New option to run Oracle inventory outside of BeaconEngine.exe

Affected FlexNet Beacon versions: All versions

Previously, Oracle inventory would run inside of the BeaconEngine.exe process. When a FlexNet Beacon was attempting to gather Oracle inventory from a large number of databases (10K+), the BeaconEngine.exe process could crash due to memory issues. From this release, users have a new option to run Oracle inventory outside of that process. The enhancement adds an external process execution option for Oracle inventory. To enable this option, add the ExternalProcessExecution registry entry with the value, Oracle, for the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\ManageSoft Corp\ManageSoft\RemoteExecution\CurrentVersion. For more details, see Troubleshooting Zero-footprint Collection of Oracle Inventory in the Online Help.

Fix for FlexNet Beacon Policy revision number incrementing every time a FlexNet Beacon made a policy request with an older InventorySettings.xml

Affected FlexNet Beacon versions: All versions

Previously, when a FlexNet Beacon made a policy request with an older InventorySettings.xml, and the FlexNet Beacon was not able to save the new policy, subsequent policy requests would be made causing the FlexNet Beacon Policy revision number to be incremented. With this fix, the FlexNet Beacon Policy revision number now correctly increments only when a change made actually requires a policy update.

Fix for Oracle VM Manager inventory task failing when the server is not part of the server pool

Affected FlexNet Beacon versions: All versions

Previously, the Oracle VM Manager inventory task could fail when a server managed by OVM reports a null value for serverPoolId, which would occur when the server was not part of the server pool. This issue has been resolved.

Fix for a ComplianceReader logging issue that was occurring when another ComplianceReader process is already running

Affected FlexNet Beacon versions: All versions

When a ComplianceReader process was already running on FlexNet Beacon, and a new ComplianceReader process begins, the new ComplianceReader process would be terminated. This termination is expected behavior; however, no indication that the process was terminated was ever reported in the log file. This issue has been resolved.

Bundled software version updated

OpenSSL has been upgraded to version 3.0.13 in this release of the FlexNet Beacon to address known security vulnerabilities.

Fix for issue with the FlexNet Beacon attempting to download deprecated agent packages

Previously, there was an issue where the beacon policy could still contain references to deprecated agent packages. This led to the FlexNet Beacon attempting to download an agent package, despite it being deprecated leading to the possibility of logging a download error in the BeaconEngine.log. This release resolves this issue.

FlexNet Beacon can now encrypt NDI, DISCO, ACTIVITY, and BSTAT files

The inventory beacon now has the capability to encrypt the data contained within the inventory (NDI), discovery (DISCO), activity (ACTIVITY), and beacon status (BSTAT) files it generates. This capability encrypts the inventory data on the machine hosting the beacon and helps prevent inventory files from being viewed or modified by malicious actors.

This requires a setting to be enabled, which at present needs to be done on the customer's behalf by Flexera. Contact Flexera support to enable this setting.

Another requirement is that ALL agents AND ALL beacons in the customer's environment must be upgraded to at least version 21.0.

Fix for an issue with copying the import activity file

Previously, there was an issue where copying the import activity file when UploadActivityToOneFlexera registry was missing would fail. This release resolves this issue.

Fix for an issue with the use of proxy

Previously, there was an issue where the inventory beacon might not function properly if the use of a proxy had been enabled and then disabled again and a specific sequence of steps had taken place prior to the disable operation. This release resolves this issue.

Fix for an issue with the Oracle RDS database inventory

Previously, there was an issue where the Oracle RDS database inventory process did not generate an .NDI file in some cases. This release resolves this issue.

New support for proxy authentication in the FlexNet Beacon UI

Previously, proxy connections on an inventory beacon could only be configured manually in the Windows Registry but not in the FlexNet Beacon application. In addition, only the anonymous authentication method was supported, which meant that users could not set up proxy connections requiring authentication with user name and password.

From this release, the FlexNet Beacon application supports proxy configuration for both anonymous authentication and authentication with user name and password. Users no longer need to edit the Windows Registry and can set up proxy connections with either authentication method directly in the FlexNet Beacon UI.

