Secure Configuration Manager 7.1 SP1 includes product upgrade and resolves previous issues.
Many of these improvements were made in direct response to suggestions from our customers. We thank you for your time and valuable input. We hope you continue to help us ensure our products meet all your needs. You can post feedback in the Secure Configuration Manager forum, our community website that also includes product notifications, blogs, and product user groups.
The documentation for this product is available in HTML and PDF formats on a page that does not require you to log in. If you have suggestions for documentation improvements, click Secure Configuration Manager Documentation page. To download this product, see the Secure Configuration Manager Product Upgrade website.at the bottom of any page in the HTML version of the documentation posted at the
Secure Configuration Manager 7.1 SP1 replaces Oracle JDK with Azul Zulu OpenJDK, an open source alternative. This change does not have any functional impact. However Secure Configuration Manager, Micro Focus will no longer provide additional Oracle JDK updates for Secure Configuration Manager. Therefore, if there are security vulnerabilities or other bugs related to Oracle JDK, the primary solution is to upgrade to 7.1 SP1 or later.
The SCAP 7.1.1 Module for Agents no longer bundle Java. You must download Java 8 or later on your computer, if you want to use SCAP Windows Agent 7.1.1 or SCAP UNIX Agent 7.1.1 with Secure Configuration Manager 7.1.1.
Security Agent for Windows:
If you are using the SCAP Windows Agent with Secure Configuration Manager 7.1, you can upgrade the SCAP Windows Agent to 7.1.1. Upgrade the agent by using the Scap_Windows_Agent_188.8.131.52.msp file on the systems running the SCAP Windows Agents.
Security Agent for UNIX:
If you are using the SCAP UNIX Agent with Secure Configuration Manager 7.1, you can upgrade the SCAP UNIX Agent to 7.1.1. Upgrade the agent by using the p76p100.zip file on the systems running the SCAP UNIX Agent.
For more information on upgrading the SCAP 7.1.1 Module for Agents, see the Installing or Upgrading the SCAP Module steps in the
Secure Configuration Manager SCAP Module Installation & Configuration Guide .
Issue: Web console runs out of memory while downloading large PDF reports.
If you run a policy template that contains a large number of security checks against a large number of endpoints, the report in PDF format might contain hundreds of pages. The Web console cannot download such a large PDF file. (Bug 1087584)
Fix: The report now downloads.
Issue: Logging in to the Windows Console fails if you are using TLS 1.2 with Secure Configuration Manager. (Bug 1122755)
Fix: The Windows Console now communicates using TLS 1.2. To make the appropriate Microsoft SQL driver changes, see the Knowledgebase Article 7023700.
For information about hardware requirements, supported operating systems, and browsers, see the following resources:
This release supports the following security agent versions:
You can upgrade to Secure Configuration Manager 7.1 SP1 from version 7.1.
For more information, see Secure Configuration Manager Installation Guide.
Before upgrading to this version, review the considerations for the following components and features:
You can upgrade only with TLS 1.0 enabled. However, if you have TLS 1.2 enabled, perform the following steps:
Disable TLS 1.2.
Enable TLS 1.0.
Restart your computer.
Upgrade to Secure Configuration Manager 7.1 SP1.
Enable TLS 1.2.
Restart the computer.
In a distributed environment, restart the Secure Configuration Manager related services. For example, restart the Dashboard services.
IMPORTANT:After you enable TLS 1.2, Secure Configuration Manager does not work on FIPS mode. There is no workaround for this issue.
You can upgrade Secure Configuration Manager components as a member of the computer’s Administrator group. You must run all the patch installers (.msp files) with administrative rights by using the command prompt. (Bug 1098523)
Security settings on Windows 10 computers might prevent you from starting the Secure Configuration Manager upgrade. The launch might either fail with an error indicating that another user canceled the operation, or fail without displaying any error. (Bug 1069836)
To upgrade on Windows 10, complete one of the following steps:
Have your system administrator enable gpedit.msc group policy on the desired computer. Then download and perform the upgrade.in the
Manually modify the MSP files.
