SecureDoc V8.1 Release Notes

Permanent AutoBoot feature added to SDLinux

SDLinux now has a Permanent Autoboot feature. The enhancement permits removal or addition
of permanent autoboot User after deployment is complete.

Limitation: Update Profile is not supported for this version.

Newly supported regions have been added to Azure GEO location policies list

Enhancement: The newly announced Regions for Africa and Asia Pacific have been added into
Azure GEO location policies list. The list in “Prevent Azure from Auto-Booting if found in the
following Region(s)” has added these 2 regions of Africa and 2 regions of Asia Pacific:
- Africa: South Africa West and South Africa North
- Asia Pacific: Australia Central 1 and Australia Central 2

SecureDoc can now merge a previously-encrypted Linux volume to a newly encrypted Linux
volume after application recovery process

SecureDoc is now enhanced to be able to a Merging a previously encrypted Linux volume to a
newly encrypted Linux volume after application recovery process.

Note: Does not support the scenario when the new instance OS disk is not encrypted.

Manufacturer info registration not updated properly for Scale Environment Cloud virtual
machines

Enhancement: The manufacturer info registration for Scale Environment CloudVM's were not
being correctly shown in the SES Console following device registration Scale VM's were being
registered as "Red Hat".
The Manufacturer info is now being displayed/Identified correctly depending on Scale VM's or
Environment.

Limitation: This issue existed exists in SES 7.28

Error 500 when creating Emergency Disk (EMG)

Issue: Error 500 is displayed when creating Emergency Disk while client is installing BootLogon.
The issue occurs in Windows client while BootLogon is being installed and creating an Emergency
Disk in SES Web at the same time.

Note: This issue does NOT occur on Linux Client.

SecureDoc Enterprise Server (SES) fails to install SES on Windows Server 2008 SP2 (DotNet 3.5.1)

As of version 8.1 you cannot run SES on Windows Server 2008 SP2 because .NET 4.7 cannot be
installed on this OS. SES can only run on an Operating System which can support .NET 4.7

Note:
• .NET Framework 4.7 is NOT Supported on Windows Server 2008 SP2.
• Supported Operating Systems:

Windows 7 SP1 (x86 and x64)
Windows 8.1 (x86 and x64)
Windows 10 Anniversary Update (x86 and x64)
Windows Server 2012 (x64)
Windows Server 2012 R2 (x64)
Windows Server 2016 (x64)

Users are able to login to SecureDoc Control Center even when the setting “Prevent key file
from being stored on device during deployment” is in effect.

Issue: The user is able to login to SDCC, and SES deploys a User Key File even when the settings
for password is “Prevent key file from being stored on device during deployment”.

Work-around: This issue requires 2 global options to be disabled:
1) Automatically update key file on device when user/device/group keys are modified
should be unchecked.
2) Enable password propagation should be unchecked.

[VDI] Cloned VM's created via the Machine Catalog provisioning are unable to get a network
connection

Issue: Where a master image on XenCenter with SecureDoc already deployed and fully encrypted
and be able to autoboot at Preboot, if a clone VM is created it hangs at preboot and is unable to
obtain a network connection. In the case an encrypted cloned VM starts off in preboot which
doesn't have VDA client, the VM is unusable until the user logs in to Windows. This means this
scenario is not supported with the encrypted master image and cloning an encrypted VM.
SecureDoc needs to be installed AFTER cloning is done and not before.

Limitation: This is a limitation in 8.1 CloudVM.

Unable to assign SFE policy to device using SESWeb

The SFE policy can be assigned from SES Console Server but not in SES Web.

Limitation: Users do not have the option to create SFE Policy on web, it can only be created on
SES Console. The Administrator can only create SFE policies and assign them to devices from SES
Console Server.

[VDI] USB devices attached to VDI environments with RMCE do not detect and encrypt

Limitation: VDI environments encrypted with RMCE packages do not detect USB drives plugged
into the host computer and encrypt them. The USB drives are available within the VDI
environment and files can be freely transferred between the device and the VDI environment.

Failed to clone the VM from parent which was permanently deleted then restored into the
original folder by communicating client with SES

This is a pre-existing issue where if Parent VM is deleted from recycle bin completely, and then at
a later time Parent VM re-communicates and is added back into Folder, any new clones created
from this restored Parent VM cannot use PBN autoboot/register onto SES. However, if the Parent
is deleted and remain in the Recycle Bin, if subsequently restored via communicating with the
server, then the clones can register and PBN Autoboot as expected.

This issue is now resolved. A parent VM is necessary and used as template for other Scale Set
instances. Those Scale Set member/Clones will not be registered in SES if the parent VM was
deleted before. If the user deletes the Parent VM when there are no clones yet, you will not get a
warning message. If there are existing clones, and you delete the parent VM, then you will get a
warning message.