For more details, see Configuring for Proxy Servers in the online help.

New support for complex passwords in user-defined connection strings

Previously, when connecting to third-party inventory sources using user-defined connection strings, users could not use complex passwords that contain certain characters, such as "=" and ";". From this release, the FlexNet Beacon supports complex passwords to be used in those connection strings.

Fix for an issue with the FlexNet Beacon UI

Previously, in some particular cases where an inventory connection was not saved yet and a new beacon version was available to install, the FlexNet Beacon UI would have unexpected behaviors. This release resolves this issue.

Fix for an issue with the Beacon Password Manager

Previously, there was an issue where the Beacon Password Manager might fail to handle some OpenSSH private keys. This release resolves this issue.

Bundled software version updated

OpenSSL has been upgraded to version 3.0.11 in this release of the FlexNet Beacon. This update also resolves a security vulnerability (Common Vulnerabilities and Exposures ID CVE-2023-4807).

New method to perform business adapter imports

Previously, for cloud-connected inventory beacons, users could only perform business adapter imports from the FlexNet Beacon console, either manually or by using the scheduling function. From this release, users no longer need to only rely on the FlexNet Beacon application to perform business adapter imports. While business adapter imports still need to be created with the FlexNet Beacon application, you can now execute existing imports outside the application by using the FlxBizAdapterImporter command line tool. For more details, see Command Line for FlxBizAdapterImporter in Using FlexNet Business Adapters.

Fix for the issue with insufficient logging information

Previously, in some particular cases where a package file could not be uploaded due to a problem in the file itself, the information in the log file was not informative enough for the user to diagnose the cause for the failed uploading. This release resolves this issue.

Fix for the issue with the UI logging file

Previously, there was an issue that caused the inventorybeacon.log file not being generated when the FlexNet Beacon UI was started. The inventorybeacon.log file contains logging information about the FlexNet Beacon UI. This release resolves this issue.

Bundled software version updated

OpenSSL has been upgraded to version 3.0.9 in this release of the FlexNet Beacon.

Fix for the issue with inventory upload

Previously, there was an issue with the FlexNet Beacon where the inventory upload might fail if the connection name contained a trailing space. This release resolves this issue.

Fix for the issue with UI refreshing

Previously, in the rare case where an event tried to refresh the FlexNet Beacon UI before the UI was completely initialized, an error might occur. This release resolves this issue.

Fix for the issue of beacon not starting after automatic upgrade

Previously, there was an issue with the FlexNet Beacon where the beacon might not start after the automatic upgrade from versions earlier than 19.2.0. This release resolves this issue.

Fix for the issue with the CheckCertificateRevocation property

Previously, there was an issue with the CheckCertificateRevocation property which was always set to be true while it should be set to the same value as the CheckCertificateRevocation registry key. This release resolves this issue.

Bundled software version updated

OpenSSL has been upgraded to version 3.0.8 in this release of the FlexNet Beacon.

Fix for an issue in VMware discovery

Previously, there was an issue with the mgsvisdk.dll module, which might cause the beacon engine service to be terminated during VMware discovery. This release resolves this issue.

Bundled software versions updated

OpenSSL has been upgraded to version 1.1.1t in this release of the FlexNet Beacon.

Fix for the issue of default active directory connection

Previously, the FlexNet Beacon had a default active directory connection, which could cause unintentional import and processing of active directory data and unnecessarily increase the load in IT Asset Management resolvers. From this release, the FlexNet Beacon no longer has a default active directory connection.

Changes to the configuration file download URL

Previously, clicking the Download Configuration button in the FlexNet Beacon would take the user to the URL https://flexnetmanager.xx/Suite. From this release, clicking this button will take you to https://app.flexera.xx.

Bundled software version updated

The zlib utility, used for data compression, has been upgraded to release 1.2.13.

Fix for the issue with MgsIPScan

Previously, the MgsIPScan process might fail if the x86 (32 bit) Visual C++ Redistributable Package for Visual Studio 2013 was not installed. This release resolves this issue.

