Endpoint Protector Server Bug Fix List

[RyanOistacher]

Looking for a bug fix list for all versions of Endpoint Protector Server?
All bug fixes will automatically be added here!

2608.0 Updates

Netwrix Endpoint Protector Server 2608.0.1.0

September 1, 2026

Module	Title & Description	ADO Number	Salesforce Number
General	Backup import fails with old database schema — Fixed issue when system backup import failed with an old database schema — importing a backup taken on an earlier EPP version failed due to schema compatibility issues.	412033	00466840
General	Diagnostic artifacts not downloadable from server UI — Fixed issue when EPP Client artifacts and diagnostic files were not downloadable from the server UI.	366535, 389189	00428733, 00446646
General	SMTP notifications failing with error 421 — Fixed issue when SMTP notifications failed with error 421 (Service Unavailable).	379463	00439536
General	Device Control alert emails not sent — Fixed issue when Device Control alert emails were not sent.	422756	00472954
General	Audit Log Backup not enforcing retention threshold — Fixed issue when Audit Log Backup did not remove logs older than the configured retention threshold — logs due for removal remained on the server after the backup job completed.	432539	00475601
General	Scheduled Audit Log Backup enters infinite retry loop and never completes — Fixed issue when the Scheduled Audit Log Backup entered an infinite retry loop and never completed — in certain conditions the job retried indefinitely without completing (workaround at the time was to use a one-time backup).	441482, 440702, 437803	00479915, 00478217
General	Logging level reset to Error after restoring global settings — Fixed issue when the logging level was incorrectly reset to Error after restoring global settings with file tracing enabled — affected individual computers and groups.	441346	00480317
General	User not available in OTP dropdown menu — Fixed issue when a user was not available in the OTP dropdown menu — when logged in as a non-super administrator assigned to multiple departments, searching for a specific user in the OTP dropdown did not return all matching users.	355792	00419825
Administration and User Management	Users absent from CAP after Entra ID synchronization — Fixed issue when users were absent from CAP after Microsoft Entra ID synchronization — users and groups synced from Entra ID appeared correctly in Device Control, but users were missing from the CAP entity picker; root cause was the sync script stopping processing of all subsequent groups when it encountered a previously deleted group in Entra ID. Note: users who have not had an EPP client installed do not appear as selectable entities in CAP until the client is deployed — this is expected behavior and is unchanged.	422196	00472683
Administration and User Management	Cannot change admin role for SSO/Okta/Azure AD-provisioned accounts — Fixed issue when admin role could not be changed for SSO/Okta-provisioned accounts, Azure AD-imported administrators (could not be changed from Super Administrator to Regular Administrator), or administrators provisioned via SSO generally — root cause was the SSO Administrator edit page being broken on load (JS crash) and missing several settings toggles (Account is active, Failed Login Alert, Enforce login IP restrictions), plus an empty email field for Azure SSO users.	438442, 438116, 438175, 439843, 444560	00478387, 00478406, 00479385, 00481547
Administration and User Management	Department-restricted admin sees all computers on login — Department-restricted admin sees all computers on initial login.	444564	00481562
Administration and User Management	Repeated failed logins block the login page — Repeated incorrect login attempts block the login page for multiple minutes.	432072	00473869
Administration and User Management	Login fails after removing an IP Access Restriction — Login fails after removing an IP Access Restriction.	445643	00482109
Administration and User Management	Login Time Restrictions intervals do not work — Fixed issue when Login Time Restrictions intervals did not work properly under System Configuration > System Administrators — the validator rejected valid values between 5 and 60 minutes, and the Login Attempt Restrictions inputs disappeared from the UI after disabling and re-enabling the option.	451432	00483928
Device Control	Group membership editing shows no selected members after 2604 upgrade — Fixed issue when group membership editing displayed no selected members following an upgrade to 2604 — computers and users were correctly assigned to groups but appeared unselected in the group edit view, and searching for users or computers within groups also returned no results.	435876, 435920, 437552, 439728, 440182	00477423, 00477460, 00478034, 00479323, 00479680
Device Control	Replicated group content does not match source — Fixed issue when replicated group content did not match the source (Group Replication feature).	441072	00480162
Device Control	False “missing serial number” error on device rename — Fixed issue when editing only the Device Name of a device record and saving triggered a false “missing serial number” error.	438509	00478653
Device Control	Policy reorder arrows missing from Widget View — Fixed issue when policy reorder arrows were missing from Widget View.	438339	00478540
Device Control	Allow rules scoped to computer and user not evaluated correctly — Fixed issue when allow rules scoped to both computer and user were not evaluated correctly.	383749	00442556
Device Control	Bulk device import blanks description with special characters — Fixed issue when special characters in a device description caused bulk device import to leave the description blank.	422447	00472814
Device Control	Unable to delete more than 10 computers/host entries in bulk — Fixed issue when deleting host entries from Device Control > Computers only worked for 3–5 entries at a time — selecting 10 or more silently failed to delete.	424106	00473516
Device Control	EasyLock client list filter panel renders blank — Fixed issue when the EasyLock client list filter panel rendered blank.	436844	00477696
Device Control	Web console freezes reordering Device Control groups via drag-and-drop — Fixed issue when reordering Device Control group priority via drag-and-drop froze the web console and eventually returned a 502 error, with no changes applied.	432229	00475443
Device Control	Diagnostics artifacts cannot be downloaded from server UI — Fixed issue when diagnostics artifacts could not be downloaded from the server UI.	372622	00428246
Device Control	Audio device incorrectly allowed by Windows Sound Recorder — Audio device incorrectly allowed by Windows Sound Recorder.	432668	00475101
Device Control	TightVNC file transfer logging via Extended VNC Policy Exit Point misbehaves — Extended VNC Policy Exit Point / TightVNC file transfer logging does not behave as intended.	435616	00480546
Device Control	Bulk import missing on Custom Classes — Fixed issue when clicking Import Content while creating a Custom Class in Device Control with “Bulk List of Devices” selected as the Adding method produced no response — the file import UI did not appear.	440703	00479902
Content Aware Protection	Actions menu dropdown mispositioned in CAP policy list — Fixed issue when accessing the actions menu at the bottom of the CAP policy list — the dropdown appeared at an incorrect position when the list was scrolled to the bottom.	396733, 401244	00451651
Content Aware Protection	MIME allowlist selections revert on save — Fixed issue when MIME file types deselected in the CAP allowlist reverted to selected on save.	440033	00479560
Content Aware Protection	Custom threat threshold not applied with regex-based rules — Fixed issue when the custom threat threshold was not applied when using regex-based Content Detection Rules.	434607	00476714
Content Aware Protection	URL denylist not enforced on Brave and Chrome — Fixed issue when the URL denylist was not enforced on Brave and Chrome — blocking worked only on Edge.	424945	00473863
Content Aware Protection	CAP conditions not evaluated with special characters in names — Fixed issue when CAP policy conditions were not evaluated if dictionary or regex names contained special characters or spaces — double-encoding of &, <, > and incorrect whitespace handling in condition names caused conditions to never match on the client, allowing files through instead of being blocked.	426395	00474838
Content Aware Protection	CAP policies sent from server to agent incorrectly — Fixed issue when CAP policies were sent from the server to the agent incorrectly under specific rights configurations.	326875	00409969
Content Aware Protection	iPhone Messages synced to macOS logged as CAP false positives — Fixed issue when iPhone Messages synced to macOS were logged as CAP false positives — when the CAP policy for Instant Messaging > Messages is enabled, messages synced from an iPhone to macOS via iCloud were incorrectly detected as policy events.	412457	00467246
Content Aware Protection	Wrong Destination Type displayed in CAP logs — Fixed issue when the wrong Destination Type was displayed in CAP logs — when a file was copied from a removable device to the local machine, the Destination Type incorrectly showed “USB Storage Device” instead of the local drive.	319732	00409911
Content Aware Protection	Regex Denylist Test tool rejects case-insensitive patterns — Fixed issue when the Regex Denylist Test tool rejected case-insensitive patterns — the Test button failed on patterns using the (?i) modifier, incorrectly flagging valid patterns as invalid; policy enforcement itself was unaffected, only the server-side Test tool was broken.	445749	00482252
Content Aware Protection	Regex not detected consistently with Boolean operators — Fixed issue when regex was not detected consistently when combined with Boolean operators — regex-based Content Detection Rules combined with other rules using AND/OR did not reliably detect all specified threats, and some terms were missed depending on operator and rule order.	444158	00481191
Content Aware Protection	Content Aware Report not loading — Fixed issue when the Content Aware Report failed to load, causing the EPP portal to become unresponsive when opening it.	444030	00481117
Content Aware Protection	AWS SES configuration for Email Server Settings stopped working after upgrade — AWS SES configuration for “E-mail Server Settings” stopped working after upgrade, resulting in missing alert notifications.	383157	00436586
Content Aware Protection	Content Aware email notifications missing attachment with “Native” mail settings — Content Aware email notifications are sent without the expected attachment when using “Native” mail server settings.	449233	00483046
Content Aware Protection	Unable to change Content Aware Protection policy priority — Unable to change Content Aware Protection policy priority.	446134	00482384
DPI	DPI Allowlist edit form missing file upload fields — Fixed issue when the DPI Allowlist edit form was missing file upload fields for entries with existing imported content.	437887	00478275
eDiscovery	eDiscovery logs not visible to read-only admin users — Fixed issue when eDiscovery logs were not visible to read-only administrative users.	397798	00452708
Reports and Analysis	Effective Rights report returns empty with filters applied — Fixed issue when the Effective Rights report returned empty when filters were applied — filtering by computer name or username returned no results despite data being present in the unfiltered view; some customers also observed mismatched computer-user pairs in the full export.	394400, 399153, 418207	00449797, 00453974, 00470496
Reports and Analysis	Report export stuck as “export currently running” — Fixed issue when the Content Aware Report / Logs Report export got stuck showing “export currently running.”	413495	00467724
Reports and Analysis	Audit Log Backup export file contains repeated header lines — Audit Log Backup export file (ofiletrace.csv) contains the same header line repeated multiple times.	401383	00455638
Reports and Analysis	Artifact log files cannot be downloaded — Artifact log files cannot be downloaded.	426325	00473021
Reports and Analysis	DNS display issue — Fixed issue with the DNS display.	444703	00480718
SCIM	SCIM log entries truncated at 65,535 characters — Fixed issue when SCIM log entries were truncated at 65,535 characters — request_body and response_body were cut off for large payloads, hindering troubleshooting; the character limit has been increased.	432826	00475770
SCIM	Okta SCIM subset PUT overwrites full group membership — Fixed issue when a subsequent subset PUT request from Okta SCIM overwrote full group membership — when Okta sent a second PUT with a membership subset shortly after the first, EPP replaced the complete membership with the subset.	434480	00476615

