u.trust LAN Crypt 11.0.0 Client release notes

After the acquisition of conpal GmbH in 4/2023 by Utimaco, the product conpal LAN Crypt has been rebranded and will be continued under the different brand name u.trust LAN Crypt. Version 11.0.0 is the first rebranded version, a feature release and replaces the conpal LAN Crypt product.
The product is able to upgrade from the previous conpal LAN Crypt 4.2.1.

The Legacyfilter has been abandoned, and is not supported anymore.
Administration versions earlier than conpal LAN Crypt 4.1.1 are EOL.
Clients earlier than conpal LAN Crypt 4.1.3 are EOL.

We recommend to upgrade the clients to 4.2.1 and the administration to 4.2.0 before upgrading to u.trust LAN Crypt 11.0.0.

 

u.trust LAN Crypt 11.0.0 also comes with improved security functionality and several bugfixes.

New features:

§  Support for new versions of operating systems

§  64 Bit .NET API

§  Several enhancements and extensions for .NET API

§  LCSendP12Password helper tool, automatically send P12 passwords by email

§  New database tool CheckDatabase.exe

§  Improved CreateTables

§  Log Collector Utility

§  Client Performance Improvements, options to cache files for encrypted SMB shares, DsStateCache for caching unencrypted files

§  Rebranding

§  Detail work on dialogs and error messages

§  Option to renew assigned certificates

§  Most important cloud apps pre-registered and maintainable via registry

§  Support for multiple policies

§  Show "Bypass" flag for rules in "Show Profile"

Changes/Improvements in V11:

§  u.trust LAN Crypt2Go replaces conpal LAN Crypt Portable

§  Improvement of accessibility

§  Accelerated create-profile functionality

§  Improved certificate handling

§  Accelerated certificate creation

§  Support for certificates in computer-store, e.g. for services

§  Optimizations, additional verifications and acceleration of CreateTables for MS SQL and Oracle

§  ClearCache Option for DsStateCache

§  Removed support for

§  deprecated Oracle versions

§  profiles in legacy format

§  Improved messages

§  .Net API update to support version 8

§  Throttling when creating certificates to preserve resources for OS accessibility

§  Performance tracing

§  When importing certificates (p12) from a file server, certificates are now checked in true descending order (by number suffix).

§  Default ignored apps can be maintained via registry

 

The EULA has been updated and is now only available in English and German.

The English version is valid for all non-German speaking countries.

The actual versions can be obtained from:

https://utimaco.com/sites/default/files/2024-02/Utimaco_IS_GmbH_EULA_2024_EN.pdf

https://utimaco.com/sites/default/files/2024-02/Utimaco_IS_GmbH_EULA_2024_DE.pdf

Please note the LAN Crypt 11.0.0 Administration release notes.

Older release notes for LAN Crypt remain valid, if not stated otherwise.

 

 

Requirements

The below listed platforms have been tested and are officially supported. Other Service Pack levels might work as well but have not run through a QA cycle and won´t be analysed in case of occurring issues.

Supported Windows 64-bit operating system platforms

Pro/Enterprise versions of Windows 10 21H2 (LTSC), 22H2

Pro/Enterprise versions of Windows 11 21H2, 22H2, 23H2

Windows Server 2022

Supported Citrix Environments

Citrix Virtual Apps and Desktop 7 1912 LTSR CU2 on WS 2019

 

 New in LAN Crypt Client release 11.0.0

• Protection of LCUser and LoadProf from being terminated by TaskManager (LC-3107)
• DsStateCache is cleared when profile is unloaded (LC-3191)
• Show bypass rules in Show profile dialogue (LC-3122)
• Support functions for Box Drive (LC-3282)
• Rebranding GUI, icons, GPOs, EULA, file header and messages to u.trust LAN Crypt (LC-3156, LC-3299, LC-3595)
• MultiPolicy support - load and merge secondary profiles (LC-2094, LC-3455, LC-3515, LC-3744, LC-3719, LC-3614, LC-3830, LC-3829, LC-3790, LC-3579)
• LCStatus can show meta information of a primary/classic policy in Status tab (LC-3446)
• Company name of a primary policy is configurable via registry (LC-3722)
  Key: HKEY_LOCAL_MACHINE\SOFTWARE\conpal\LAN Crypt
  Value: CompanyName
  Type: REG_SZ
• Setting cloud sync apps as ignored apps is configurable via registry, default apps: see manual (LC-3638)
• Overlay icons now scale when the desktop scaling is changed (LC-2998)
• The “OptimizeNetworkDelayedClose” optimization can provide significant performance benefits for applications that repeatedly open network files at short intervals. It is only active when “OptimizeNetworkCachingMode” is not set to FESF_DEFAULT.

All network files (encrypted or not) appear closed to the upper layers on the client, but in reality they remain open for a short time so that they can be read from the cache when they are accessed quickly again. The maximum time to final closure is about 30 seconds. If someone on the network accesses the file during this time, the network driver will immediately report the access to the minifilter, and the minifilter will attempt to close the file as quickly as possible. Unfortunately, this is not always successful, and in this case the accessing application from the other client may receive a SHARING_VIOLATION message on the first access. The next attempt would be successful, but may be too late for some applications. For this case, the “DelayedCloseExcludedPaths” registry parameter is provided, where you can configure the paths that are excluded from this optimization. Please contact support for details. (LC-4074)

• New support tool Log Collector Utility (LC-3165)
• Support for caching on encrypted SMB Shares can be enabled via registry. Please contact support for details. (LC-3226, LC-3772)

 

 

Changes in LAN Crypt Client release 11.0.0

• For SO and user certificates without x509v3 key usage option (keyUsage=keyEncipherment, dataEncipherment)

If the 'Check certificate extension' group policy is not configured, this policy is treated as 'Enabled'.

Certificates without an appropriate key usage will be rejected.

 

This applies to

    Importing a user certificate into the LC Client

    Importing a SO certificate into the LC Client

    Assigning a user certificate in the LC Administration Console

    Assigning a SO certificate in the LC Administration Console

    Logging in to the LC Administration Console

 

Starting with LC v4.2.0, the behaviour was inadvertently treated as "disabled" if the "Check certificate extension" group policy was not configured.

With LC v11.0.0 this has been fixed so that LC behaves as it did before LC v4.2.0. (LC-3938)

 

Therefore, before upgrading LCA and LCC to v11.0.0, make sure that the group policy is set to "disabled" when using certificates without the x509v3 key usage option.

• C++ runtime has been updated (LC-3295).
• 3^rd party components updated, old components removed (LC-3747, LC-2680, LC-3144, LC-3315, LC-3221, LC-3222, LC-3223, LC-3366, LC-3748, LC-3749, LC-3484, LC-4109, LC-4179)
• Rename from inWebo to Trustbuilder for 3^rd party MFA (LC-3196)
• When "Load encryption rules" is selected from the tray icon, the PIN entry window for the user .p12 import now has keyboard focus (LC-11)
• Improved rigidity of the initial encryption wizard (LC-3150)
• Buffer overflow prevention measurements (LC-3314, LC-3450)
• Improved and accelerated signature handling in LoadProf (LC-3439, LC-3584)
• Instead of a warning, only a note (icon) is displayed if the path to the profile file is (temporarily) unavailable (LC-3527)
• Improved error message when MFA authentication fails due to timeout (LC-3382)
• Default WPP tracing session disabled to save kernel memory (LC-3653)
• Improved serial number handling when importing certificates, especially for incorrect numbers according to RFC 5280 (LC-3632, LC-4139)
• Improved error message when loading policy from webserver failed (LC-3427)
• Removed check for old policy file if policy could not be loaded from websesrver (LC-3404)
• Improved signature check for future backwards compatibility when loading a policy (LC-3716)
• No more creating new headers with 512 bytes of padding, instead set padding length to 0 (which is basically the same, but MacOS and Android LC can handle it better) (LC-3849)
• Default Ignored Apps (except SearchProtocolHost.exe) will be set in the registry by the setup at:
  HKLM\SYSTEM\CurrentControlSet\Services\cplcdt2\Parameters\DefaultIgnoredApplications and can be modified by the customer in case of need (LC-3935)
• The search order of the p12-file on a file share has been changed so that "newer" p12 are imported first (according to the number suffix (higher number first)) (LC-120)
• Restricted access to named pipe of LAN Crypt service (LC-3997)
• Improved performance, especially when reading large network files (LC-4040)
• New CopyFile feature implemented to overcome unusually long initial encryption time for OneDrive files when used with Sophos Endpoint Protection (LC-4043)
• Extended trace for time validity errors in certificate chain (LC-4147)
• Antivirus: In general,anti-malware software has to be configured according to what you want them to do. The part that needs to scan files needs to be added to the Virus Scanner settings of LAN Crypt, preferably along with the authenticode of their manufacturers.

