Tachyon Agents

Tachyon Server Components

Tachyon Explorer Portal

Tachyon Toolkit

Microsoft System Center Configuration Manager Console Extensions

TIMS (Tachyon Instruction Management Studio)

Tachyon App

The below table lists the mobile device OS versions that support the Tachyon App.

Scripting

Tachyon Agent language SCALE directly supports running PowerShell on Windows OS and bash on non-Windows OS devices, which can be scripts that must be downloaded by SCALE when an instruction runs, or actual command text. You will very probably want to use this feature in your own instructions and ones that you download from 1E. Therefore you must ensure the appropriate scripting environment is present on Agent devices.

PowerShell on Windows OS

PowerShell is used by some Tachyon instructions (that have PowerShell commands embedded or scripts that are downloaded) and some of these require PowerShell 3.0 or later, although some scripts will support PowerShell 2.0. PowerShell scripts are supported only on Windows OS. 

To see if an instruction requires PowerShell, look in its Instruction Definition XML file for PowerShell resources defined under the <Resources> tag.

If installing or upgrading PowerShell, it is best to install the latest version available. However, do not expect full forward or backward compatibility between PowerShell versions.

The table below shows which versions of PowerShell are supported on each OS version and Service Pack, and if it is built-in or needs to be installed.

* These OS are regarded as Legacy OS.

1. PowerShell is not built-in for these OS. These OS do not support 3.0 or later. See Constraints of Legacy OS.
2. If PowerShell 1.0 is installed it must be removed in order to install a later version.
3. Support for PowerShell 2.0 is included in PowerShell 3.0 and later.
4. PowerShell is not installed by default on these OS but is an optional feature that should be enabled using Server Manager.
5. PowerShell 2.0 is part of WMF Core package (KB968930) with prerequisite of .NET Framework 3.51 (which includes .NET 2.0 SP1).
6. PowerShell 3.0 is part of WMF 3.0 with prerequisite of .NET Framework 4.0 or later. Refer https://www.microsoft.com/en-us/download/details.aspx?id=34595
7. PowerShell 4.0 is part of WMF 4.0 with prerequisite of .NET Framework 4.5 or later. Refer https://www.microsoft.com/en-us/download/details.aspx?id=40855
8. PowerShell 5.0 is part of WMF 5.0 with prerequisites of .NET Framework 4.5 or later and WMF 4.0. Refer https://www.microsoft.com/en-us/download/details.aspx?id=50395
9. PowerShell 5.0 is part of WMF 5.0 without any other prerequisites. Refer https://www.microsoft.com/en-us/download/details.aspx?id=50395
10. PowerShell 5.1 is part of WMF 5.1 with prerequisites of .NET Framework 4.6 or later, WMF 4.0 and SHA-2 Code Signing. Refer https://msdn.microsoft.com/en-us/powershell/wmf/5.1/install-configure
11. PowerShell 5.1 is part of WMF 5.1 with prerequisites of .NET Framework 4.6 or later and WMF 4.0. Refer https://msdn.microsoft.com/en-us/powershell/wmf/5.1/install-configure
12. PowerShell 5.1 is part of WMF 5.1 with prerequisite of .NET Framework 4.6 or later. Refer https://msdn.microsoft.com/en-us/powershell/wmf/5.1/install-configure
13. In these Server OS, PowerShell 5.1 is referred to as the Desktop Experience. You can use the PowerShell Core version if you prefer.

Bash on non-Windows OS

Bash and perl are required for installation of all non-Windows Agents, with the exception of the Agent for Android which is available from the Google Playstore.

Tachyon instructions support the use of Bash scripts on all supported non-Windows OS.

To see if an Instruction requires a Bash script, look in its Instruction Definition XML file for Bash script resources defined under the <Resources> tag. Bash is the preferred choice when developing custom Instructions for non-Windows OS.

There are slight differences between OS implementations of Bash, particularly on the Mac. Therefore 1E recommends testing custom Bash scripts on each supported OS.

Constraints of Legacy OS

In this documentation, the following are referred to as legacy OS. Below are described some known issues for these OS.

Support

1E does not provide support for the Tachyon Agent on the following OS. This is because Microsoft has withdrawn support for these OS or they are not significantly used by business organizations.

Please contact 1E if you require support for these legacy OS.

If you experience an issue on these OS, then please try replicating the issue on a supported OS.

PowerShell limitations

Some Tachyon instructions use PowerShell and some of those expect PowerShell version 3.0, which is not supported by the legacy OS listed above. However, PowerShell 2.0 is supported on the following OS versions:

• Windows XP SP3
• Vista SP1 & SP2
• Windows Server 2003 R2 & SP2

Certificate limitations - encrypted certificate requests

Windows XP and Server 2003 are unable to encrypt certificate requests, whereas later OS are able to support higher more secure RPC authentication levels. If you are using a Microsoft CA and expect these clients to request (enrol) certificates then the CA must have its IF_ENFORCEENCRYPTICERTREQUEST flag disabled. It is disabled by default on Windows 2003 and 2008 CA, but is enabled by default on Windows 2012 CA.

To determine which InterfaceFlags are set, execute the following command on the CA server:

	certutil -getreg CA\InterfaceFlags

If the following is specified then it means the flag is enabled.

	IF_ENFORCEENCRYPTICERTREQUEST -- 200 (512)

To disable the encrypt certificate requests flag, execute the following commands on the CA server:

	certutil -setreg CA\InterfaceFlags -IF_ENFORCEENCRYPTICERTREQUEST
	sc stop certsvc
	sc start certsvc

Certificate limitations - SHA2

When installing Tachyon Agent on Windows XP and Server 2003 you may also require a hotfix as described in KB968730. This hotfix is required if your PKI has CAs configured to use SHA2 256 or higher encryption.

Certificate limitations - expired root certificates

Ensure that your Root Certificates are up-to-date. The Update Root Certificates feature is enabled by default on these OS but its configuration may have been changed or restricted by Group Policy. You may see DisableRootAutoUpdate = 1 (dword) in HKLM\Software\Policies\Microsoft\SystemCertificates\AuthRoot.

Certificate limitations - signing certificates missing

As described in Requirements: Digital Signing Certificates the root VeriSign Class 3 Public Primary Certification Authority - G5 certificate must exist in the Third-Party Root Certification Authorities store (which is replicated in the Trusted Root Certification Authorities store). This root certificate is normally automatically provided by Microsoft's Update Root Certificates feature, however this may not be present for legacy OS. To verify if you affected by this issue see Implementation issues: 1E Digital Signing Certificate.