76 results found

1. Change Agent User Interface

   Dear DriveLocker,
   it would be nice if you could show the self-service unlock as a tile on the agent user interface.

   2 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  UX / UI / DOC  ·  Delete…  ·  Admin →
   declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

   After much deliberation, we have decided to respectfully decline this feature request. We will look into this again as part of a new end-user UI.

2. Temporary unlock with scripts

   Sometimes a temporary unlock is almost a daily routine I notice with some customers. Example: PCx, 30 minutes free for USB. With input of PC and time, maybe even from-to (the from is not possible yet) would be very nice with a script. I need to be able to trigger this remotely of course.

   2 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Device/Drive Control  ·  Delete…  ·  Admin →
   declined  ·  AdminMark Hartmann (Director Corporate Strategy, DriveLock SE) responded

   As there have not been any additional votes on this idea, we will not implement such kind of functionality into DriveLock.

   Also because it would introduce a way to bypass security features currently available.

3. Power management

   Actions under "power management" should have the option for notebooks in docking station or without alternative with ethernet/power supply or without connection. Otherwise, there is a risk that a notebook in the notebook bag performs an action. It would also be good to configure power options with all setting options as under Windows to establish itself as a central device management solution.

   2 votes

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Security Configuration Management  ·  Delete…  ·  Admin →
   declined  ·  AdminMark Hartmann (Director Corporate Strategy, DriveLock SE) responded

   Currently most customers do not use these settings and so we will probably deprecate this feature in a future release.

   Therefor we will not put efforts into further enhancing this capability.

4. Automatisierte Authentifizierung der DriveLock PBA im internen Netzwerk

   In unserer Umgebung wäre es äußerst hilfreich, wenn die DriveLock PBA so konfiguriert werden könnte, dass bei erkannter Verbindung zum internen Unternehmensnetzwerk keine Benutzerinteraktion erforderlich ist und der Bootvorgang automatisch direkt in das Windows-Betriebssystem übergeht.

   Ziel:
   - Im internen Netzwerk: Automatischer Bootvorgang ohne Benutzereingabe (z. B. Passwort).
   - Außerhalb des Netzwerks: Beibehaltung der vollständigen PBA-Authentifizierung zur Sicherstellung der Gerätesicherheit.

   Ein vergleichbares Verhalten lässt sich bei einer reinen BitLocker-Implementierung über die Verwendung von Netzwerkzertifikaten (Network Unlock) realisieren.

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   declined  ·  0 comments  ·  Encryption  ·  Delete…  ·  Admin →

5. DOC: X-XXS-Protection aktivieren

   DOC: Durch ein Audit ist aufgefallen das der Parameter X-XXS-Protection nicht gesetzt ist. Da dies als Abweichung gilt wäre es gute wenn dieser Paramter gesetzt werden könnte

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Others  ·  Delete…  ·  Admin →
   declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

   After checking with and getting an explanation from the customer, this request can be closed.

6. Integration of Windows Hello (PIN) in the PBA for login

   Please integrate Windows Hello (at least PIN) into your PBA as an additional login option.

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  UX / UI / DOC  ·  Delete…  ·  Admin →
   declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

   Pre-Boot Authentication (PBA) is a security measure that occurs before the operating system starts. It ensures that only authorized users can boot the system.

   Windows Hello is Microsoft’s modern authentication framework that supports:

   - PIN, Face recognition, Fingerprint login

   Important: Windows Hello only works after Windows has started. It's part of the Windows login process, not pre-boot.

   Windows Hello is a post-boot authentication mechanism.

   PBA takes place before the OS loads, often in a custom mini-OS or bootloader from security vendors.

   This means Windows Hello cannot be used in traditional PBA environments, unless a vendor mimics its behavior (e.g., using a similar PIN mechanism).

   Windows Hello cannot be directly integrated into traditional PBA because it is tied to Windows.

   What is possible: PIN-based authentication in the PBA, similar to Windows Hello, but not using its APIs.

   What I would find more interesting is MFA with an authenticator app (i.e., displaying a QR code in the PBA to scan and store in the authenticator).

   As this approach isn’t currently feasible, I will close the request. Many thanks for your understanding.

   Pre-Boot Authentication (PBA) is a security measure that occurs before the operating system starts. It ensures that only authorized users can boot the system.

   Windows Hello is Microsoft’s modern authentication framework that supports:

   - PIN, Face recognition, Fingerprint login

   Important: Windows Hello only works after Windows has started. It's part of the Windows login process, not pre-boot.

   Windows Hello is a post-boot authentication mechanism.

   PBA takes place before the OS loads, often in a custom mini-OS or bootloader from security vendors.

   This means Windows Hello cannot be used in traditional PBA environments, unless a vendor mimics its behavior (e.g., using a similar PIN mechanism).

   Windows Hello cannot be directly integrated into traditional PBA because it is tied to Windows.

   What is possible: PIN-based authentication in the PBA, similar to Windows Hello, but not using its APIs.

   What I would find more interesting is MFA with an authenticator app (i.e., displaying… more

7. Funktionen bei Mehrfachselektion ermöglichen

   Da nach Behandlung von Schwachstellen z.B. durch Softwareupdates die Schwachstelle nicht automatisch aus der Übersicht entfernt wird, muss diese manuell "ausgeblendet" werden.
   Treten nun an einem Rechner zu einem bestimmten Produkt mehrere Schwachstellen auf, wäre es vorteilhaft man könnte in der Mehrfachselektion alle betroffenen Schwachstellen markieren und gesammelt "ausblenden".
   Leider stehen bei der Mehrfachselektion keine Funktionen zur Verfügung.

   "Multiple (474) items are selected. No additional information or actions available"

   Beispiel:
   An einem Client ist Software XYZ veraltet und es werden mehrere Schwachstellen aufgeführt. Ich aktualisiere Software XYZ an diesem Client und möchte nun alle Schwachstellen ausblenden. "Ausblenden für alle Computer" möchte ich aber nicht nutzen, da ich nur den einen Client behandelt habe.

   Da nach Behandlung von Schwachstellen z.B. durch Softwareupdates die Schwachstelle nicht automatisch aus der Übersicht entfernt wird, muss diese manuell "ausgeblendet" werden.
   Treten nun an einem Rechner zu einem bestimmten Produkt mehrere Schwachstellen auf, wäre es vorteilhaft man könnte in der Mehrfachselektion alle betroffenen Schwachstellen markieren und gesammelt "ausblenden".
   Leider stehen bei der Mehrfachselektion keine Funktionen zur Verfügung.

   "Multiple (474) items are selected. No additional information or actions available"

   Beispiel:
   An einem Client ist Software XYZ veraltet und es werden mehrere Schwachstellen aufgeführt. Ich aktualisiere Software XYZ an diesem Client und möchte nun alle Schwachstellen ausblenden. "Ausblenden für alle Computer"… more

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Vulnerability Management  ·  Delete…  ·  Admin →
   declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

   Once the scan is run again after the necessary patches have been applied, the identified vulnerabilities will be automatically closed. Consequently, we believe that implementing this feature request is unnecessary from our perspective.

8. Geräteliste für gesperrte HID Geräte (BadUSB) per Drivelock Updates zur Verfügung stellen bzw. erweitern
   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Delete…  ·  Admin →
   declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

   I'm afraid we have to decline this proposal because we are unable to allocate the necessary resources to maintain these well-known USB devices.

9. Customizable Language and Text for Security Awareness Invitation Emails

   Es wäre sehr Hilfreich wenn man de Standard Sprache innerhalb der Domäne Festlegen könnte.
   Und wenn man den Text der vom DOC verteilten E-Mail selbst anpassen kann.
   Das zum Beispiel der Display Name statt des Logins nach dem Hallo kommt
   
   Und der Text zum Test in der Mail dem CI entspricht.
   Da der Standard Text der DriveLock Awareness E-Mail von vielen Mitarbeitern als Spam war genommen wurde.

   1 vote

   Vote Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   1 comment  ·  Security Awareness  ·  Delete…  ·  Admin →
   declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

   DriveLock is introducing a new Security Awareness solution. For more information, please contact your DriveLock sales representative.

10. Filter im Knoten Betrieb - Agenten Ferncontrolle

    In der DMC sollte es möglich sein unter dem Knoten einen Filter zu implementieren, so das man z.b. Nach dem Computernamen oder dem angemeldeten Nutzer Filtern kann. Bei ca. 10000 Computern ist ohne Filter ein suchen sehr mühselig

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  UX / UI / DOC  ·  Delete…  ·  Admin →
    declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

    We would like to kindly inform you that there are already several ways to do this in the DOC. Unfortunately, this means that we have to reject your request.

11. Check PBA Prerequisites - availibility of CA-certifiate "Microsoft Corporation UEFI CA 2011"

    Many new notebook systems of the manufacturers HP and Lenovo are shipped with the CA-certifictate
    "Microsoft Corporation UEFI CA 2011" disabled in their firmware settings.

    The DriveLock-PBA is signed with this CA-certificate. So this CA-certificate needs to be enabled and
    available on a system in advance of installing the DriveLock-PBA.

    The installation routine of the DriveLock-PBA should verify if this CA-certifiacte is enabled and available on a system
    when attepmpting to install the PBA, and write a message of level=Error when detecting this CA-certificate is not available
    on a system.
    With this enhancement the administrator of a DriveLock environment will become able to monitor for that event in the DOC and
    will then know the DriveLock-PBA could not be installed on a certain system because that CA-certificate is not available.

    Many new notebook systems of the manufacturers HP and Lenovo are shipped with the CA-certifictate
    "Microsoft Corporation UEFI CA 2011" disabled in their firmware settings.

    The DriveLock-PBA is signed with this CA-certificate. So this CA-certificate needs to be enabled and
    available on a system in advance of installing the DriveLock-PBA.

    The installation routine of the DriveLock-PBA should verify if this CA-certifiacte is enabled and available on a system
    when attepmpting to install the PBA, and write a message of level=Error when detecting this CA-certificate is not available
    on a system.
    With this enhancement the administrator of a DriveLock environment will… more

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Encryption  ·  Delete…  ·  Admin →
    declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

    Since version 23.1 there is a message with EventID=757 “SecureBoot is enabled but the Microsoft Corporation UEFI CA 2011 certificate is missing.”. This function is therefore already implemented. Please configure this event in a policy so that it is sent from clients to the DES.

12. Freigabe von Softlinks (via mklink erzeugt)

    Bei der Freigabe von Pfaden werden keine Softlinks (via mklink erzeugt) berücksichtigt. Hilfreich wäre eine Ausnahme für Softlinks (via mklink erzeugt) als Ausnahme zu definieren, während der Ursprungspfad per WL Regel gesperrt bleibt.

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Application Control  ·  Delete…  ·  Admin →
    declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

    Thank you so much for your suggestion regarding the allowance of soft links created via mklink.

    Our system currently resolves paths upon access, meaning we ultimately only see the resolved path, not the soft link itself. As a result, we're unable to differentiate or specifically allow soft links without impacting existing security mechanisms. Therefore we unfortunately have to reject this request.

    We really appreciate your understanding and are here if you have further questions or feedback.

13. Wiederholung von Fehlgeschlagenen Installationen

    Wir lassen Drivelock automatisch Installieren, indem Drivelock bestimmte AD-Verzeichnisse scannt.
    Jetzt ist der Server aber ausgelastet oder Systeme sind zu dem Zeitpunkt nicht mehr am Netzwerk, da die Systeme nach der Installation des Betriebssystems ausgeschaltet werden und dann erst im AD verschoben werden.
    Der Scann des ADs erfolgt anscheinen nur zu jeder vollen Stunde und dies lässt sich leider nicht ändern.

    Kann man implementieren, dass Drivelock fehlgeschlagene Installationen (Netzwerkname wurde nicht gefunden, RPC-Server ausgelastet etc) nicht regelmässig wiederholt?

    RPC-Server ausgelastet vielleicht zur nächsten vollen Stunde immer wieder.
    Netzwerkname nicht gefunden alle 8 Stunden.

    Allgemein finde ich es als Verantwortlicher etwas unschön, dass viele Parameter nicht anpassbar sind.

    Ebend wie die Wiederholungen , Wiederholfrequenzen, Zeitpunkt etc.

    Wir lassen Drivelock automatisch Installieren, indem Drivelock bestimmte AD-Verzeichnisse scannt.
    Jetzt ist der Server aber ausgelastet oder Systeme sind zu dem Zeitpunkt nicht mehr am Netzwerk, da die Systeme nach der Installation des Betriebssystems ausgeschaltet werden und dann erst im AD verschoben werden.
    Der Scann des ADs erfolgt anscheinen nur zu jeder vollen Stunde und dies lässt sich leider nicht ändern.

    Kann man implementieren, dass Drivelock fehlgeschlagene Installationen (Netzwerkname wurde nicht gefunden, RPC-Server ausgelastet etc) nicht regelmässig wiederholt?

    RPC-Server ausgelastet vielleicht zur nächsten vollen Stunde immer wieder.
    Netzwerkname nicht gefunden alle 8 Stunden.

    Allgemein finde ich es als Verantwortlicher etwas… more

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Others  ·  Delete…  ·  Admin →
    declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

    We will no longer support this feature. We will even remove it because it no longer corresponds to our idea of practical distribution. Instead, one should rely on software distribution.

14. PC Neustart bei Push-Installation verzögern

    Beim Update besteht ja über die Konfig die Möglichkeit, den Reboot des Clients zu verzögern.
    Bei der Pushinstallation, wenn man den Restart anklickt, erfolgt dieser ja nahezu sofort, ohne das die Möglichkeit besteht Daten zu sprichern.

    Toll wäre es, wenn man hie die selben Einstellungen wie bei einem Update machen könnte, um dem Benutzer die Möglichkeit zu geben, den Neustart z.B. in eine Pause zu legen.

    Den es ist Dumm, wenn der Neustart plötzlich während der Arbeit erfolgt. z.B. bei einem Meeting, Videokonferenz, Kundengespräch etc.

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Others  ·  Delete…  ·  Admin →
    declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

    Please use Software Distribution for appropriate control

15. Citrix VDI and Terminal Server Golden Images should not be counted as a consumed license (from DOC).

    Citrix VDI and Terminal Server Golden Images should not be counted as a consumed license (from DOC).

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Delete…  ·  Admin →
    declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

    At first glance, this use case seems sensible. However, the image is created from a computer with an agent and needs a license. After 30 days, an inactive computer is no longer counted anyway.

16. automatish push installation should support tenant

    it seems automatic push installation supports only root tenant

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Others  ·  Delete…  ·  Admin →
    declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

    In any case, we are currently checking whether this feature should be discontinued in principle. In the cloud environment, this is not an option anyway. Software distribution does the job better.

17. Ability to disable Logging for specific uses of the Usage Policy

    When using a Usage Policy with different rules we would sometimes not want the rule to be logged with our enterprise Service (or at least be able to filter it out of our log).
    Example:
    We have one Rule that creates Usage Policies that we want to see to validate the device daily and add it to the permanent whitelist.
    We have a different rule where we would like to show a Usage Policy to that user group for certain devices they connect. We have no need to see this Log in our DOC.

    Right now we either get all logs or no logs. This means we get multiple dozens of Usage Policy Logs per day that we have to skip over to find the ones we actually have a TODO with. As such this would save us a lot of time.

    We have seen a "Do not create Audit events when this rule is activated" and something similar for the Usage Policy would be great.

    When using a Usage Policy with different rules we would sometimes not want the rule to be logged with our enterprise Service (or at least be able to filter it out of our log).
    Example:
    We have one Rule that creates Usage Policies that we want to see to validate the device daily and add it to the permanent whitelist.
    We have a different rule where we would like to show a Usage Policy to that user group for certain devices they connect. We have no need to see this Log in our DOC.

    Right now we either get all… more

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    declined  ·  0 comments  ·  Device/Drive Control  ·  Delete…  ·  Admin →

18. Use fingerprint and/or face recognition at DriveLock PBA (Windows Hello support)

    When using the Drivelock PBA with Yubikeys to implement a 2FA, the use of fingerprint scanners and facial recognition is not possible. Login works with PIN or username/password.
    We have notebooks with fingerprint and face recognition in use. If you activate the functionality in Windows, the Drivelock PBA does not work anymore. The PBA cannot be installed or uninstalled. The PBA users are not synchronized. This means that the additional logon methods cannot be used. With the PBA fingerprint and face recognition should be possible.

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Encryption  ·  Delete…  ·  Admin →
    declined  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

    The current PBA does not support face recognition or fingerprint. UEFI does not support that. The request is closed. There is a possibility that we will revisit the issue at some point with further development. Thank you for your understanding.

19. Using VMWare workstation , USB Device can be accessed in VM Client even though it is blocked in host machine..

    Using VMWare workstation , USB Device can be accessed in VM Client even though it is blocked in host machine..

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Device/Drive Control  ·  Delete…  ·  Admin →
    declined  ·  AdminMark Hartmann (Director Corporate Strategy, DriveLock SE) responded

    Please contact your support partner or our support team in case of problems. There you will get assistance in analyzing any error and fixing the issue.

20. Deactivate MQTT on the server

    It should be possible to disable MQTT on the server side as well. The existing option to disable MQTT on the client side via policy is not sufficient in my opinion. It should best be configurable via a feature in the DMC UI.

    1 vote

    Vote Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  UX / UI / DOC  ·  Delete…  ·  Admin →
    declined  ·  AdminMark Hartmann (Director Corporate Strategy, DriveLock SE) responded

    Disabling MQTT by policy provides a way to respond to restrictions on the use of MQTT communications in certain situations and environments.

    We do not foresee disabling MQTT server-side at this time, as it is a central part of the DriveLock components' technical communication, the use of which will continue to expand in the future.