11.1.0 Release Notes

June 15th, 2021:

Enhancements

Enhancements available with the 11.1.0 release of Privilege Manager. Enhancements are for both versions, On-premises and Cloud, unless otherwise outlined under a specific On-prem or Cloud subtopic.

  • SAML Support

    • Only one SAML connection/foreign systems configuration is supported.
    • Tested with Okta, Centrify, GSuite and others, documentation examples based on Okta and GSuite integration.

  • Improved Azure AD support for:

    • User Context Filters: Azure AD users have 2 SID values. These are mapped and handled on the backend.
    • Group Policies:
      • Add/remove Azure AD users from group policies
      • Add Azure AD user SID to local machine group
  • Renamed Group Policies to Group Management.
  • Renamed User Policies to User Management.
  • Reorganization of the Server tasks as it relates to Foreign Systems and Directory Services tasks. Created new component entry Directory Services Maintenance Tasks.
  • In support of Computer Name Pattern Collections, the Computer by Name Pattern Query was added to Privilege Manager. The query allows to create custom collections containing a subset of computers based on a wild card supported name query.
  • Added a framework that allows real-time status reporting of running server-side tasks. This is currently available for the AD Import task only.
  • Privilege Manager now automatically sets the home directory path during provisioning.
  • The Security Descriptor Agent Discoverer has been removed for new installations and will be disabled during system upgrades from pre 11.1.0 versions.
  • Standardized Privilege Manager logout process to remove access token on logout.
  • Console Audit Logs can be sent to a syslog connector, for example to Splunk.
  • New View Password role added to Role Management.
  • Commandline arguments added to policy feedback and approvals.
  • Updated About page. Refer to Viewing the About Page. Added Privilege Manager product version details and 3rd party web licenses information to the page.
  • Added Config Feeds for Thycotic Policy Framework quick start policies that improve the initial Privilege Manager configuration experience.

macOS Specific

Unix/Linux Specific

  • User and group inventory for reports.
  • Setting to delay password for "X" times after first login.
  • Added File Hash filter support.
  • Added Run as User action, which allows a command the user runs on an endpoint to be treated as if a different user ran it.
  • Added CLI Approval Message action, which allows administrators to prompt command line users on Unix/Linux endpoints for an approval request.
  • Added CLI Justification Message action, which can be used to provide a customized multi-line justification question to the user.

Security

  • Implemented friendly error messages when registration fails due to invalid BaseURL, excluding stack trace details.

  • Added support for additional Hash algorithms (Limitation: newer security hash algorithms are only supported on v11.1 Agents and later.)

    Note: Customers are encouraged to change their policies and filters with SHA1 specification to SHA256 or other supported algorithms.

API

Integrations/Foreign Systems

  • New ServiceNow integration via available ServiceNow Application in the ServiceNow App Store. The ServiceNow app requires a Privilege Manager Foreign Systems setup that includes webhooks configuration. The Privilege Manager ServiceNow app provides the following functionality:

    • Approval/denial
    • Time based approvals
    • Privilege Manager approval process support
    • Records approvals from outside normal flow

Bugs Fixed

  • The Resources page is not showing any computers under Organizational Units.
  • Agent registration not automatically merging with Azure AD Devices data.
  • Loading groups from Not Well-Known Local Group Summary or Well-Known Group Summary pages creates an error.
  • Retrieving large numbers of Users and Groups can be slow.
  • The application control agent creates an error when uploading a file to OneNote 2008 notebook.
  • When a new managed user is created, the original created password is reset, preventing user login.
  • Justification and approval messages are not working when used with networked drive letters in the path properties.
  • Computer Groups are not always picking up all added endpoints.
  • Password changes for standard users are not honored.
  • UAC triggers false positive detection messages.
  • Running Privilege Manager: Task Purge Maintenance does not work for Correlated Change History.
  • ArelliaDisplayXAMLaction.exe inherits elevation from parent policy when the Add Administrative Rights and/or Unrestricted actions are included in a blocking policy.
  • The Event Summary widget does not reflect changes when changing the associated resource target filter.
  • Once the number of events crosses ~21 Million, trimming does not work.
  • An issue with the Ams.SimpleWorkerTask table causes tasks not to run while agent events are processed.
  • The agent summary by OS report is not reflecting the correct numbers.
  • Path exclusion changes are not saved.

Cloud

  • UI stops responding while trying to select "Security Group" as an option to add computers to a computer group.
  • Azure Only Accounts are required for when Azure AD Authentication is configured.
  • The task scheduler does not correctly reflect history for tasks with single quotation marks.
  • 504 timeout error reported on loading of "Group Policies - Administrator Built-In Managed Group".

macOS

  • macOS justification policy ends the script targeted by a sudo plugin policy.
  • The sudo plugin fails to elevate binary with path relative to current directory.
  • Users added to multiple groups via macOS Just-in-Time Group Membership Action are only removed from the first but not all groups automatically.
  • On agent installation, a Privilege Manager Server URL with a port number is not saved properly.

Known Issues

  • If your Privilege Manager instance experiences database performance issues following an upgrade to Privilege Manager v11.x, reach out to Delinea Support for assistance on resolving an indexing issue. This issue has been resolved with the v11.1.1 hotfix release in July 2021.
  • Privilege Manager Agents v10.8 and up, might prevent user login when USB over IP options are enabled for eCatcher or eBuddy setups. If you encounter an issue, disable the USB over IP option.
  • The Alerts page does not display file name details under the Name column.
  • When Authentication providers are changed, an application pool recycle might be required as indicated via error message.
  • When using the latest Privilege Manager agents with old Privilege Manager Server version, like v10.6, policies on the endpoint might not be available. The workaround is to run the Resource and Collection Targeting Update Task on the policy until the endpoint is updated.
  • The Setup Add/Upgrades Feature page fails to provide new package information, if the Privilege Manager server is installed on a Windows 2016 system that is also configured as a domain controller.
  • The File Hash Filter for Authenticode does not work. This is no longer supported with the new hash algorithms.

macOS

  • One-time approvals are not properly recognized when using the latest Privilege Manager agent with older versions of Privilege Manager Server (e.g. v10.5, v10.6, v10.7). In this scenario, once approved, the user will be prompted with another approval request. However, time-based approvals work (within the approved time period). The workaround to one-time approvals is to use a time-based approval.
  • On a Safari browser, the option to print licenses via the About page does not render.

Documentation Clarifications