NetIQ Change Guardian 5.0 Release Notes

1.1 Support for Azure Active Directory Monitoring

This version of Change Guardian supports monitoring functionality on the Azure Active Directory along with on-premises Active Directory. For information about the capabilities that are supported in this version of Change Guardian, see Understanding Azure Active Directory Monitoring in Change Guardian User Guide.

1.2 Simplified Packaging for Change Guardian for UNIX Installations

Change Guardian 5.0 bundles the Security Agent for UNIX 7.5 SP1 installer and makes it easy to install through the Change Guardian Agent Manager. The packaging and deployment model is similar to the model for the Windows agent that was introduced in Change Guardian 4.2.

You can use UNIX Agent Manager or Change Guardian Agent Manager (CG AM) to deploy and manage your agents. Both UAM and CG AM allow you to remotely install one or more Agents. However, there are certain specific functionalities available only on UAM or CG AM. Depending on your requirements, you can decide whether you need to install UAM, CG AM, or both. UAM and CG AM can coexist. For more information see Comparison of UAM and CG AM functionalities.

To get an overview of the most important considerations to make when you are installing or upgrading Security Agent for UNIX, see Deployment Considerations in Security Agent for UNIX documentation.

1.3 New Dashboard

Change Guardian 5.0 introduces a new Threat Response Dashboard. The Threat Response Dashboard is the main user interface for viewing and triaging alerts. Any user with permission to manage alerts can use the Threat Response Dashboard.

1.4 Interoperability of Directory and Resource Administrator With Change Guardian For Privileged Monitoring

Change Guardian 5.0 provides enhanced user monitoring in conjunction with Directory and Resource Administrator 9.1. Together they provide an integrated solution to control, manage and monitor the Active Directory environment.

When you use DRA to make changes to Active Directory, for example, when you create a user using Create User wizard in DRA, Change Guardian server gets notified and displays the actual user name, domain name and System ID of the user who logged in to DRA to make AD changes. For more information, see Interoperability of Directory and Resource Administrator With Change Guardian For Privileged Monitoring.

Before you upgrade Change Guardian to 5.0, you must first upgrade the Directory Resource Administrator to 9.1 or later.

1.5 Displaying Active Directory Attributes Correctly

When you log in to a host and make any changes to Active Directory in the domain controller machine, Change Guardian displays the IP address and the Active Directory hostname of the computer (through which you have logged in to the domain controller) in the event list on the Change Guardian web console.

For example, when you modify the Active Directory attributes from the member server, the event that is forwarded to Change Guardian web console displays the actual user name and IP address in the event list.

1.6 Support of Higher TLS Versions for Enhanced Secure Communication

To improve the security posture and to prevent known vulnerabilities, now you can disable TLSv1.0 so that Change Guardian can use a higher version of TLS such as TLSv1.1 and TLSv1.2. For more information, see Enabling Higher Versions of TLS for Communication in the NetIQ Change Guardian User Guide.

1.7 Enhanced OpenSSL Security

Change Guardian bundles a newer version of OpenSSL to support new protocols and address known vulnerabilities.

1.8 Updates to Certified Platforms

There are several updates to the Change Guardian certified platforms.

For more information about the certified platforms, see the Technical Information for Change Guardian web page.

1.9 Software Fixes

Change Guardian 5.0 includes software fixes that resolve several previous issues.

1.10 Displaying Correct Source Hostname Information for Active Directory Events

Issue: The Domain Controller hostname and IP address information was displayed for all Change Guardian Active Directory events.

Fix: The actual hostname and IP address of the computer from where the changes are made is displayed for all Change Guardian Active Directory events. (Bug 1042678)

1.11 VMware vSphere 5.5 Web Client Can Import OVF Templates

Issue: An issue with VMware vSphere 5.5 Web Client prevents you from using it to import .ovf templates. (DOC332977)

Workaround: You can now import an .ovf template, using the VMware vSphere 5.5 Client.

1.12 Approved Assets Does Not Require Authentication

You no longer need to provide username and password, when you select an asset in the All Assets list and that asset has an agent installed on it. (Bugs 942853)

1.13 Restoring Data to Remote Change Guardian Server Is Supported

Due to certificate updates, the Agent Manager Server data and configuration are now restored successfully on the secondary servers. (Bug 999503)

3.1 Upgrading the Change Guardian Appliance

To upgrade the appliance, use the zypper command line utility because user interaction is required to complete the upgrade. WebYaST is not capable of facilitating the required user interaction. For more information about upgrading the appliance using zypper, see Upgrading the Appliance by Using zypper in the NetIQ Change Guardian User Guide. (Bug 1054209)

4.1 Cannot View Alerts with IPv6 Data in Alert Views

Issue: Change Guardian alert views do not display alerts that have IPv6 addresses in IP address fields. (Bug 981570)

Workaround: To view alerts with IPv6 addresses in Change Guardian, perform the steps mentioned in NetIQ Knowledge base Article 7016555.