Fix for the issue of tasks not running at the correct scheduled time following daylight saving time (DST) changes

Previously, after the daylight saving time (DST) was applied on a FlexNet Beacon, the import tasks might not run at the correct scheduled time. This release resolves this issue.

Fix for the agent policy download failure upon absence of IP address

Previously, when there was no IP address specified in an agent policy request, the policy download from a FlexNet Beacon might fail. This release resolves this issue.

Fix for the issue of rules not running at the correct scheduled time following time zone changes

Previously, after the time zone or daylight savings setting of a FlexNet Beacon was changed, discovery and inventory rules might not run at the correct scheduled time until the beacon engine service was restarted. This release resolves this issue.

Bundled software versions updated

OpenSSL has been upgraded to release 1.1.1q in this version of the FlexNet Beacon.

Bundled software versions updated

The following pieces of software that are bundled with the FlexNet Beacon have been updated in this release:

• OpenSSL has been upgraded to release 1.1.1o in this version of the FlexNet Beacon.
• The zlib utility, used for data compression, has been upgraded to release 1.2.12.

Fixes

• Oracle database inventory now generates trace level logging when trace level logging has been enabled in the FlexNet Beacon.

New scheduled task "Upload Flexera inventories"

A new scheduled task called Upload Flexera inventories has been added to the FlexNet Beacon. This task uploads Flexera inventory files to the inventory server in parallel to the Upload Flexera logs and inventories scheduled task.

Inventory connection types updated

On the  Inventory systems page of the FlexNet Beacon, the inventory connection source type Tivoli Endpoint Manager has been removed, and a new source type  BigFix Inventory has been added.

Bundled software versions updated

The following pieces of software that are bundled with the FlexNet Beacon have been updated in this release:

• OpenSSL has been upgraded to release 1.1.1n in this version of FlexNet Beacon.
• The RestSharp library used by some PowerShell-based connectors has been upgraded to release 106.15.0 in this version of the FlexNet Beacon.

Bundled software versions updated

Several pieces of software that are bundled with the FlexNet Beacon have been updated in this release, including some noncommercial software components:

• Microsoft Visual C++ 2019 Redistributable Package (x86) is shipped with, and automatically installed with, FlexNet Beacon. This package has been upgraded in this release from the 2010 to the 2019 FlexNet Beaconversion.
• OpenSSL has been upgraded to release 1.1.1m in this version of the FlexNet Beacon.
• The nmap utility is used within the MgsIPScan component, and with this version has been upgraded to release 7.92.

File replication settings to capture uploads for review

A new file Replication page in the FlexNet Beacon interface allows you to save local copies of selected types of files received by the inventory beacon before they are uploaded to the parent device (either another inventory beacon in the hierarchy, or the central application server). This option supports troubleshooting and diagnosis, and is intended for temporary use, with saved files being automatically removed after your specified period, so that you don't overrun the disk space in the inventory beacon server. This configuration must be applied individually at each inventory beacon where you are conducting your investigation — there is no equivalent available through the web interface of IT Asset Management for setting up file replication across all inventory beacons.

Mutual TLS configuration is documented

With configuration of UNIX-like inventory devices now available to support mutual TLS for authentication of HTTPS communications with inventory beacons (see the topic in Features by Release), documentation about configuring an inventory beacon for mutual TLS has been added to the online help under Inventory Beacons > Local Web Server > Configuring Mutual TLS.

Supports client secret for Microsoft 365 connector

When you configure the Microsoft 365 connector on your updated inventory beacon, a new Authenticating Flow option lets you select Client Credentials, which exposes the Client Secret field where you can paste in the client secret created for you in the Azure AD portal. Related online help topics, as well as the Inventory Adapters and Connectors Reference, have been updated appropriately.