Virus Scanner	Executable	Authenticode
Sophos Endpoint Security and Control	Old: SavService.exe Now: SophosFileScanner.exe   e.g.: C:\Program Files\Sophos\Endpoint Defense\SEDService.exe C:\Program Files\Sophos\Sophos File Scanner\SophosFS.exe C:\Program Files\Sophos\Sophos File Scanner\SophosfileScanner.exe C:\Program Files\Sophos\Endpoint Defense\SSPService.exe C:\Program Files\Sophos\Clean\SophosCleanM64.exe C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe	Yes
Microsoft Defender	MsMpEng.exe
CrowdStrike	CsScan.exe

In case EDR, XDR, or MDR is used, it makes sense to exclude them or some of their processes from decrypting files and at the same time allow these processes to access them. This is done by adding the executable names to the unhandled applications settings in the LC Group Policy

EDR/XDR/MDR	Executable	GPO unhandled applications recommended
Sophos XDR	OsQuery.exe	Yes
Palo Alto Cortex	cyserver.exe*	Yes

* Guess, not verified at release time

 

Bugfixes in LAN Crypt Client release 11.0.0

• Made the path to the default policy file cache visible in Client Status (LC-3262)
• Fixed BSOD when drive has less space available than required (LC-3184)
• Policy file cache folder is now correctly ignored (LC-3379)
• Fixed registry write error for DATAID_LCINIT_FILETYPES_USER (LC-3431)
• Improved spelling in lcinit help (LC-3494)
• Fixed memory leak (LC-3533)
• Fixed BSOD of cplcisolate.sys in Horizon VDI (LC-3597)
• Create file in plain when created on a volume with ignored drive letter that was mapped after boot (LC-3657)
• Wordpad 'File In Use' issue fix for files on network shares (LC-3937)
• BSOD with Clear Case fixed: GetEncState stack reduced by 1K+ (LC-3982)
• Fixed potential hang when moving a large number of plain files by cutting and pasting to the same SMB share (LC-3678)
• Encryption status of a file can now be queried with SGFEApi for imported LC2GO keys (LC-4042)
• Nx-Pool leak fixed to allow activation of HVCI - hypervisor-protected code integrity (LC-3679)
• Bug fixes for compatibility with Microsoft’s Driver Verifier (LC-4127)
• Fixed BSOD when copying files using the CopyDeploymentManager tool (LC-4055)
• Fixed memory leak in mini filter. (LC-3625)
• Driver Verifier Exception during OneNote Sync fixed (LC-4163)
• Fixed inability to save Office documents to a network drive, corrupted Office files, especially Excel files - more common in environments with Sophos AV (LC-3793)
• Fixed BSOD when moving files to an encrypted DFS share where files already exist (LC-4192)
• Exception handled in LCUser when iterating over directory for async encryption (LC-4188, LC-4037)

 

New and known issues in LAN Crypt Client release 11.0.0

• Some debugger protection functionality has been deactivated due to interoperability issues (LC-4063, LC-4020).
• In very specific situations, the new DelayedClose functionality will cause an access error when quickly closing, opening, and modifying files on the network, which will not occur if you try to save a file a second time or if you wait a little while between actions. (LC-3937)
  "The purpose of the DelayedClose optimization is to keep the files in our driver open for a short time so that they can be opened more quickly if they are accessed again during that time.

However, if another application or somebody in the network accesses the file earlier and wants to open it exclusively, this can in rare cases lead to an error.

Important note: In any case, all data is "flushed" (written to disk) but not "purged" (deleted from cache), so no data is lost in the event of a system crash.

• When copying LC-encrypted text files (via multiselect or via parent directory) from a VM environment with no LC client installed to an outbound share or to a different VM with LC client installed, some AES-XTS encrypted files can end up double-encrypted. Double encryption can be removed using the wizard. (LC-4157)
• API: When using “SetTemporaryRule” via the API, the rule is not removed after access or within 15 seconds, as described in the manual. The rule may be persistent for the session. (LC-4122)
•  The PreventPlainFiles functionality has been officially supported and released for LAN Crypt version 4.2. Administration is done solely via ADMX templates.
  Since previous versions were only made available on a project basis to very few customers, no migration of existing settings was implemented.
  The settings in older versions were stored under
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Utimaco\SGLCENC
  "PreventPlainFiles"=....
  Now, the settings are stored under
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\cplcdt2\Parameters]
  "PreventPlainFiles"="...", they can be managed via ADMX.
  Note that the newer settings use a REG_MULTI_SZ. (LC-3792)
• Explorer crashes when a local drive is moved using LC “Secure move”, affects LAN Crypt 4.2 as well (LC-3225)
• Profiles cannot be created for users in subgroups with depth greater than or equal to 80. Affects Lan Crypt 4.1.1, 4.2 and 11.0 (LC-3193)
• Non-standard screen scaling may result in incorrect display of menus and setup (LC-4190)
• For the administration, the rules and the managed paths, there is a restriction of <260 characters (Microsoft MAX_PATH). The client also checks for this length restriction. (LC-2500, LC-3844)
• The GPO “Strong private key protection“ (“CertUserProtected”) is currently not applied, when using the import function for user certificates of the LC client. (LC-4213)
• We have identified two problems that appear to be related to the “OptimizeNetworkDelayedClose” optimization (This optimization keeps a file in the cache for a short time after closing which speeds up some use cases significantly.):
• Building a C++ project on a network share with Visual Studio may fail with the message 'File already in use'.
• If CSC (client-side caching - offline files) is enabled, moving network directories (cut-paste) may fail with the message 'File already in use by another process'.

With the setting OptimizeNetworkDelayedClose=0, this behaviour does not occur in either case. (LC-4201)

• Unfortunately, LCC can only evaluate the IP addresses in the rules correctly if the RemoveDomainFromRules flag is not set, otherwise only \172* of the rule \172.20.2.23* remains. With normal rules, this functionality can be controlled via the registry, but this is not possible with PreventPlainFiles rules in the current version (LC-3626).

 

 

 

Manuals, documentation and support

At https://support.conpal.de registered customers with active maintenance contracts get access to downloads, documentation and knowledge items.

 

Read or download the client product documentation at

https://help.lancrypt.com/docs/windows/11_0_0/de/ in German language, at

https://help.lancrypt.com/docs/windows/11_0_0/en/ in English language and at

https://help.lancrypt.com/docs/windows/11_0_0/fr/ in French language.

 

API documentation can be obtained from:

https://help.lancrypt.com/docs/api/client/en/

https://help.lancrypt.com/docs/api/admin/en/

 

conpal LAN Crypt 4.2.1 Client release notes

 

conpal LAN Crypt 4.2.1 is a maintenance release, there are no new features included.
Please refer to the conpal LAN Crypt 4.2.0 part of the release notes.

Older release notes for LAN Crypt remain valid, if not stated otherwise.

LAN Crypt 4.2.1 was built solely to provide workarounds for behavioral changes of Microsoft technologies.
We recommend that all LAN Crypt clients, that are operated with MiniFilter, should be updated, when affected by the described issue.

IMPORTANT LAN Crypt Notice: Windows Update results in changed behavior with LAN Crypt

Issue

In rare cases, copying files to network shares results in a change in the size of the destination file. This is increased to the next 512-byte limit. The behavior is independent of the encryption status. It does not occur without LAN Crypt installed, nor does it affect file operations on local media. Removable media or cloud storage likewise are not affected according to our tests.

Affected systems

Windows 10 and 11 with KB505221 or KB5023774 or KB5025239 in combination with LAN Crypt Client (4.x with MiniFilter).

Other systems/combinations are not affected to our current knowledge.

 

Countermeasures/fixes:

LAN Crypt 4.2.1 contains a workaround for that behavior.

We are categorizing this issue as a potential data corruption and classify it as critical. We advise installing the LAN Crypt client version 4.2.1 on affected systems.

There are currently no other known workarounds, despite delaying the referenced Microsoft patches.

 

Background:

Microsoft continues to make significant changes to Windows to increase the performance of file copy operations*. While this is mostly transparent to file system filter drivers, in our testing we have discovered an incompatibility between our drivers and a recent change to this code path in the OS.

 

Example:

A non-cached copy operation of a 7-byte source file to a network share will result in a 512-byte destination file.
xcopy /v /j localsource networkdestination

 

Occurrence:

The issue affects Windows machines with all LAN Crypt versions using MiniFilter (4.0 - 4.2). We have determined the change in OS behavior was introduced to Windows 10 via KB5025221. Further testing shows that this issue is also present in recent releases of Windows 11 21H2 and can be traced back to KB5023774. For Windows 11 22H2, the issue seems to be present since at least KB502523.

 

Severity:

The issue arises sporadically, in most cases the change in file size is inconsequential or easily remedied by the associated app.

 

Related Links:

 

 

2023-04 Cumulative Update for Windows 10 *** Systems (KB5025221)

https://support.microsoft.com/help/5025221

KB5025221 - Microsoft Update Catalog

 

2023-03 Cumulative Update Preview for Windows 11 21H2 *** Systems (KB5023774)

https://support.microsoft.com/help/5023774

KB5023774 - Microsoft Update Catalog

 

2023-04 Cumulative Update for Windows 11 Version 22H2 *** Systems (KB5025239)

https://support.microsoft.com/help/5025239

KB5025239 - Microsoft Update Catalog

 

 

*Further details about these changes by Microsoft in general can be found here:

Kernel-mode file copy and detecting copy file scenarios - Windows drivers | Microsoft Learn

Changes in conpal LAN Crypt Client release 4.2.1

§  Based on the recent OS changes it is no longer valid to clear the FO_NO_INTERMEDIATE_BUFFERING bit in non-cached opens to network files. LAN Crypt previously cleared this bit to have better control over caching on network files, however the I/O subsystem now uses the presence of this bit to determine if files should or should not be truncated to a non-aligned size during non-cached copies. While we do not believe that the I/O subsystem should be using this bit for the determination, the OS releases are now in the wild and we must change our handling within LAN Crypt.
Using different mechanisms for the operations (LC-3337)

§  Due to a bug in the current sysinternals Sysmon version (14.6), LC performance problems may occur. A workaround has been implemented (LC-3173). The workaround might be benefcial for other situations, where users face performance problems when opening and saving files

In general Sophos virus scanners have to be configured differently:

Virus Scanner	Executable	Authenticode
Sophos Endpoint Security and Control	Old: SavService.exe Now: SophosFileScanner.exe	Yes

 

 

 

conpal LAN Crypt 4.2.0 Client release notes

 

conpal LAN Crypt 4.2.0 is a feature release that also comes with improved security functionality and several bugfixes. New features:

• Malware Protection
• OneDrive Settings package
• LAN Crypt 2Go Key Import
• Adding Multiple Encryption Groups to a User
• Bypass Rules Deployment
• Multiple Virus Scanner Configurations
• PreventPlainFilesPath Option
• New Operating Systems Support
• Additional Database Support
• API extensions
• Localization Support for MFA
• Client Performance Improvements
• HTML-Based Client Help
• On-Premise OneNote Support
• Search field for groups
• Network filter installation without network interruption
• Detail work on icons, dialogs and error messages
• LCA 64-bit .NET API
• Several enhancements for .NET API
• Support of Server-Side Copy
• DsStateCache for caching unencrypted files
• Renewal of assigned certificates

Please note the LAN Crypt 4.2.0 Administration release notes.

Older release notes for LAN Crypt remain valid, if not stated otherwise.

 

Important information, if you had early access to LAN Crypt Client 4.2.0

During the release of LAN Crypt v4.2.0.5550, we detected a data corruption,
if encrypted files were copied from an unregulated server share to an unregulated folder on the same server share, when server side copy was utilized by the LCC.
Shipment of the version has been stopped, but it is possible that this version still arrived at individual customers or partners.

