ManageEngine ddiagent 7.1.0 Build Number:7100 - README

Enhancements

  • ddiagent Plus now supports the more secure Modern Mail authentication.

  • The trust browser cookie for two-factor authentication has now been set as HttpOnly for enhanced security.

Fixes

  • An issue in resolving the name GUID of the WMI filter Objects for the reports under Advanced AD Objects report profile has been fixed.

  • Technicians, assigned the operator role, will no longer be able to configure the audit settings for object-level auditing and default domain controllers policy.

  • The agent sync issue in build 7090 has been fixed.

  • An XSS vulnerability in logon failure reports that was reported by Ryan has been fixed.



ManageEngine ddiagent Plus 7.0.9 Build Number:7091 - README

Fix

  • Issue while archiving using 7zip being blocked in anti-virus environments has been handled



ManageEngine ddiagent Plus 7.0.9 Build Number:7090 - README

Features

  • Amazon FSx auditing: You can now audit file accesses, modifications, and deletions across your Amazon FSx Windows file systems.

  • New reports that let you track when a service starts, stops, or fails and monitor the Startup type changes have been introduced.

  • In NetApp auditing, you can now audit access permission changes and share deletion events.

Enhancements

  • Event data from the processed folder is now processed faster than ever in the Database and DataEngine.

  • The self-signed certificate bundled along with ddiagent Plus now uses the more secure SHA-256 algorithm for encryption.

  • A new dashboard containing the graphical and summary view of the Azure AD reports has been introduced.

  • In the User Services report, you can now filter the services running on your computers based on the managed service accounts, local accounts, or other accounts that are used to run them.

  • New options have been added to the Rebranding Settings to:

    • a. enable or disable the PDF cover logo.

    • b. enable or disable the logo in alert mail.

  • An option has been added to exclude the events of users who are deleted from an OU from appearing in the OU-based custom reports.

  • The Java version has been upgraded to ZuluJDK_8_0_322.

  • The Tomcat version has been upgraded to 9.0.54.

  • ddiagent Plus now supports EMC Isilon version 9.4

Fixes

  • An issue that prevented the DataEngine from starting has been fixed.

  • A new notification has been introduced to notify when the DataEngine is restarting frequently.

  • An issue with updating the custom query cache when creating an alert profile has been fixed.

  • An issue that prevented the Caller Machine Name column from displaying the session recording link has been fixed.

  • An issue with exporting the Print Job based reports in printer auditing has been fixed.

  • The agent installation process that is interrupted due to ddiagent Plus server's unavailability will now resume once the server is available.

  • A column mismatch issue in the RADIUS Logon Failure (NPS) and RADIUS Logon History (NPS) reports has been fixed.

  • An issue that prevented account lockout events from displaying in the User Object History report in multi-domain environments has been fixed.

  • An issue with applying the license for trial users and license-expired accounts has been fixed.

  • When creating new technicians, the parent technicians can now delegate only the domains to which they have access.

  • An issue with auditing Packaged app Rules under AppLocker settings in certain cases has been fixed.



ManageEngine ddiagent Plus 7.0.8 Build Number:7082 - README

Important Update

  • Third-party requirement for NTLMv2 SSO: To enable NTLMv2 SSO for ManageEngine ddiagent in builds 7082 and above, you have to manually download the Jespa JAR file and add it to ddiagent Plus' lib folder (\ManageEngine\ddiagent\lib).

Enhancements

  • The Apache Commons Text jar has been upgraded from version 1.8 to 1.10.0.



ManageEngine ddiagent Plus 7.0.8 Build Number:7080 - README

Features

  • Azure Active Directory Domain Services (Azure AD DS) auditing: You can now audit logon activity and track changes to users, groups, computers, GPOs, and more across your Azure AD DS domains.

  • New Risk Detection reports that provide insights into risky sign-in attempts to Azure AD have been introduced.

  • New reports on Conditional Access Policy changes in Azure AD have been introduced.

  • New Rebranding settings that let you customize the logos and icons in ddiagent Plus' user interface and exported reports have been introduced.

  • You can now audit file accesses and permission changes across Huawei OceanStor v6 devices.

Enhancements

  • A separate AdminSDHolder Permission Changes report has been added.

  • A new alert profile has been added to detect ransomware attacks.