Fixes

• An inventory collection target created using the Cloud service provider or region option for Define machines to target no longer prevents the download of inventory beacon policy to inventory beacons earlier than release 16.3.0. Policy now downloads successfully to older inventory beacons.
• As an alternative to using IIS to point to a separate web server, an inventory beacon may use a self-hosted web server. This fix corrects a failure of the self-hosted web server to start.

Improved Amazon connector

The Amazon connector available on each inventory beacon, which previously allowed connections only to Amazon Elastic Cloud Compute (EC2) instances, now also automatically discovers instances of Oracle Database running in Amazon Relational Database Service (RDS). This discovery is particularly important where you plan to bring your own license (BYOL) by transferring entitlements previously purchased for on-premises installations to cover the database running in this cloud service provider's environment. For more information, see the Features by Release documentation available at https://docs.flexera.com/.

Supports early adopters of inventory tasks

From this release, the FlexNet Beacon supports the use of new "inventory tasks" to collect VMware inventory. This simplified approach is currently available only to IT Asset Management customers who are also using IT Visibility; and use also requires an updated license for IT Asset Management to turn on the functionality in the FlexNet Beacon. For more information, please see the Features by Release document.

Customize data locations on your inventory beacon

A new registry value lets you customize the locations of inventory beacon log files and configuration files by specifying the common parent folder as [Registry]\Beacon\CurrentVersion\DistributionLocation. A companion DATADIR variable can be included in answer files used for automated installation/upgrades, or can be used on the command line to run the beacon installer. For more information, see the Features by Release document.

Fixes

• If you choose to install the FlexNet Beacon software in a custom location (such as on the D: drive rather than the C: drive), the self-updating mechanism has been improved to preserve registry settings through an upgrade.
• Updates to FlexNet Beacon now also update settings for the system file shares: mgsREA$, ManageSoftREA$, mgsRET$, and ManageSoftRET$.
• Connectivity of an inventory beacon to the central application server through an intermediate proxy server is improved, with the https_proxy and http_proxy values saved in the local registry path HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\ManageSoft Corp\ManageSoft\ under both Launcher\CurrentVersion and Common.

Filters for overlapping inventory imports added to selected connectors

With this release of the inventory beacon, the new PowerShell-based ServiceNow inventory connector has additional Overlapping Inventory Filter settings available to set the desired behavior when there is overlapping inventory imported from multiple sources. A typical setting is to make your FlexNet inventory top priority, and then set the ServiceNow inventory connector to Import the inventory from this source for possible merging. This setting allows for any extra data points in that secondary source to augment the basic inventory record, without overriding values returned as part of the FlexNet inventory import. See the Inventory Adapters and Connectors reference for further details about the ServiceNow inventory connectors.

Improved policy management reduces agent 404 errors

Improved management of the inventory beacon cache now prevents delivery of FlexNet Inventory Agent policy when there are cache issues. (Previously, these cache issues could cause invalid URLs to be delivered in policy, triggering future 404 errors when these URLs were accessed.) Typically the cache self-repairs before the next policy request is received; but if not, the normal fail-over mechanism means that installed FlexNet Inventory Agents request their next policy update from another inventory beacon that is able to respond.

Changed handling of fail-over settings packages

Each download of policy from the central application server to all inventory beacons includes a fail-over settings package, which lists all inventory beacons configured for anonymous authentication, as these provide the upload and download locations accessible to all installed FlexNet Inventory Agents. Previously, the schedule for agents requesting the fail-over settings packages could cause problems, possibly resulting in 404 errors when the downloads were requested. This process has been simplified, with agents now requesting the fail-over settings package as part of processing their downloaded agent policy, reducing the possibility of errors.

Inventory beacon processing improved

Previously, a lightly loaded inventory beacon could return an end-of-task message that arrived at the central application server before its corresponding start-of-task message. If this sequence happened, the start-of-task, arriving late, never got closed, giving a false appearance of a task that had hung and never completed. Processing has now been improved so that start and end messages are kept in strict sequence, and the false 'hung tasks' appearance can no longer occur at the central application server.