Right-click the file, then select.
In thetab, select .
For more information, see the following explanations of this Microsoft issue:
The upgrade process removes all existing records from the Discovered Host table in the database. This means that the upgrade also removes all systems from the Discovered Systems content pane.
After you successfully upgrade Secure Configuration Manager and register your agents, the Asset Details and Discovery job automatically add application endpoints discovered on currently registered Windows and UNIX systems.
To manually repopulate Discovered Systems with unmanaged systems, update the Discovery settings in the Core Services Configuration Utility, and then initiate the discovery process. For more information about discovery, see the Help and the User’s Guide for Secure Configuration Manager.
To discover systems in Active Directory, you must update the settings on the Discovery tab of the Core Services Configuration Utility.
Secure Configuration Manager 7.1 fails to import security checks and policy templates. This happens when Secure Configuration Manager 7.0 is installed with latest service packs of Microsoft SQL Server 2008, 2012, or 2014, or with Microsoft SQL Server 2016. Perform the steps mentioned in the Knowledgebase Article 7023551, before you upgrade to Secure Configuration Manager 7.1.1. (Bug 1116496)
Mirco Focus strives to ensure our products provide quality solutions for your enterprise software needs. The following issues are currently being researched. If you need further assistance with any issue, please contact Technical Support.
The following issues apply only to the Web console, which this release introduces:
Issue: When you view the details for a batch-created exception that has expired, the Web console erroneously updates the . The time should reflect when the exception expired, which is midnight on the expiration date. Instead, the time corresponds with the moment that you refresh the page to view the details or run a policy template. (Bug 1099937)
Issue: Microsoft Internet Explorer 11 does not support the underlying code that the Web console uses to display the content in an assessment report. (Bug 1097429)
Workaround: To view the prediction content in an assessment report, use one of the other supported browsers, such as Google Chrome, Microsoft Edge, or Mozilla Firefox.
Issue: In the Web console, the following security checks erroneously require you to specify an integer instead of alpha-numeric characters to indicate an enabled/disabled value for a parameter:
FTP logging enabled
Ownership and permissions of files under /etc
Minimum Password length restrictions
User list by status
Workaround: When you run these security checks, enter 1 to represent enabled and 0 for disabled.
Alternatively, you can use the Windows console to run the security checks.
The Web console might display the following anomalous behavior when you view a job that is in progress:
Issue: Some jobs might take longer than others to complete due to the number of security checks or endpoints being assessed. You can select a job that is still in progress to view its progress. However, the Web console might fail to display the status for one or more endpoints within the job. (Bug 1051613)
Issue: If you open a job that is in progress, the Web console might display an erroneous number of endpoints associated with the job. To determine the appropriate number of endpoints, check the value listed in the column of the list. (Bug 1067395)
Issue: Although the Web console can display all jobs in the jobs queue for Secure Configuration Manager, The console cannot generate a report for tasks or delta reports.
Workaround: To view those reports, use the Windows console.
The Web console does provide enhanced views of assessment reports, as well as dynamic reporting. For more information, see the Help for the Web console and the User’s Guide for Secure Configuration Manager. (Bug 1069002)
Issue: The Web console provides a Getting Started tour to help you explore new features in the product. To move from one page in the tour to the next, you must click the left or right arrows in the interface. The tour does not respond to presses of the keyboard arrows. (Bug 1069547)
Issue: When you click for a desired report, the Web console might display the following message:
Cannot display the report because it does not exist.
This message occurs in the following circumstances:
Someone deleted the report in the Web console. For example, a different user deleted the report, and your browser had not refreshed the list of reports.
The report existed in a previous version of Secure Configuration Manager. However, either no one had opened the report in that version or the report’s schedule expired before you upgraded to this release.