  • A new alert profile has been added to notify when Windows is unable to write events to the security log.

  • Azure AD auditing now supports the following cloud types when using Microsoft Azure AD Premium license:

    • a. Azure GCC High Cloud

    • b. Azure for US Government (DOD) Cloud

    • c. Azure China Cloud

    • d. Azure Germany Cloud

  • Performance enhancements have been made for faster processing of permission change events.

  • Performance enhancements have been made for faster event processing from Windows File Clusters and Synology NAS devices.

Fixes

  • An issue in resolving the response data for pointer records in the DNS Record Changes report has been fixed.

  • An authentication issue that occurred when using the User Principal Name (UPN) in multi-domain environments has been fixed.

  • An issue that prevented the default admin from deleting custom reports created by technicians has been fixed.

  • An issue that prevented technicians from accessing scheduled reports from delegated domains has been fixed.

  • An issue that caused EMC Isilon clusters to remain undeleted has been fixed.



ManageEngine ddiagent Plus 7.0.6 Build Number:7062 - README

Fixes

  • When 2FA is enabled, the second factor of authentication can now be reset for the default Admin account if you have lost your authentication device or if you are unable to retrieve the authentication codes.

  • ADSync settings can now be changed only by technicians with write access to the Domain Settings page.

  • An issue with displaying scheduled reports with special characters in the file names has been fixed.

  • In file share auditing, an issue with collecting events from mounted drives in agent mode has been fixed.

  • When creating alert profiles, an issue that caused previously selected report profiles to disappear has been fixed.

  • In Azure auditing, an issue with displaying MFA information when using Microsoft graph API has been fixed.

  • Performance improvements have been made to NetApp C-mode event processing.

  • A fix has been added to support EMC Isilon's change of syslog format in the latest versions.

  • A fix has been added to support authentication in the latest EMC Isilon versions.



ManageEngine ddiagent Plus 7.0.6 Build Number:7060 - README

Features

  • Agent to server communication is now authenticated.

Enhancements

  • UI alerts and email notifications have been introduced to force password change for the default Admin account after license application.

  • Multiple alert profiles can now be copied in bulk across multiple domains.

Fixes

  • An unauthenticated remote code execution vulnerability (CVE-2022-28219) reported by Naveen Sunkavally at Horizon3.ai has been fixed.

  • An issue that caused a delay in exporting reports has been fixed.

  • An issue with filtering group names using underscore (_) in custom reports has been fixed.

  • The timestamps in custom report charts now display the date and time instead of epoch time.

  • In the aggregate search feature, an issue in retrieving logon summary data has been fixed.

  • In scheduled reports, an issue that prevented charts from being exported when business hours is selected has been fixed.

  • The user session recording frames collector issue has been fixed.

  • An issue that caused newer credentials to get rejected during EMC Isilon configuration has been fixed.



ManageEngine ddiagent Plus 7.0.5 Build Number:7050 - README

Features

  • User Session Recording: Keep track of all user actions using a video recording of users' session for all Active Directory activities.

  • A light version of Data Security Plus' File Analysis feature has been integrated.

  • The old and new names of renamed files are now displayed for File servers, File clusters and File integrity monitoring.

  • All Active Directory change activities are now reported with details about the computer from which they have been performed.

Enhancements

  • Branch Office Direct Printing auditing is now supported.

  • Active Directory object updates are now synced in real time using ADSync.

  • In NetApp auditing, server's volume information can now be fetched from the conf file.

  • In Azure AD auditing, a new API which uses token based authentication has been introduced while configuring Azure AD via Office 365 account.

  • In Azure AD auditing, information about Client app and Applied conditional access policies is now available.

  • Graphs have been added for Azure AD reports.

  • In Azure AD, MFA details are now supported via the beta version of Microsoft graph API.

  • Alert profiles can now be copied across domains.

  • Alert processing has been improved by introducing an alert queue.

  • Performance improvements have been made to the User Work Hours report to get more accurate readings.

  • Performance improvements have been made to the UBA modelling engine to consume less system resources.

  • A new port (8555) has been added to secure the communication between the agent and server.

  • Agent can now be installed when automatically adding member servers and workstations in ddiagnet.

  • Agent is now supported for Workgroup auditing.

  • In the Automatic Configuration page, 'Run Now' option has been provided for server addition and removal.