We strongly advise against productive use of LAN Crypt for Windows Client v4.2.0.5550.
The version can be identified by the build number of the binaries,
the information in the info/about-box of the client or you can already distinguish the MSI:
The client of the defective version 4.2.0.5550 has the revision number {2F4D80EF-733F-48B1-AA67-8EABD636C7C6}.

The root cause for the possible corruption has been found and the problem is fixed with LAN Crypt v4.2.0.5559,
which is currently available as a released version.
The MSI of the released LAN Crypt client version 4.2.0.5559 has the revision number {BAFCA5AD-9B37-4BBE-A8B9-973ED914A50F}.

The defective version cannot be updated to the released version, so it would have to be uninstalled and reinstalled.

 

 

Requirements

The below listed platforms have been tested and are officially supported. Other Service Pack levels might work as well but have not run through a QA cycle and won´t be analysed in case of occurring issues.

Supported Windows 64-bit operating system platforms

Pro/Enterprise versions of Windows 10 1809 (LTSC), 20H2, 21H2, 21H2 (LTSC), 22H2

Pro/Enterprise versions of Windows 11 21H2, 22H2

Windows Server 2019

Windows Server 2022

Supported Citrix Environments

Citrix Virtual Apps and Desktop 7 1912 LTSR CU2 on WS 2019

 

 New in conpal LAN Crypt Client release 4.2.0

• Rule for Import/Malware Protection (No Plain File Access on Removable) (LC-2861)
• OneDrive Settings can be applied as an optional package with the setup (OneDrive HKCU configuration for the user running the setup) (LC-2904)
• LAN Crypt 2Go Key Import: Key value, GUID, name and encryption algorithm can be imported from a file encrypted with LC2Go. This enables the LAN Crypt client to read and decrypt files encrypted by LC2Go with a password and vice versa (LC-2859).
• Bypass rules can be provided within the profile (LC-2864)
• Configuration of multiple Virus Scanners without delays when profile is loaded (LC-2925)
• InWebo/TrustBuilder: Localization support for error messages (2FA) (LC-2800, LC-2793, LC-2792).
• Windows 10 and Windows 11 – 22H2 support
• Support for On-Premise MS OneNote (NB: The OneNote Cache must be deleted, before using the functionality with encrypted OneNote files with 4.2).
• In addition, there are further speed improvements, special adjustments for NetAPP file shares, Citrix and terminal server environments and several bug fixes.
• Documentation and help are provided HTML based online, including API documentation. (LC-3013, LC-3060).
• LoadProf assistant prevents black screens on terminal servers (LC-2433, LC-469, LC-2686).

 

Changes in conpal LAN Crypt Client release 4.2.0

• DsStateCache now enabled by default for local and network drives (LC-93, LC-2771, LC-3185)
  DsStateCache is a mechanism to save constant header reading for non-encrypted files. When DsStateCache is active, the header of each unencrypted file is read only once in 10 minutes (local [45s on network drives]) and all subsequent calls are served by the cache. That is, once a local file is detected as unencrypted, it is considered unencrypted for the next 10 minutes until either event occurs:
  - The file is explicitly encrypted by our EncryptFile function.
  - The file is overwritten, renamed or otherwise replaced by an encrypted file with the same name.
  There is a registry setting available to switch the Caching off in case of problems. Contact the support in such cases.
• Significantly improved activation of virus scanners. Multiple anti-virus scanners configuration activated without delay when loading a profile (LC-2925)
• There are some specific system paths that are excluded from encryption. If you need more information about which paths these are, please get in touch with conpal support. However, starting from LC version 4.2.0, it is now possible to enable encryption for the root folder, Windows folder, and Program Files folders. To do this, you need to set the following registry keys to "1" underneath "HKLM/System/CCS/Services/cplcdt2/Parameters/": “AllowEncryptionOfRootFolder”, “AllowEncryptionOfWindowsFolder”, and “AllowEncryptionOfProgramFilesFolders” (LC-3011).
• Specific locking behavior (NetworkLockRounding) can now be configured based on the application (LC-2645).
• LAN Crypt Message changed, when "Deactivate encryption” is selected in the taskbar options (LC-58). Also, the title bar of those messages now shows the product name again (LC-2889).
• Updated Windows start menu folder names. Changed to “conpal LAN Crypt Administration” and “conpal LAN Crypt Client” (LC-1261).
• Change of the build numbering (LC-2927).
• Product icons modified (LC-2860, LC-2978).
• Embedded libraries updated (LC-2922, LC-3000).
• Import function of intermediate and root certificates stores these certificates in the correct certificate stores now (LC-2611).
• Minifilter now evaluates sorting methods correctly, as used to in 3.x versions (Rules with no/less wildcards (*) are listed first) (LC-2449).
• SGFEApi.exe: Encryption of data files on UNC paths is now possible (LC-2843).
• Profile remains active after crash/termination of LoadProf/LCUser, when user is not allowed to “Clear encryption rules” (set via GPO “Enable Menu Entries”) (LC-3106).
• Support Server-Side Copy: works for all non-controlled network directories, i.e. for all directories where no encryption state change can take place during copying (LC-2657).
• Minifilter performance improvements (LC-2844)

 

Bugfixes in conpal LAN Crypt Client release 4.2.0

• Profiles that cannot be loaded with SO certificate with expiration date >3100 now receive a corresponding error message (LC-2458).
• Issues fixed when LAN Crypt installation path changed for an upgrade. Minifilter ACL is now updated correctly (LC-3024).
• If files are written to an Azure and LAN Crypt controlled share, they are now handled correctly (LC-2879).
• Data corruptions and sync errors, that occurred when multiple users work on the same OneNote (on-premises) document in parallel, have been fixed (LC-1256, LC-3062).
• BSOD fixed on Citrix machines, as soon as files with red key are listed in Explorer (LC-2888).
• Network filter installation works without network interruption during install and filter components are now correctly removed from the "DriverStore" during LC uninstallation (LC-2476, LC-2659, LC-2660, LC-2397, LC-2326, LC-2448, LC-2934).
• Installation of NDIS driver failed when LC Client was installed outside the default installation directory. This has been fixed (LC-2448).
• Explorer extension 32-bit registry entries now get repaired, when deleted accidently (HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced) (LC-3061).
• Setup: 32-bit components now installed in correct "LAN Crypt" subfolder (LC-2779).
• InWebo/TrustBuilder: Sometimes appearing error message when MFA login was already performed fixed (LC-2768).
• When trying to encrypt a read-only file, the error message “You don't have any permission to access this file” is now displayed instead of “Unknown Error” (LC-2485).
• Sometimes the client froze when many plaintext files were encrypted/decrypted in a LAN Crypt controlled environment (LC-3042).
• When saving a PowerPoint file to a NetApp file share while CSC (Offline Client-Side Cache) is enabled for that directory, PowerPoint got stuck while saving. The process could still be cancelled via UI, but the thread hung, and the file could not be deleted. This deadlock got fixed (LC-2722, LC-2781).
• Explorer extension: registry entries were installed despite the feature being deselected (LC-2427).
• When using Intel CPU integrated graphics Intel(R) iRIS(R) Xe or Intel(R) HD 530 the encryption information box did not show the full text (LC-2442).
• Citrix encryption status errors occurred repeatedly on DFS shares and slowed down file processes such as opening documents or data encryption (LC-3019).
• When the Visual Studio runtime were not be available, deinstallation of the LAN Crypt Client could sometimes not be possible. This issue has been fixed (LC-2447).
• Unzipping files to a LC controlled network share sometimes caused a freeze (LC-3108).
• BSoD with network filter driver when saving with Autodesk VRED and Adobe After Effects fixed (LC-2846).
• Trying to create files in an encrypted Azure share was not possible with error “file too large for target system”. This has been fixed (LC-2837).
• Avoiding a BSOD in Citrix on locally mapped drives (LC-2785).
• Client hang was fixed, that could occur when a rule using a drive letter exists, CSC (local offline cache for network files) is enabled, and the network upon reboot is unavailable (LC-2698).
• LoadProfService handle issue fixed, which prohibited deletion of a second service (LC-2465).
• Secure File moving was not possible on Isilon and NetApp shares - fixed (LC-2758).

 

New and known issues in conpal LAN Crypt Client release 4.2.0

• The 3^rd party inventory “3rd_party_software.pdf” is present and up to date in the LCA and LCC deployment folders. The “3rd_party_software.pdf” installed with the LC product is missing an entry:
  “libkmip/BSD license” (LC-2696).
• The joint installation of LAN Crypt Administration V3.97 (or earlier) and LAN Crypt Client V4.x is not supported. The connection to LCSERVN.exe might get lost (LC-1929).
• The initial encryption wizard does not encrypt files, when a network problem accessing these files occurs. In this case the file is reported correctly as unencrypted. The wizard should be used again, until the desired encryption state is achieved (LC-3150).
• Moving a folder to the Recycle Bin, whose files were encrypted without a rule, results in decryption of the files during recovery, when Windows 10 1809 is used (LC-2471).
• The LCC MSI cannot be executed correctly in repair mode from an encrypted drive or when a rule exists for this location (LC-3157).
• When a file is encrypted with a key that cannot be accessed, the hex error 1B might erroneously be reported (LC-1884).
• When a predefined PIN for .P12 files is used, on client side not necessarily the newest user certificate gets imported and the error "User certificate not found" is presented (LC-120, LC-1995)
• LAN Crypt Client does not support changing the display scaling without a user logging off and on. If a user does not log off and log on, the icon in the taskbar cannot work properly and the message boxes cannot display the full text (LC-3020).
• An uninstall after an upgrade of the product might leave some orphaned directories of the previous version (LC-2264).
• BSOD might occur when not enough disk space is available while extracting files with WinRAR (LC-3184).
• When using DFS services in certain configurations, the LAN Crypt network filter might only work without caching leading to a reduced performance (LC-3167).
• When using „No plain file access on removables” while having an ignore rule for a path on that removable, the ignore rule has higher priority and plain files can still be created there (LC-3201).

