11.3 Agent Release Notes

Enhancements

  • The Item Processing Performance report displays the agentevent category, which enables customers to track agent events passed to the server. These events include Application Control, Core, File Inventory, Local Security, and Directory Services.

macOS

  • Added support for the Energy Saver preference pane for Monterey.
  • Added support for the Battery preference pane for Big Sur and later.

Bug Fixes

  • The Application Control agent is unable to remove expired hashes.
  • Windows agents do not enforce policies following post-installation reboot.
  • There is memory leak in the Application Control agent.
  • Privilege Managercollects certificates in the local store, which diminishes performance.
  • The "User Access Control Consent Dialog Detected" action does not always replace the Windows UAC prompt on the first UAC challenge after an endpoint reboot.

Windows

  • A vulnerability was discovered in the Windows agent which may result in an elevation of privilege attack. It is highly recommended that customers upgrade their agents to version 11.2.3095 or higher to mitigate the exposure. Security Vulnerability Discovered by : Andrew Kisliakov.

Known Issues

  • There is a security issue with Windows Core agent versions 13.0.1058 and older. A fix for this issue is included in v12 versions 12.0.5804 and newer, and v13 versions 13.0.2064 and newer of the Windows Core agent which is available on the Software Downloads page.

    Delinea recommends customers who cannot immediately upgrade to use group policy or device management tooling to take the following actions on their workstations running the Privilege Manager Windows agent:

    This workaround covers remote connections. For coverage against a local connection, upgrading the Window Core agent is required.

    • Privilege Manager Cloud: Block inbound TCP on port 5593. There is no degradation in function from blocking the port.

    • Privilege Manager On-premises: Block inbound TCP on port 5593, or at least restrict it to your Privilege Managerr web server IP address. If you block the port, agents pull updates from the server based on a set schedule.