SAP connections support Secure Network Communication (SNC)

The configuration page in FlexNet Beacon for setting up a connection to an SAP system (whether it's an Independent SAP System or an Admin Module, or a dependent system accessed through an Admin Module) has been enhanced to support SNC, on a system-by-system basis. Once your SAP system is correctly configured for SNC, it is a simple matter of defining a few values on your connecting inventory beacon to use that facility. You can choose the level of security, from simple authentication, through integrity checking and encryption, to the maximum protection offered by your SAP system.

Updated Tanium connector

The FlexNet Beacon includes an updated connector for use with Tanium Asset release 1.8.0.0075 or later. At that release, Tanium Asset changed the API methods for reporting inventory of Microsoft SQL Server, and the new connector works with that changed API.

Time window for inventory collection from Independent SAP systems

The FlexNet Beacon interface now offers a choice of time frames for inventory collection from an Independent SAP system:

• You may choose a rolling time window that defaults to 3 months, but the time window can be set to your preferred number between 1-12 months.
• You can select the previous calendar year (this automatically toggles over next January 1).
• You can set a fixed start date and end date, and reset these values manually when the end date passes (this option is useful for investigating particular issues).

Supports connector to Flexera One SaaS Management

The set of inventory beacon connectors, configured by PowerShell (5.1 or later), is extended to include a connector for Flexera One SaaS Management:

• Allows managed service providers (MSPs) running their own cloud implementations of IT Asset Management to link to Flexera One SaaS Management (which runs only in the Flexera cloud)
• Note that for customers using IT Asset Management in the Flexera cloud, no inventory beacon connector of any kind is needed: since both products are within the Flexera cloud, integration is as easy is setting a check box.

Fixes

• Corrects an issue where, after a failure to download beacon policy, an inventory beacon could flood the endpoint with repeated policy requests. Repeated requests now adhere to the standard 15-minute timing.
• Corrects a problem where inventory beacons for release 2019 R2 (14.0.0) set incorrect permissions on securely signed upgrade packages, so that child inventory beacons could not download them and therefore could not self-upgrade.
• Corrects an issue where, after download of a revised beacon policy, requests from multiple inventory devices for updated device policy could drive CPU usage on the inventory beacon to 100%. This usage could delay delivery of device policy to locally installed FlexNet inventory agents. Customers using release 14.0.0 inventory beacons should consider upgrading them to release 17.0.1 or later to take advantage of these repairs.

Supports inventory imports from Tanium

The set of inventory beacon connectors, configured by PowerShell (5.1 or later), is extended to include a connector for Tanium:

• Supports Tanium Server (7.3.0 or later) running Tanium Asset (1.6.3 or later).

Support for macOS 10.15

FlexNet Beacon 14.0.0 introduces support for macOS 10.15 (Catalina):

• Adoption: Contains updated functionality to adopt devices that are running macOS 10.15. If you are attempting to adopt a Mac with macOS 10.15 installed, FlexNet Beacon version 14.0.x or later is required. If you deploy FlexNet Inventory Agent to macOS 10.15 machines by third-party means (without using IT Asset Management device adoption), it is not necessary to upgrade the FlexNet Beacon.
• Zero-footprint inventory gathering: Contains updated functionality to remotely gather inventory from a macOS 10.15 inventory device. If you are attempting to run an inventory scan remotely on a Mac with macOS 10.15 installed, FlexNet Beacon version 14.0.x or later is required. If you are not using remote inventory gathering for macOS 10.15 machines (for example, using FlexNet Inventory Agent installed locally instead), upgrading your FlexNet Beacon is not necessary.