 

Manuals, documentation and support

At https://support.conpal.de registered customers with active maintenance contracts get access to downloads, documentation and knowledge items.

 

Read or download the client product documentation at

https://help.lancrypt.com/docs/windows/4_2_0/de/ in German language, at

https://help.lancrypt.com/docs/windows/4_2_0/en/ in English language and at

https://help.lancrypt.com/docs/windows/4_2_0/fr/ in French language.

 

API documentation can be obtained from:

https://help.lancrypt.com/docs/api/client/en/

https://help.lancrypt.com/docs/api/admin/en/

 

 

 

 

conpal LAN Crypt 4.1.2 Client release notes

 

conpal LAN Crypt 4.1.2 is a Japanese language version and functional identical to LAN Crypt 4.1.1.
Please refer to the conpal LAN Crypt 4.1.1 part of the release notes.

Please note the LAN Crypt 4.1.2 Administration release notes.

Older release notes for LAN Crypt remain valid, if not stated otherwise.

Manuals, documentation and support

At https://support.conpal.de registered customers with active maintenance contracts get access to downloads, documentation and knowledge items.

Download the client product documentation at

https://docs.lancrypt.com/ja/client/lc_412_hjpn.pdf in Japanese language, at

https://docs.lancrypt.com/de/client/lc_411_hdeu.pdf in German language, at

https://docs.lancrypt.com/en/client/lc_411_heng.pdf in English language and at

https://docs.lancrypt.com/fr/client/lc_411_hfra.pdf in French language. Please note, the French manual will be published delayed, for the time being use the English manual

 

 

 

 

conpal LAN Crypt 4.1.1 Client release notes

 

conpal LAN Crypt 4.1.1 is a maintenance release, there are no new features included.
Please refer to the conpal LAN Crypt 4.1.0 part of the release notes.

Please note the LAN Crypt 4.1.1 Administration release notes.

Older release notes for LAN Crypt 4.00.x remain valid, if not stated otherwise.

 

Requirements

The below listed platforms have been tested and are officially supported. Other Service Pack levels might work as well but have not run through a QA cycle and won´t be analysed in case of occurring issues.

Platforms supported	32-bit	64-bit
Pro/Enterprise versions of Windows 10 1809 (LTSC), 20H2, 21H1, 21H2, Windows 11	No	Yes
Windows Server 2019	No	Yes
Windows Server 2022	No	Yes
Citrix XenApp, Citrix XenApp LTSR *	No	Yes

*Citrix Environments are supported, but have not been extensively retested

 

Bugfixes in conpal LAN Crypt Client, Release 4.1.1

• File system issues fixed on NetApp, Isilon and other non-Windows filers (LC-2688, LC-2133, LC-2681, LC-2398, LC-2574, LC-2234, LC-2687)
• Links in File Properties are now active (LC-2676)
• Versioninfo and missing productnames fixed (LC-2623)
• File info in explorer shows now correct copyright information (LC-2621)
• The wizard (lcinit) report now includes files, where the keys are not available and sums up correctly (LC-2523)
• SysInternals PsExec after version v2.34 can now be supported by a specific registry key (to be provided by support) (LC-2505).
• A very few, very specific files encrypted with old LAN Crypt versions can now be opened and will not be corrupted (LC-2492)
• Deleting files on network without key access (red key) while the profile is loaded, is now correctly not permitted. (LC-2464).
• Client status: DefaultIgnoreRule default value (*) is now correctly displayed again (LC-2459)
• Potential handle leak in network filter fixed (LC-2450)
• Virtual Smart Card: Cancel the dialog for PIN entry now does not attempt smart card logon anymore (LC-2408)
• Files encrypted with LC Client Version 2.00, are encrypted with the encryption mode OFB. The operation with these legacy files is now possible, when DoNotHashkeys is enabled. This affects i.e. DES and IDEA encrypted files, and some legacy encryption keys (more than 10 years old) can now be used with LC again.  (LC-2365, LC-1872, LC-2052)
• Fix of another OFB specific decryption misbehaviour, related to old file formats (LC-2761)
• Slowed down performance, browser hangs and black screens fixed, especially for terminalservers (LC-2133)
• Caching for non-encrypted files on local drives can be tested with registry key, to be provided on request by support (LC-93)

 

Manuals, documentation and support

At https://support.conpal.de registered customers with active maintenance contracts get access to downloads, documentation and knowledge items.

Download the client product documentation at

https://docs.lancrypt.com/de/client/lc_411_hdeu.pdf in German language, at

https://docs.lancrypt.com/en/client/lc_411_heng.pdf in English language and at

https://docs.lancrypt.com/fr/client/lc_411_hfra.pdf in French language. Please note, the French manual will be published delayed, for the time being use the English manual

 

 

 

 

conpal LAN Crypt 4.1.0 Client release notes

conpal LAN Crypt 4.1.0 comes with support for new operating systems new functionality, improved security functionality and new features

e.g.

·          Support for SGN/SafeGuard Fileshare customers

·          Portable file encryption

·          Minifilter with caching capabilities for SMB network shares

·          New .NET Administration API

·          Client API login with user context

·          LAN Crypt-Service functionality

·          Manipulation protection for processes

·          Multi factor Authentication based on 3^rd party technology

·          Oracle 19 Support

The Legacyfilter has been abandoned, but is still supported with the 4.00.x version of the product.

Older release notes for LAN Crypt 4.00.x remain valid, if not stated otherwise.

Please note the LAN Crypt 4.1.0 Administration release notes.

Requirements

The below listed platforms have been tested and are officially supported. Other Service Pack levels might work as well but have not run through a QA cycle and won´t be analysed in case of occurring issues.

Platforms supported	32-bit	64-bit
Pro/Enterprise versions of Windows 10 1809 (LTSC), 1909 (19H2), 20H2, 21H1, 21H2, Windows 11	No	Yes
Windows Server 2016	No	Yes
Windows Server 2019	No	Yes
Windows Server 2022	No	Yes
Citrix XenApp 7.18 on Windows Server 2016*	No	Yes
Citrix XenApp 7.15 LTSR on Windows Server 2016*	No	Yes

*Citrix Environments are supported, but have not been extensively retested

 New in conpal LAN Crypt Client release 4.1.0

• Support for SGN/SafeGuard FileShare keys. In combination with a key export and an key import tool Fileshare encrypted files can be handled by conpal LAN Crypt Client 4.00.3 or newer with Minifilter.
• The legacy filter is deprecated by Microsoft. Starting with LAN Crypt 4.1 the Legacy driver is not part of the LAN Crypt Client anymore. LAN Crypt 4.1 comes with a Minifilter. Legacyfilter is no longer referenced in the code / called by any component. Legacyfilter is removed from the installation package(s). Information about Legacy driver is removed from customer facing documentation. New installations are configured to use Minfilter driver. Upgrades of existing installations use Minifilter driver.

Non-default Legacy-filter registry settings are migrated to respective Minifilter Settings (where necessary) (LC-1681)

• LAN Crypt V4.1 comes with a new functionality that – in some cases – can significantly improve the performance of accessing files on network shares:
  LAN Crypt version 4.1 supports cached access to SMB V2/SMB V3 network shares (for this functionality it is required, that the SMB intrinsic encryption functionality is not used). In LC version 4.1 Caching Mode WINDOWS_NATIVE default is supported (LC-1506, LC-1559, LC-1560). 
• Code security, replacement of functions (LC-1299, LC-1295, LC-1286).
• Client API login with user context is now possible. For example, a RunAs in user context will have a LAN Crypt profile (LC-1501).

 

Changes in 4.1.0

• The Legacy driver is not part of LAN Crypt 4.1.0 anymore. If older products are updated, settings will be migrated automatically for the Minifilter functionality. In some rare cases, there might be compatibility issues, which will be fixed over the time. For the time being in such cases it is recommended to stay with the LAN Crypt 4.00.x Legacyfilter. (LC-1681)
• Like in earlier LAN Crypt versions NTFS Compression is not supported. Differently to earlier versions files on network shares will not be automatically decompressed any more (LC-2384, LC-1437).
• Improvements for IBM Doors have been implemented (LC-1403)
• The ‘old’ OptimizeNetwork switches should be removed and only be reactivated, when essential for the specific use case. Corresponding switches should be removed from the registry as well (LC-1928). Please contact support in case of doubt.
• RemoveDomainFromRules works now as initially designed. When switched off, full domainnames are used in rules and not cut off (LC-1417).
• Further significant performance improvements for the Amesim application due to cached access of SMB fileshares in the network (LC-1364)
• Boost library removed for better maintenance of security relevant functions (LC-474).
• Removal of the "Created with operating system" field in the client status (LC-1344)

 

Bugfixes in 4.1.0

• DNSRuleCreationMode did not create corresponding rules for all IP addresses of all found DFS targets (LC-1476)

• ServicesDefaultIgnoreRules with value "*" were not applied correctly. Accessing encrypted files with a service in folders (and subfolders) having a DefaultIgnoreRule would lead to an "access denied" (not correct), in other folders the cipher text could be read (correct). (LC-2256). The wrong behaviour has been corrected.
• Display and export of DefaultIgnoredRules did not work properly in the client (LC-1311)
• Client status: "Cached Policyfile Lifetime"/"Profile Update Interval" showed period in rounded weeks instead of days (LC-1112)
• Secure Move - Confirm File/Folder Replace contained complete target path instead of file/folder name (LC-902).
• The Minifilter driver had a conflict with the VirtualBox Shared Folders Redirector VBoxSF.sys. (LC-1217)
• The client setup was not able to install or modify single packages, when Minifilter was used in VirtualBox.
  The client with Minifilter had to be installed with all components, otherwise it led to BSOD (LC-2291).
• Upgrade installation LCA and LCC v3 -> v4: MSI ProductCode did not match with Registry ProductCode (LC-1324).
• When opening files from an application other than Windows Explorer, no key symbols were displayed in the Explorer window (LC-1245).
• lcsdel.exe feedback regarding deleting files from C:\Windows\ was incorrect (LC-1277).
• Explorer Extension: `Initialverschlüsselung` vs. `Encrypt according to profile`. The message has been aligned between English and German version of the LCC (LC-1005).
• Plaintext files existing in the PreventPlainFiles path are now displayed without the key icon (local and network). In the Explorer context menu, the LAN Crypt option "Encrypt according to profile" is no longer offered (local and network) (LC-1513).
• ClientAPI function "SetTemporaryRule" key passing did not work (LC-1514).
• If the PolicyCache data is not available, a load of a profile from the shared folder is requested (LC-117).
• Links to web addresses could not be created on network drives (LC-66)

 

New known issues

• The joint installation of LAN Crypt Administration V3.97 (or earlier) and LAN Crypt Client V4.x is not supported. The connection to LCSERVN.exe might get lost (LC-1929).
• When a file is encrypted with a key that cannot be accessed, the hex error 1B is erroneously reported (LC-1884)
• There is a difference between Legacy and Minifilter. With Legacy, deleting files on network without key access (red key) while the profile is loaded, is not permitted.
  With Minifilter the behaviour is different, these files can be deleted. Opening, renaming, copying is still not possible. This affects LAN Crypt 4.0.x and 4.1.(LC-2464).
• The VisualStudio runtime might not be available on some machines. In this case e.g. deinstallation of the product might not be possible.

https://docs.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170
https://aka.ms/vs/17/release/vc_redist.x86.exe
https://aka.ms/vs/17/release/vc_redist.x64.exe

 

 

Manuals, documentation and support

At https://support.conpal.de registered customers with active maintenance contracts get access to downloads, documentation and knowledge items.