Netwrix Endpoint Protector Client Version 2608

August 24, 2026

The following table contains a comprehensive list of updates and fixes introduced in this version:

Component	Description	Case #	Escalation #
Security	**Updated Component: OpenSSL library** — EPP uses latest version with upstream security fixes.	437978	—
Security	**Updated Component: WolfSSL library** — Enforced Encryption uses latest version with upstream security fixes.	445103	—
Security	**Files exposed under Tamper Protection** — Fixed an issue on Windows where, with Tamper Protection enabled, two internal configuration files could be read by unauthorized processes. File access permissions have been tightened to prevent this exposure.	440887	—
General	**False “Forced Uninstall” log on Linux startup** — Fixed an issue where Linux endpoints generated a “Forced Uninstall” log entry every time the machine started, even though no uninstall was attempted.	320083	—
General	**Collect Diagnostics action not returning data** — Fixed an issue where running “Collect Diagnostics” from the server did not return a diagnostic artifact, leaving the Diagnostic Data table empty.	438317	—
General	**Client sending empty log packets** — Fixed an issue where the client periodically sent empty log packages to the server, creating unnecessary log traffic.	442256	—
General	**Client configuration could be lost after an unexpected shutdown** — Improved reliability on macOS and Linux so the client’s local settings file can no longer be left empty if the client process is terminated while saving, which previously could cause the client to lose its server connection details.	445461	00481291
General	**Leftover files after uninstalling on macOS** — Fixed an issue where uninstalling the client on macOS left behind two application support folders instead of removing them completely.	451175	—
General	**File Shadows not delivered to FTP repository** — Fixed an issue where shadow copies of blocked files were not sent to the File Shadows Repository when it was configured to use an FTP connection.	452018	—
General	**File shadows missing for file move events on Linux** — Fixed an issue where moving a file to a removable device or network share generated a File Copy event without an accompanying shadow copy.	390728	—
General	**Linux install certificate script failed to detect domain-style home paths** — Fixed an issue where the Linux DPI certificate installer did not correctly detect a user’s home path when the path included a domain name (e.g. `/home/infra@domain`).	447476	00481378
DC	**Device lockdown option not enforced on macOS Sonoma** — Fixed an issue on macOS Sonoma where enabling “lockdown all endpoints” and clearing exclusions in the Device Control dashboard did not actually block the excluded device types (Wi-Fi, Bluetooth, keyboard, etc.).	319869	—
DC	**Bluetooth mouse/keyboard remained usable after being denied** — Fixed an issue on Linux where a Bluetooth mouse or keyboard set to Deny was blocked only briefly, then resumed working with erratic behavior.	437232	—
DC	**Third-party virtual drives could crash on startup** — Fixed an issue where certain virtual drive software (e.g., Box Drive) was incorrectly identified as an unknown storage device, causing it to crash on launch when unknown devices were set to Deny.	442287	00480242, 00481321
DC	**Specific virtual drives could be blocked by “Unknown Devices” policies** — Improved device identification so administrators can exclude specific third-party virtual drives from Device Control enforcement at the driver level, without needing to broadly allow all unknown devices.	442754	00466821
DC	**Advanced Printer and MTP Scanning not working correctly on Windows ARM64** — Fixed an issue where the Advanced Printer and MTP Scanning feature did not interoperate correctly with x64 and x86 processes running under WoW64 emulation on ARM64 Windows devices.	426297	—
DC	**Trusted Device content readable outside EasyLock on macOS** — Fixed an issue where files on a TD1/TD1+ device could be listed and copied via Finder or Terminal on macOS, bypassing EasyLock. macOS now matches the full-block behavior already applied on Windows.	452102	00477749
DC	**Built-in webcam not blocked on macOS** — Fixed an issue on macOS where denying the Webcam device right did not stop the built-in camera; on affected Macs, the built-in camera is handled by a separate system component that was not covered by the existing camera-blocking logic.	452353	00482087
CAP	**DLP engine could crash loading a large custom dictionary** — Fixed a crash that could occur when the DLP engine loaded a large custom dictionary file.	437988	—
CAP	**DLP engine could crash reporting threats on a network share** — Fixed a crash that could occur when threat events were reported for files detected on a network share.	438145	—
CAP	**Duplicate remediation prompts for network share transfers** — Fixed an issue on macOS where the user remediation pop-up for a Block & Remediate policy could appear twice for a single file transfer to a network share, with the event logged multiple times.	320086	—
CAP	**CAP scanning direction dependent on File Tracing settings (Linux)** — Fixed an issue on Linux where Content Aware Protection scanning of removable-device transfers was incorrectly affected by the File Tracing direction setting, letting some monitored transfers through undetected.	341792	—
CAP	**CAP scanning to removable devices required File Tracing (Linux)** — Fixed an issue on Linux where Content Aware Protection policies for removable devices were enforced only when File Tracing was also enabled, letting transfers bypass detection otherwise.	347533	—
CAP	**Sensitive DOCX files could bypass network share protection via “Save As”** — Fixed an issue where using “Save As” to copy a DOCX file with sensitive content to a network share could bypass Content Aware Protection, even though the transfer was logged as blocked.	398611	00452594
CAP	**SBF files not always recognized by content detection** — Fixed an edge case where certain .sbf files were not correctly identified, allowing them to bypass Content Aware Protection policies restricting this file type.	426543	00473674
CAP	**Outlook attachment policy also matched email body content** — Fixed an issue where a Content Aware Protection policy scoped to Outlook attachments could still block an email based on content found in the message body rather than the attachment.	432088	00475228
CAP	**Print jobs sometimes evaluated against the wrong document** — Fixed an issue where, in certain printing scenarios, the client could attempt to scan a temporary print file that no longer existed on disk, so the print job was not properly evaluated against content policies.	433789	00475104
CAP	**Sensitive image files not blocked when “report all sensitive data” enabled** — Fixed an issue where enabling “Ignore thresholds (report all sensitive data)” caused image files that should have been blocked by file location, filename, or size rules to be allowed through instead.	437668	—
CAP	**False content alerts triggered by Chrome Translate** — Fixed an issue where using Chrome’s built-in translate feature could trigger false-positive gzip file detections when Chrome monitoring and DPI were enabled.	437698	—
CAP	**Policy conditions using multiple custom dictionaries did not trigger correctly** — Fixed an issue where a file was not blocked if a matched word belonged to more than one custom dictionary and the policy used logical conditions referencing those dictionaries.	437734	00474838
CAP	**Google Photos uploads not blocked** — Fixed an issue where image uploads to Google Photos were not blocked by Content Aware Protection policies denying graphic file types on browser exit points.	437861	00477061
CAP	**Sensitive clipboard content could remain visible in remote sessions** — Fixed an issue where blocking a clipboard copy/paste in AnyDesk cleared the content locally but not on the remote machine, leaving it accessible there.	438599	00477984
CAP	**Shadow copies not created for large blocked files** — Fixed an issue where shadow copies were not consistently generated for blocked files, most often affecting files larger than 10 MB transferred via Teams or USB.	439926	00450675
CAP	**Downloaded Teams screenshots occasionally removed** — Fixed an issue on macOS where screenshots downloaded from Microsoft Teams could be intermittently and silently removed from the Downloads folder while OCR-based content scanning was active.	442103	00480316
CAP	**Non-JPEG image uploads to M365 Copilot not monitored** — Fixed an issue where the client only inspected JPEG image attachments uploaded to Microsoft 365 Copilot; other common image formats (PNG, BMP, GIF) were not monitored.	444447	—
CAP	**OCR-enabled policies could delete newly created image files** — Fixed an issue where, with OCR content scanning enabled, newly saved image files such as screenshots could be deleted shortly after creation, even under Report Only policies.	444725	00481321
CAP	**First message in Google AI Mode not inspected** — Fixed an issue where the first text message sent in a new Google AI Mode session was not inspected for monitored content.	447532	—
CAP	**Paste restrictions not enforced in ChatGPT desktop app** — Fixed an issue where clipboard paste restrictions configured in a Content Aware Protection policy were not enforced when pasting into the ChatGPT Windows app.	450844	—
CAP	**Fasoo DRM-encrypted files not detected** — Improved file type detection to recognize Fasoo DRM-encrypted documents, which were previously classified as a generic file type and could bypass policies restricting this format.	451642	00483864
CAP	**Printer name missing from CAP report on Mac** — Print events on macOS did not include the printer name in the CAP report; the report showed a generic “Printer” or “Network Printer” label instead.	452007	00484573
DPI	**Slow or failed website loading with DPI enabled on macOS** — Fixed an issue on macOS where enabling Deep Packet Inspection could cause certain websites to load very slowly or fail to load, caused by an excessive number of concurrent inspection connections.	423981	00468494
DPI	**DPI inspection process could crash** — Fixed a crash in the client’s SSL inspection component caused by an internal memory-handling error.	438981	—
DPI	**Large file uploads could stall when DPI scanning is enabled** — Fixed an issue where uploading files larger than the initial HTTP/2 flow-control window while DPI content scanning was enabled could cause the upload to hang and eventually fail.	439906	00479286
DPI	**Google Meet calls dropped when DPI enabled** — Fixed an issue where Google Meet and other WebRTC-based apps could drop calls after about a minute when Deep Packet Inspection was enabled.	444654	00483630, 00480760
DPI	**External sites unreachable with DPI enabled while on GlobalProtect VPN** — Fixed an issue where several external sites, including Outlook, Azure DevOps, Grok, and Copilot, became unreachable when a policy had DPI enabled while connected to GlobalProtect VPN.	451184	—
DPI	**Stale IPv6 connectivity status on macOS after network changes** — Fixed an issue where the Transparent Proxy network extension on macOS did not re-evaluate IPv6 connectivity when the network configuration changed (Wi-Fi/Ethernet connect/disconnect, VPN connect/disconnect, interface changes), which could route browser and app connections to IPv6 destinations based on stale connectivity information.	452053	00479286
DPI	DPI could block access to GitHub and Azure DevOps — Fixed an issue where enabling Deep Packet Inspection could prevent connections to github.com and dev.azure.com from completing in the browser.	452165	—

---

Known Limitations

Component	Description	Case #	Escalation #
General	In newer Linux distributions, the default snap application for file access events in xdg Desktop portals is not supported by the EPP Client.	EPP-8735	EPPSUPPORT-3198
General	Windows XP, Windows 7, Windows 8, early Windows 10 builds, and Windows Server 2016/2019 no longer supported as of EPP client version 5.9.4.1.	438053	—
DC	Despite denying Bluetooth, Webcam, and iPhone access on macOS, Continuity Camera continues functioning in Slack, Zoom, FaceTime, and Photo Booth.	EPP-8781, EPP-6826	—
CAP	On Linux environments using the Wayland protocol by default, paste control is constrained due to Wayland’s inability to detect the focused window.	EPP-8510	—
CAP	File Shadow downloads from AWS S3 buckets with concurrent File Tracing and CAP may result in inconsistent behavior.	320213, EPP-9023	—
CAP	AI interaction monitoring does not extend to meta.ai when accessed within Facebook, Messenger, or WhatsApp due to encryption dependencies.	410799	—
CAP	On macOS, files containing confidential content are not blocked when uploaded through the Cursor application’s “New Agent” feature, even when a CAP policy with DPI enabled is monitoring Cursor. A fix is targeted for a future release.	453228	—
General	On macOS 27 “Golden Gate”, both a fresh EPP Client install and an upgrade of an existing install trigger a Bluetooth permission pop-up that requires manual end-user approval; the previous silent pre-approval method is no longer available under macOS 27. A fix restoring silent, MDM-enforced approval is in progress for a future release.	451042	—

---

Deprecated

Component	Description	Case #
CAP	Contextual Detection under System Parameters has been discontinued and replaced by Context Detection Rules in CAP Policies.	EPP-8941

---

Upcoming Deprecations

Component	Description	Case #	Targeted Release
General	The File Shadow Maintenance feature for listing and managing File Shadows on the EPP Server will be discontinued in a future release.	—	TBD