  • Shares can now be automatically removed from ddiagent when they are deleted/unshared on the server.

  • The event fetch mode can be changed to RealTime for all member servers and workstations simultaneously.

  • The notification banners for audit policy alert and privileged domain user alert can now be hidden.

  • Password policy has been introduced for technicians.

  • The password reset option for technicians is now available for administrators.

  • Technician based personalization settings have been introduced.

  • The resultant audit policy can be viewed for domain controllers, member servers, and workstations.

Fixes

  • The log4net package has been upgraded to 2.0.12 (CVE-2018-1285).

  • The vulnerable log4j v1.2.15 has been removed from this build.

  • A parsing issue in importing event log files has been fixed.

  • An issue that caused 'Member added to Local Administrator' to be shown under Group Management instead of Local Account Management before the server is promoted to Domain Controller has been fixed.

  • In Azure AD auditing, an issue related to interrupted logons has been fixed.

  • In Azure AD auditing, an issue related to access token expiry has been fixed.

  • In Azure AD auditing, the certificate required for querying the Azure AD audit logs is now imported automatically.

  • A parsing issue while auditing Synology NAS events has been fixed.

  • An issue in fetching File cluster events in real time has been fixed.

  • Two-Factor Authentication (2FA) enrollment notification has been added to notify when 2FA is not configured.

  • AMS license expiry details are now displayed.

  • The Alert view link configuration has been moved from the Modify Alert Profile page to Alert/Report Settings.

  • A custom LDAP query will automatically run whenever a user, computer, group or an OU object is updated.

  • When NAT device is down, agent to server communication automatically switches to the default agent port and protocol.

  • Differentiation has been made between Active Directory and Azure AD search categories while saving a report with search criteria.

  • In LDAP and PowerShell auditing, an issue related to event data duplication has been fixed.



ManageEngine ddiagent 7.0.0 Build Number:7002 - README

Fixes

  • An SQL query exception in the Recently Enabled Users, Recently Disabled Users, and Recently Locked Out Users reports has been fixed.

  • An issue while applying the license caused due to the presence of multiple versions of a jar file has been fixed.

  • An issue in fetching events from NetApp, EMC, and Hitachi NAS servers has been fixed.



ManageEngine ddiagent 7.0.0 Build Number:7000 - README

Features

  • User logon reports are now stored in the DataEngine for faster search and reporting.

Enhancements

  • You can now configure network address translation (NAT) device settings from ddiagent' UI. NAT devices are used in agent to server communication.

  • You can now receive email alerts when the disk space is low and when the product shuts down due to low disk space.

  • Member severs, workstations, and domain controllers are automatically configured into the product when the agent is installed on the target machine to minimize manual configuration (non-persistent VDI, Azure Virtual Desktop).

  • ddiagent now supports the following remote and virtual desktop technologies through agent installation: DirectAccess, persistent, and non-persistent VDI, linked clone and full clone VDI in VM, Azure Virtual Desktop.

  • In Account Logon report under Profile-based reports, the chart type has been changed from vertical bar (3D) chart to a time series graph.

Fixes

  • In File Audit reports, an issue in exporting the Folder Audit Setting Changes (SACL) report along with sub-reports has been fixed.

  • A configuration has been added to automatically change the event fetch mode to real-time when the agent is installed manually.

  • An issue related to configuration file corruption in the agent when the system drive is out of disk space has been fixed.

  • High CPU utilization while excluding files or folders from File Audit/File Integrity Monitoring has been fixed.

  • A query exception that occurred while viewing the All Users Activities and User Activities reports when logged in as a technician with delegated control over an OU has been fixed.

  • 2k3 OS servers/Domain Controllers can now use WMI event fetch mode as legacy APIs are no longer supported with Windows' latest update.

  • An issue that prevented the Computer Startup and Shutdown report from showing the Shutdown process name has been fixed.

  • In reports, an issue while using underscore "_" in the search string has been fixed.

  • The issue of an empty line appearing in xls while exporting a report with sub-report has been fixed.

  • An issue with parent domain credentials getting rejected for printer auditing in a child domain has been fixed.

  • An issue in updating the last read event time in the UI while reading the audit files from NetApp Cluster devices has been fixed.



