This service pack improves usability and resolves several previous issues. Many of these improvements were made in direct response to suggestions from our customers. We thank you for your time and valuable input. We hope you continue to help us ensure our products meet all your needs. You can post feedback in the Secure Configuration Manager forum on Qmunity, our community Web site that also includes product notifications, blogs, and product user groups.

For more information about this release and for the latest Release Notes, see the Secure Configuration Manager Documentation web site. To download this product, see the Secure Configuration Manager Service Packs Web site.

What's New?

The following outline the key features and functions provided by this version, as well as issues resolved in this release:

• Operating System Support
• Additional Windows Endpoints
• Enhancements and Software Fixes

Operating System Support

You can install NetIQ Secure Configuration Manager Windows Agent (Windows agent) on the following operating system versions:

• Windows Server 2012 (64-bit)
• Windows 8 (32-bit and 64-bit)

Additional Windows Endpoints

The Windows agent can monitor the following endpoints:

• Windows Server 2012
• Windows 8
• SQL Server 2012

NetIQ recommends using a Windows agent running on a Windows Server 2012 or Windows 8 operating system to monitor these new endpoint types.

Enhancements and Software Fixes

This service pack includes software fixes that resolve several previous issues.

• Temporarily Enables WUS when Running Security Checks for Patch Assessment
• Includes Defect Fixes from Previous Releases
• Normalizes Names of Windows Service Accounts in Reports

Temporarily Enables WUS when Running Security Checks for Patch Assessment

When you run security checks that assess the patch-level status of your Windows endpoints, the Windows agent needs Windows Update or Automatic Update services enabled on the endpoint to complete the query. If the Windows Update Service (WUS) is disabled, the agent temporarily enables WUS while running the check, and then disables the service upon completing the query. For more information, see Additions to Documentation. ENG329077

Includes Defect Fixes from Previous Releases

When you install this service pack on the Windows agent, the set of new features and fixed defects depend upon the version from which you upgrade. For example, if the system is running NetIQ Security Agent for Windows 5.8.2, defect fixes from Secure Configuration Manager Windows Agent 5.9 are also applied as part of this upgrade.

Normalizes Names of Windows Service Accounts in Reports

Return to Top

System Requirements

This service pack requires the following product versions of Secure Configuration Manager:

• 5.9
• 5.9 Service Pack 1

Note To use an upgraded Windows agent as a deployment agent, you must be running Secure Configuration Manager 5.9 Service Pack 1.

For the most recently updated list of supported application versions, see the Secure Configuration Manager Technical Information page. For detailed information on hardware requirements and supported operating systems, and browsers, see the Installation and Configuration Guide for NetIQ Secure Configuration Manager Windows Agent.

Return to Top

Installing and Upgrading the Windows Agent

This version enables you to install new agents or upgrade existing ones. NetIQ recommends that you use the remote deployment feature to quickly install or upgrade agents in your enterprise. First, you must locally install or upgrade at least one agent in each domain. Secure Configuration Manager uses this first upgraded agent as a Deployment Agent for the domain. Once an agent is upgraded or installed, Secure Configuration Manager can automatically assign it as a Deployment Agent.

The setup program for Secure Configuration Manager 5.9 Service Pack 1 automatically adds a Windows agent to the Core Services computer. If a Windows agent already exists on the computer, the setup program upgrades the agent to this version. Secure Configuration Manager also assigns this agent as the default Deployment Agent for the computer's domain.

To support version 5.9 or later Windows agents, the installation and upgrade functions make the following changes on the target computer:

• Automatically grants the "Log on as a service" right to the specified account for the Windows agent service.
• Enables the Services utility in the Windows Control Panel to automatically restart the Windows agent service after a failure.

For more information about installing, upgrading, and deploying the Windows agent, see the Installation and Configuration Guide for NetIQ Secure Configuration Manager Windows Agent included in the installation kit or on the Secure Configuration Manager Documentation Web site. For assistance with installation or upgrades, contact Technical Support.

• Upgrading Existing Windows Agents
• Installing New Windows Agents
• After Upgrading or Installing New Windows Agents

Upgrading Existing Windows Agents

You can upgrade the following agent versions:

• 5.9
• 5.8 Service Pack 2

NetIQ recommends that you review the following considerations before upgrading to this version:

• If you do not immediately upgrade your Windows agents after upgrading to Secure Configuration Manager 5.9 Service Pack 1 from version 5.8 Service Pack 2 or older, you must apply Hotfix 73282 to the agents. This hotfix updates the certificate file that ensures communication between the agent and Core Services.

  You must also continue running a Windows agent on a computer other than the Core Services computer. The agent computer must be running the older agent version and have the Standalone Deployment Wizard installed locally. You can use the standalone wizard to push the hotfix to your older agents. You cannot use the console to deploy Hotfix 73282.