2604.0 Updates

Endpoint Protector Server 2604 Released

May 5, 2026

Module	Description	ADO Number	Salesforce Number
Alerts	Content Aware Alert Email Delivery - Fixed an issue where Content Aware alert emails were not generated in certain configurations that included both computers and users. In these cases, incorrect policy association in backend processing could prevent the alert from matching the expected policy and stop the email from being sent. Alert evaluation now works correctly, and email notifications are generated as expected.	320002	00029809
SIEM Integration	Administrator Username in SIEM Logs for SSO Authenticated Users - Fixed an issue where SIEM exports displayed the Azure UUID instead of the administrator username for users authenticated through Single Sign-On (SSO) with Azure AD. Endpoint Protector now sends the correct username in SIEM logs, improving event readability and audit traceability.	377615	00437325
CAP	Paste Restriction Enforcement for KakaoTalk on macOS - Fixed an issue where Content Aware Protection paste restrictions were not enforced for KakaoTalk on macOS when the option to apply paste restrictions to all monitored applications was enabled. This occurred because the localized KakaoTalk process name was not recognized correctly. KakaoTalk is now identified properly and paste restriction policies are enforced as expected.	412474	00463597
Reports and Analysis	Log Export for Administrators Assigned to Multiple Departments - Fixed an issue where log exports could fail when initiated by an administrator assigned to multiple departments. This affected export generation from reports such as Device Control, Content Aware Protection, and File Tracing. Log exports now complete successfully regardless of the number of departments associated with the administrator.	415113	00468236
Reports and Analysis	Historical CAP Policy Type Display After 2602 Upgrade - Fixed an issue where historical Content Aware Protection logs created before the 2602 update could be displayed incorrectly as Outside Network instead of Standard in Reports and Analysis after the patch was applied. Historical log entries now retain the correct policy type in reports.	416392	00469556
Single Sign-On	SSO Redirect Handling After Login - Fixed an issue introduced after the 2601 upgrade where Single Sign-On (SSO) authentication could complete successfully, but the console did not redirect users correctly and displayed a failure message instead. This issue affected environments using PingID. Users are now redirected to the Endpoint Protector dashboard as expected after successful authentication.	417621	00468481
System Maintenance	System Backup Import with Legacy Database Schemas - Fixed an issue where System Backup import could fail when the backup was created from an older database schema and restored on a newer Endpoint Protector server version. System Backup imports now complete successfully in legacy schema migration scenarios.	417735	00466840
Reports and Analysis	CAP Log Details for Delegated Administrators - Fixed an issue where administrators with access to the Reports and Analysis section, but without Super Administrator privileges, could not expand and view Content Aware Protection log details. CAP event details now load correctly for delegated administrators with the appropriate permissions.	419361	00470747
General	QuickLogs Recovery and Ingestion Handling - Improved handling for scenarios where oversized QuickLogs directories could interrupt log ingestion. However, this process should still go through flagged by customers and go through Netwrix Support for a quicker fix.	423709	00472377
Directory Services	Active Directory Sync for Organizational Units with Special Characters - Fixed an issue where Active Directory sync could fail to display Organizational Units and related objects in the Directory Browser when Organizational Unit names contained special characters, such as %, , parentheses, braces, or brackets. Associated objects, including groups, computers, and users, are now displayed and synchronized correctly.	425953	00474344
Reports and Analysis	Okta not able to create groups through SCIM - Fixed an issue where group provisioning from Okta through SCIM could fail because the Department attribute was required during group creation. Endpoint Protector now supports Okta SCIM group creation without requiring this attribute, improving compatibility with Okta group provisioning workflows.	418944	00470914

2602.0 Updates

Netwrix Endpoint Protector Client version 2602 Released (Now with Hotfix 2)

February 5, 2026

No bugs were fixed in this update.

Endpoint Protector 2602.0.1.0 Server Patch Released

February 5, 2026

Module	Title & Description	ADO Number	Salesforce Number
General	Backend Security Updates – MariaDB package conflict prevention - Fixed an issue where applying Backend Security Updates on EPP Server 2510 could fail to apply (updates would reappear as available) and, in some cases, could lead to the Web UI becoming inaccessible with a 500 Internal Error after updates.	409945 & 411911	00463162 & 00466742

Known Limitations

Component	Description	Case #	Escalation #
CAP	An error is returned when enabling CAP and eDiscovery modules on a new server: ”An error occurred. Please ensure the Endpoint Protector Server has a functional Internet connection or that the required domain and ports have been whitelisted for outgoing traffic." This is not a blocking limitation, as the modules can be enabled after trying to click “Save” and enable them a second time.	370216
CAP	File Shadow downloads from AWS S3 buckets, with concurrent File Tracing and CAP activation, may result in inconsistent behavior, displaying artifacts deleted in File Tracing reports but still available in CAP reports, and vice versa.	320213, EPP-9023
EPP Server UI	When installing a fresh Endpoint Protector (EPP) Server, the default time zone is set to a default value that may differ from your own. As a result, computers may appear as “Offline” in the status column until the time zone is adjusted and synchronized. To resolve this, navigate to Appliance → Server Maintenance, select the appropriate time zone (e.g., Istanbul), and synchronize the server time. This action ensures computers will display the correct “Online” status. A fix for this issue is planned for future updates.	395435
EPP Server Networking	When performing a backup restoration from a 5942 server to a 2510 server, the custom logo used for User Remediation is not imported correctly. After completing the restoration process, navigate to System Parameters → User Remediation; you may notice that the custom logo is missing. A fix for this issue is being considered for an upcoming release.	402066
EPP Client Update	Starting with the 2601.0.1.0 release, the Client Upload page in EPP Server was cleaned up, and there is currently a known limitation that does not allow EPP Clients older than the 2509 version to be uploaded. Currently only EPP Clients with version 2509 and up are permitted for upload by the interface.	414748

For any issues, please contact the Support team for assistance.

Upcoming Deprecations

List of features which will be discontinued in future.

Component	Description	Case #	Targeted release
CAP	Contextual Detection under SYSTEM PARAMETERS will be discontinued in future updates and replaced by ‘Context Detection Rules’ in the ‘Content Detection Summary’ section of CAP Policies.	EPP-8941	TBD
General	The File Shadow Maintenance feature, which provides functionality for listing and managing File Shadows stored locally on the EPP Server will be discontinued in future.		TBD

2601.0 Updates

Netwrix Endpoint Protector Server Version 2601.0.1.0 Released

January 15, 2026

Module	Title & Description	ADO Number	Salesforce Number
CAP	NetworkShare Allowlist Application Issue - Resolved a critical issue where NetworkShare Allowlist settings were not applied correctly on versions 2509/2510, causing copy operations from allowed shares to be blocked. A query change resulted in endpoints receiving an empty allowlist. This has been fixed, ensuring allowlisted shares function as expected.	406336 & 406650	00460045 & 00460337
Enforced Encryption	EasyLock and Client Presence Issue on Windows 11 - Fixed an issue where “Client Presence” settings didn’t prevent access to EasyLock on non-client Windows 11 machines, allowing partition access across non-client setups. A discrepancy in settings transmission from server-side to group levels caused improper application of “Client Presence.” We’ve corrected the logic for group settings, ensuring proper enforcement across all environments. This includes ensuring that EasyLock settings are correctly applied and inherited at the group level, with additional database changes like introducing a new table for logging client settings.	404913	00458700
Reports and Analysis	Fix for Missing XML Files and Empty Export Archives - Addressed issues where exporting reports such as CSV or XLSX files from Logs Reports, File Tracing, and Content Aware Reports resulted in empty directory archives with missing XML files. Following an update to version 2509, customers experienced loss of historical report downloads and encountered errors in generating new logs reports. The fix ensures all exported archives contain the selected files and that logging processes are adequately handled across server environments. Additional adjustments were made to alleviate time-out issues during export processes, particularly when file tracing reports are involved.	405845	00459480
General	IP Saving Issue on VMware EPP 2510 Image - Addressed a persistent issue where IP configurations failed to save on VMware vSphere VM appliances (versions 7.0.2, 8.0.2) using EPP Image 2510.0.1.0. Customers had to manually adjust netplan configurations as a workaround due to DHCP not assigning IPs on first boot. A fix has been implemented to ensure network settings are correctly applied during initial configurations. Investigations highlighted a need for configuration adjustments in the virtual appliance setup process.	408487 & 408764 & 408135	00461744 & 00461971 & 00461405
General	Language Display Error on Web Console - Resolved a critical issue where selecting Ukrainian language in the web console incorrectly displayed Turkish. This affected entire environments post-migration to EPP server version 2510, causing disruptions for many administrators. The fix ensures correct language selection and display across server interfaces, restoring smooth workflow integration for all users.	409305	00462409
System configuration	PHP ELS State and License Import Issue - Resolved an issue where importing a new license with a unique ELS key on the 2510 server resulted in an erroneous message, “Something went wrong during the installation. Please retry.” The ELS state did not update in the UI, and the php_els_install_status parameter remained at 0. This was caused by DNS and internet connectivity issues, as well as scenarios with duplicate licenses. The fix addresses these scenarios by ensuring accurate error messaging and state updates, improving overall stability and clarity during license import processes.	407585 & 408350	00460881 & 00461569
Reports and Analysis	Audit Log Backup Download Issue - Resolved a critical issue where audit log backup files could not be downloaded from the EPP server hosted on AWS. Following the upgrade to EPP Server version 2510, attempts to retrieve backup logs for compliance audits failed, affecting multiple log entries and blocking audit preparations. The fix addresses inconsistencies in log data handling post-migration, with DevOps implementing a cron job to extract available data. This solution prioritizes restoring log accessibility through simulated audit archiving.	408745	00461931
Certificate Management	Certificate Display Issue on macOS - Resolved an issue where DPI certificates marked as trusted on macOS clients appeared as N/A in the EPP Server UI. This was due to a validation process in the backend that erroneously used UI-only components, causing worker processes to fail. The improvement ensures certificates are accurately reflected and updates are correctly processed by server-side validation logic, enhancing synchronization between macOS clients and the server.	406528	00460223
Reports and Analysis	EPP Console Not Displaying Detailed Logs for Certain Files - Fixed an issue where detailed logs for CSV files were not visible in the EPP console, despite the server receiving accurate information. The console was not correctly processing logs for CSV files while PDF logs were displayed properly. The resolution ensures comprehensive visibility of log details for all file types, reinforcing complete reporting in Content Aware Reports.	409935	00463129
General	Email Alert - Log csv file not properly aligned - Resolved a problem where CSV files attached to email alerts were not properly parsed, resulting in all data being added to the first column. This made it difficult to read and utilize the data effectively. The fix ensures that content in CSV files is correctly distributed across the appropriate columns, enhancing clarity and usability of alert information.	406074	00459728
General	EPP 2510 OS downgraded to 2509 after importing 2509 backup - Addressed an issue where importing a 2509 backup file into an EPP 2510 server incorrectly showed the server version as downgraded to 2509. This is a UI display issue rather than an actual version rollback. The fix ensures that the server version is accurately displayed post-backup import, avoiding confusion and ensuring consistency across system maintenance operations.	409666	00462856