Workaround: Try opening the report in the Windows console. Once Secure Configuration Manager generates the report in the Windows console, you can view it in the Web console.
Issue: When you use Internet Explorer 11, the Web Console occasionally might fail to display icons or images. For example, the images that indicate and endpoints might disappear. However, the text indicating the status of the endpoints continues to be visible. (Bug 1070011)
Workaround: If this issue occurs, clear the cache in Internet Explorer. Alternatively, use one of the other supported Web browsers, such as Firefox, Edge, or Chrome.
Issue: When you use the keyboard for navigation, the tab in the assessment report fails to display the prediction chart and table for the selected endpoint. The console responds appropriately when you use the mouse to select the content. (Bug 1100180)
Issue: To support accessibility, you can use a screen reader or keyboard to navigate the Web console. However, some fields in the Web console might not behave as expected for your chosen navigation method.
To activate a dropdown menu, you might need to use therather than the .
To select items in a dropdown menu, you might need to use the, even though the screen reader prompts you to use the .
The screen reader cannot provide information about the contents of charts and graphs. However, it can read the legends associated with each chart or graph, which provide the same information in text format.
When you run a policy template or security check, you cannot use the keyboard to modify thevalue under .
(Bug 1069370, Bug 1068850)
Issue: When you install Core Services, the initialization process for Core Services continues in the background even though you have completed and closed the installation program. A shorter initialization period occurs after you restart the service.
If you attempt to launch the Web console before the initialization process completes, the console displays an error.
Workaround: You can refresh the page to establish a connection to Core Services. (Bug 1073053)
NOTE:The console can display some content without communication with Core Services. However, most content requires Core Services. For example, endpoint status.
Issue: In the job queue, you can select multiple jobs then click to cancel the jobs. However, the Web console cancels only the most recent job. (Bug 1054179)
Workaround: To cancel jobs that are in progress, select only one job, then click . Then repeat the process for each job that you want to cancel.
Issue: Downloading SCAP reports fail with an error message
Failed to download the report. Please try again..(Bug 1124750)
Workaround: Use Windows Console to download SCAP reports in PDF format.
This release enables you to apply a batch-created exception that includes multiple policy templates for a particular set of endpoints or groups. This functionality works only in the Web console. In other Secure Configuration Manager components, the following issues might occur:
Issue: The Windows console does not support batch-created exceptions. Therefore, the Admin Report Exceptions, which you run in the Windows console, does not provide data about this type of exceptions.
NOTE:In the Web console, you can also create an exception within an assessment report. This exception applies only to the endpoints and security checks associated with that policy template run, which is similar behavior as creating an exception in the Windows console. The Exceptions report does include data for this type of exception, regardless of the console that created the exception.
Workaround: The Web console lists all exceptions, regardless of the console that created the exception. In the Web console, go to . Select all exceptions in the current tab, then click .
Issue: If you enable batch-created exceptions in the Web console, the Dashboard does not provide an indication that these exceptions exist. When you review an assessment report in the Dashboard, the field equals zero, rather than accurately reporting the number of exceptions that have been applied to the results.
Workaround: Disable batch-created exceptions. For more information, see
Allowing Exceptions in the Web console in the Web console Help.
Issue: Sentinel fails to retrieve the data when you configure Secure Configuration Manager to send events only. This issue occurs only when both Sentinel and Secure Configuration Manager are in FIPS mode.
Workaround: For more information about configuring FIPS mode, see User’s Guide for Secure Configuration Manager. (Bug 1068366)
Issue: If you install a Secure Configuration Manager component on a computer running Windows Server 2016, the Core Services log lists an erroneous version for the Windows platform:
System: Windows NT (unknown)
Secure Configuration Manager does know that the platform is Windows Server 2016. The log simply lists the incorrect version. (Bug 1065829)
The following issues occur if you use Security Agent for UNIX 7.5.1 (UNIX agent) or later with both Change Guardian 5.0 and Secure Configuration Manager, and you use Change Guardian AM to upgrade or install the UNIX agent:
Issue: When you install Security Agent for UNIX 7.5.1 or later, as part of a new installation of Change Guardian 5.0 on the same computer as Secure Configuration Manager, the agent registration fails in Secure Configuration Manager because of the dynamic certificate changes. (Bug 1045613)
Workaround: To configure Security Configuration Manager server, see the Knowledge Base Article 7023134.
