.Loading..Loading.

AntiVirus

• Retired KES AntiVirus from EPM
  • Kaspersky AV is no longer supported or include in Ivanti Endpoint Manager 2021
• CroundStrike Tenant selection
  • Customers can now specify the CrowdStrike tenant they want to be connected to

API/SDK

• Added new endpoint in Patch API
  • -

Core

• Updated to SQL Express 2019
  • Endpoint Manager install now includes Microsoft SQL Express 2019. It is for new installs when using included SQL Server Express in small environments.

Inventory

• Mini-scan data processing order
  • Do not allow newer mini scan data to be overwritten by a regular scan
• Multiple threads for miniscans
  • Customers can increase the thread count for Miniscan processing to improve performance
• Inventory add necessary indexes to DB tables to prevent deadlock exceptions
  • -
• Turn off Port 5007 for Inventory Server on Core Server with Option for Customers to Re-enable
  • -
• Agent Version - Collect Friendly Name as part of Inventory for the Windows Agent
  • -

Linux

• Linux Agent Scheduling
  • Define the scheduled for Linux Agents to use to when running jobs from the Core such as Inventory and Patch scans

Mac

• Universal binary of EPM Agent and Apple M1 chip suupport
  • EPM now supports the latest Apple Silicon M1/Arm chips, enabling deployment on the newest Apple devices
• New APNS Service
  • Updates to support HTTP/2 communications protocols for APNS as required by Apple, beginning March 31, 2021
• Provide a means to rename an Apple MDM device in the EPM database
  • -
• Mac Software Distribution - Add ability for Additional Files
  • Mac Software Distribution jobs can now include multiple files
• Agent Version - Collect Friendly Name as part of Inventory for the Mac Agent
  • -
• Updated Mac BitDefender for Big Sur
  • -
• New macOS CPE Payloads: com.apple.system-extension-policy
  • -
• macOS Remote Control: Add option to defer screen capture permissions until actually needed
  • -

Patch Manager

• On-demand refresh of vulnerabilities data grid during Patch Campaign step processing
  • Users can refresh vulnerabilities on-demand during a Patch Campaign step to get real-time statuses
• Change HTTPS from HTTP for WSVulnerabilityCore
  • -
• Update Patch Automation feedback support to latest version of CEFSharp (v86)
  • -
• Patch Automation on Remote Console
  • Patch Campaigns functionality is now fully supported on the EPM Remote Console

Remote Control

• Make the RC console "Owner" field more reliable
  • -
• RDP Session Selection
  • Individual RDP sessions can now be remote controlled, where previously only the console session could be remote controlled

Security

• Updated OpenSSL to 1.1.1i
  • -
• Updated TLS version support for Core/Console
  • TLS versions 1.2 and 1.3 supported. TLS 1.0 and 1.1 no longer supported. Note: this will not affect machine level or IIS configuration.

Software Licensing Monitoring

• Software Licensing Monitoring has been migrated from a Silverlight application directly into the EPM Console.
  • -

Unmanaged Device Discovery

• Deploy Agent from Unmanaged Device Discovery
  • Deploy the EPM Agent to unmanaged devices faster than before by doing it directly from Unmanaged Device Discovery

Win Console

• New EPM Onboarding Guides for adding domain credentials and deploying agents to unmanaged devices
  • -

Unix Support

Support for Unix will be discontinued and removed from the product in the next major release of EPM in 2022.

For more information see: COMMUNITY DOCUMENT HERE

Security Suite

Ivanti will be discontinuing support and removing the Spyware and Blocked Application features from Security Suite.

Spyware Scanning

Spyware scanning is now part of most Antivirus products, including the Ivanti AV solution avilable in EPM

Blocked Applications

The Blocked Application functionality has been surpassed and improved in the Application Control features avialable in Security Suite. Customers should prepare to migrate to using Application Control.

For more information see: Getting started with Application Control

These features and components are expected to be removed from the next major release of Endpoint Manager in 2022.