4.2 Cannot Install Change Guardian Server as Non-root User

The installation process does not support installing the Change Guardian Server as a non-root user. (Bug 948756)

4.3 Upgrade Process Fails if You Renamed the .msi Package for the Original Installation

If you renamed the .msi file when packaging the program to silently install a previous version of Change Guardian, the upgrade to the current release fails. During an upgrade, Microsoft Windows looks for an original installation with the same identification as the .msi package for the upgrade. For more information about this issue, see the Windows Installer Team Blog. (ENG328889)

4.4 Manual Configuration Required to Use Registry Browser

To enable the Registry Browser in Change Guardian, you must set the repositoryEnabled flag (under HKLM\Software\Wow6432Node\NetIQ\ChangeGuardianAgent\repositoryEnabled) to 1, and then restart the agent.

If you do not manually set the flag to 1, when you use the Registry Browser, you will receive a Could not connect to Windows Data Source error. (Bug 945225)

4.5 Local Users in Administrator Group Cannot Deploy Agents to Windows Computers

With Microsoft KB article 951016, Microsoft introduced a feature called UAC remote restrictions, which removes the SID (security identifier) for the Administrators group from the logon token for local non-Administrator user accounts in the Administrators group. The actual Administrator account remains unchanged. As a result, to deploy agents to Windows computers, you must use the actual Administrator account or a domain account that has administrator access to the computer. For more information, see https://support.microsoft.com/en-us/kb/951016. (Bug 918180)

4.6 Option to Rerun Tasks from 'Failed Tasks' Does Not Work

Issue: If an agent installation, upgrade, or uninstall task fails, the option to re-run the task from the Failed Tasks list does not work. (Bug 942426)

Workaround: In Agent Manager, select the asset and run the task again.

4.7 Asset Tasks Remain 'In Progress' Indefinitely

Issue: If the connection between Agent Manager and a monitored asset is lost, tasks related to that asset remain In Progress indefinitely. (Bug 941549)

Workaround: Manually cancel the task in Agent Manager.

4.8 Issues Monitoring DNS Configuration Changes

If you create a policy to monitor for DNS Configuration Modified events, a limitation in Microsoft Windows prevents the policy from retrieving information about the users who performed the actions for which the policy is monitoring. As a result, Change Guardian does not support the following options when monitoring for DNS configuration changes:

4.9 Issue Monitoring Local User and Groups Privilege Events

If you create a policy to monitor for Local User and Groups Privilege events, a limitation in Microsoft Windows prevents the policy from retrieving information about the users who performed the actions for which the policy is monitoring. (Bug 957980)

4.10 Internal Audit Events Go Only to Primary Event Destination in FIPS Mode

If you run Change Guardian in FIPS mode, internal audit events go only to the primary event destination. They do not go to any additional event destinations in your environment. (Bug 956881)

4.11 Change Guardian Server Cannot Connect to Data Sources in FIPS Mode

Issue: If the Change Guardian Server is running in FIPS mode, when you browse data source objects while creating a policy, you will receive a Could not connect to Windows Data Source error. (Bug 956886)

Workaround: You can avoid this error by manually entering the file paths in the policy. To find the file paths, log on to the computer you want to monitor, and then use the cd and dir commands.

4.12 Deleting an Asset with Agent Manager Does Not Delete All Components

Issue: If you use Agent Manager to delete an asset, Agent Manager does not delete the NetIQ Change Guardian Agent component from the Installed Programs list in Windows. To remove all asset components completely, uninstall the NetIQ Change Guardian Agent component from the computer, and then use Agent Manager to delete the asset from Change Guardian. (Bug 940340)

4.13 Issue with Privileges for Local Users and Groups Prevents Change Guardian from Generating an Event

If you delete a privilege from a user, and it was the only privilege assigned to that user, Change Guardian will not generate any events for that privilege. This is caused by a known issue with the way Microsoft implements the removal of some privileges for local users and groups. (Bug 957505)

4.14 Manually Uninstalling an Agent Does Not Remove the Agent's Version Details from Agent Manager

Issue: If you manually uninstall an agent, Agent Manager continues to display version details for the agent. (Bug 946582)

Workaround: In Agent Manager, select the agent in the 'All Assets' group and delete it.

4.15 Tips Table Search Does Not Return the Complete List of Alert Fields in Upgraded Installations

Issue: In upgraded installations, when you search for alert attributes in the Tips table in the web interface, the search does not return the complete list of alert fields. However, alert fields display correctly in the Tips table if you clear the search. (Bug 914755)

Workaround: There is no workaround at this time.

4.16 Change Guardian Web Console is Blank if the License is Expired

Issue: If your Change Guardian license expires, the web console displays a blank page. (Bug 949208)

Workaround: Add the license through the command line by using the softwarekey.sh script. For more information, see Adding a License Key in the Change Guardian User Guide.

4.17 Change Guardian Cannot Retrieve Events Related to Users Logging On or Off a Domain Controller

Issue: If you have an agent on a Domain Controller, when domain users use their network credentials to log on or off from a remote domain member computer, Change Guardian cannot retrieve the events related to the users logging on or off. (Bug 939651)

Workaround: There is no workaround at this time.