• You can deploy version 5.9 or later to upgrade your Windows agents without Hotfix 73282 applied. However, you must re-register the agents after deployment. Secure Configuration Manager cannot communicate with the agents until they are successfully registered.
• Before using the Deployment feature in the console to upgrade older agents, you might need to specify a fully qualified host name (FQHN) for the agent computer. Secure Configuration Manager needs to know in which domain each agent resides so that Core Services can assign a Deployment Agent to use for deploying version 5.9 to the agents.
• (Conditional) To upgrade a version 5.9 agent on a local computer, run the following command from the directory containing the NetIQSecurityAgentForWindows.msi file:

  msiexec.exe /i NetIQSecurityAgentForWindows.msi REINSTALL=ALL REINSTALLMODE=vomus

• (Conditional) To upgrade an agent older than version 5.9 on a local computer, run the following command from the directory containing the NetIQSecurityAgentForWindows.msi file:

  msiexec.exe /i NetIQSecurityAgentForWindows.msi

• (Conditional) If you upgrade an agent that communicates with Core Services on a port other than the default ports, you must manually re-register the upgraded agent. When the upgraded agent registers with Secure Configuration Manager Core Services, the default communication port changes from 1626 to 1627.
• (Conditional) To use an upgraded agent as a Deployment Agent, you might need to modify the run-as account for the NetIQ Security Agent for Windows service on that agent's computer. The service account for Deployment Agents must have the credentials to deploy to remote computers. For example, specify a domain administrator account. When you upgrade a Windows agent, the setup program persists the agent settings, including baselines and registry key settings.
• You can upgrade a Windows agent that has the NetIQ Secure Configuration Manager Module for SCAP (SCAP module) installed on the agent computer.

Return to Top

Installing New Windows Agents

NetIQ recommends that you review the following considerations before installing this version:

• (Conditional) To deploy this version to remote agent computers, use the Deployment wizard in the Secure Configuration Manager console and select the Windows_Agent_5.9.1_Release.nap package.
• (Conditional) To install an agent on a local computer, run the NetIQSecurityAgentForWindows.msi setup program included in the installation kit.
• (Conditional) To re-deploy an agent that has already been successfully deployed to a remote computer, you must uninstall the agent first. For example, you might want to change the credentials of the Windows agent service or resolve issues with the agent. The Deployment wizard does not change the settings for a previously installed agent, even though you modify the settings as part of the deployment process. The Windows agent setup program prevents you from installing an agent when the same version already exists on the computer, but the Deployment wizard does not.

Return to Top

After Upgrading or Installing New Windows Agents

After you install this version, you should reestablish the All Services baseline to incorporate the modified account names for Windows services.

Also, review all scheduled delta reports that include the following security checks, including delta reports for policy templates:

• Local - High risk services running
• Service status and permissions
• Service status and permissions setting minimum
• SQL Server account group membership
• SQL Server Agent account

Run these security checks or policy templates, and then use the most recent runs as the base report. For more information and a list of affected policy templates, see NetIQ Knowledge Base article 7011763.

This version does not install these release notes or the Installation and Configuration Guide for NetIQ Secure Configuration Manager Windows Agent included in the installation kit. To maintain the latest documentation on the console computer, copy the files to the Documentation folder, by default \%Program Files%\NetIQ\Secure Configuration Manager\Documentation.

Return to Top

Verifying the Installation

To verify that the Windows agent installation was successful, on the computer where you installed the Windows agent, open the Control Panel utility for adding and removing programs. Verify that the list of currently installed programs includes NetIQ Security Agent for Windows 5.9.1.

Return to Top

Known Issues

NetIQ Corporation strives to ensure our products provide quality solutions for your enterprise software needs. The following issues are currently being researched. If you need further assistance with any issue, please contact Technical Support.

• Restrictions for Effective Policy Object in Collecting Group Policy Object Data
• CIS Policy Setting Security Check Reports a Not Configured Status for Some Disabled Policies
• Security Checks Report Proxied Endpoints as Offline When Windows Firewall is Enabled
• Cannot Upgrade a Version 5.9 Agent on a Local Computer
• Password Analysis Checks are Not Supported for 64-bit Windows Operating Systems

Restrictions for Effective Policy Object in Collecting Group Policy Object Data

The following limitations apply to the Effective Policy object:

• Due to data integrity issues, Microsoft APIs prevent the Windows agent from running Effective Policy object queries against some GPOs.
• The Windows agent cannot collect GPO settings information when the agent runs as the Local System account on queried endpoints. The Windows agent must have Administrative permissions on the endpoint to run the queries. (DOC304630)

CIS Policy Setting Security Check Reports a Not Configured Status for Some Disabled Policies

The CIS Policy Setting security check verifies whether an endpoint complies with specified policy settings. This check reports the following group policies as not configured when the policies are disabled:

• Disable remote Desktop Sharing
• Do not process the legacy run list
• Do not process the run once list
• Require trusted path for credential entry
• Restrictions for Unauthenticated RPC clients

(DOC310546)

Security Checks Report Proxied Endpoints as Offline When Windows Firewall is Enabled

