Supported platforms

Windows client

macOS clients

/usr/sbin/softwareupdate --install-rosetta
/usr/sbin/softwareupdate --install-rosetta --agree-to-license

Linux clients

Solaris clients

Feature dependencies

Products and Features with dependencies on the 1E Client.

Supported versions of 1E companion products with features that depend on 1E Client 8.0.

Supported versions of 1E companion products that 1E Client 8.0 features depend on.

Firewall ports

1E does not provide a combined diagram showing all components and features. Please refer to the communications reference page for each product:

• Tachyon communication ports — A diagram and a table with a list of all the Tachyon communication ports.
• Nomad communication ports — Diagrams and tables with lists of all the Nomad communication ports.
• PXE Everywhere communication ports — A list of communication ports used by PXE Everywhere. Useful, if needed, for network and device firewalls.
• Shopping communication ports — A diagram and a table with a list of all the Shopping communication ports.
• NightWatchman Enterprise communication ports — Tables with lists of all the NightWatchman Enterprise components and their communication ports.

Anti-Virus and Malware

The following should be excluded from scans to prevent file locking and resource deletion.

• 1E log files. See Log files.

• The 1E Client temporary directory. We recommend modifying the TemporaryDirectory 1E Client configuration setting to %programdata%\1E\Client\Temp and excluding that directory. See 1E Client settings. 

  TemporaryDirectory must be specified as an absolute path. The directory is not automatically created by 1E Client. It must be created before being set otherwise 1E Client will use its default.

Digital signing certificates

On Windows computers, the installation MSIs, executables and DLLs of the 1E software are digitally signed by 1E using the 1E Limited SHA1 and SHA256 signature certificates.

These signing certificates are issued by the Symantec Class 3 SHA256 Code Signing CA, which in turn is issued by the root CA VeriSign Class 3 Public Primary Certification Authority - G5.

The SHA1 and SHA256 signature certificates are each countersigned with the same Timestamp signature certificate Starfield Timestamp Authority - G2, itself issued by Starfield Secure Certificate Authority - G2, in turn issued by the root CA  Starfield Root Certificate Authority – G2.

The root CA certificates (for signing and countersigning) must exist in the Third-Party Root Certification Authorities store (which is replicated in the Trusted Root Certification Authorities store). These root CA certificates are normally automatically provided by Microsoft's Update Root Certificates feature, however for legacy OS computers in a lab environment that are not connected to the Internet, see Constraints of Legacy OS.

Constraints of Legacy OS

In this documentation, the following are referred to as legacy OS. Below are described some known issues for these OS.

1E does not provide support for 1E products on the following OS unless the OS is explicitly listed as being supported for a specific 1E product or product feature. This is because Microsoft has ended mainstream support for these OS or they are not significantly used by business organizations.

For Microsoft product lifecycle details, please refer to https://support.microsoft.com/en-us/lifecycle/search.

PowerShell limitations

PowerShell version 3.0 (required by some Tachyon instructions) is not supported on Windows XP, Vista and Server 2003. However, PowerShell 2.0 is supported on the following OS versions:

• Windows XP SP3
• Vista SP1 & SP2
• Windows Server 2003 R2 & SP2

Certificate limitations - SHA2

Like most software vendors, 1E software requires the OS to support SHA2. If your organization has a PKI configured to use SHA2 256 or higher encryption, then your legacy OS may have already been updated to support it.

Windows XP and Server 2003 require an update as described in KB968730.  Microsoft no longer provides this hotfix as a download. You must contact Microsoft Support if you need it.

Windows 7 and Server 2008 R2 require an update as described in KB3033929. This update is not available for Vista and Server 2008.

Windows 8, 8.1, Server 2012, Server 2012 R2 and later OS already support SHA2.

Certificate limitations - encrypted certificate requests

Windows XP and Server 2003 are unable to encrypt certificate requests, whereas later OS are able to support higher more secure RPC authentication levels. If you are using a Microsoft CA and expect these clients to request (enrol) certificates then the CA must have its IF_ENFORCEENCRYPTICERTREQUEST flag disabled. It is disabled by default on Windows 2003 and 2008 CA, but is enabled by default on Windows 2012 CA.

To determine which InterfaceFlags are set, execute the following command on the CA server:

	certutil -getreg CA\InterfaceFlags

If the following is specified then it means the flag is enabled.

	IF_ENFORCEENCRYPTICERTREQUEST -- 200 (512)

To disable the encrypt certificate requests flag, execute the following commands on the CA server:

	certutil -setreg CA\InterfaceFlags -IF_ENFORCEENCRYPTICERTREQUEST
	sc stop certsvc
	sc start certsvc

Certificate limitations - signing certificates missing

On Windows computers, the installation MSI files, and binary executable and DLL files of 1E software are digitally signed. The 1E code signing certificate uses a timestamping certificate as its countersignature. 1E occasionally changes its code signing certificate, and uses it for new releases and patches for older versions, as shown in the table(s) below. 

Root Certificate Authorities are implicitly trusted to validate certificates, and their certificates must be correctly installed to do this. Your computers should already have the necessary root CA certificates installed, however this may have been prevented by your organization's security policies, or inability to connect to the Internet, or they are legacy OS. In general this is not an issue because by default Windows allows software to be installed and run without validation, although you may see a warning or experience a delay. However, you must have relevant CA certificates installed if you are using 1E Client (which self-validates its own files), or your organization has applied more secure polices (for example UAC, AppLocker or SmartScreen).

Typical reasons for issues with signing certificate are:

• If your organization has disabled Automatic Root Certificates Update then you must ensure the relevant root CA certificates are correctly installed on each computer
• If computers do not have access to the Internet then you must ensure the relevant root and issuing CA certificates are correctly installed on each computer, numbered in the table(s) below. 

The signature algorithm of the 1E code signing certificate is SHA256RSA. In most cases, the file digest algorithm of an authenticode signature is SHA256, and the countersignature is a RFC3161 compliant timestamp. The exception is on legacy OS (Windows XP, Vista, Server 2003 and Server 2008) which require the file digest algorithm of an authenticode signature to be SHA1, and a legacy countersignature. 

The table below applies to software and hotfixes released in 2020.

Certificate limitations - expired root certificates

Ensure that your Root CA Certificates are up-to-date on clients and servers. The Automatic Root Certificates Update feature is enabled by default, but its configuration may have been changed or restricted by Group Policy Turn off Automatic Root Certificates Update.

If this GPO is enabled, then you will see DisableRootAutoUpdate = 1 (dword) in HKLM\Software\Policies\Microsoft\SystemCertificates\AuthRoot.