Remote Control

Agent

• 714409 LDAPS-only customers cannot run ldapwhoami if they have to set Use LDAPS to Never to avoid smart card prompts
  • If detected that smart card is configured, use anonymous connection to open LDAP object in TSL channel.
• 766540 Download for Advance Agent fails when using https path
  • There was some logic that was only checking for http:// not https://. Also switch to use the full curl library rather than the no_ssl library.
• 797620 Old Ivanti Notification Manager doesn't get uninstalled after upgrade
  • The Ivanti Notifications Manager installer was updated to fully replace previous installations of the component.
• 797655 'Ivanti Notifications Manager' install calls a reboot directly on the system.
  • Added the suppress reboot flag to the notifications manager install.
• 803724 Remove Old Defunct Commands from Agent Installer (pxectrl.exe & LANDESKFuseInitialize.exe)
  • Several obsolete commands were removed from the agent install. The Agent Configuration and Agent Settings UI for Workspaces was also removed.

Alerting

• 772192 Email Alerts configured with a username more than 35 characters are not saved to the database.
  • SMTP authentication for Email Alerts configured with a username made of more than 35 characters should not cause unwanted issues anymore.

AntiVirus

• 708701 Crowdstrike Agent Not Reporting Properly - "CrowdStrike does not report the device as protected"
  • Due to mismatching IP addresses reported by CrowdStrike in relation to EPM, some agents would show up in the Crowdstrike Report with duplicate entries. We have provided a fix to address that situation.
• 725516 Selecting Manage Devices for CrowdStrike integration gets the error" Connection Failed Object reference not set to an instance of an object.
  • In certain situations, connecting to the CrowdStrike api with the EPM console fails with the error:Connection Failed Object reference not set to an instance of an object.
• 743499 Device Control module has expired - bitdefender
  • We have provided a fix for the situation where the Ivanti Antivirus 2017 Device Control Module license expires after 1 month.
• 782170 IvantiAV unable to Load Libraries due to SIP
  • A code signing issue with the Ivanti AV, that stopped it from properly loading and hence licensing the AV engine, has been resolved
• 789289 Customer is not able to connect the CrowdStrike EU api in EPM Console
  • We have implemented CrowdStrike tenant selection based on region in the CrowdStrike action center.

API\SDK

• 717943 DistributionAPI - Deleting a software distribution package that is a dependency of another package should throw an exception
  • The Package endpoint in the DistributionApi (DistributionApi/api/v1/Package(id)) will now not allow users to delete a package that is a dependency of another package. If you try to delete a package that is a dependency, you will get a response back that explains why the package can't be deleted and which package(s) have it as a dependency.

Cloud Services Appliance

• 778136 BrokerServiceActivity.log is not getting controlled by MaxSize setting
  • BrokerServiceActivity logs are now rolling logs.
• 793760 Broker Service crashing every 5 minutes
  • Fix for an error in the logging logic that could cause an exception.

CSEP

• 783343 Invalid password on ESXi scan, although password is correct.
  • fix for exception in ESXI scan when no vm's are hosted on an ESXI server.

Data Analytics

• 711288 ESX host giving an error: 'Object reference not set to an instance of an object'
  • fix for a possible exception when refreshing VOS hosts in the EPM console.
• 791080 Proxy settings are not getting saved under Dell Warranty Import rule
  • The Dell Warranty Import rule now correctly saves and displays proxy settings.

Endpoint Security

• 738063 Endpoint Security Agent causes BSOD on VECTRA ISP
  • Ivanti Agents with EPS enabled will encounter BSOD if the computer is connected to theVECTRA ISP.(VECTRA is an ISP in Poland)
• 766483 EPS Cancel button is missing when change protection level in Chinese core
  • We have provided a fix for the customers with EPM installed in Chinese where on the agent side the EPS "cancel" button is missing when changing the protection level.
• 776016 Device Control Blocking SCSI Devices
  • We have fixed and issue where secondary volumes or partitions on a computer are not accessible if the DCM setting is deployed with No Access security level is used. This option only applies to removable volumes.
• 783680 BSOD on some of there clients with EPS installed.
  • We have provided a fix for a certain scenario where computers with the EPS component enabled may experience BSOD.