ManageEngine ddiagent 6.0.7 Build Number:6077 - README

Fixes

  • Issue in refreshing the Summary View on the Dashboard has been fixed.

  • Issue related to Azure event fetch getting stuck has been fixed.

  • Issue in fetching Isilon event data on machines running the product in Chinese has been fixed.

  • Issue in reading large number of files from Huawei OceanStor storage systems has been fixed.



ManageEngine ddiagent 6.0.7 Build Number:6075 - README

Features

  • Advanced DNS Server auditing: Track DNS service status, scavenging activity, zone changes, record changes, configuration changes, and more.

  • Sysmon auditing: Audit file operations, registry changes, clipboard changes, DNS queries, network connections, and more.

  • AD Replication auditing: Monitor the start and end time of replication; track replication changes, failures, and more.

Enhancements

  • File Integrity Monitoring can now be implemented for workgroup servers added as member servers or workstations.

  • Day based Logon Errors report provides a summary of all logon failures every day.

  • Day based Logon Service report provides a summary of all logons daily.

Fixes

  • Issue in GPO Settings Changes report for Default Domain/Domain Controller Policies in case of multiple domains has been fixed.

  • User Rights Assignment Changes report no longer shows unchanged values.

  • Domain DNS name is now displayed for success events when two domains share the same flat name.

  • Old and new value columns are no longer blank while exporting Custom Reports for User Attribute New and Old Value report.

  • Issue in filter variables for Netlogon vulnerable Schannel Connection Audit report profile has been fixed in alerts.

  • In Reports, issue in Advanced Search while using special character "_" has been fixed.

  • In Schedule Reports, issue of wrong slash (/) in mail link has been fixed.



ManageEngine ddiagent 6.0.5 Build Number:6050 - README

Features

  • Azure AD password protection auditing - Track successful and failed password set and password change activities.

Enhancements

  • LDAP auditing now provides information on secure binds, unsecure binds, and binds which have been rejected because of errors.

  • Performance improvements have been made on the Analytics module to consume less system resources.

  • Shares configured for auditing will continue to get audited, even if their location is changed.

  • Search option has been added to help select reports, under Schedule Reports.

  • Multiple SMS recipients can be included in alert profiles.

  • Alert link URL for an alert profile can be customized.

  • The entire alert profile list as well as individual alert profiles can be exported.

  • Refresh and filter options have been added to Restore Archive Events.

  • Advanced GPO reports can be forwarded to any SIEM solution.

  • Old and new values of OU-level and domain-level permission changes can be forwarded to ArcSight.

Fixes

  • Account Lockout Analyzer will display the correct user name for lockouts caused by mapped drives.

  • Analytics alerts will no longer get duplicated and will display the correct domain name.

  • Program, Program(x86), and SystemRoot files will get configured by default, in File Integrity Monitoring.

  • Special characters will get parsed in Synology NAS auditing.

  • Under Alert Profile and Custom Reports filters, users and groups can be selected without any issues.

  • Special characters can be used in passwords when migrating database to MSSQL server.

  • Agent will collect data from a server even when only one among Server name, Server IP, or Server DNS is correct.

  • Under Alert me, failure events can be configured for cloud directory events.

  • Under User Created and Computer Created reports, changes to all User-Account-Control attribute values will get displayed.

  • Add To Dashboard option will not be visible to technicians who do not have the privilege to view the Dashboard (Home).

  • Under Archive Events, there will be no discrepancy between archive category size and audit data size.

  • Changes to firewall GPO settings will be audited.

  • Changes to security options settings (local security policies), newly added in 2012 R2, will be audited.

  • Login failures will no longer occur in the domain where ddiagent is installed, when user name is used in the UPN format under Domain settings.

  • Technicians will no longer face login issues, when the domain flat name of configured AD and Azure AD domains is the same.



ManageEngine ddiagent 6.0.3 Build Number:6032 - README

Fixes

  • Issues in viewing Windows file cluster audit reports have been fixed.

  • Interrupted logons are now reported as Logon Failures in Azure AD auditing.

  • In PowerShell auditing, issues in parsing of certain scripts have been fixed.

  • The Feedback icon has been made less intrusive.



ManageEngine ddiagent 6.0.3 Build Number:6031 - README

Fixes

  • DataEngine startup issue has been fixed.



ManageEngine ddiagent 6.0.3 Build Number:6030 - README

Features

  • Audit file access across Synology storage devices.