[RyanOistacher]

The following versions may have limited or no support. Please see the Supported Version page for guidance.

2510.0 Updates

Patch Version 2510.0.1.0 Released

October 30, 2025

Module	Description	ADO Number	Salesforce Number
Denylists	Issue with Domain and URL Denylists Functionality - Resolved problem where URLs added to Denylists were not being blocked as expected. The issue was caused by a deprecated condition in the code. This fix ensures that URLs listed in Denylists are correctly denied access, strengthening web browser CAP Policy enforcement.	404363
General	Dual DNS Configuration Requirement in Image 2509 - Identified and addressed the requirement in image version 2510 for both DNS entries to be configured before saving settings. Previously, entering a single DNS was sufficient. This update ensures configurations save properly with either single or dual DNS setup, preventing erroneous resets to default values after 5 minutes.	405166
General	Sync Time Not Working - Computers Appear Offline - Resolved an issue where machines appeared offline due to sync time failures. This was caused by an outdated database setting related to automatic update checks, which interfered with the operations.php cron job, preventing time synchronization. As of version 2510, the setting is removed to ensure proper time syncing and accurate machine status.	405673
General	Update to Autoloader Configuration - Addressed an issue where the autoloader was not properly included in the project, causing Zend-encoded (encrypted) files to fail loading. This fix ensures the autoloader is correctly initialized before executing encoded files, ensuring smooth operation and loading within the application environment.	405928

Known limitations

For any issues, please contact our Support team for assistance

Component	Description	Case #	Escalation #
Contant Aware Protection	An error is returned when enabling CAP and eDiscovery modules on a new server: ”An error occurred. Please ensure the Endpoint Protector Server has a functional Internet connection or that the required domain and ports have been whitelisted for outgoing traffic." This is not a blocking limitation, as the modules can be enabled after trying to click “Save” and enable them a second time.
General	In newer Linux Ubuntu versions, the default installation of the ‘snap’ application for file access events in xdg Desktop portals is not supported by EPP Client. This may lead to unexpected behavior in File Tracing, File Shadow, CAP, and DPI due to missing file access events.	EPP-8735	EPPSUPPORT-3198
Device Control	Despite denying Bluetooth, Webcam, and iPhone access on macOS endpoints, the Continuity Camera issue persists in applications like Slack, Zoom, FaceTime, and Photo Booth, where the camera is not correctly blocked.	EPP-8781 EPP-6826
Content Aware Protection	Clipboard operations may not always be captured accurately by MacOS CAP OCR	EPP-8651
Content Aware Protection	On certain Linux environments, particularly those using the Wayland protocol by default, paste control is constrained due to Wayland’s inability to detect the focused window, resulting in content blocking during the copy operation.	EPP-8510
Content Aware Protection	File Shadow downloads from AWS S3 buckets, with concurrent File Tracing and CAP activation, may result in inconsistent behavior, displaying artifacts deleted in File Tracing reports but still available in CAP reports, and vice versa.	320213, EPP-9023
Endpoint Protector Client	With the release of EPP Client version 5.9.4.1, support for Windows XP, 7, 8, early builds of Windows 10, and Windows Server 2016 has been discontinued. To maintain EPP coverage on these systems, customers should continue using EPP Client version 5.9.4.0. Please note that no new features or fixes will be backported to this release.		438053
Endpoint Protector Client	False Positive Generation on Ubuntu with Firefox. For Ubuntu versions 18.04, 20.04, 22.04, and 24.04, when using Firefox browsers to navigate through files, the EPP Client may generate false positives.	367650	00433696, 00427782
Device Control	When installing a fresh Endpoint Protector (EPP) Server, the default time zone is set to a default value that may differ from your own. As a result, computers may appear as “Offline” in the status column until the time zone is adjusted and synchronized. To resolve this, navigate to Appliance → Server Maintenance, select the appropriate time zone (e.g., Istanbul), and synchronize the server time. This action ensures computers will display the correct “Online” status. A fix for this issue is planned for future updates.	395435
Device Control & CAP	When performing a backup restoration from a 5942 server to a 2510 server, the custom logo used for User Remediation is not imported correctly. After completing the restoration process, navigate to System Parameters → User Remediation; you may notice that the custom logo is missing. A fix for this issue is being considered for an upcoming release.	402066
Network Configuration	Cannot setup network configuration for Proxmox EPP Appliance 2509. The netcfg.yml file is missing information. To resolve, edit the /etc/netplan/netcfg.yml file ensuring the eth0 interface has the correct details, then validate and apply changes using netplan try and netplan apply.	405653	00459372
UI Accessibility	UI not accessible after rebooting server version 2509. Backend remains accessible. Resolution involves backing up and modifying the nginx configuration file with the correct listening settings and restarting nginx.	405423	00459122

2509.0 Updates

Major Version Announcement Endpoint Protector Server Version 2509

October 14, 2025

Component	Description	ADO #	Salesforce #
General	“Show/Hide Columns” Modal Display Issue in Reports and Analysis Fixed issue where the modal was hidden behind other interface elements.
General	“Test Connection” Button Error for S3 Buckets Restored functionality for S3 Bucket test connections.	360224
General	Filter Application Issue in Admin Actions Filters now apply correctly based on selected criteria.	369459	00430586
General	Incorrect License Display After Accessing System Licensing Menu Licensed devices no longer appear as unlicensed after menu navigation.	341452	00410118
General	Incomplete AD Group Membership Visibility Post-Import Ensures all users’ group memberships are correctly synchronized.	367260	00429080
General	Exporting Devices in JSON Format Export now works properly across versions.	377658	00437711
General	High Communication Volume Between Client and Server Optimized event generation to reduce load.	378002	00437920
General	Emailed Alerts Not Delivered SMTP test emails now send successfully after setup.	378303	00438327
General	Translation Problems – German Search in Device Control now works with localized terms.	385901	00444667
General	Can’t Connect macOS Device to EPP Server Resolved connectivity problem with a specific macOS device.	391937	00448448
General	Duplicate Entries for Manually Added Computers Installing client on pre-added devices no longer creates duplicates.	394531
General	File Shadowing Reliability Issues Fixed missing/failed shadowing in certain scenarios.	395573	00450674 (contin. of 00412043)
eDiscovery	Correction for Contextual Detection “Related File Type” Now correctly flags only matching files.	362859	00425235
CAP	Incorrect OS-Based Loading of Policy Entities Entities now load correctly by OS type.	366142
CAP	Incomplete Log Fields in CAP When Server Connection Lost Ensures full log information is retained offline and uploaded later.	396527
CAP	Inability to Delete Files from Allowlist Files can now be removed individually.	376245	00436274
CAP	UI Section Mislabeling for Exported Email Denylists Corrected export log naming for email domain denylists.	383236
CAP	File Deletion Issues Fixed removal of files requiring entire list deletion.	377593	00434230