Note: All descendant scale set

Azure: Fails to create VM scale from parent VM with SecureDoc installed

Issue: Creating VM scale machines from a parent VM with SecureDoc installed unsuccessful. The
scripts used are meant for Unmanaged Storage (blob storage).
Azure has shifted from Unmanaged to Managed storage.
This is a limitation.

Contact Technical Support error occurs when sending Crypto erase device to SDLinux devices

Issue: SES Console is sending Crypto erase device command to SDLinux device but shows error
'781a contact technical support'. In the SES console, sending Crypto erase command to Linux
client still works properly but user may see a pop-up error message.

Note: Pop-up error issue does not occur when sending command from SES Web.

Limitation: This issue only occurs in Private cloud (VMWare, Hyper-V and VSphere) but not in
Public cloud (Microsoft Azure and Amazon).

SDLinux deployment on kernel 4-4.0-1020 of Ubuntu 16.04 LTS (HVM) is not supported

Issue: [AWS] Fails to deploy default package on Ubuntu 16.04 LTS (HVM) kernel 4-4.0-1020 (New Kernel). No driver file was found for new kernel version 4.4.0-1020 when deploying package on Ubuntu. This kernel is the special version for AWS: https://launchpad.net/ubuntu/+source/linuxaws/
4.4.0-1020.29

Work-around: Download the new version of pre-build file for kernel 4.4.0-1020, and add the new
version in the publishing build.

Encryption of the root volume is skipped when performing online fast conversion on kernel
4.8.0-46-generic of Ubuntu 16.10

Issue: Ubuntu 16.10 kernel 4.8.0-46-generic: Online fast conversion skipped root volume with
error:adjustSectorBlockToConvert failed 0x7f2bb79c. The volume sda1 (root volume) was skipped

while other data/swap volumes successfully encrypting/encrypted after deploying the package.
This only occurs on Ubuntu 16.10 with kernel 4.8.0-46-generic.

Work-around: N/A.

SDLinux: Timeout interval should be disabled or made longer when driver is being downloaded

Due to slower network, if it takes over 30 seconds to download the driver, an error will be
displayed as no driver found when deploying package. This issue does not occur on a faster
network. The timeout is now set to 25 seconds as the default.

Limitation: In SES 8.1

Linux Cloud devices deleted completely (removed from recycle bin) are unable to re-register in OS time

Issue: Using Windows as the Client OS, when a device was deleted from SES including being
deleted from the recycle bin, upon its next communication attempt SDConnex will not be able
find it in the Database and will send an error to the client with a specific error code. When the
client receives this response it will send another request which will allow SDConnex to re-register
it as a new device.
However in Linux Cloud, devices are not able re-register.

Limitation: For Windows devices, users have special handling to allow re-registration of a
Windows CloudVM that was deleted and moved to recycle bin. After 2 communication requests, it
can re-register and move itself back to its original folder.
For Linux this feature has not yet been developed.

Linux cloud device completely deleted from SES (including from the recycle bin), once restarted, will hang at pre-boot

Issue: When Cloud devices (Windows or Linux) deployed with PBN Autoboot enabled, and is
deleted (including from the recycle bin), the device hangs at pre-boot.

Limitation: SecureDoc currently do not support device re-registration at pre-boot time. Windows
supports re-registration at OS time, however Linux does not support re-registration at pre-boot
nor at OS time.

Azure: Fails to create VM scale from parent VM with SecureDoc installed

Issue: Creating VM scale machines from a parent VM with SecureDoc installed unsuccessful. The
scripts used are meant for Unmanaged Storage (blob storage).
Azure has shifted from Unmanaged to Managed storage.

This is a limitation.

Ubuntu16.04 Kernel 4.11.0-1013-azure: Fails to boot into Linux OS after the installation

Issue: Ubuntu 16.04 with Kernel 4.11.0-1013 or 4.11.0-1014 on Microsoft Azure fails to boot in Linux or hangs at pre-boot.

Limitation: This is as existing limitation, where a custom Ubuntu 16.04 image is required for
Azure.

Unable to deploy SDLinux to default Ubuntu 14.04.3 LTS image on Google Cloud

Issue: Deploying SDLinux to default Ubuntu 14.04.3 LTS image on Google Cloud failed while it is
NOT occurring with the custom Ubuntu 14.04.3 LTS image on Google cloud or default/custom
Ubuntu 16.04 LTS image on Google cloud.

This is a known limitation.

RedHat - Offline login with key file on USB is only working if USB with key file was not
disconnected since last time it was used in the OS

Issue: This occurred in RedHat in private cloud, the administrator will physically plug in the USB
and authenticate at our pre-boot to boot the server that cannot reach SES due to connectivity
issue. Currently this is only working if USB with key file inside was connected while Device is in OS
and then restarted and the device gets back into preboot (USB connected all the time).

This is a known limitation.