Cannot Upgrade a Version 5.9 Agent on a Local Computer

Password Analysis Checks are Not Supported for 64-bit Windows Operating Systems

Some security checks that gather information about passwords do not report data for endpoints on 64-bit Windows computers, such as Windows Server 2008 R2 and Windows Server 2012 endpoints. For more information about this issue, see NetIQ Knowledge Base article 7012696. (DOC243464)

Return to Top

Additions to Documentation

This service pack does not provide an updated version of the Installation and Configuration Guide for NetIQ Secure Configuration Manager Windows Agent. The following topics describe additions and modifications to the guide:

Section	Added Information
Windows Agent Computer Requirements	Windows Server 2012 Windows 8 (32-bit and 64-bit)
Considerations for Managing the Windows Agent Environment	To successfully run security checks for Windows patch assessment, the following programs must be running on the endpoint computers that you want to assess: Windows Update or Automatic Updates service, depending on the operating system Windows Update Agent 7.4 or later Secure Configuration Manager does not require a specific setting for the Windows service. If Windows Update Service (WUS) is disabled on the endpoint when you run a patch assessment check, the Windows agent will temporarily enable WUS. Once the check query completes, the agent disables WUS. To prevent an agent from temporarily enabling WUS, complete the following steps: In the Secure Configuration Manager console, expand IT Assets > Agents > OS > Windows. Select the Windows agent that manages the endpoints where you want to prevent enabling WUS. In the lower pane, right-click the endpoint where the Windows agent is installed, and then click Run Tasks. On the menu, click Actions. Expand Windows > System. Move Assign Registry Value to the Selected Task pane. Click Next. For Data, specify 0. (Conditional) For Subkey, if the endpoint runs a 64-bit operating system, specify software\wow6432Node\NetIQ\VigilEnt. (Conditional) For Subkey, if the endpoint runs a 32-bit operating system, specify software\NetIQ\VigilEnt. For Value, specify manageWUS. Press Enter, and then click Finish.
Windows Endpoints	Windows Server 2012 Windows 8
Managing Microsoft SQL Server Endpoints	SQL Server 2012

For the most recent documentation, see the NetIQ Secure Configuration Manager Documentation Web site. For more information about supported versions, see the NetIQ Secure Configuration Manager Technical Specification Web site.

Return to Top

Contact Information

Our goal is to provide documentation that meets your needs. If you have suggestions for improvements, please email Documentation-Feedback@netiq.com. We value your input and look forward to hearing from you.

For detailed contact information, see the Support Contact Information Web site.

For general corporate and product information, see the NetIQ Corporate Web site.

For interactive conversations with your peers and NetIQ experts, become an active member of Qmunity, our community Web site that offers product forums, product notifications, blogs, and product user groups.

Return to Top

Legal Notice

NetIQ Secure Configuration Manager is protected by United States Patent No: 5829001 and 7707183.

THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT ARE FURNISHED UNDER AND ARE SUBJECT TO THE TERMS OF A LICENSE AGREEMENT OR A NON-DISCLOSURE AGREEMENT. EXCEPT AS EXPRESSLY SET FORTH IN SUCH LICENSE AGREEMENT OR NON-DISCLOSURE AGREEMENT, NETIQ CORPORATION PROVIDES THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SOME STATES DO NOT ALLOW DISCLAIMERS OF EXPRESS OR IMPLIED WARRANTIES IN CERTAIN TRANSACTIONS; THEREFORE, THIS STATEMENT MAY NOT APPLY TO YOU.

For purposes of clarity, any module, adapter or other similar material ("Module") is licensed under the terms and conditions of the End User License Agreement for the applicable version of the NetIQ product or software to which it relates or interoperates with, and by accessing, copying or using a Module you agree to be bound by such terms. If you do not agree to the terms of the End User License Agreement you are not authorized to use, access or copy a Module and you must destroy all copies of the Module and contact NetIQ for further instructions.

This document and the software described in this document may not be lent, sold, or given away without the prior written permission of NetIQ Corporation, except as otherwise permitted by law. Except as expressly set forth in such license agreement or non-disclosure agreement, no part of this document or the software described in this document may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, or otherwise, without the prior written consent of NetIQ Corporation. Some companies, names, and data in this document are used for illustration purposes and may not represent real companies, individuals, or data.

This document could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein. These changes may be incorporated in new editions of this document. NetIQ Corporation may make improvements in or changes to the software described in this document at any time.

U.S. Government Restricted Rights: If the software and documentation are being acquired by or on behalf of the U.S. Government or by a U.S. Government prime contractor or subcontractor (at any tier), in accordance with 48 C.F.R. 227.7202-4 (for Department of Defense (DOD) acquisitions) and 48 C.F.R. 2.101 and 12.212 (for non-DOD acquisitions), the government's rights in the software and documentation, including its rights to use, modify, reproduce, release, perform, display or disclose the software or documentation, will be subject in all respects to the commercial license rights and restrictions provided in the license agreement.

© 2013 NetIQ Corporation and its affiliates. All Rights Reserved.

For information about NetIQ trademarks, see http://www.netiq.com/company/legal/.

Return to Top