New Features V5.3

Responding to the multiple requests submitted through our customer calls, user voice ideas, and support calls, we are supporting for the first time another operating system. 5.3 update brings to the IDAC family the new macOS agent with a modern UI that focuses on attached devices rather then device classes.

This first version enables permission assignment on Removable storage devices from the management console. The supported macOS versions are 10.15 (Catalina) and 11.2 (Big Sur).

While developing the mac agent, we have taken the opportunity to introduce an MQTT component to facilitate the communication between the server and the mac agents. This new component enables increased scalability, more efficient information distribution, reduced update rates, extremely lightweight overhead, and a more secure communication. To take full advantage of the new mac agent, you need to install an MQTT broker at your choosing or use an existing component.

No additional license is required. You can use the free seats from your current license.

Support for M1/ARM64 is currently still in Beta. To use removable encryption provided through the kernel extension you need to boot the device into recovery mode. Access Security Policy and select Reduced Security. Selecting the tick boxes underneath enables the management of kernel extensions.

For information about installing Device Control for macOS, see macOS Setup.

Using shadowing on large environments can lead to great storage requirements. To better handle this need, with IDAC 5.3 you can change the default path where shadow files are stored. In this case you can use your storage servers or even better, using third party applications that mount cloud storage drives, you can store your shadow files in the cloud. This can be done easily by changing the registry key Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sxs\parameters\TempFileDirectory.

For more information, see Add Shadowing.

Over the years, application control was recognized as a great instrument for achieving a bullet proof environment. This is mainly because of its efficiency and robustness. But sometimes the rigidity of the product can add additional complexity to the process. We have listened your feedback and with 5.3 we are bringing new tools to make your life easier when managing application control rules.

With IDAC 5.3, when defining path rules for application control you can now use the following additional system variables: “%ProgramFiles(x86)%”, %ProgramData%, %HomePath%, %AppData%, %LocalAppData%.

For more information, see Managing Path Rules.

Trusted certificate helps administrators to manage application control. Enable the System Trust AC option in Default Options to execute on the endpoints any application or library that is digitally signed either with embedded digital signature or through a catalog file (trusted by the operating system).

For more information, see Computer Tab.

Micromanaging of devices got better with this release. We have added an option to manage device permissions using wildcards on device hardware id. If your devices match a specific pattern you can add a single entry into Device Explorer and assign your policy on this entity. All devices that are matching the hardware id rule will have this policy applied.

For more information, see Create Device Patterns.

In some situations, the notifications generated by the attachment/detachment of the devices can be alarming for the end-user. To avoid this, mainly when connecting to a docking station, you can now manage the visibility for these notifications from the Default Options panel.

For more information, see Computer Tab.

To better manage the license seats, with 5.3, the administrator is notified in the console if the license limit has been reached. This is very useful in identifying when the endpoints have been disabled but are still consuming license slots. There is no enforcement linked to this feature so there is no need to worry about limited security.

A new sxopt option has been added to help with printing issues after an update occurred. In some cases, the end-user can encounter difficulties in using the printers unless they reboot after the update. Having this option enabled will disable printing shadowing until the next successful reboot but will allow printing normally. By default, the option is disabled. For more information, contact Ivanti support.

With the 5.3 update, a minimal set of anonymized data usage will be captured on a weekly basis. This data will be used to help us target common functionality areas to address in future releases as well as enabling us to gain better insight to help troubleshoot issues. We believe that capturing anonymized data will help us to give you the greatest return of value going forward with IDAC, helping us to focus in the right areas of the product that matter the most to you.

The amount of data sent through the telemetry feature can be controlled through the Management Console Default Options> Telemetry. The new telemetry options are Minimum and Full. Note that the Disable option has been changed to Minimum. For further information, please see the following KB article: https://forums.ivanti.com/s/article/idac-telemetry.

For more information, see Computer Tab.

The following customer issues have been resolved in this release: