Supported Platforms
A list of all the platforms supported by Nomad, and the software required to allow Nomad to be installed or to work.
Tachyon Platform
Refer to Server software for Tachyon server requirements and information that will help you design and plan the implementation of Tachyon in your organization.
Nomad Administration Tools
Category | Product | Notes |
|---|---|---|
Windows OS | OS versions supported by Configuration Manager versions are listed below. | |
Microsoft Endpoint Manager Configuration Manager |
| 1E maintains a testing cycle for our products relative to the Current Branch release cycle. Please refer to Microsoft Rapid-Release Cycle on https://support.1e.com/ for the latest information on future releases of CM Current Branch, and any advisories related to these releases. NoteWhen using CB 1910, be sure to apply Hotfix rollup KB4537079 or later to sites. Prior to this update, there is an issue that prevents Alternate Content Providers downloading certain types of content referenced in Task Sequences. NoteMicrosoft, and therefore 1E, no longer support CB1706. If you are running CB1706 and find that NomadAdminUI is not working as expected, we recommend you apply KB4036267 to address the issue. For each Configuration Manager site server where you intend to administer task sequence packages to use Tachyon as the alternate download provider, you need to ensure that:
NoteIf these conditions are not met, the Tachyon settings for task sequences will not be created correctly. This is the case even if you install a remote Configuration Manager Admin Console with the Nomad Admin Console GUI extension, except for Nomad Branch Tools, which are required to be installed on Configuration Manager Site Server only. |
Runtime libraries |
| Note.NET Framework is required for the Admin Console GUI extensions, the Download Monitor, and NomadBranch GUI. It is not a requirement for other features of Nomad. |
Antivirus | Nomad is able to work with Antivirus systems provided they have certain exclusions configured. | It is likely that performance will be impaired by antivirus programs. To mitigate this, we have detailed suggested antivirus exclusions you can implement. Please refer to Nomad post-installation tasks. |
Nomad client
The 1E Client (with Nomad client enabled) must be installed on client devices and Configuration Manager Distribution Points.
Category | Product | Notes |
|---|---|---|
Windows OS |
| The zip for 1E Client for Windows is available for download from the Tachyon Exchange. Professional and Enterprise editions are supported for Windows 10 and Wndows 11. All versions are provided with 32-bit & 64-installers, and can be installed on physical and virtual computers. NoteThis list shows only those OS versions in mainstream support by Microsoft, and therefore supported by Tachyon, and by 1E Client . Please refer to Constraints of Legacy OS regarding the end of mainstream support. For Microsoft product lifecycle details, please refer to https://support.microsoft.com/en-us/lifecycle/search. Refer to Support for Microsoft Rapid-Release Cycle on https://support.1e.com/ for details of which Current Branch versions are supported by 1E products, and known issues regarding specific versions. For Windows Server 2016 Core Server installations:
For installation guidance on Windows, please refer to Deploying 1E Client on Windows. Nomad and Nomad Multicast require MSXML6 to communicate with the Configuration Manager client. This is present in all the supported versions of Windows (with the required service packs). Peer copy over HTTP or HTTPS is the recommended method of peer sharing content. |
Runtime libraries |
| .NET Framework is required only for the following features of 1E Client:
NoteThis list is automatically updated to show only those .NET Framework versions in mainstream support by Microsoft, and therefore supported by 1E, and by Tachyon 8.1. For Microsoft product lifecycle details, please refer to https://support.microsoft.com/en-us/lifecycle/search. |
Other Windows Software |
| 1E Client installer includes the redistributable package for Visual C++ 2013. 1E Client provides client features. It also includes the Nomad client module which replaces the legacy branch client. Tachyon client features can optionally use Nomad to download content (feature enabled by default) if the Nomad client module in is enabled (module disabled by default) or Nomad Branch 7.0 or later is running. PowerShell is not a prerequisite for the installation of the 1E Client. PowerShell is used by some Tachyon instructions (that have PowerShell commands embedded or scripts that are downloaded) and some of these require PowerShell 3.0 or later. For more details, please refer to Downloading client content and Nomad integration. |
Microsoft Endpoint Manager Configuration Manager Client |
| NoteThis list is automatically updated to show only those Configuration Manager versions in mainstream support by Microsoft, and therefore supported by 1E, and by Nomad 8.1. For Microsoft product lifecycle details, please refer to https://support.microsoft.com/en-us/lifecycle/search. Please refer to the Support for Microsoft Rapid-Release Cycle on https://support.1e.com/ for details of which Current Branch versions are supported by 1E products, and known issues regarding specific versions. 1E maintains a testing cycle for our products relative to the Current Branch release cycle. Please refer to Microsoft Rapid-Release Cycle on https://support.1e.com/ for the latest information on future releases of CM Current Branch, and any advisories related to these releases. NoteWhen using CB 1910, be sure to apply Hotfix rollup KB4537079 or later to sites. Prior to this update, there is an issue that prevents Alternate Content Providers downloading certain types of content referenced in Task Sequences. NoteIf IIS filtering is enabled on Distribution Points, you may encounter problems during downloads if certain types of content are present in the download. Please refer to IIS Request Filtering. (Microsoft Endpoint Configuration Manager is also known as Configuration Manager, ConfigMgr, Config Man, CM and SCCM among other names. Version names include 2012 and Current Branch or CB.) |
Antivirus | Nomad is able to work with Antivirus systems provided they have certain exclusions configured. | It is likely that Tachyon performance will be impaired by antivirus programs. To mitigate this, we have detailed suggested antivirus exclusions you can implement. Please refer to Nomad post-installation tasks. |
Legacy OS constraints
In this documentation, the following are referred to as legacy OS. Below are described some known issues for these OS.