  • Audit PowerShell script blocks and modules.

  • Enable two-factor authentication (2FA) for login to ddiagent.

  • Add/remove servers and workstations automatically in ddiagent, as and when they are created/deleted in your domain.

  • Configure servers, workstations, and shares in bulk; in ddiagent.

Enhancements

  • NetApp and EMC Permission Changes report to provide information on before and after values of permissions.

  • Locked out users report to provide information on caller's IP address.

  • User work hours report to take into consideration screensaver invoke and dismiss.

  • Track denied access to Remote Desktop.

  • The following alert profile templates have been added, enable them to notify when:

    • A disabled user is enabled

    • A login attempt is made by a disabled user

    • The 'Password never expires' attribute is enabled for a user

    • A user's account is locked out (the notification is sent directly to the end user in this case)

  • Automatic upgrade of client-side agent.

Fixes

  • Security vulnerabilities such as path information getting disclosed, help doc click-jacking, and others have been fixed.

  • Export issue with DataEngine and a host of other issues have been fixed.



ManageEngine ddiagent 6.0.0 Build Number:6010 - README

Enhancements

  • Technicians in ddiagent can now be granted OU-level delegation.

  • Besides users of the groups which have access to ddiagent, users who are in a nested group can also log in to the product now.

  • MySQL/MS SQL to PostgreSQL product database migration is now supported.

  • Option to view audit data of all domains in a single report has been added.

  • Command line arguments used by a process can now be tracked.

  • Option to configure an email alert when there is no communication from agent has been added.

  • Alert and Custom Report filters have been enhanced for improved user experience.

  • Column-wise summary has been added to each table under Archive Events.

  • The following default alert profiles have been added:

    • Group Membership Changes

    • Folder Permission Changes on Sensitive Shares

    • Logon Access On Executive Servers

    • PII user attributes changed and

    • User, Group, Computer Modifications under an OU

  • Option to manually configure High Availability of ddiagent has been added.

Fixes

  • Tomcat has been upgraded from version 8.5.27 to 8.5.32, to overcome security vulnerabilities.

  • Time series graph bug under Custom Reports has been fixed.

ManageEngine ddiagent 6.0.0 Build Number:6000 - README

Features

  • Faster search and retrieval of data with ddiagent all new DataEngine.

  • Smoothen out log collection over WAN connections with the ability to deploy a client-side software agent.

  • Get status reports and instant alerts on the current working state of ddiagent to ensure round-the-clock availability.

  • Copy alert profiles and scheduled report templates to quicken creating customized reports and alerts.

Enhancements

  • Active Directory risk assessment reports have been added to Analytics.

  • Track rename activity of user/computer/groups.

  • Regex support has been provided for file exclude patterns.

  • While creating email and SMS alert profiles, the mailing list can be set based on multiple variables (eg. caller username, SID, etc).

  • New CSRF tokens are implemented for every user session.

  • A custom LDAP query can now be added to filter data in custom reports.

Fixes

  • The issue with downloading XLSX files from the scheduled reports' directory listing has been fixed.

  • All requests (including images, JS & CSS files) now pass through a security filter.

  • The 'add objects' pop up in 'Alert Profiles' failed to list workstations, which has now been fixed.

  • Ipv6 addresses can now be resolved to get machine names.

  • Occurrences of missing printer audit data fields have been fixed.

Note

  • Due to an upgradation in the indexing methodology, the archive files currently indexed under 'Search Archived Events' link will be un-indexed automatically and they need to be indexed once again after applying the service pack.


ManageEngine ddiagent 5.1.0 Build Number:5120 - README

Enhancements

  • Now forward Azure AD audit data to your SIEM solution.

  • Define alert thresholds based on multiple event fields.

  • Suppress emailing of redundant alerts.

  • You can now save a custom LDAP query while choosing users/computer/OU/group in the alert filter, eg., Alert logon attempts for disabled users.

  • Event fields can now be included in SMS alerts.

  • Support for any AD object changes in custom reports.

  • Support for multiple business hour configurations.

Fixes

  • The unauthenticated proxy server for Azure AD issue is fixed.

  • While scheduling reports, 'Don't send empty report' checkbox is now included so that empty zip files are not sent.