 

The client manuals in French language will be available in form of a pdf manual a couple of days after release for download. For the time being an old manual with a testpage will be available at the link for the French manual.

 

Download the client product documentation at

https://docs.lancrypt.com/de/client/lc_410_hdeu.pdf in German language, at

https://docs.lancrypt.com/en/client/lc_410_heng.pdf in English language and at

https://docs.lancrypt.com/fr/client/lc_410_hfra.pdf in French language. Please note, the French manual will be published delayed, for the time being use the English manual

 

 

 

 

conpal LAN Crypt 4.00.3 Client release notes

conpal LAN Crypt 4.00.3 comes with support for additional operating systems, support for SGN/SafeGuard FileShare and bugfixes. Older release notes for LAN Crypt 4.00.x remain valid, if not stated otherwise.

Please note the LAN Crypt 4.00.3 Administration release notes.

 

Requirements

The below listed platforms have been tested and are officially supported. Other Service Pack levels might work as well but have not run through a QA cycle and won´t be analysed in case of occurring issues.

Platforms supported	32-bit	64-bit
Windows 10 1909 (19H2), 2004 (20H1) Pro/Enterprise, 20H2 Pro/Enterprise, 21H2 Pro/Enterprise, Windows 11	No	Yes
Windows Server 2012 R2	No	Yes
Windows Server 2016	No	Yes
Windows Server 2019	No	Yes
Citrix XenApp 7.9 on Windows Server 2012 R2	No	Yes
Citrix XenApp 7.18 on Windows Server 2016	No	Yes
Citrix XenApp 7.15 LTSR on Windows Server 2016	No	Yes

 New in conpal LAN Crypt Client release 4.00.3

• Windows 11 support
• Windows 10 21H2 support
• Support for SGN/SafeGuard FileShare keys. In combination with a key export and an key import tool Fileshare encrypted files can be handled by conpal LAN Crypt 4.00.3 with Minifilter.

 

Changes in 4.00.3

• Minifilter: When verifying permission for the AntiVirus programs, configured short names led to a complete search for the configured files in the protected directories (windows, program files, program files (x86)). The verification process has been changed to improve the loading time of the profile (LC-1846 Determine AV full path in Verify procedure)

 

Bugfixes in 4.00.3

• Minifilter: When USB keys are inserted the first time and forced to a specific driver letter, which got LAN Crypt encryption rules, encryption is not executed. After inserting the USB key the second time, the encryption rule is enforced. (LC-1965)

 

Manuals, documentation and support

At https://support.conpal.de registered customers with active maintenance contracts get access to downloads, documentation and knowledge items.

 

The client manuals in French language will be available in form of a pdf manual a couple of days after release for download. For the time being an old manual with a testpage will be available at the link for the French manual.

 

Download the client product documentation at

https://docs.lancrypt.com/de/client/lc_400_hdeu.pdf in German language, at

https://docs.lancrypt.com/en/client/lc_400_heng.pdf in English language and at

https://docs.lancrypt.com/fr/client/lc_400_hfra.pdf in French language.

 

 

 

conpal LAN Crypt 4.00.2 Client release notes

conpal LAN Crypt 4.00.2 is a maintenance release.Older release notes for LAN Crypt 4.00.x remain valid, if not stated otherwise.

Please note the LAN Crypt 4.00.2 Administration release notes.

 

Requirements

The below listed platforms have been tested and are officially supported. Other Service Pack levels might work as well but have not run through a QA cycle and won´t be analysed in case of occurring issues.

Platforms supported	32-bit	64-bit
Windows 10 1909 (19H2), 2004 (20H1) Pro/Enterprise, 20H2 Pro/Enterprise	No	Yes
Windows Server 2012 R2	No	Yes
Windows Server 2016	No	Yes
Windows Server 2019	No	Yes
Citrix XenApp 7.9 on Windows Server 2012 R2	No	Yes
Citrix XenApp 7.18 on Windows Server 2016	No	Yes
Citrix XenApp 7.15 LTSR on Windows Server 2016	No	Yes

Bugfixes in 4.00.2

• Minifilter: Office files are not decrypted when preview window in file explorer is active and registrykey IgnoredApplicationsChildProcs =2 (LC-1603)
• Minifilter: FSLogix profiles are not created / mounted (LC-1717)
• Minifilter: Loadprof crashes sporadically without loading rules (LC-1730)
• Minifilter and Legacyfilter: encrypted p12pwlog.csv sometimes gets filled with garbage (LC-1793, LC-1825)
• Client cannot find user certificate if profile was created with LAN Crypt Administration 4.00.x, client cannot load the profile with the error message: " User certificate not found (LC-1597, LC-1686)
• V4.00.1 Minifilter: Explorer crashes sporadically when accessing encrypted directory (LC-1688)
• Minifilter: Isilon 8.x shows wrong behaviour handling timestamps. Isilon 9.x fixes this issue. As a workaround the registrykeys NovellSupport / Alwayswritethroughonmup corrects the wrong Isilon timestamp handling in older versions (LC-1758)
• Client cannot find SO certificate if profile was created with LCA 4.00.x (LC-1860)

 

Manuals, documentation and support

At https://support.conpal.de registered customers with active maintenance contracts get access to downloads, documentation and knowledge items.

 

The client manuals in French language will be available in form of a pdf manual a couple of days after release for download. For the time being an old manual with a testpage will be available at the link for the French manual.

 

Download the client product documentation at

https://docs.lancrypt.com/de/client/lc_400_hdeu.pdf in German language, at

https://docs.lancrypt.com/en/client/lc_400_heng.pdf in English language and at

https://docs.lancrypt.com/fr/client/lc_400_hfra.pdf in French language.

 

 

 

 

 

 

 

conpal LAN Crypt 4.00.1 Client release notes

conpal LAN Crypt 4.00.1 is in focus a maintenance release and brings support for W10 20H2. If not referenced in the sections New in conpal LAN Crypt Client release 4.00.1, changes in 4.00.1, Bugfixes in 4.00.1 the release notes for LAN Crypt 4.00 remain valid.

Please note the LAN Crypt 4.00.1 Administration release notes.

 

Requirements

The below listed platforms have been tested and are officially supported. Other Service Pack levels might work as well but have not run through a QA cycle and won´t be analysed in case of occurring issues.

Platforms supported	32-bit	64-bit
Windows 10 1803 (RS4), 1809 (RS5), 1903 (19H1), 1909 (19H2), 2004 (20H1) Pro/Enterprise, 20H2 Pro/Enterprise	No	Yes
Windows Server 2012 R2	No	Yes
Windows Server 2016	No	Yes
Windows Server 2019	No	Yes
Citrix XenApp 7.9 on Windows Server 2012 R2	No	Yes
Citrix XenApp 7.18 on Windows Server 2016	No	Yes
Citrix XenApp 7.15 LTSR on Windows Server 2016	No	Yes

 New in conpal LAN Crypt Client release 4.00.1

• Windows 10 20H2 support
• Significant performance improvements especially in large network environments
• DefaultIgnoreRules and ServicesDefaultIgnoreRules for Minifilter (LC-1238)
• Enable PreventPlainFiles Rules for local drives (LC-1156)
• Separate Legacy components from Utimaco DiskEncrypt (LC-1275)
• Add IBM ClearCase redirector to the list of ignored NetworkNames (LC-1413)
• Add translations for error message on unsupported OS (LC-1251)
• (Re-)Enable Windows File Indexing support on Clients (LC-1323)
• Limited support for VMWare Shared Folders (LC-1338)
• Allow FECGetTrustedVendors as Minifilter internal ClientAPI ACL (LC-1529)
• Configure which network names should be resolved and create additional rules for certain/all possible access ways automatically. The Registry-Entry DNSRuleCreationMode has been created to offer fine grained administration. (LC-1476)

Changes in 4.00.1

• remove client api docs from setup (LC-1436)
• Configuration options for unsupported EFS collaboration (LC-1429)
• Default DFS handling changed to "Do not normalize network names" (LC-1395)
• Do not load PreventPlainFiles for internal System SIDs (LC-1156)
• Adjust encryption state messages and overlay icons for PreventPlainFiles (Minifilter only) (L C-1513)
• FECGetTrustedVendors for SGFEApi set by Setup (LC-1503)

 

Bugfixes in 4.00.1

• BSOD "bad pool caller" when switching from Minifilter to legacy driver (LC-1358)
• Incompatibility of the Minifilter with the VirtualBox Shared Folders Redirector VBoxSF.sys. (LC-1217)
• When opening a file, no key icons are displayed in the Explorer window. (LC-1245)
• ignore child processes in Minifilter driver (LC-1270)
• Empty REG_MULTI_SZ settings are handled properly (LC-1238)
• Problem with DirSizeCorrection = PROFILE (LC-1346)
• Rules that start with an asterisk and do not have a path are not correctly executed(LC-1396)
• Fix Minifilter Network Performance Issues (LC-1346, LC-1364)
• CertificateVerification Switches did not execute correctly in V4.00.0 (LC-1318)
• Broken German in context menu(LC-1005)
• Performance problems when enumerating directory in shares with large number of files (LC-1346)
• Incorrect handling of rules starting-with-angle-brackets (LC-1407)
• lcsdel gives the impression that files can be deleted from C:\Windows /corrected error message (LC-1277)
• Key wrapping could not be disabled (LC-1231)
• Setup issues (LC-1424, LC-1312, LC-1391, LC-1392)
• Fix for PreventPlainFiles parsing error (LC-1156)
• Install edc files without ReadOnly flag (LC-1452)
• Minifilter Driver sometimes stores wrong padding information for large files (>16777216 bytes) (LC-1500)
• Client-API-Dll can handle long pathnames now (LC-1454)
• Branding topics (LC-1518) (LC-1537)
• Fixed issue with the LAN Crypt PreventPlainFiles (LC-1237).