Fixes

• Reduces the FlexNet Beacon engine’s DNS lookups to avoid situations where too many DNS reads occur, and limits DNS reads so that there are no reads outside the subnet assigned to each particular FlexNet Beacon. (As background, FlexNet Beacon executes DNS read calls when a FlexNet Inventory Agent requests a policy file and when a discovery rule runs.)
• Corrects a problem in environments that use a parent/child inventory beacon hierarchy, where child inventory beacons were not properly downloading adoption and upgrade packages from their parent inventory beacon. The fix requires that FlexNet Beacon version 14.0.x or later is installed at all points in the inventory beacon chain leading to child inventory beacons. inventory beacons that have no descendents do not need to be upgraded.
• Corrects an issue for certain releases of the FlexNet Beacon installers included with IT Asset Management that create an incorrect BeaconMode registry entry. This entry results in issues with the FlexNet Beacon for the customers who had auto-upgrade enabled or who manually upgraded their inventory beacon to version 13.5.x through 13.8.x.
  Note: Those inventory beacons will work with a one-time manual fix to delete the BeaconMode registry key after inventory beacon upgrade from: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\ManageSoft Corp\ManageSoft\Beacon\CurrentVersion.
  For more details, see the instructions provided in Knowledge Base article “Restoring operations for inventory beacons 13.5.x-13.8.x”. Alternatively, you can upgrade to the latest FlexNet Beacon version 17.0.1 (or later) in the Beacon version approved for use dropdown in the Beacon settings section of the Inventory Settings page.
• The Active Directory import can import AD data only from the same domain where the inventory beacon is connected.
• Fixes issues where discovery failed completely when an invalid IP address range, such as 255.255.255.0/24, was configured as a subnet.
• Fixes reported issues where discovery failed to inter-operate with port 443 correctly.
• Fixes an issue where the connection string for an inventory connection was lost upon closing and reopening the FlexNet Beacon interface on a stand-alone inventory beacon.

Update of MgsIPScan

An internal tool used by FlexNet Beacon during network discovery is updated at this release:

• MgsIPScan has been upgraded to the latest version that has a number of improvements and uses the latest version of OpenSSL.
• The new MgsIPScan includes the Npcap packet capture utility. The old version used WinPcap, which is now deprecated.

Supports restricting FlexNet Inventory Agent communication to selected inventory beacons

Inventory groups can be used to restrict FlexNet Inventory Agent communication to a subset of your inventory beacons. Limiting which inventory beacons can be contacted by which FlexNet Inventory Agents may help reduce infrastructure overhead, giving you more control over the load balancing of communications, uploads, and network traffic. Inventory groups are specified on the Inventory Settings page of the web interface; and operation requires that version 17.0.1 (or later) of FlexNet Beacon is installed.

Supports targeted upgrades of FlexNet inventory agent

The internal filtering of targeted inventory devices has been enhanced to allow for transfer of specified upgrade packages for FlexNet Inventory Agent to devices identified in the target and not to other devices. This is a precondition that supports specifying such targeted upgrades through the web interface.

Fixes

• Corrected an error within a multi-beacon environment where the local FlexNet Beacon failed to insert its own upload endpoint into the agent policy.
• The Active Directory import can import AD data only from the same domain where the inventory beacon is connected. Typically this means that the FlexNet Beacon software is installed on your application server (or batch server in larger implementations), so this applies only to on-premises implementations.
• This update fixes issues where discovery failed completely when an invalid IP address range, such as 255.255.255.0/24, was configured as a subnet.
• This update fixes reported issues where discovery failed to inter-operate with port 443 correctly.
• Fixes an issue where the connection string for an inventory connection was lost upon closing and reopening the FlexNet Beacon interface on a stand-alone inventory beacon (that is, one that is not co-located on the application server, or batch server in larger implementations).

Enhancements to Salesforce adapter

Enhancements have been made to the Salesforce adapter to support sandbox connections:

• Added the ability to set the Salesforce (SF) URL for OAUTH so that a sandbox version of SF can have its own adapter
• Added the "default" URL to the beacon UI so that it will populate for a 2018 R3 inventory beacon
• Added a default URL to the Logic.ps1 for use when nothing is passed to the PowerShell methods that now require a SF URL parameter.

Fixes

• Corrected an error where the FlexNet Beacon may not have served policy to the FlexNet Inventory Agent when the IBM PVU mode was enabled.
• FlexNet Beacon uses TLS 1.2 by default on platforms that support TLS 1.2.