  • While configuring email address for an alert, 'Add more recipient' can be configured directly without providing an email.

  • In custom reports, the exception while adding GPO and group management reports is fixed.

  • Auditing changes to Azure AD has been updated to the new event format.

ManageEngine ddiagent 5.1.0 Build Number:5110 - README

Enhancements

  • Users will be prompted for consent while integrating with third party applications.

  • Password protection for exported reports, database backup, and archived audit data ZIP files.

  • Database access via command prompt or client tool is secured with a password.

  • Report export actions are audited.

  • Sensitive information such as email server and email addresses are masked in the User Interface.

  • New GDPR compliance reports and alert templates are included.

  • Permission to export reports can now be defined for technician roles.

ManageEngine ddiagent 5.1.0 Build Number:5100 - README

New

  • Active Directory User behaviour analytics.

  • ADFS 4.0 support.

Enhancements

  • Forward logs to ArcSight - CEF format support.

  • Alert and custom reports filter enhanced.

Fixes

  • Lots of security enhancements.

ManageEngine ddiagent 5.0.0 Build Number:5051 - README

New

  • Receive alerts via SMS.

Enhancements

  • Improved data collection performance for print servers.

  • Alert e-mails now contain a link to the alert profile.

  • Default setting for server audit is set to "all computer objects" for a simplified view.

  • Support for Arabic characters while exporting to a PDF.

Fixes

  • Configure ddiagent to collect data from Azure Active Directory via proxy credentials.

  • Export issue pertaining to data fields containing "," in PostgreSQL is fixed.

ManageEngine ddiagent 5.0.0 Build Number:5050 - README

New

  • Azure AD auditing

  • User attendance - new report.

  • LDAP authentication auditing.

  • Workgroup Servers can be audited now.

Enhancements

  • A comprehensive search feature encompassing reports, help, configuration pages etc.,

  • LAPS - New report when passwords are viewed through the "attribute editor tab"

  • ADFS auditing(OAuth support).

Fixes

  • Advanced GPO alerts configured for "All GPOs" will not work for newly created GPO.

  • Scripts does not gets triggered for GPO alerts.

ManageEngine ddiagent 5.0.0 Build Number:5040 - README

New

  • EMC Isilon auditing.

  • Configure scripts for alert actions.

  • Computer startup and shutdown reports.

Enhancements

  • Now analyze logon failures as we analyze account lockouts.

Fixes

  • Chart issue fixed for Profile based reports.

  • Profile based reports now shown for technicians.

ManageEngine ddiagent 5.0.0 Build Number:5030 - README

New

  • Forward logs to syslog or SIEM servers.

  • Support for LDAP over SSL.

  • Reports from archives can be exported to PDF/CSV.

  • Audit Active Directory Lightweight Directory Services(ADLDS).

  • Audit Local Administrator Password Solution(LAPS).

Enhancements

  • Create custom alert profiles directly from reports with a single click.

  • Export to PDF/CSV formats 10 times faster.

  • In custom reports, time series chart supports monthly/yearly time periods.

Fixes

  • Crash issue involving, import archived logs along with live log.

  • Issue in file audit reports(server based reports) with MSSQL as database.

ManageEngine ddiagent 5.0.0 Build Number:5020 - README

New

  • Active Directory Federation Services[ADFS] auditing.

Fixes

  • Elaborate disk info provided in "Admin" pages.
  • "Jump To" delegate option for technicians handled.

ManageEngine ddiagent 5.0.0 Build Number:5010 - README

New

  • Account Lockout Analyzer now analyzes OWA/ActiveSync for lockout reason.

  • User idle time calculation [Beta]

Enhancements

  • Support for home page charts on-demand refresh.

Fixes

  • Schedule Reports - "View Reports" link gets hidden on a particular date format.

ManageEngine ddiagent 5.0.0 Build Number:5000 - README

New

  • Powerful Search, Reports on Archives

Enhancements

  • Advanced filters for Alerts [C/O - Darragh O'Shaughnessy, VHI Group Ltd.,].
  • Terminal Gateway Server Audit added to Custom Reports.
  • Advanced Search in reports
  • Copy Custom Report feature [C/O - Darragh O'Shaughnessy, VHI Group Ltd.,]

Fixes

  • Spanning multiple IE instances in the background during service start.
  • Schedule reports - business hours issue.