 

New known issues

• Overlay Icons might not be displayed correctly, depending on total number of registered icons and position in the Microsoft registry entries (LC-1370)
• The known issues remain valid, if not listed in the above chapters
• Under VMWare Shared Folders, both the Minifilter and Legacy drivers have issues with Notepad. Both filters seem to affect memory mapped functionality, not only with Notepad, but overall. (LC-1442)
• DNSRuleCreationMode does not yet create corresponding rules for all IP addresses of all found DFS targets (LC-1476)
• Unhandled Applications can be registered. How they are handled, can be configured with IgnoredApplicationsChildProcs. 0 means switched off, 1 means apps are handled untrusted and 2 means childs are handled untrusted as well. LAN Crypt comes with default registered applications (e.g. svchost, onedrive, WindowsSearchHost).

The switch IgnoredApplicationsChildProcs is used for the internal default processes as well. That leads to problems especially with Office applications, when preview and accessing lead to concurrent access.
The workaround recommendation is to avoid the setting 2 for inheritance to childs and to use 1 instead. (LC-1603).

 

Manuals, documentation and support

At https://support.conpal.de registered customers with active maintenance contracts get access to downloads, documentation and knowledge items.

 

The client manuals in French language will be available in form of a pdf manual a couple of days after release for download. For the time being an old manual with a testpage will be available at the link for the French manual.

 

Download the client product documentation at

https://docs.lancrypt.com/de/client/lc_400_hdeu.pdf in German language, at

https://docs.lancrypt.com/en/client/lc_400_heng.pdf in English language and at

https://docs.lancrypt.com/fr/client/lc_400_hfra.pdf in French language.

 

 

 

conpal LAN Crypt 4.00.0 Client release notes

Please note the LAN Crypt 4.00.0 Administration release notes.

conpal LAN Crypt is the successor of SafeGuard LAN Crypt.

conpal LAN Crypt 3.97 Client was the initial release of conpal for the client. It contained fixes and hotfixes of the previous SafeGuard LAN Crypt 3.95 Client version, fixed several known issues and came with support for current operating systems.

conpal LAN Crypt 4.00 Client is a significant rework of the client technology. The cryptographic base has been reworked for potential certifications and approvals. The underlying filter technology has been built on Minifilter technology to be future-proof and assure long term support for the technology by Microsoft.

conpal will develop new client features based on the Minifilter technology.

Due to the strong customer demand, even stronger during Corona times, we have decided to deliver legacy and Minifilter technology with the client and also to implement some features, which were originally only intended for the Minifilter, also for the legacy filter.

This was done primarily in order to offer business continuity for the client based on the legacy filter.

We recommend the use of the legacy filter for existing customers, if Minifilter functionality is not essentially required.

We have invested a great effort in compatibility with old encryption methods from LAN Crypt and were able to ensure extensive compatibility and thus also simple migration.

Nevertheless, we strongly recommend piloting the use of the new technologies.

 

Manuals, documentation and support

At https://support.conpal.de registered customers with active maintenance contracts get access to downloads, documentation and knowledge items.

 

The client manuals in French language will be available in form of a pdf manual a couple of days after release for download. For the time being an old manual with a testpage will be available at the link for the French manual.

 

Download the client product documentation at

https://docs.lancrypt.com/de/client/lc_400_hdeu.pdf in German language, at

https://docs.lancrypt.com/en/client/lc_400_heng.pdf in English language and at

https://docs.lancrypt.com/fr/client/lc_400_hfra.pdf in French language.

 

Last minute changes

Due to recently urgent customer requests, we decided at the very last moment to consider the legacy driver as the primary filter driver, which is now also installed by default. This was requested by the clients mainly because new technologies are currently difficult or impossible to pilot.

In this context, we therefore recommend that the necessity for the use of the Minifilter be carefully examined once again.

Requirements

The below listed platforms have been tested and are officially supported. Other Service Pack levels might work as well but have not run through a QA cycle and won´t be analysed in case of occurring issues.

 

Upgrade

conpal LAN Crypt 4.00 Client has been essentially tested to upgrade conpal LAN Crypt 3.97. SafeGuard LAN Crypt 3.95.3.2. or newer might be upgraded to conpal LAN Crypt 4.00 on the supported platforms, but the upgrades have not been tested on a broader base and might require paid professional service.

We recommend that you install the latest Windows security patches on your clients before installing the conpal LAN Crypt Client release.

New in conpal LAN Crypt Client release 4.00.0

• Windows 10 2004 (20H1) support
• Support of OneDrive Files on demand (the OneDrive sync app must be unhandled application)
• New crypto libraries (for security reasons, to be future-proof and for potential certification and approval)
• Replacement and updates of 3^rd party libraries
• Integration of earlier patches for LAN Crypt
• Support of Removables, Opticals, Local Volumes, Boot Volume and Network Shares as keywords in rules.
  This functionality was developed for the Minifilter and has been adopted due to strong customer demand in the legacy filter. Some behaviour is different. Opticals are supported for the Minifilter only. Ignored Device types are supported with Minifilter only.
• With Minifilter Office365 print-to-pdf-functionality is supported
• One client installation package for standard and terminal server clients

 

Operation of LAN Crypt 4.00 environments

A mixed operation of LAN Crypt v4 Admin and LAN Crypt v3.x Admin is not supported.

It is possible to run a v3.97 Admin with v4 Clients and v3 Clients.

It is possible to run a v4.00 Admin with v4 Clients and v3 Clients.

XML is the only supported policy file format of v4.00 Admin and v4.00 Clients.

New profile files are created by v4.00, with sections for v3 and v4 Clients.

The new encryption rules for Removables, Opticals etc. are transported in the new section.

Once new rules have been created with v4.00, it is no longer possible to create profiles with a v3 Admin. Doing so would potentially have negative effects on the client.

 

Changes

• LAN Crypt 4.00 Client makes use of conpal registry keys
• The LAN Crypt 4.00 Administration still uses Utimaco/Sophos settings
• Client-side a service copies the settings into the new, appropriate paths
• This way, customer-side no migration of registry keys is needed
• Integration of new cryptographic libraries (for security reasons)
• Renewal of 3^rd party libraries (for security reasons)
• Integration of a new random number generator (for security reasons)
• The usage of the Client API must be configured in the LAN Crypt Administration and – in case the Minifilter is used on client-side - the included script to enable permissions for specific applications has to be adopted and executed on the client-side.
• New client API function ClearProfile
• The EULA has been updated (German, English and French)
• The 3^rd parties' inventory has been consolidated and updated
• The Minifilter behaves different in details, compared to the Legacyfilter, most of the differences in respect to a more correct handling of encryption
• LAN Crypt tools have been moved to the folder LAN Crypt\tools (LC-694)
• EFS Encryption is not supported with the Minifilter (LC-1240)
• Some Registrykeys have been changed

 

Bugfixes

• BSOD "bad pool caller" when configuring python3-cryptography fixed (LC-263)
• The LAN Crypt Filter is not "attached” in certain configurations (LC-101)
• Warning indicates loading of a cached profile although none is in the cache (LC-1117)
• Better error message when loading from cached profile (LC-1026)
• Login to DB (Azure SQL) with Azure AD Interactive authentication leads to crash (LC-1015)
• Display error in encryption status (LC-428)
• Offlinefolder: Officefiles cannot be saved (LC-225)
• Several spelling errors and wordings in the product and error messages
• "sglcinit.exe -D" not all sub directory levels are processed (LC-486)
• Explorer Extension à Encryption status: Gaps / incorrect results with multi-select of directories (LC-1001)
• Office files cannot be written, temporary files remain (LC-696)
• New MSO cert is not loaded on client after recovery (LC-248)
• The displayed drives, apps and devices in the client status were limited to a string length of 260. This lead to the problem that e.g. not all apps were displayed when the character limit was reached. The character limit has now been removed. (LC-29)
• LAN Crypt Registry settings for explorer integration are lost during Windows 10 in-place upgrade: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\LC Settings (LC-198)

 

Known issues

• Opticals: DVD+RW media is set to read-only state after few accesses, when the legacy filter is used.
  Opticals rule is not supported with the legacy filter (LC-1158).
• AES-OFB (LC-715)
• AES-OFB encrypted files can be read and can be reencrypted to more modern AES modes, like CBC and XTS.
• Existing OFB encrypted files might get reencrypted automatically to the configured CBC or XTS mode, when opened.
• We strongly recommend, to do an initial encryption with the wizard to migrate files encrypted with weak algorithms to state-of-the-art algorithms.
• OneDrive:
• SharePoint synchronization must be switched off
• Files stored on the local file systems are handled by the LAN Crypt driver. Browser and WebDAV-Transport is not handled. Storing encrypted files by downloading it with SharePoint or the browser might lead to double-encrypted files (which can be decrypted with the wizard).
• Microsoft’s handling of overlay icons is buggy. The LAN Crypt icons can therefore not be shown correctly. (LC-121)
• FilesOnDemand is supported with Minifilter driver only (LC-1258).
• Microsoft’s Vault is handled by Minifilter only. The Legacyfilter displays the wrong encryption state (LC-1258).
• OneNote (LC-1256, LC-1243)
• Encryption of OneNote is not supported. Especially multiuse might lead to corrupted data.
• Windows 10 upgrades:

When an upgrade to Windows 10 is done or a feature update is applied to Windows 10 all data stored in the registry hive HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Utimaco will be removed.