Add a connection to AWS EC2

IT Asset Management automatically recognizes computing instances located in Amazon Web Services Elastic Compute Cloud, provided that you create a connection to your AWS EC2 services on an appropriate inventory beacon. This connection then identifies the instances and (where used) dedicated hosts; but to gather software inventory from those instances for license management, best practice is to deploy the FlexNet Inventory Agent as part of the Amazon Machine Image used to instantiate your instances. For full details about making connections, see the online help topic Managing AWS EC2 Connections.

Helping your migration to SAP S/4HANA

The SAP Connection dialog has a new dropdown menu to identify the SAP suite type to which you are connecting. The S/4HANA suite option is supported only for Independent SAP systems, where new migration and license surplus fields within FlexNet Manager Suite allow you to plan for, and track, your migration from the Classic Business Suite to S/4HANA. For more details, see the online help topic Creating SAP Connections, or see the FlexNet Manager for SAP Applications User Guide.

Improved security for password testing

When an inventory beacon attempts remote execution for adoption or inventory gathering on a device, it tests suitable credentials against the device until one account name/password pair from the Password Manager vault succeeds. You have always been able to 'filter' a credential so that it is tested only against devices matching your filter. By default, unfiltered credentials are tested/used only after all matching filtered credentials have failed to grant access. However, from this release, you can entirely prevent the use of unfiltered credentials simply by selecting the Use only filtered credentials checkbox on the Password Manager page on your inventory beacon(s). As well, a new Filters column on the list of available credentials helps manage which credentials have filters and which have none (so far). Since filters can be as specific as matching a single device, you can enforce the use of filters to prevent testing a large number of credentials across wide sections of your network. Full details are in the online help topic Using Password Manager.

Upload visibility and improvements

Changes include:

• Enable TCP keepalives during uploads to avoid timeouts on intermediate network devices
• Limit reuse of HTTP connections to work better with load balancers
• Upload files in date order to improve fairness and predictability when there are many files awaiting upload
• Report versions of Beacon prerequisite software to assist in planning of upgrades
• Report age, number, size, and type statistics on files awaiting upload.

Fixes

• Locally installed FlexNet Inventory Agent now supports inventory of Oracle 12c pluggable databases.
• On SuSE 12 SP2 and later, installation of FlexNet Inventory Agent no longer fails when ndtask.service cannot start.
• On UNIX platforms, agent-based Oracle inventory no longer fails when there are restricted permissions on Oracle directories.
• Upgrading FlexNet Inventory Agent on CentOS / Oracle Linux 7.4 no longer fails when earlier version does not support custom paths.
• On macOS, installation of FlexNet Inventory Agent no longer stops when MGSFT_RUN_CONFIGURE is not found (one device may be skipped, and installation on other devices continues).
• When BeaconEngine.exe calls ActiveDirectoryImport.exe, it no longer uses plain text passwords in the command line.
• Beacon status update now updates LastKnownActivityTime even when LastKnownActivityTime was not previously set.

Configurable timeout for credential checking

The first step in remote execution tasks for the inventory beacon is to test whether the supplied credentials can connect to the target device. This preference sets the maximum count of seconds that the inventory beacon may wait for a response before logging the attempt as a connection failure. When the registry key is not present, the default value is 30 seconds. You may override this default by registering a new value in HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ManageSoft Corp\ManageSoft\RemoteExecution\CurrentVersion.

Fixes

• Beacon Engine crashes while collecting VMware inventory from a large number of ESX servers or VMs.

Upgrades for inventory beacon strongly recommended

It is mandatory to upgrade to version 12.4 for those inventory beacons that communicate with the application server and wherever digital signing is implemented for downloaded beacon policy.

• Digital signing of policy is always on for cloud-based implementations.
• For on-premises implementations, digital signing defaults to off, but it may have been turned on as part of system configuration.

Support for CyberArk credential storage

The Password Manager on each inventory beacon is updated to support:

• Encrypted credentials stored locally in the registry of the inventory beacon (as always), and
• Queries to request credentials stored in a CyberArk Vault.