5.9 Updates

Version 5.9.4.3 Released (Now with Hotfix 1)

June 5, 2025

Component	Description	Case #	Escalation #
General	EPP Client to Server Communication Compression In this release, we’ve introduced a Client to Server compression feature, which will be utilized in upcoming versions of EPP Servers (5.9.5.0 and higher) and Unify releases (7.4 and higher). This enhancement is designed to conserve bandwidth and reduce transfer limits on metered connections, as well as to lower costs associated with cloud providers.	382009, 382939, 383176	00437920
General	User Remediation Challenge for Domain-Joined Devices Offline This release addresses an issue where domain-joined Windows devices (connected to Active Directory) could not utilize user remediation for device control when disconnected from the network. Previously, attempting to authenticate with user credentials after disconnecting from the network resulted in an “Invalid credentials. Couldn’t initialize the connection.” error. This has been optimized to ensure seamless authentication, allowing users to access connected USB devices even when offline.	384611	00437637
General	Enhancement to EPP Client Behavior on Ubuntu Xorg We’ve refined the login process on Ubuntu Xorg (version 24.04) to prevent the EPP client window from opening automatically without user initiation, ensuring a more seamless user experience. Additionally, options accessed via the right-click menu now appear as intended, enhancing usability.	385428	00435662
General	Resolution for Department Reverting Issue in EPP Client Upgrade Upgrading the EPP client to version 6.2.4.2000 or higher previously caused departments to default to “defdep” due to a re-registration process triggered by an OpenSSL upgrade. This update ensures that custom department settings are retained during client upgrades, whether performed manually or via server updates, maintaining organizational consistency.	379516	00437612, 00437246
General	Improved Client Termination Logging During Node Maintenance The update refines handling to prevent unintended termination logs during node maintenance. This ensures smooth node transitions without triggering “Unplanned Client Termination” or “Forced Uninstall Attempt” logs.	380237	00436395
DC	Improvement in Bluetooth Device Classification for Access Rights The update enhances the accuracy of device classification, addressing situations where Bluetooth headphones previously detected as “Bluetooth Other” by older EPP agents are assigned incorrect access rights upon upgrading. Now, devices identified as “Bluetooth Headphone” will consistently receive the appropriate permissions, reflecting improved device categorization and resolving mismatches in access rights application.	369454	00423693, 00424784
DC	Enhanced Linux Bluetooth Control via DBus Events We have reworked the handling of Linux Bluetooth permissions to leverage DBus events, significantly enhancing the ability to control Bluetooth devices on Linux. This change improves precision and flexibility in managing Bluetooth connections and device interactions within the Linux environment.	377022, 385745
DC	Improved Management of Bluetooth Pop-Ups on macOS Adjustments have been made to ensure that Bluetooth pop-ups are properly displayed only when appropriate permissions are in place. This enhancement ensures that the EPP agent requires full disk access to modify local databases, preventing unnecessary pop-ups if permissions are not granted, thereby streamlining user interaction on macOS.	370581	00423432
DC	Streamlined Log Generation for iPhone Connections Improvements have been implemented to ensure log entries are generated only once when connecting or disconnecting iPhones, preventing duplicate entries. This update enhances clarity and accuracy, reflecting actions performed with devices set to “Deny” permissions, optimizing log management in the specified environment.	371529
DC	Improved File Tracing for Write Events Enhancements have been made to ensure that the EPP client consistently captures File-Write and Read-Write events on network shares and removable devices. Previously, certain file changes, such as edits and saves made using Notepad, Notepad++, or Visual Studio, might not trigger events as expected. This update refines the File Tracing process, increasing the reliability of event detection on Windows for diverse editing applications.	374320
DC	Resolution for Ignored File Size Limit in Shadowing The EPP system has been updated to respect the “Max File Size for Shadowing (KB)” setting, ensuring files exceeding the set limit are not shadowed on macOS systems running Sequoia and above. Previous behavior allowed oversized files to be shadowed and sent to S3 buckets despite size constraints. This enhancement restores expected functionality for effective file management and compliance.	375226	00431461
DC	Enhanced Detection for ASIX Ethernet Adapters on macOS The EPP client now accurately identifies ASIX Ethernet adapters as wired connections, ensuring that Wi-Fi is blocked when these adapters are in use. This improvement uses name detection for ASIX devices to correctly categorize the connection type, providing consistent enforcement of Wi-Fi denial policies on macOS systems.	375955	00434222
DC	Improved Detection of Teensy Board Devices on Windows This update refines device identification by limiting detection to specific VIDs, ensuring more accurate classification of Teensy boards. It corrects previous misclassifications on Windows, such as identifying certain adapters as Teensy boards, and aligns detection more closely with intended device types.	375964	00434607
DC	Enhanced Network Printer Recognition by EPP Client The latest update improves the recognition of network printers by the EPP Client on Windows 10, ensuring seamless identification and integration within the network environment.	375227	00436900
DC	Enhanced WiFi Blocking on Linux The update ensures WiFi is consistently blocked upon policy changes or reactivation without needing a service restart, enhancing enforcement on Ubuntu 22.04 systems.	376531	00435378
DC	Restoration of “Deny-Access but Allow Charging” Functionality The update addresses an issue in version 5.9.4.1 where the “Deny-Access but Allow Charging” setting unintentionally blocked iOS devices, hindering charging. The functionality is restored to ensure devices are not blocked while allowing charging as intended.	377456	00418020
DC	Enhanced File Shadowing for Names with Special Characters Updates have been implemented to ensure files with whitespaces or special characters in their names are successfully uploaded to an FTP server as part of the file shadow repository. Improvements in handling file URL formatting address prior errors, ensuring seamless file tracing and shadowing on Windows systems.	380898
DC	Improved Remediation for Logitech MX Master Mouse Enhancements have been applied to ensure a stable remediation session for the Logitech MX Master Bluetooth mouse. Users will no longer experience intermittent blocking and notifications, allowing uninterrupted use during active remediation sessions with Device Remediation enabled for Bluetooth Mice.	381996
DC	Correction of File Tracing Events on macOS This update refines file tracing for text file edits on macOS, ensuring proper event logging. Previously, edits on removable devices or network shares could lead to incomplete logs. Now, file activities are consistently captured and reported.	384396
DC	Resolution for Mountain Duck Accessibility The update addresses issues where Mountain Duck cloud drive was blocked by EPP settings for “Unknown Devices.” Now, Mountain Duck can start and function properly without errors, even with restrictive device policies in place.	384518	00437196
DC	Adjustment for Handling Multiple Printers with the Same Name This update resolves issues where network printers with identical names were not consistently blocked in Safari when disabled in DC. The system now ensures that all instances of the same printer are correctly recognized and restricted, preventing unauthorized printing.	384608
DC	Improved Enforcement of Bluetooth Permissions on Ubuntu 22.04 The update ensures that Bluetooth permission settings are adhered to on Ubuntu 22.04, preventing manual enablement of Bluetooth devices when permissions are set to Deny.	385745
CAP	Improve Detection of Brazilian PIIs We’ve improved the detection of Brazilian Personally Identifiable Information (PII) by differentiating between CPF and CNH patterns. Due to excess noise generated by CNH, CPF has been separated into its own selectable pattern within CAP/eD policies. Customers will need to manually adjust their CAP/eD policy definitions to accommodate this change and align with their specific requirements. Note: This update requires at least version 5.9.4.2 of the EPP Server and version 5.9.4.3 of the EPP Clients.	342068, 320008, 376836	00419481
CAP	Suppress Windows Notifications When Copying to USB To enhance user experience, we have suppressed Windows notifications that prompted users to Skip, Replace, or Cancel during file copying to USB drives when blocked by a CAP policy. Previously, these notifications could be disruptive, especially when multiple files were copied at once. This improvement ensures a smoother interaction by eliminating the need for user intervention in such scenarios.	343859
CAP	Stop Monitoring XDG Desktop Portals Except for Ubuntu 18.04 We have refined our monitoring processes to reduce unnecessary log noise by ceasing to monitor xdg-desktop-portal* for file access on all systems except Ubuntu 18.04. On Ubuntu 18.04, we will continue to monitor xdg-desktop-portal-gtk to effectively capture file access events, particularly for file pickers used by applications like web browsers. Known Limitation: For Ubuntu versions 18.04, 20.04, 22.04, and 24.04, when using Firefox browsers to navigate through files, the EPP Client may generate false positives.	367650	00433696, 00427782
CAP	Proxy Configuration Management in Endpoint Protector This update ensures that the proxy configuration is accurately reflected post-upgrade, allowing users to disable or adjust proxy settings without residual entries that could affect performance. Users making this transition should now find a smoother experience in adjusting their network configurations according to the new settings.	371451	00427365
CAP	Improved File Scanning for Google Translate Uploads We are addressing the handling of file uploads to Google Translate, enhancing our scanning process to ensure data protection. Currently, limited file types such as .docx, .pdf, .pptx, .xlsx, and images are supported for upload and translation.	374645	00434813, 00435082
CAP	Resolution of False Positive US SSN Detection in PDF Printing We have addressed an issue where false positives for US Social Security Numbers (SSN) were detected when printing threat-free PDFs from OneDrive Business using browser menu options. This release enhances the detection algorithms to mitigate false alarms, ensuring that print jobs proceed smoothly without unnecessary interruptions.	339356	00431461
CAP	Resolution of False Positive US SSN Detection in Webpage Printing We have addressed a regression issue where false positives for US Social Security Numbers (SSN) were detected while attempting to print threat-free webpages from browsers like Edge and Chrome. This update refines the detection process, ensuring webpages without sensitive data can be printed successfully without being erroneously flagged by CAP policies.	339390