4.18 Active Directory Does Not Synchronize New User if the Account Name is the Same as a Deleted User

Issue: If you delete a user from Active Directory, and then create a new user with same account name, Active Directory does not synchronize the new user. (Bug 940781)

Workaround: There is no workaround at this time.

4.19 Default Database Service Port Must Be Used for Change Guardian Server

To successfully install Change Guardian 4.2 or later, you cannot modify the default Database Service port. (ENG333165)

4.20 Event Severity is Always Calculated Automatically for Security Agent for UNIX Events

Event Severity is always calculated automatically for Security Agent for UNIX events, including events generated by policies configured with a custom severity. (DOC333969)

4.21 Forwarded Events Might Contain Extra Characters

When you use the Syslog Dispatcher to forward events in Change Guardian, event attributes might contain additional backslash (\) characters to escape the following characters: \, =, and |. These extra characters are necessary to allow the event to conform to the Common Event Format (CEF) specification. To remove them, parse the events with a CEF parser. (ENG334907)

4.22 File Integrity Diff Data Might Be Truncated in Events Forwarded to Syslog Servers

If you configure the Change Guardian Server to forward File Integrity events to a Syslog Server, and then you modify a monitored file, the diff data in the forwarded event might be truncated if the diff data size is greater than 1 KB. The forwarded event provides a URL that allows you to view the full event and the complete file diff data in the Change Guardian Web console. (ENG335411)

4.23 Events Not Generated When AD Schema Policies Created for Attributes and Class Together

Issue: When you assign the Active Directory schema policies which are created for Attribute and Class schema monitoring together to the monitor assets, the AD schema events are not generated successfully. (Bug 994045)

Workaround: You must assign Active Directory schema policies separately for Attributes and Class in the Policy Editor console for successful event generation.

4.24 Unable to Browse File Locations And Active Directories Using Policy Editor File Browser

Issue: Following are the conditions:

Workaround: To enable LDAP browsing in policy editor, perform the steps mentioned in NetIQ Knowledgebase Article 7017291.

4.25 Backup Directory Not Removed After Successful Restore

Issue: After a successful restore, the Change Guardian backup directory remains on the Change Guardian server. (Bug 997595)

Workaround: Although there is no impact to the functionality, NetIQ recommends you to delete the directory before taking a new backup.

4.26 Agent Manager is Not Populated With the Newly Added Assets

Issue: When you launch the Agent Manager using Internet Explorer, and add an asset, the newly added assets are not populated in the Explorer until you do a manual refresh. (Bug 992655)

Workaround: Complete the following setting changes in IE browser each time you launch the Agent Manager:

4.27 New Installation of Change Guardian 5.0 Cannot Manage Security Agent for UNIX 7.5

Issue: When you have Security Agent for UNIX7.5 with Sentinel and SCM, and you want to install Change Guardian 5.0, Change Guardian 5.0 cannot manage 7.5 agents due to a profile mismatch.(Bug 1056377)

Workaround: Upgrade your agents to 7.5 SP1 or later using UAM.

4.28 Issues with Azure Active Directory For Change Guardian

4.29 Issues with DRA Coexisting with Change Guardian

Following are few issues with the DRA coexisting with Change Guardian:

4.30 Issue With Removable Media Audit Events

4.31 Exception While Installing Change Guardian 5.0 Version

Issue: With new platform support in Change Guardian 5.0. release, the following message appears during installation:

su: ignoring --preserve-environment, it's mutually exclusive with --login

Workaround: You can safely ignore this message. There is no functional impact. (Bug 1044685)

4.32 AD Authentication Fails when ‘LDAP Require Signing’ Is Enabled for an Asset Supporting SSL Protocol

Issue: AD Authentication on SSL supported asset fails when you use the Agent Manager to add asset that has LDAP Require signing enabled.

Workaround: Perform the following steps:

4.33 Change Guardian Server Installation Fails on FIPS Enabled Operating System

Issue: Change Guardian server installation fails if the Operating system is in FIPS mode. (Bug 996277 and 993398)

Workaround: Perform the installation in the following sequence:

4.34 Cannot View Alerts When OS is in FIPS Mode

Issue: Change Guardian alert views do not display alerts when OS is in FIPS mode. (Bug 1052197)

Workaround: There is no workaround at this time.

4.35 Exception After Changing Keystore Password With Specific Special Characters

Issue: When you upgrade Change Guardian to 5.0, change the keystore database password which consist of specific special characters, you will see the following exception: Failed to initialize Communicator

(Bug 1055428)

4.36 Unable to Change Password of Existing Email Configurations

Issue: You will not be able to change the password of the existing email configurations. (Bug 1058048)

Workaround: If you change your email password, you must perform the following steps to receive email notifications:

4.37 Document Available With The Change Guardian Installation Files Refers to Uncertified Operating Systems

Issue: A workaround in the User Guide > Troubleshooting section suggests to install Change Guardian on SLES 12 SP4 and Red Hat Enterprise Linux 7.3, which are not certified platforms. This incorrect reference is only in the documentation available with the Change Guardian installation files.

Workaround: Refer to the latest version of Troubleshooting section and the documentation available online at Change Guardian User Guide.