Integration is handled by the CyberArk Credential Provider, locally installed on the inventory beacon. This release also includes the ability to customize the Application ID by which CyberArk recognizes IT Asset Management when it requests credentials.

For more details, see the enhanced online help for inventory beacons, or refer to Inventory Beacon Credentials for Other Computers in System Reference.

XenApp server agent changes

For on-premises customers, the XenApp server agent is enhanced to allow replacing the staging database with direct upload to an inventory beacon (and from there uploading to the compliance database). This change may be helpful where the normal staging database represents an unnecessary administrative overhead, or a security risk.

ACE support for business adapter imports

At this release, the OLEDB provider used for imports of .xslx, .xls, or .csv files imported through the Business Importer (using a business adapter) is changed from JET to the 32-bit version of the Microsoft ACE OLEDB 12.0 Provider.

Fixes

• DES and 3DES have been removed as fail-over encryption technologies (AES is used and is now ubiquitous across all supported platforms).
• Downloads of signed inventory beacon policy no longer fail their signature check on inventory beacons 12.3 or later. This backward compatibility is expected to apply through future updates of the central application server.
• Unhandled exceptions accessing BeaconPolicy.xml are repaired.

Support for IPv6 address families

Support includes the following:

• Both IPv6 and dual stack (IPv6 and IPv4) networks are supported, in addition to existing IPv4 support.
• Communication between installed FlexNet Inventory Agents and an inventory beacon may use IPv6.
• Communication between an inventory beacon and its parent may use IPv6.
• Communication between an inventory beacon and a dual-stack application server (for on-premises implementations) may use IPv6. (For cloud implementations, the top-level inventory beacon(s) must be dual stack, as the Flexera cloud servers are all located in IPv4 networks.)

• Remote execution does not support IPv6 address families. This limitation includes adoption (use third-party deployment instead), zero-footprint inventory collection, VMware host scans, and all other remote execution tasks.
• Files downloaded to FlexNet Inventory Agents cannot use the IPv6 address family (since legacy agents cannot process this format). Instead use device names or fully qualified domain names in these files.

New registry settings on inventory beacon for configuring discovery

See online help under Inventory Beacons > Inventory Beacon Reference > Registry Keys for Inventory Beacon for:

• DefaultPingSweepOptions
• DefaultPortScanOptions
• DefaultTcpScanTypeOptions
• DefaultUdpScanTypeOptions.

Fixes

• Dependent SAP systems newly added in Beacon do not refresh in the SAP systemlandscape in the IT Asset Managementweb interface
• Level 1 Oracle customers (holding the EDS Oracle Option license term) are unable to import Oracle inventory
• Process started from inventory beacon needs full path specified
• Inventory support for vSphere 6.5
• Issues with Office 365 inventory gathered through a proxy
• Security improvements when the Business Importer is run from an inventory beacon.

Fixes

• Beacon inventory imports are left "In Progress" if PackageUploadTriggersWriters setting is disabled.

Security fixes

• Security vulnerability in inventory upload processes. This vulnerability has a CVSS score of 10.0, and is classified as CWE-22 Path traversal.
• Security vulnerability in third-party inventory upload processes. This vulnerability has a CVSS score of 10.0, and is classified as CWE-22 Path traversal.

Fixes

• Invalid IP address causes discovery process to fail
• Beacon policy download times out due to IT Asset Managementapplication server taking too long to calculate targets
• FlexNet Inventory Agent ignores the Do not rerun after success setting.

Rules execution

• Improved scoping and adherence to scope settings
• Use of previously discovered devices for inventory
• Performance improvements for rules execution
• Ability to perform only Discovery or Inventory or both operations
• Separate in-scope and out-scope list of devices discovered
• Improved algorithms for de-duplication and normalization of the devices, and the services discovered on those devices.

Fixes

• Setting a target using name matching now works predictably
• Manually running a rule through the FlexNet Beacon UI when a rule is already running causes the currently running rule to fail.

IT Asset Management (On-PremisesCloud)

2023 R2.4Current