Release Notes › Feature Support Limitations › Windows Endpoint Limitations

Windows Endpoint Limitations

This section describes feature support limitations for Windows endpoints.

x64 Feature Support Limitations

The following are known limitations on Windows 2003 x64:

• Unicenter TNG migration and integration
• Mainframe password synchronization
• Impersonation interception (class SURROGATE functionality), if SurrogateInterceptionMode is set to 1

  Important! Impersonation interception is supported on x64, IA64 and x86 platforms by default via the RunAs plug-in (SurrogateInterceptionMode is set to 0).

  Note: For more information about the SurrogateInterceptionMode registry setting, see the Reference Guide.

IA64 Feature Support Limitations

The following features are not supported on IA64 platforms:

• Unicenter TNG migration and integration
• Mainframe password synchronization
• STOP
• Report Agent
• PUPM Agent
• SSL
• FIPS 140-2 compliance

Windows Server 2008 Feature Support Limitations

The following are known limitations on Windows Server 2008:

• Impersonation interception (class SURROGATE functionality), if SurrogateInterceptionMode is set to 1

  Important! Impersonation interception is supported on x64, IA64 and x86 platforms by default via the RunAs plug-in (SurrogateInterceptionMode is set to 0).

  Note: For more information about the SurrogateInterceptionMode registry setting, see the Reference Guide.

SAN Support

CA Access Control supports a SAN (storage area network) environment when you install CA Access Control on:

• A local file system and use it to protect files on a SAN, when the SAN is accessible from a single host.

  Note: If the SAN is accessible from multiple hosts, install CA Access Control on each host that can access the SAN and use each installation to protect files on the SAN.

• A SAN disk, subject to the following limitations:
  • CA Access Control drivers must be installed on the local file system.
  • You must manually start CA Access Control on the SAN disk each time you start or restart the computer. Do not start CA Access Control automatically when you start or restart the computer.

    Note: The previous condition only applies when you install CA Access Control on a SAN disk. If you install CA Access Control on a local file system and use it to protect files on a SAN, you do not need to manually start CA Access Control each time you restart the computer.

If the SAN is accessible from multiple hosts and CA Access Control is installed on the SAN, and you want to install CA Access Control from a different host to the same location on the SAN, consider the following before you begin:

• The new installation of CA Access Control replaces the existing installation of CA Access Control and overwrites the existing CA Access Control configuration files and database.
• You must stop the existing installation of CA Access Control before you begin the new installation.

McAfee Entercept Buffer Overflow

The CA Access Control STOP feature is incompatible with the McAfee Entercept buffer overflow technology.

Turn off the CA Access Control STOP feature or the McAfee Entercept buffer overflow protection feature.

Short File Name Rules (8.3 Format) Are Not Supported

CA Access Control does not support rules created as short file names (8.3 format). When you define any of the following classes, you must enter the full path name of the file or directory:

FILE, PROGRAM, PROCESS, SECFILE, SPECIALPGM

The following is an example of a rule using a full path name:

nr file ("C:\program files\text.txt")

The following is an example of a rule using a short path name that is not supported:

nr file ("C:\progra~1\test.txt")