1E does not provide support for 1E products on the following OS unless the OS is explicitly listed as being supported for a specific 1E product or product feature. This is because Microsoft has ended mainstream support for these OS or they are not significantly used by business organizations.
|
|
Note
1E Client and later will not install on Windows XP and Windows Server 2003. Please contact 1E if you intend to continue using any of the other legacy OS. If you experience an issue, then please try replicating the issue on a supported OS.
For Microsoft product lifecycle details, please refer to https://support.microsoft.com/en-us/lifecycle/search.
PowerShell limitations
PowerShell version 3.0 (required by some Tachyon instructions) is not supported on Windows XP, Vista and Server 2003. However, PowerShell 2.0 is supported on the following OS versions:
Windows XP SP3
Vista SP1 & SP2
Windows Server 2003 R2 & SP2.
Certificate limitations - SHA2
Like most software vendors, 1E software requires the OS to support SHA2. If your organization has a PKI configured to use SHA2 256 or higher encryption, then your legacy OS may have already been updated to support it.
Windows XP and Server 2003 require an update as described in KB968730. Microsoft no longer provides this hotfix as a download. You must contact Microsoft Support if you need it
Windows 7 and Server 2008 R2 require an update as described in KB3033929. This update is not available for Vista and Server 2008
Windows 8, 8.1, Server 2012, Server 2012 R2 and later OS already support SHA2.
Certificate limitations - encrypted certificate requests
Windows XP and Server 2003 are unable to encrypt certificate requests, whereas later OS are able to support higher more secure RPC authentication levels. If you are using a Microsoft CA and expect these clients to request (enrol) certificates then the CA must have its IF_ENFORCEENCRYPTICERTREQUEST flag disabled. It is disabled by default on Windows 2003 and 2008 CA, but is enabled by default on Windows 2012 CA.
To determine which InterfaceFlags are set, execute the following command on the CA server:
certutil -getreg CA\InterfaceFlags
If the following is specified then it means the flag is enabled.
IF_ENFORCEENCRYPTICERTREQUEST -- 200 (512)
To disable the encrypt certificate requests flag, execute the following commands on the CA server:
certutil -setreg CA\InterfaceFlags -IF_ENFORCEENCRYPTICERTREQUEST
sc stop certsvc
sc start certsvcCertificate limitations - signing certificates missing
On Windows computers, the installation MSI files, and binary executable and DLL files of 1E software are digitally signed. The 1E code signing certificate uses a timestamping certificate as its countersignature. 1E occasionally changes its code signing certificate, and uses it for new releases and patches for older versions, as shown in the table(s) below.
Root Certificate Authorities are implicitly trusted to validate certificates, and their certificates must be correctly installed to do this. Your computers should already have the necessary root CA certificates installed, however this may have been prevented by your organization's security policies, or inability to connect to the Internet, or they are legacy OS. In general this is not an issue because by default Windows allows software to be installed and run without validation, although you may see a warning or experience a delay. However, you must have relevant CA certificates installed if you are using 1E Client (which self-validates its own files), or your organization has applied more secure polices (for example UAC, AppLocker or SmartScreen).
Typical reasons for issues with signing certificate are:
If your organization has disabled Automatic Root Certificates Update then you must ensure the relevant root CA certificates are correctly installed on each computer
If computers do not have access to the Internet then you must ensure the relevant root and issuing CA certificates are correctly installed on each computer, numbered in the table(s) below.
The signature algorithm of the 1E code signing certificate is SHA256RSA. In most cases, the file digest algorithm of an authenticode signature is SHA256, and the countersignature is a RFC3161 compliant timestamp. The exception is on legacy OS (Windows XP, Vista, Server 2003 and Server 2008) which require the file digest algorithm of an authenticode signature to be SHA1, and a legacy countersignature.
The table below applies to software and hotfixes released in 2020.
2020 | Signing certificate | Timestamping certificates |
|---|---|---|
Certificate | 1E Limited | TIMESTAMP-SHA256-2019-10-15 and DigiCert Timestamp Responder |
Issuing CA | DigiCert EV Code Signing CA (SHA2) Thumbprint: 60ee3fc53d4bdfd1697ae5beae1cab1c0f3ad4e3 | DigiCert SHA2 Assured ID Timestamping CA Thumbprint: 3ba63a6e4841355772debef9cdcf4d5af353a297 and DigiCert Assured ID CA-1 Thumbprint: 19a09b5a36f4dd99727df783c17a51231a56c117 |
Root CA | DigiCert High Assurance EV Root CA Thumbprint: 5fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25 | DigiCert Assured ID Root CA Thumbprint: 0563b8630d62d75abbc8ab1e4bdfb5a899b24d43 |
This is described in Digital signing certificates. To verify if you affected by this issue see 1E Digital Signing Certificates.
Certificate limitations - expired root certificates
Ensure that your Root CA Certificates are up-to-date on clients and servers. The Automatic Root Certificates Update feature is enabled by default, but its configuration may have been changed or restricted by Group Policy Turn off Automatic Root Certificates Update.
If this GPO is enabled, then you will see DisableRootAutoUpdate = 1 (dword) in HKLM\Software\Policies\Microsoft\SystemCertificates\AuthRoot.