Issue: Secure Configuration Manager fails to register the UNIX agent if you upgrade the agent to 7.5.1 or later using Change Guardian AM.
Workaround: Perform the following steps from UAM to re-register the UNIX agent in Secure Configuration Manager:
In the SCM Configuration window, ensure that theis same as the SCM Core IP Address, then click .
Restart the agent service by selectingand in the panel.
You can manually register the UNIX agent:
Navigate to the /usr/netiq/bin file.
Run the following command:
To restart Secure Configuration Manager services, run the following command:
Issue: Secure Configuration Manager does not export full delta reports to Microsoft Excel format. (Bug 1001599)
Workaround: You can export delta reports in any other file formats such as .pdf, .tsv, .rtf, or .xml.
Issue: While upgrading Secure Configuration Manager to version 7.0 or later in the distributed setup in a computer where Core Services and the console are installed, the installation wizard displays incorrect screens if you click after the License Agreement screen. (Bug 994646)
Workaround: Cancel the upgrade process by closing the wizard, and start upgrading again.
Issue: You cannot create, install, or view security certificates in your Core Services computer by running the sslkey tool. Secure Configuration Manager displays an error when you run the sslkey.bat file. (Bug 971532)
Workaround: You can use any third-party tool to create, install, or view security certificates.
Issue: When you edit an existing weekly or daily scheduled job for recurrence time schedule and save it, Secure Configuration Manager does not save and apply the updated recurrence schedule. The next run date is not updated as per the updated recurrence schedule. (Bug 971902)
Workaround: Delete the scheduled job you intend to update and create a new schedule job with the same parameters but with the new, intended recurrence time schedule.
Issue: While registering or reregistering an endpoint, if you regenerate the crypto key for SSH, the registration fails. This occurs because the key is not replaced in the .ssh/known_hosts file. (Bug 860552)
Workaround: Delete the .ssh/known_hosts file and register the endpoint again.
Issue: When you try to uninstall a Secure Configuration Manager component using the installation program on a computer that has Windows 7 or Windows Server 2008 R2, and if some files that belong to the component are in use, the installation program displays a dialog box. If you click in that dialog box, ideally uninstallation should not continue and the error message should persist, but uninstallation resumes. (Bug 893069)
Workaround: Install the Microsoft KB 2649868.
Issue: The check output view in Secure Configuration Manager reports has the following issues when the amount of the data is high:
The output view is incomplete.
The scroll bar function is not supported.
Workaround: There is no workaround at this time.
Issue: In Secure Configuration Manager 7.1, if the standalone AutoSync Client is not installed on the default location, upgrading the AutoSync Client fails to start the AutoSync service.
Workaround: Perform the steps mentioned in the Knowledgebase Article 7023534 before you upgrade the AutoSync Client.
Issue: After downloading the AIX 6.1 SCAP 1.1 template, if you import it to Secure Configuration Manager and run on an AIX endpoint, Secure Configuration Manager returns an error message
No data returned from scat.
Workaround: Perform an offline assessment with the AIX template, and manually import the report to Secure Configuration Manager. For more information about offline assessment see the Secure Configuration Manager SCAP Module Installation & Configuration Guide.
© Copyright 2019 Micro Focus or one of its affiliates.
The only warranties for products and services of Micro Focus and its affiliates and licensors (“Micro Focus”) are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Micro Focus shall not be liable for technical or editorial errors or omissions contained herein. The information contained herein is subject to change without notice.
For additional information, such as certification-related notices and trademarks, see http://www.microfocus.com/about/legal/.