Windows Patch Notes for CTE v7.6.0

Resolved Issues

• AGT-59495 [CS1552113]: Slowness when copying files to a guarded CIFS path

  The speed issue occurred because CTE was trying to detect the normalized name of files that were opened with short names. To solve this issue, CTE added a flag, in the registry, to disable this feature.

  Note

  If short names are enabled on your system, Thales does not recommend using this setting. If short names are not enabled, you can use the registry entry to improve the performance. To change your registry settings, contact Thales Support.

• AGT-60591 [CS1565249]: BSOD with the error 0x3B_c0000005_vmlfs!OpenTargetFile

  The VMLFS driver tried to access the Microsoft ECP data returned by the OS in the ECP context, but the ECP context was not correctly updated by the OS. As LFS tried to access the data from the ECP context, CTE crashed. The solution was to implement a Windows API to validate that the ECP context is properly acknowledged and updated by the OS.

Known Issues

• AGT-36370: The vorvmd.log reports an error message when guarding LDT over CIFS GuardPoint

  CTE agent needs CIFS credentials to apply a GuardPoint on a CIFS share. This error message displays when the CTE agent is in the process of authenticating the user. This error can be safely ignored.

• AGT-39189 | AGT-55063: CTE failed to unguard after changing to incorrect CIFS credentials

  If a user has a CIFS guarded path, and tries to access it with invalid credentials, the unguard request fails. After this, if the user switches to valid credentials, the unguard request still fails.

  Work-around

  To successfully guard/unguard a CIFS path, use valid credentials.

• AGT-48196: Microsoft DPM reports recovery creation failed when creating a recovery point after synchronizing data

  Work-around

  Perform a complete backup. Do not perform an incremental backup. The incremental backup does not work properly with LDT.

• AGT-48580: Ransomware Protection gzip files in a directory can be mistakenly identified as ransomware

  Intermittently, zip or unzip activity that occurs within a Ransomware Protection GuardPoint is identified as ransomware.

  Work-around

  Add the zip/gzip/winzip programs to the Ransomware Protection process exemption list in the CipherTrust Manager client profile.

• AGT-48862: Stopping secfsd service does not unguard CIFS GuardPoint

  Secfsd service is a critical service needed to perform Guard/Unguard operations. If this service is not running, CTE agent fails to unguard the CIFS GuardPoints.

  Work-around

  Manually disable the GuardPoint in CipherTrust Manager.

• AGT-58577: Issues and limitations for Multifactor Authentication and Ransomware Protection co-existence

  • When Multifactor Authentication is configured and used in a Client Profile (OIDC or EntraID), Ransomware Protection fails to setup on the host.

  • When attempting to change the Multifactor Authentication profile to the default client profile, that also fails.

  • When an OIDC connection is associated with a client profile, CipherTrust Manager reports an error while creating a Ransomware Protection GuardPoint.

  Note

  Multifactor Authentication is not yet supported for a GuardPoint with Ransomware Protection with a CTE Agent. You can associate Multifactor Authentication with a CTE GuardPoint with no Ransomware Protection, and that should work normally.

  Work-around

  1. Remove the OIDC connection from the client profile.

  2. Create another Ransomware Protection GuardPoint and re-associate the OIDC connection to the client profile after guarding succeeds.

• AGT-61138: Guard a system UNC by Standard policy, files are shown as cipher-text format from local Windows explorer

  Work-around

  Only view the files using the UNC from the local system (\\192.168.1.1\secrets). Do not use Windows Explorer (e:\secrets).