CAP	Improved Monitoring of New Microsoft Teams File Transfer on Windows This update enhances the EPP client’s ability to monitor and control file transfers in the New Microsoft Teams on Windows. With improved visibility, the EPP client effectively intercepts and manages file transfers, ensuring they are appropriately monitored and controlled even when DPI is disabled.	340606	0042295, 00417651
CAP	Improved Monitoring for Microsoft Teams on Linux Enhanced the EPP client’s ability to monitor Microsoft Teams activity on Linux. This update ensures that the "teams " process is properly tracked, allowing file transfers to adhere to CAP policies and improving overall compliance with monitoring requirements.	347077
CAP	Refined Identification of Microsoft Teams and Slack Traffic with Proxy Usage An enhancement has been made to accurately distinguish network traffic originating from Microsoft Teams and Slack from that of Chrome when a third-party proxy, like Sophos, is used. Previous configurations led to all traffic being routed through the proxy being incorrectly identified as Chrome, causing scanning irrespective of CAP policy settings.	369085
CAP	Improved Functionality for Safari Browser in Xcode Simulator This update enhances functionality for the Safari Browser in Xcode Simulator on macOS when DPI is enabled. It ensures that webpages load correctly, providing a seamless browsing experience in the simulator environment regardless of the “Intercept VPN Traffic” setting.	343756	00411657
CAP	Enhanced Blocking for Print Screen on Windows 11 This update addresses the issue where the EPP client did not consistently block the print screen functionality on Windows 11 for certain key combinations. The enhancement ensures that all defined scenarios within CAP policies, including Fn+PrintScreen and PrintScreen alone, are effectively blocked, maintaining compliance and security on Windows 11 systems.	364964
CAP	Blocking SnippingTool on Windows 11 with CAP Policy Enhanced CAP policy capabilities to effectively block the SnippingTool executable on Windows 11 when the print screen function is selected.	367687	00438810, 00426022
CAP	Enhanced Stability for Print Screen Blocking The EPP agent has been updated to address issues where print screen functionality might not be consistently blocked due to multithreading complications. By refining the policy loading process to ensure flags are set accurately across threads, print screen operations are now reliably controlled, maintaining security expectations for both Windows 10 and Windows 11 environments.	373916	00426022
CAP	Resolution for Incorrect File Type Reporting in Image Transfers This update enhances the monitoring of files transferred via Airdrop using Drag and Drop on macOS. By implementing a dynamic detection mechanism for temporary file paths, the EPP agent ensures that files are accurately scanned and sensitive data is effectively blocked during transfer using this method.	367340
CAP	Enhanced Airdrop File Blocking for Drag and Drop Actions The EPP agent now better monitors files sent via Airdrop using Drag and Drop on macOS. Through dynamic detection of temporary file paths, files are scanned, and sensitive data is effectively blocked during transfer.	367530	00426475
CAP	Custom Content Denylist for Korea The CAP policy for Korean custom content now effectively blocks files sent via browsers. This update ensures accurate detection and blocking of Korean-language files.	368220	00419610
CAP	Improved Scanning for swisstransfer.com Data Transfers The EPP agent has been updated to ensure accurate scanning of data sent via swisstransfer.com.	368729	00429663
CAP	Enhanced Policy Enforcement with OCR Configuration The policy enforcement has been improved to ensure that image files are accurately blocked by the EPP client when OCR is enabled, regardless of the content. This refinement addresses previous limitations by allowing stricter adherence to image blocking policies without relying solely on detected text content.	370034
CAP	Stability Enhancement for Ubuntu 18.04 Linux Clients Handling File System Events Enhancements have been made to prevent crashes in Linux clients when generating a large number of file system events. Implementing a thread pool addresses the issue of reaching thread count limits, ensuring system stability while handling extensive file operations on removable devices. This improvement optimizes performance and reliability on Ubuntu 18.04.	371646	00432785
CAP	Resolution for Application Denylist Parameters The application denylist has been refined to ensure consistent operation regardless of parameter case sensitivity. Previously, rules with uppercase command line arguments were ineffective, but this update ensures applications are properly blocked irrespective of parameter casing. The fix applies to both Windows and macOS environments, enhancing reliability and functionality in diverse setups.	373725
CAP	Resolution of File Shadowing Issue with Printer Names The EPP system now supports file shadowing for CAP policies irrespective of the characters used in printer names. Previously, special characters like “:” in "http://10.0.1.10 could block shadow creation, compromising the handling of confidential content. This update ensures consistent shadowing functionality, accommodating complex printer names without disrupting operations.	374363	00427161
CAP	Enhanced Stability for EPP Client on macOS The update addresses EPP client crashes during app control by improving the handling of multiple security events. By optimizing message processing, the client now operates smoothly without interruptions when utilizing CAP policies to block applications on macOS.	374276	00428724
CAP	Resolution of CAP File Shadowing Issue The update ensures images are properly shadowed according to CAP policies, addressing previous issues where JPEG uploads were not shadowed despite monitoring on macOS and Linux environments.	376510	00426339
CAP	Enhanced Clipboard Image Blocking on Windows The update ensures clipboard images are blocked effectively under CAP policies on Windows 10 and 11, resolving prior inconsistencies when reporting sensitive information.	376539
CAP	Enhanced Git Upload Blocking on macOS The update addresses the ability to block uploads to “GitHub” using the native Git application on macOS when “Intercept VPN Traffic” is enabled in DPI. This ensures commands over HTTP remotes are effectively restricted under CAP policies.	377208	00430839
CAP	Enhanced Regex Functionality in CAP Policies The latest update resolves issues where not all regex patterns were applied in CAP policies, leading to unblocked transfers. The EPP client now consistently applies multiple regex patterns as defined by administrators, ensuring all relevant transfers are properly monitored and blocked when conditions are met.	380070	00438983
CAP	Enhanced Stability for Notifier Under Clipboard Spam Improvements have been made to ensure the Notifier maintains stability even when subjected to excessive clipboard copy commands. The update prevents freezing, ensuring smooth functionality when clipboard filtering policies are active on Ubuntu 22.04 with recent client versions.	380341	00435758
CAP	Correction for CAP Report Item Count Accuracy An update has been applied to accurately reflect item counts in CAP reports, ensuring reported logs match the set policy criteria. This resolves discrepancies where fewer items appeared than expected, aligning displayed counts with actual detection results.	380525	00427620
CAP	Reduction of False Positives for Rippling.com Enhancements have been made to CAP policy configurations to significantly reduce false positive threat reports while browsing rippling.com. Adjustments improve the accuracy of detection for personal and sensitive data, ensuring more reliable results.	380588
CAP	Improved Regex Support for International Characters This enhancement ensures that content with international symbols, such as Chinese characters, is accurately matched against defined regular expressions, addressing customer concerns.	382013	00440150
CAP	Resolution for Google Meet Performance Issues on macOS Enhancements have been made to address performance issues in Google Meet sessions on macOS, ensuring smooth connectivity and functionality for video and audio.	382020	00429561
CAP	Resolution for Slowness in WebStorm Application Adjustments have been made to CAP policy settings to address slowness experienced in WebStorm and PyCharm applications. The issue was linked to the network share exit point; modifying these settings ensures normal application performance without compromising functionality.	385321	00437363
CAP	Printing Delay Issue Resolved in Special Browser Pages Fixed a printing delay issue where the “Block Print from Browsers” feature caused hangs when printing from special Chrome pages. This update ensures prompt printing on Windows with Edge or Chrome browsers.	388233	00445778
DPI	Reduction of DPI False Positives Related to Cloudflare The update refines DPI scanning to reduce false positives when browsing websites utilizing Cloudflare security measures like bot detection and CAPTCHA. It ensures more accurate monitoring, preventing unnecessary reports during routine navigation on various websites.	384498
DPI	Enhancement to DPI with “Intercept VPN Traffic” Capability on macOS Addressed a limitation where DPI with “Intercept VPN Traffic” could not inspect network traffic for unsigned applications run from non-standard locations on macOS due to sandboxing restrictions. The update improves DPI’s ability to better manage applications launched from non-standard directories, though it may still face challenges without full permissions. Users are encouraged to maintain standard application paths to ensure proper functionality.
DPI	Improved Enforcement for DPI Restricted Apps The update strengthens DPI controls by ensuring that the “Bypass DPI Certificate Rejection by Third-Party Applications” setting does not apply to DPI-restricted apps like Git. This enhancement prevents unauthorized uploads to Git repositories with untrusted certificates, aligning functionality with CAP policies to consistently restrict intended operations.	369796	00430839
DPI	Reduction of False Positives in Google Meet Sessions This update refines DPI functionality to prevent false positive alerts during Google Meet WebRTC sessions, ensuring accurate detection and reducing unnecessary noise in CAP policies configured for Brazil PII.	378052	00423343
DPI	Enhanced Scanning of File Uploads to m365.cloud.microsoft The update improves DPI capabilities to scan and assess files uploaded to m365.cloud.microsoft, specifically targeting requests to graph.microsoft.com with URIs containing /drive/. This enhancement ensures sensitive data is detected and appropriately blocked during uploads from the HOME page, refining CAP policy enforcement for browser-monitored activities.	384336	00442443
General	HOTFIX: EPP Client Version 6.2.5.1004 Crash During Upgrade Upgrading the EPP Client to version 6.2.5.1004 might result in a crash of EPPnotifier.exe due to a missing Microsoft redistributable DLL, causing the client to become unusable.	395207	00449020, 00448903
CAP	HOTFIX: Netwrix Data Classification: PDF Tag Support Issue Fixing issue with the Netwrix Data Classification tags within PDFs were not extracted correctly.	349046	00429414