Inventory

• 650762 OS > Drivers and Services > Services - service names are truncated to 16 characters
  • MacOS service names are no longer truncated in EPM Inventory
• 773162 Inventory Server Service is struggling with processing inventory scans
  • Added indexes to some inventory tables so that deadlocks would be prevented during scan processing.
• 773538 LDAP Machine Group Membership Disappearing
  • Fixed inventory scanner and ldapwhoami.exe to still get machine related LDAP info if scanner running as local system without a user logged into the machine.
• 773643 Inventory shows unknown for chassis type on Lenovo ThinkPad X1 Yoga 3rd
  • The business impact is that in ISM Asset Management there are different lifecycle flows for portable devices and desktops and the Chassis type 32 devices are added into the wrong workflow. This needs to extra validated and remediated which means time and money
• 773702 Error inserting inventory Error: Computer.Mass Storage.Drive Encryption.Encryption Mode is an unmodeled one-to-many relationship. This is not supported.
  • modeled Encryption Mode in Drive Encryption
• 782173 Add Drive Type to Inventory
  • Added drive type (HDD or SSD) to inventory
• 783665 Mac M1 Not Showing Processor in EPM Inventory
  • The EPM Mac agent components are now universal binaries, which allows to get information about CPU processor again.
• 790436 MBBScanner.exe crashes when scanning Device with SIM Card
  • MBBScanner.exe will now remove newline characters from the discovered data to accommodate processing.
• 792858 Big Sur OS Version Incorrect
  • Fixed a problem reporting the OS version, where all versions of macOS 11.x were reported as 11.0.0
• 793383 Inventory sync scans for devices managed by both the macOS Agent and by EPM MDM are not accepted by the core because they are out of sync
  • Inventory scans initiated by the Mac EPM Agent no longer fail when the device is co-managed with MDM
• 798471 Windows Server 2016 detected as Microsoft Windows 10 Server Standard Edition
  • A fix to detect Windows 10 mulit-session caused our detection of Windows Server 2016 to report incorrectly. That has been fixed.
• 803623 Software - Data Files - File Size Can't Handle Large Numbers
  • Get accurate data file sizes when the files are more than 4Gb in size.

Linux

• 734953 Windows & Linux inventory scanner report CPU values to different fields
  • Linux inventory's PROCESSOR - PROCESSOR COUNT now matches Window's interpretation as the number of CPUs in the computer. Previously that number of CPUs on linux was reported as PROCESSOR - PROCESSOR PHYSICAL COUNT, which will be maintained for backwards compatibility.
• 746802 Linux inventory scanner sends non-padded IP-addresses
  • Formatting was performed using standard linux calls.  Updated to return output consistent with Windows and Mac.
• 753793 The Linux agent installation going on failed on the EPM 2020.1 SU2
  • Two new parts of the installation script assumed the output would be in english and failed to parse a different native language. The script sets the C locale for consistent language processing
• 753974 Linux Vulnerabilities Incomplete Epoch
  • No epoch information is provided in CentOS vulnerability content. If an installed package has an epoch value, the agent would compare it to a set '0' epoch, which would incorrectly discard packages as not matching exactly what the content was looking for. The agent was updated to use the same epoch as the installed package. This allows the comparison to pass and continue to verify against the package name and version.
• 768601 Linux - CentOS 8 RPMs .spec file has a typo in its script.
  • An rpm variable --gid %{pkg_gid} was used where a bash variable should have been [--gid ${pkg_gid}].
• 769212 Linux agent install fails on Beelink BT3 Pro II Mini (Ubuntu 18.04 x64)
  • Being we could not reproduce this issue what we have added is a warning log message about what it tried to access and failed. With the error handling it should process properly and give us better info about what tripped the inventory scan up.
• 782853 Linux agent debian packages postinst script(s) causes sporadic installation failures on Ubuntu systems
  • The crontab was initialized with a randomized minute value so that all agents wouldn't report at the same time. In the lucky case where the random minute was calculated to be 0, the command was considered to have failed and the script terminated because the script was run with set -e
• 783252 Unable to push or manually install agent on RHEL 8.3 - ERROR: No known repositories available.
  • On redhat 8 due to a change in the format of yum repolist -v, the nixconfig.sh function verify_repository_access_linux() no longer correctly gots the list of repositories to test. The function was updated to parse the new format.
• 784824 Linux vulnerability scanner doesn't report back on all vulnerabilities that it should.
  • For Ubuntu Vulnerabilities, epoch values were added to the version information in the form epoch version. The EPM agent was not correctly parsing out these epoch values, causing version comparisons to fail. The agent was updated to look for these epoch values, and parse them out to be compared separately from the version.
• 785233 Debian-Packages ivanti-base-agent_11.0.3.1374-ubuntu[18|20]_amd64.deb fails during preinstallation.
  • The EPM agent installs its packages from inside the nixconfig.sh script. A customer wanted to install the agent using its own script and the ivanti packages and discovered issues that were not found previously because nixconfig.sh always setup the host in a state where the package installation could not fail.  The bourne shell script was testing a condition in a way that was incompatible with the set -e flag.

macOS

• 691762 Filevault only enabled on Log off and not on Restart.
  • Changes to "Security & Privacy" payload's FileVault section:This will allow to configure the payload with the "workaround" mentioned inhttps://forums.ivanti.com/s/article/Filevault-policy-does-not-apply-and-credential-prompt-appears-after-reboot-on-MacOS-Catalina directly by checking "Don't prompt user when logging out" and "Restrict number of deferrals" and setting the deferral count to 0. (macOS Catalina and later seem to impose this behavior - we cannot change the difference in behavior between Mojave and Catalina, but with this change, the necessary changes can be done directly in our config profile editor)
• 752309 CPE shows no icon for some payloads
  • Some missing icons have been added to the Config Profile Editor
• 761291 "\library\ launch agent\" directory on clients missing files
  • An issue was fixed with the agent installer, which corrupted the Agent install under certain conditions.
• 761351 UI changes to Network settings and agent
  • Small inconstancies in the UI for Agent app and the software download dialog on the core were addressed
• 770517 Safari.app inconsistencies in macOS inventory
  • An inconsistency, in essence duplication, with data in inventory scans has been fixed
• 774037 Add Apple macOS version 11.x Big Sur to the Ivanti Creator Config Package in Get macOS Installer please as Apple macOS version 11.x Big Sur is not present.
  • TheIvanti Create Config Package.app can now download Big Sur Installers.
• 797641 Default value for EPM macOS Agent network communication timeout is too small
  • -
• 797861 Agent request timeout cannot be set to > 100s, which may be too low when doing vulscan or swdist through CSA
  • -

Mobility

• 707653 iOS restrictions are mis-labeled
  • Allow FaceTime is now labeled as (Supervised only) in the configuration profile editor (CPE)
• 726399 Unable to generate QR codes due to TLS 1.0 being blocked by the network
  • QR codes are being requested via Google API from core.secure. Added code to require use of most secure TLS version which avoids communication failure with Google on certain EPM cores.
• 727074 Not all available VPP Apps Displayed When Creating a Distribution Package
  • Added three retries for VPP request failed to get response in case of network failed.
• 729190 Automatic Device Enrollment named Templates fail to work with new variables created.
  • The template workflow has been simplified with a pre-made list of variables that can be used as templates for device names during enrolment. These include %serialNumber%.
• 750180 Not enough logging in the MDMManagementService.exe.log for APNS communication
  • Extra logging has been added for APNS communication to help in diagnosing network issues.
• 768877 MDM errors, in inventory and application lists, causes failed installations and incomplete inventories in MDM devices
  • A number overflow (64bit > 32bit) that caused an issue during MDM install and inventory, when apps were larger than 4 Gigs, has been resolved
• 780764 Application Restrictions not applying (Supervised Devices Only)
  • Apple has updated some MDM settings, since iOS 13, to enforce the need for supervised devices.The Config Profile Editor now shows these configuration settings as only applying to supervised devices.
• 782176 LDInstallProfile doesn't defer to MDM after Profile changing from "LANDESK" to "Ivanti"
  • When installing profiles via scheduled task to a macOS agent enrolled in MDM, LDInstallProfile failed to recognize the device being enrolled in MDM and defer in order to install the profile.In Big Sur, this resulted in the profile always failing to install.
• 782761 Installing Rosetta 2 Agent
  • Rosetta 2 is installed, as required, by the EPM Agent Installs
• 793827 Windows 10 Autopilot enrollment fails on 2004
  • The large number of HTTP headers generated by Windows 10 version 2004 during enrollment resulted in the CSA rejecting the request. The maximum number of headers has been increased to a sufficiently large number to allow enrollment. To deploy the fix, the CSA 4.5 must be patched using a patch with this specific issue addressed and EPM must be updated to accept the larger number of headers from the CSA. Therefore, this requires either EPM 2021.1 or upcoming SUs for earlier versions of EPM.

Patch Manager

• 529375 Change http://corename/WSVulnerabilityCore\VulCore.asmx to only support HTTPS, Not HTTP
  • After changing VulCore.asmx to only support HTTPS, Not HTTP, it’s mandatory that after Agent installation, the Agent’s certificate be approved.Configure > Client Access > Manage Client Certificates Approve unapproved ones
• 673282 Schedule time change on a repair task affects other tasks when performed from remote console.
  • On a remote console that's in a different time zone from it's associated core, there will now be no issues with the start times of tasks changing unexpectedly.
• 754007 Portal patch task is removed without the patch being installed
  • Policy handling was updated to retain vulscan policies in Portal Manager until after they are executed, or indefinitely if they are configured to remain in the Portal.
• 766487 Patch Installed Dashboard does not display Critical patches
  • Tweaked the "Patch Installed Dashboard" to make sure the Critical patches that were installed on the endpoints are properly counted.
• 769283 Filter does not work with Service Pack Published Severity
  • Downloaded vulnerabilities are properly filtered now when the service pack is part of the configured filter.
• 775404 Vulscan is removing CatalogURL setting
  • Vulscan no longer removes CatalogURL settings on macOS

Provisioning

• 537493 Edit permission for Provisioning is not sufficient to edit Team templates
  • Users with only View/Edit permissions for OS provisioning can now edit templates owned by teams they belong to.

Remote Control

• 763585 Unable to RC devices with same hostname
  • Fixed an issue where agents with the same name in the console could not be properly remote controlled.
• 770158 Unable to view C:\ drive in "remote execute" function of Remote control
  • Fixed an issue that could cause the user of remote control not to be able to browse the remote hard disk when trying to use remote execute functionality.
• 787949 RC causing LDAppMain to crash due to bad CSA data
  • CSA name will no longer allow '*' character.
• 803565 "Allow the User to Terminate the Session" not showing
  • Fixed an issue that may cause the "End Session" button to not properly display on a remote controlled endpoint.

Reports

• 744121 E-mail reports not working
  • Fixed a scenario where the reports were not properly sent on email based on the configured smtp options.

Role Based Administration

• 725548 Changes made under Teams are not visible in user configuration Users and groups
  • Fixed an issue in the user management tool that could lead to the teams information not updating correctly in the UI.
• 770160 Edit scope query default dropdown blank
  • The dropdown menu in the query editor dialog will now have a default value of "And".

Software Distribution

• 623842 Portal Manager: SWD progress doesn't look good in dark mode
  • Software Download Progress in the OSX Portal has been improved for display in Dark Mode
• 736897 Unable to create shortcut for Action Packages in a French Ivanti console
  • An issue was corrected that prevented customers using a French EPM core from using shortcut actions within Windows Action packages.
• 779922 Windows 10 notifications may not work for non-admin users
  • Create temporary toast configure file in ProgramData\LANDesk\Temp, every should have access to this folder.
• 798589 Agent state sets computers to "failed" state instead of "pending" if inventory has a 0 status
  • Set the state to pending for any device that is off according to agent state for all task types except push.
• 804091 SchedPkgUpdate fails to hash large files hosted on AWS S3
  • Previously, users were unable to create a distribution package with a large additional file from an Amazon S3 bucket. Now there should be no issue using very large additional files from S3.

Win Console

• 772148 Console performance degrades if it displays dates that are not already localised. The console will convert those dates before displaying data. Dates are stored as YYYY-MM-DD HH:MM:SS:ss
  • In the Network view, having columns with dates will not affect the performance of the console now. All the dates will still be displayed in the format consistent with the time zone set in the control panel.
• 779171 Device Name Column in All Devices goes missing when changing columnsets
  • An issue was corrected where the Device Name column wasn't correctly loaded when modifying the columnset.

Android MDM

• Error when upgrading from EPM 2019.1 SU3 - SU6 to EPM 2021.1, causing Android management to fail.
  • If upgrading from 2019.1 SU3 through SU6, some files are not updated as expected, leading to failures in Android Enterprise.

    For more information please see Known issue: Upgrade from 2019.1 to 2021.1 - Android MDM failure

Alerting and Monitoring

• To improve security, real-time alerting and monitoring is disabled in the 2021.1 agent.
  • To address a security concern, the client functionality that provides real-time alerting and monitoring has been disabled in the 2021.1 agent. It can be re-enabled on clients if necessary, however the security concern will return.

    For more information see: Real time Inventory and Monitoring and Inspector Disabled by Default in EPM 2021.1