• After applying the current group policies to the client, these registry settings will be configured again. If there were some custom settings made in this registry hive, these settings must be manually applied after the Windows 10 upgrade has finished.
• Due to the client-sided copy into the new paths, the functionality remains. For the time being the key should be restored by GPO. In a follow-on version the administration will be based on the conpal path in the registry (LC-63)
• Utimaco Disk Encryption (UDE)
• Interaction with Utimaco Disk Encryption requires pre- and post-installation care during installation, uninstallation, and upgrades. Please contact support to ensure clean operation. (LC-1229)
• Overlay Icons might not be displayed (LC-1370)
• Windows 2004 (20H1):
• Windows W10 20H1 Bug when renaming files on network shares (LC-1006)

The problem occurs when an unencrypted file on a network drive is moved (=renamed) to an encrypted folder.

In this case the driver should encrypt the file when moving / renaming. With 20H1, however, this does not happen because it cannot determine the name of the target file due to an error in the filter manager of Microsoft.

The error was fixed by Microsoft with KB4557957

https://support.microsoft.com/de-de/help/4557957/windows-10-update-kb4557957
https://support.microsoft.com/en-us/help/4557957/windows-10-update-kb4557957

• Minifilter and Legacyfilter (LC-281, LC-1234):

Some regular expressions in rules might be handled differently than in 3.97, and different between legacy- and Minifilter:

• Some (exotic) expressions are handled different in the filters of v4 and v3
• Minifilter differences to Legacyfilter (1106)
• Move encrypted file from an unregulated to a regulated network directory: File is stored encrypted
• Move an encrypted file from a regular network directory to a different one: File is stored encrypted
• Now it finally behaves as you would expect it to, but it doesn't match with the legacy drivers behaviour.
• Minifilter (LC-1360)
• Wrong handling of explicit rules for file extensions
• The Minifilter does not execute rules like *.ext correctly for encryption and ignore rules.
• As a workaround, we recommend to add an additional rule like *\*.ext
• Having both rules, *.ext and *\*.ext active, works as well for V3.9x and V4.0 clients
• Minifilter (LC-1262, LC-1323)
• Indexing was and is default switched off with the legacy filter (V3.97, V4.0)
• The Minifilter requires to add Searchprotocolhost.exe as an unhandled application to prohibit indexing.
• Further versions will implement the original behaviour of the Legacyfilter, where Indexing has to be switched explicitly on (Parameter AllowIndexing).
• Minifilter (LC-1169):

Files are not handled properly according to the profile rules:

• If <Boot Volume> and <Local Volume> and <Network Shares> are configured as ignored devices at the same time, files may no longer be handled correctly according to the encryption rules, or a wrong encryption status is determined.
• Minifilter (LC-1293)
• EFS is not supported. The EFS attribute can neither be set nor removed from files or folders, and access to EFS encrypted files is denied.
• NTFS Compression is not supported, files will be automatically decompressed.
• Minifilter (LC-1156):

Shared folders in VMware virtual machines are not supported properly:

• Prevent plain files not executed properly.
• Encryption rules are not applied correctly.
• Ignore rules are not applied correctly.
• Minifilter (LC-1217)
• There is an incompatibility of the Minifilter with the VirtualBox Shared Folders Redirector VBoxSF.sys.
  Minifilter leads to a BSOD with Oracle Box (tested with 5.238, 6.1.14).
• Minifilter (LC-1106):

Encryption behaviour has changed when moving files:

• Move encrypted file from an unregulated to a regulated network directory: File is stored encrypted.
• Move encrypted file from a regular network directory to another regular network directory: File is dropped in an encoded file.
• The behaviour is correct, but may differ from the description in the manual and from the legacy filter.
• Minifilter (LC-1000)

The registry key

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LCENCM\Parameters]

"NovellSupport"=dword:00000001

used for a different timestamp handling, compared to windows fileservers, e.g. for Isilon support, has been removed for the Minifilter.
Please use instead

[HKLM\SYSTEM\CurrentControlSet\Services\cplcisolate]

"AlwaysWriteThroughOnMUP"=dword:00000001

• Minifilter and Legacy Filter (LC-802):

Key visualization and handling in recycle bin might be different to LAN Crypt version 3.97 and in particular wrong (red key symbol visible, when key is accessible).

• Deleted files might end up in the recycle bin with a red key, differently to Version 3.97
• Restoring and deleting from the recycle bin works anyway.
• Support of placeholders in the legacy filter (LC-857)
• The <Network>, <Bootvolume>, <Removable>, <Optical>, <Local> placeholders are decoded in the legacy filter and translated into the corresponding directory names or drive letters
• Minifilter missing functionality compared to Legacyfilter
• DefaultIgnoreRules and ServicesDefaultIgnoreRules are not yet supported (LC-1238)
• Ignored Drives (LC-1060):

The encryption status of legacy and Minifilter is determined and visualized differently.

• The Minifilter correctly determines the encryption status of encrypted files on ignored shares as ENCRYPTED_IGNORED and displays the red key.
• The legacy filter determines the encryption status of encrypted files on ignored shares as PLAIN_IGNORED and does not display an overlay key. The behaviour of the legacy filter is basically wrong (at least since SafeGuard LAN Crypt 3.95) but will not be corrected.
• Ignored Device Types (LC-1242)

Ignored device types are not supported with the legacy filter

• Legacyfilter
• AES with Legacyfilter installed may lead to wrong encryption method displayed when files are moved into a folder with different AES rule. (LC-1177)

If the legacy filter is operated with CBC and a file encrypted with a respective rule is moved (cut and pasted) to a folder with a different AES rule (XTS), the display of the encryption method remains on CBC.

Moving XTS encrypted files to CBC ruled folders as well display the wrong initial method.

• LAN Crypt loads a certificate based on the provided PIN, not necessarily the newest p12-file (LC-120)
• LAN Crypt searches a sorted list of the users p12 files until it finds the first p12 file that can be accessed with the entered PIN. If not every p12 file has a different PIN, an older certificate can be loaded.
• Citrix Terminal Server:
• Client Drive Redirection:
  Encryption of files on client drives mapped on a Citrix Terminal Server is not supported and these drives will be ignored by the LAN Crypt encryption filter driver.
• Streamed applications:
  Citrix application streaming is not supported.
• Virus scanners:
• Virus scanner services:
  Virus scanner services need to be explicitly authorized to have access to encrypted files in order to be able to find viruses inside.
• There is a changed behaviour regarding permissions for security improvement:

Long path names can be used for. For convenience reasons short names are internally completed by searching some protected paths when program names are configured without path information. The client will search in the following directories:

 

CSIDL_SYSTEM (typical C:\Windows\System32, non-recursive)

CSIDL_WINDOWS (typical C:\Windows, non-recursive)

CSIDL_PROGRAM_FILES (typical C:\Program Files, recursive)

 

If an EXE file with the specified name is found, the full path will be internally added.

Other paths are now untrusted for short file names. (LC-1218).
When mixed environments (LAN Crypt 3.9x and 4.0) are administrated by LAN Crypt Administration 4.00.0, it is best practice to add the executable names for virus scanners in short form (executable name only), when the virus scanner is located in one of the referenced paths (note, that program files on 64 bit system includes the 64 bit path only). When the scanner executables are in other paths, the long pathname including the executable and a second entry with a short name should be used. The long name for the version 4 clients and the short name for the version 3 clients.

• We recommend on-access and background scanning tests
• LAN Crypt Tools:
• The LAN Crypt executables DriveNotifier.exe, lchelper.exe, lcinit.exe, lcsdel.exe, lcstatus.exe, lcuser.exe, loadprof.exe, SGFEApi.exe, lcservn.exe should be trusted by the antivirus software.
• Minifilter:
  A new random number generator was implemented (LC-881, LC-882).
  This may have some effects on runtimes when encrypting while the virus scanner is running.
• Tested virus scanners (among others):
  The following virus scanners have been tested with the LAN Crypt Client:

 

• Configuration of other virus scanners tested with earlier versions (not tested with this release):

• Known issues:
• There might be an issue with the LAN Crypt PreventPlainFiles functionality with some virus scanners when the legacy filter is used. This behaviour is the same in conpal LAN Crypt 3.97, SafeGuard LAN Crypt 3.95 and probably earlier versions (LC-1237).
• FSecure SAFE 17.8: viruses are detected and deleted during scanning, zipped files are detected and deleted when opened
• There is an issue with Sophos Anti-Virus that may cause encrypted files to be locked (either only for write or for read and write access). This is caused by a timing issue of Sophos Anti-Virus if the on-access scanning level is set to 'intensive'.
• There is an issue with Sophos Anti-Virus that may lead to damaged Microsoft Office documents when saving them in a folder that is made available when offline (“OfflineFolder”). To avoid this issue please configure the Sophos Anti-Virus on-access scanner to exclude the folder “C:\Windows\CSC”.
• After receiving a new virus scanner executable via the policy file, the client has to be rebooted.
• If Antivirus and LAN Crypt are installed on Windows, it may happen that the LAN Crypt profile cannot be loaded. As a workaround, the folder for the policy file cache (default "%LOCALAPPDATA%\conpal\LAN Crypt\Local Policy Cache") must be excluded from the virus scan. Alternatively registering the LAN Crypt processes with Antivirus to be trustworthy, might solve the problem.
• DFS:
• Domain-based DFS:
  In a domain-based DFS, you can access the DFS either via the server name or via the domain name.
  The encryption rules must always be created in the same way as used to access DFS.
  If the DFS is accessed via the server name, the encryption rule must be based on a server name. If DFS is accessed via the domain name, the rule must be domain name based.
  If you want to access the DFS both ways, you must define two encryption rules, one with the domain name and one with the server name.
  e.g.:
  Y: is mapped to \\DOMAIN\DFSROOT
  Encryption rule:
  Y:\*.*
  or
  \\DOMAIN\DFSROOT\*.*
  Z: is mapped to \\SERVER.DOMAIN\DFSROOT
  Encryption rule:
  Z:\*.*
  or
  \\SERVER\DFSROOT\*.*
• Nested DFS links:
  Nested DFS links (DFS links to other DFS links or DFS roots) can be used but encryption rules must not include a physical path to the DFS link and there are some known problems in combination with persistent encryption. When copying an encrypted file to a plain folder it may become decrypted. When moving encrypted files to an ignored/excluded folder it may stay encrypted.
• Rules using IP address:
  It is not possible to use rules for DFS that contain the IP address of the server hosting the DFS share.
• DFS and persistent encryption:
  When copying encrypted files to ignored or excluded folders on DFS drives they may not be stored decrypted.
• Viewing folders in Windows Explorer:
  Viewing folders on a DFS share cause problems that either the display takes very long or the folder selection jumps to the root folder after a while.
  In this case the following registry value can be set:
  [HKEY_LOCAL_MACHINE\Software\Policies\Utimaco\SGLANCrypt\LCShellx]
  IgnoreBuildInOverlayIcons=dword:00000001
  A reboot is necessary to activate the change. Afterwards the Windows overlay icons for shared folders and links are not displayed if a LAN Crypt overlay icon is displayed.
• Network Attached Storage (NAS) devices:
  In general, LAN Crypt will operate with network shares hosted on NAS devices. If it is planned to use a NAS device, conpal recommends the execution of intensive tests prior to using LAN Crypt in a productive environment.
  However, due to various SAMBA implementations and versions, not every NAS device will act like a Windows Server. Protocol variations are possible and therefore a few special cases might not work properly in combination with LAN Crypt; for example, a user’s “my documents” folder might not be encrypted on a file share. Therefore, conpal does not guarantee that encrypted file shares on NAS devices will work in every condition and only provides limited support in cases where issues arise.
• Volume mount points:
  LAN Crypt does not support volume mount points. (An encryption rule for a directory that is a volume mount point will not work.)
  The same is true for virtual drives generated with the SUBST.exe command.
• EFS encryption and NTFS compression:
  LAN Crypt encrypted files cannot be (additionally) EFS encrypted or NTFS compressed.
  It is possible to EFS decrypt (provided that the EFS key is available) and/or NTFS decompress files during initial encryption.
• NTFS rights:
  While Windows is able to create new files or copy files to a folder where the NTFS rights
  - Traverse Folder / Execute File
  - List Folder / Read Data
  - Read Attributes
  - Read Extended Attributes
  - Create Files / Write Data
  - Read Permissions
  are granted to a user, the following additional rights have to be granted if there is an encryption rule on a folder:
  - Create Folders / Append Data
  - Write Attributes
  - Write Extended Attributes
• Backup programs:
  Backup programs should be configured as unhandled applications. If you do this, the files will retain their encryption state after a restore. The backup applications from Windows should be automatically treated as unhandled application.
  The backup target files themselves must not be encrypted, because they cannot be restored by the backup application as it does not decrypt the backup files. Because the files included in the backup are already encrypted, it is not necessary to encrypt the backup target files itself.
• Configuration data:
  Because the client reads the configuration data from the Registry during the boot and login process, you may need to reboot the PC to include any changes to this data.
  In some cases two reboots are necessary.
• SafeGuard Enterprise:
• There is no tested compatibility with SafeGuard products.
• It is likely, that newer SafeGuard products like Central are interoperable.
• Piloting is essential, there are no guarantees for compatibility.
• SafeGuard PrivateDisk:
  LAN Crypt cannot be used to encrypt SafeGuard PrivateDisk volume files (*.vol).
• <Opticals>:
• The Opticals rule works for Minifilter only.
• The Opticals rule leads to errors with the legacy filter, e.g.

when using UDF formatted DVD+RW media, with installed LAN Crypt Legacyfilter massive problems occur after a few accesses. (LC-1138)

• CD burning with legacy filter or tools:
• Burning encrypted CDs with Windows Explorer built-in mechanism
  To create a CD with LAN Crypt encrypted files, use a separate burning application that you must add to the list of unhandled applications. All encrypted files remain encrypted if you now burn them onto a CD.
  As the Windows native burning tool is implemented as an Explorer Extension, you cannot use this tool for creating encrypted CDs (you would have to specify Explorer as an unhandled application, which has a huge number of unwanted side effects).
• Known problem with Nero InCD
  There is an issue with Nero InCD and Office 2003 together with LAN Crypt when encryption rules are set for the CD drive. If an Office 2003 file is stored on the CD a BSOD may occur during processing the file (e.g. open, save).
• Certificates:
  User and administrator certificates must be located in the current user’s certificate store. Certificates located in the local computer’s certificate store cannot be used for LAN Crypt.
• Folder overlay icons:
  Overlay icons for folder icons in the left-hand tree-view are sometimes missing.
• No key column in Explorer:
  It is not possible to have a column added in Explorer that shows key names or GUIDs for encrypted files.
• Offline files:
  On some machines it may happen that some encrypted offline files are not accessible in offline mode.
  To avoid this problem please disable indexing of offline files.
• UAC dialog on not accessible encrypted files:
  If an encrypted file is renamed or deleted and the corresponding key is not available in the LAN Crypt profile, a User Account Control dialog is shown because the file is not accessible.
  Providing credentials of an administrator does not allow the file operation in this case, because even as administrator the file cannot be modified as the proper key is not available.
• Manual/Helpfile
• Client help is provided by default via

https://docs.lancrypt.com/de/client/lc_400_hdeu.pdf,

https://docs.lancrypt.com/en/client/lc_400_heng.pdf or

https://docs.lancrypt.com/fr/client/lc_400_hfra.pdf, depending on the language.

The first part of the URL (domain name) can be specified in strictly internally operated environments in the registry under "HKLM\SOFTWARE\Policies\conpal\LAN Crypt\HelpURL”

• Offline Folders:
  If Windows Offline Folders are used it may happen that not all files get synchronized if LAN Crypt is installed. Subsequent synchronization requests should complete the synchronization.
  If the default location of the offline folder cache (usually C:\Windows\CSC) is changed, an ignore rule should be set on this folder (e.g. D:\CSC).
• Known problem with crypto.sys:
  The driver crypto.sys is shipped with different products, like SafeNet Netscreen Remote, SafeNet VPN and others. There is a known problem with this driver that can lead to a BSOD.
• Multiple smartcard PIN entries:
  When LAN Crypt is used together with certain smartcard middlewares, e.g. Nexus Personal Edition 4.0.1, it may happen that the user has to enter the smartcard PIN multiple times.
• Compatibility issues with Microsoft SharePoint:
  Downloading documents from a SharePoint server may fail if there is an encryption rule set on the folder containing the temporary internet files.

• Restricted support of short path names:
  Following restrictions exist in relation to short path names:
• The path used in the encryption rule must exist at profile load time (except paths on shares)
• The path used in the encryption rule must not be renamed after the profile was loaded, otherwise it may happen that the short path name will not work anymore on this path
• Only for absolute path rules the short path name is also handled (relative path rules are only considered in the way they are entered during profile creation)

• Encrypted applications on network shares:
  If an executable file is started which is stored encrypted on a network share, it may happen that the file remains to be used, even if the application is no longer running.
  To replace such files it is necessary to rename the existing executable file at first and then copy the new file.
• User elevation for encrypted executables:
  If an encrypted executable or installation package is started and requires a user elevation, it may happen that the elevation doesn’t take place and the executable is not started.
• Profile expiration:
  If the folder where the LAN Crypt user profiles are stored is made available for offline access, the profile expiration will not work if there is no network connection available.
• Deletion of files using psexec.exe:
  LAN Crypt prevents the deletion of files which are encrypted and the user is not in possession of the proper key. However, if psexec.exe is used to connect to a machine where LAN Crypt is installed, it is possible to delete encrypted files without having the proper key. Opening encrypted files is not possible in such a way.
• Encryption rules on %USERPROFILE%\AppData\Roaming:
  Setting encryption rules on %USERPROFILE%\AppData\Roaming may result in several error situations, as some of these files (e.g. desktop background image) are already accessed by Windows at a very early logon stage where the LAN Crypt profile is not yet loaded.
  In general it is not recommended to encrypt files in this folder. Encryption will only work for files which are accessed after the LAN Crypt profile was loaded.
• Multiple rules for the same target:
  If more than one rule is defined for the same target path (e.g. rule 1 for x:\*.*, rule 2 for y:\*.*, x: and y: are both mapped to the same share), only the first matching rule according to the current rule sort order is applied.
• Missing overlay icons:
  The number of different overlay icons is limited by Windows, so if another application is installed which also uses overlay icons (e.g. SharePoint extension in Microsoft Office and OneDrive) the LAN Crypt overlay icons may disappear.
  Please see the following knowledgebase article how you can enable the overlay icons again: https://www.sophos.com/en-us/support/knowledgebase/108784.aspx
• When a shortcut to a web page is right clicked, no LAN Crypt entry is visible in the Explorer context menu.
• Rules using IP addresses (v4/v6) will only match if the network share was mapped using the IP address. There is no DNS resolving done in the filter driver, so when the very same network share is mapped using the server name, the rule will not match.
• Verification of the encryption status using the Initial Encryption Wizard:
• Encrypted files for which the user has no key are counted as "failed to open" instead of "already encrypted".
• Encrypted files which are encrypted with an algorithm which is not the current configured one (e.g. encrypted with XTS-AES, but configured is CBC), are reported as "Encrypted with another key" instead of "Encrypted with another algorithm".
• Encryption of VHD (Virtual Hard Disk) and WIM (Windows Imaging Format) files is not supported.
• Paths which are longer than 259 characters are not supported.
• Legacy filter and Minifilter might behave different in visualization of encryption status, and behaviour and features.
• API
• If a key KEY_NAME_WITH_SPECIAL_CHAR = "key!§$%&()=}][{@üäö" in a group GROUP_NAME_WITH_SPECIAL_CHAR ="group!§$%&()=}][{@üäö" is assigned by calling the API, group and key are created without errors, but the assignment does not take place.
• lcapi.WriteKey(GROUP_NAME_WITH_SPECIAL_CHARS, KEY_NAME_WITH_SPECIAL_CHAR, 3, 1, isSpecific, "", COMMENT, strKeyShortName) (LC-541)

• The rebranding of Sophos SafeGuard to conpal is comprehensive but may inadvertently be incomplete.