5.9.4.2 Cumulative Upgrade Patch for Endpoint Protector Server 5.7.0.0 - 5.9.4.1

April 22, 2025

• All updates, fixes, and new features introduced between versions 5.7.0.0 and 5.9.4.2.
• The latest release of the Enforced Encryption (formerly Easy Lock) Client

Version 5.9.4.2 Released

April 3, 2025

Component	Description	Case #	Escalation #
Security	Security fixes This release contains important security fixes for EE. For information on these security fixes, please visit this security advisory. All EE customers are advised to update.	376907, 376911, 376835
Security	Endpoint Protector Server Back End Components Refreshed Upgraded backend components for JQuery	3788110	431347
General	Re-enabling license management on Netwrix hosted environment License management functionality has been restored in the Netwrix-hosted environment	377943
General	Fix “Transfer Limit” alert not to be sent to the deleted administrators Adjusted system configuration, now only the available administrator receives the Transfer Limit Alert. This targeted notification approach ensures timely and relevant updates are delivered to the appropriate personnel, streamlining alert management and response.	344718	411953
General	Alerts cache is not recreated properly Resolved an issue with the alert caching system, where updates made to a CAP alert involving changes to selected computers and users were not properly reflected in the cache. Previously, editing an alert to uncheck or check machines did not result in a correctly rebuilt cache. With this fix, the alert cache will now be accurately regenerated to include all specified machines and users after any modifications.	319858	416406, 409790
General	Ensuring Proper Cache Regeneration After Alert Renaming Fixed an issue where renaming an alert did not trigger the proper regeneration of the cache, leading to outdated or inaccurate information being displayed. With this update, whenever an alert is renamed, the system will now correctly regenerate the cache to ensure all data is current and reliable.	348301	416406
General	Correct Email Address Display in Alert History Resolved an issue where the wrong email addresses were being displayed in the Alert History under Alert Details: Recipient across all alert types. This occurred when an alert was created using the “Check All” option in the Administrator section, which included deleted administrators. With this fix, the system now accurately displays the correct email addresses associated with active administrators in the Alert History.	364793, 366029	426144
General	Group selector improvement Enhanced the functionality within the Computers and Users tables to ensure that selected items remain checked even after clicking the “select all” checkbox while using the search filter.	358129	356518
General	Improved Responsiveness of Dashboard Text Addressed an issue where the text under the Modules section on the General Dashboard was not responsive, causing it to be overlapped by the Most Active Users section when the browser width was reduced to less than 1880px. With this update, the text is now fully responsive, ensuring clear and unobstructed display across all screen sizes.	319927
Device Control	Reliable Computer Name Updates for Mac and Windows Resolved an issue affecting both Mac and Windows computers, where changes to the computer name were not being permanently applied. With this update, any computer name edits are now consistently saved and accurately reflected in the Computer List, ensuring reliable updates across both platforms.	319856
Device Control	Correct Handling of Serial Numbers with “&” in Custom Classes Resolved an issue where adding devices to Custom Classes using the Bulk Import or New Device options resulted in incorrect handling of serial numbers containing the “&” character. This led to improper saving of these devices and misapplication of device rights. With this fix, serial numbers with “&” characters are now correctly processed, ensuring accurate saving and application of device rights.	370345	430816
Content Aware Protection	Results are not sorted when using specific filter in CAP reports Improved sorting and filtering capabilities to allow results to be organized according to any specified column.	351200	351168
Content Aware Protection	MPIP reporting details We’ve refined the reporting details for the Content Remediation Session Active log. Now, the ‘Items Type’ column prominently displays the ‘MIP Classification,’ offering clearer insight and a more organized view of your data management activities.	355766
Content Aware Protection	Denylists/Allowlists dictionaries import Resolved an issue where an invalid .xls file import would incorrectly create a dictionary despite showing an error message. Now, the error “Import failed! Please use a valid .xls file!” will be displayed, and no dictionary will be created, ensuring accurate data handling and user notifications.	359542
Content Aware Protection	Resolved Export Issue in Denylists/Allowlists Sections Addressed a problem affecting the export functionality in the Denylists/Allowlists sections, where exporting a dictionary containing 50,000 items would result in a “no results” message upon opening the file. This issue has been resolved, and exports will now correctly display all items as expected.	359501
Content Aware Protection	Fixed Misidentification of Microsoft Outlook as Microsoft Teams by Endpoint Protector Client Resolved the issue where the Endpoint Protector Client was incorrectly identifying Microsoft Outlook as Microsoft Teams. With this fix, Microsoft Outlook is now properly recognized, ensuring accurate monitoring and protection for the correct application	367917
Enforced Encryption	Enhanced Security for Offline File Tracing with Enforced Encryption We’ve enhanced the security of our Enforced Encryption feature, specifically when configured for “Offline File Tracing.” With this update, file encrypt/decrypt events are now securely encrypted, ensuring that offline file tracing events are uploaded to the server only after the user logs into Enforced Encryption (EE) with their password.	362675

Version 5.9.4 Released

December 12, 2024

See the Endpoint Protector 5.9.4 Bug Fix List for a list of bugs fixed in this version.