options menu now remains anchored to the Options button in the PBA login screen when accessed using Tab+Enter. [DDPC-4104]
• After upgrade to the Windows 10 Anniversary Update on non-UEFI computers with PBA activated, the Challenge/Response popup now displays as expected after the user exceeds the maximum allowed attempts to correctly enter the password and answer Recovery Questions. [DDPC-4126]
• An issue is resolved that resulted in a computer with PBA activated reporting No OPAL Drive after resuming from hibernation. [DDPC-4476]
• Keyboard layout changes are now retained on computers with PBA activated. [DDPC-4684]

SED Client v8.12

• When installing SED Management using the child installers, the installation no longer fails if the Validate URL button is pressed. [DDPC-4271]

• Effective policies from the Dell Server are now automatically exported and stored in C:\ProgramData\Dell\Dell Data Protection\Policy\Policy-xxxxxxxx.xml, where "xxxxxxxx" is the sequence number of the policy. By default, the last 10 policies received from the Server are stored. To change the default number of policies stored, change the value of the following registry key. The valid range is 0 - 100.

  ["HKEY_LOCAL_MACHINE\SOFTWARE\Dell\Dell Data Protection]

  "MaxPoliciesStored" =dword:00000010

  Valid range = 0 - 100

  [DDPC-4583]

BitLocker Manager v8.12

• Effective policies from the Dell Server are now automatically exported and stored in C:\ProgramData\Dell\Dell Data Protection\Policy\Policy-xxxxxxxx.xml, where "xxxxxxxx" is the sequence number of the policy. By default, the last 10 policies received from the Server are stored. To change the default number of policies stored, change the value of the following registry key. The valid range is 0 - 100.

  ["HKEY_LOCAL_MACHINE\SOFTWARE\Dell\Dell Data Protection]

  "MaxPoliciesStored" =dword:00000010

  Valid range = 0 - 100

  [DDPC-4583]