Tanium Cloud Enforce Updates & Release Notes

Improvements

• Added Tanium TSL scripting engine support for the Machine Policy Status sensor on Windows.
• Windows Firewall v2 (GPO apply) policies now hide the policy-level Rule Management field and show a banner explaining that rule merging is set per network profile.
• Dependency updates.

Resolved Issues

• Fixed a crash that could occur when processing malformed Kubernetes cluster label data.
• Fixed a search issue where a limited-rights user searching for FileVault recovery keys triggered a request for up to 1,000 keys on the first keystroke.
• Fixed an issue where FileVault keys beyond the first 1,000 were re-encrypted every 5 minutes.
• Fixed an issue where limited-rights users saw no results when searching for FileVault recovery keys.
• Fixed excessive action creation by improving cleanup logic to ensure only one status action exists at a time.
• Fixed the Machine Policy Status sensor so fully superseded policies are reported as Superseded instead of Error.
• Importing a Group Policy Object (GPO) backup that contains no supported settings now shows a clear error instead of a false success message.
• Security Updates.

Dependency updates

• Dependency updates.

Improvements

• Windows Enforce security sensors now use TSL in TSL enabled environments. This is a modernization to the underlying implementation of Windows security sensors (Anti-Malware, Host Firewall, USB Device, AppLocker, and related sensors) with no change in reported data or behavior.
• Removed the retired Mac Device Management pages from Enforce; visiting an old bookmarked link now redirects to the Overview with a notice instead of showing a broken device list.

Resolved Issues

• Enforce no longer stops delivering all policy enforcements when one enforcement's stored targeting cannot be used. Such an enforcement is held back with its already-delivered configuration left in place, reported in the service log and through the new unusableTargetingReason field on the enforcement, and picked up automatically once the targeting is corrected. Environments where the sync had been blocked will see every change made during the block delivered in one step after upgrading, and deletions of removed enforcements resume.
• Fixed a policy validation gap that allowed the BitLocker Drive Encryption registry key to be added as an extra ADMX setting when its path was typed with different capitalization.
• Fixed an issue that prevented FileVault recovery keys from syncing for some newly-enrolled Mac devices.
• Fixed an issue where enforcement creation and updates failed after the legacy mobile device management service was uninstalled.
• Improved Enforce server reliability by removing its dependency on the legacy (v1) MDM service, so an unreachable MDM no longer prevents the server from starting or serving enforcement lists.
• Security Update.

Resolved an issue where enforcements targeting a question saved under a non-default persona were incorrectly flagged as malformed, which could halt delivery of all Enforce policy changes to the endpoints. Enforcements now save and sync correctly regardless of the persona used.

Fixed an issue where importing an Enforce policy would fail for users whose write access was scoped to a custom content set. Policy import now works without requiring a default Tanium content set, restoring parity with the create and duplicate flows.

Increased the character limit for the List of SIDs field in Security Settings > User Rights Assignment. Large SID lists that previously exceeded the field's character cap. Configurations with many individual local account entries can now be entered and saved.

Improvements

• Added a new "Superseded" enforcement status that appears across the Enforce API, metrics, and trends dashboards alongside applied, error, and unsupported counts. Superseded status is now reported consistently whether a policy was applied through a legacy or current enforcement path, and Windows Firewall enforcement now correctly indicates when a policy has been superseded by another.
• Windows Firewall policies now support choosing the policy application method.
• Added the latest Windows Server 2025 October ADMX templates, including Windows AI, Secure Boot, and Internet Explorer policy settings.
• Windows Firewall rules now validate IP addresses in real time, flagging invalid addresses immediately rather than when saving.
• Policies can now be targeted based on endpoint client version, letting administrators scope enforcement to endpoints that meet the required capabilities.
• The policy-type search filter now returns results instantly, without waiting on a network request.
• Added a search filter to the GPO backup import list, making it easier to locate a specific backup entry.
• Added health alerts for periodic background tasks, such as Defender definition downloads.
• Increased the maximum length of GPO Security Settings text fields from 1,023 to 2,048 characters to support DISA STIG and similar compliance frameworks.
• This release includes security and dependency updates.

Resolved Issues

• Fixed an issue where custom device classes and devices could not be edited or deleted from the workbench.
• Fixed an issue where setting the GPO log size limit to 0 was incorrectly displayed as "Not Configured."
• Fixed an issue where setting the GPO log size limit to its maximum of 32 MB caused an error on endpoints.
• Fixed an issue where policy status displayed incorrectly when disabling GPO enforcement.
• Fixed an issue where invalid port numbers were not clearly flagged during port configuration.
• Fixed an issue where the rule import preview displayed only one rule instead of all rules.
• Fixed an issue where invalid rules imported from endpoints were not flagged for easy identification.
• Fixed an issue where a "Policy priorities file is out of date" warning could linger for up to 30 minutes after a Linux Firewall policy was first enforced.
• Fixed an issue where adding a new policy type to an existing policy hid the newly added settings.
• Fixed an issue where category filters were not applied correctly when switching from the ADMX detail view back to the list view.
• Fixed an issue where policy priority could not be set.
• Fixed an issue where the enforcement details panel displayed outdated targeting rules when navigating between enforcements.
• Fixed an issue where the AppLocker import interface did not disable the Save button when an XML parsing error occurred.
• Fixed an issue where AppLocker script labels were inconsistent between the console and Windows endpoints.
• Fixed an issue where BitLocker policy dialogs showed inaccurate reboot messaging when "skip hardware test" was enabled.
• Fixed an issue where images in BitLocker policies could cause display problems on endpoints; SVG image support has been removed from BitLocker policies.
• Fixed an issue where Recovery Keys table labels for removable drives were inconsistent.
• Fixed an issue where the Enforce Overview remediation chart counts did not match the underlying data.
• Fixed an issue where policy-list action buttons shifted position while permission checks were running.
• Fixed an issue where the Target Hive dropdown in Windows remediation tasks showed both a selected value and a required-field error at the same time.
• Fixed an issue where the search filter in the Select Policy Types modal did not clear when switching platforms.
• Fixed an issue where the left and right panel filters in policy details did not stay in sync.
• Fixed an issue where policy name validation rejected forward slashes.
• Fixed an issue where importing a device-actions policy produced an error in the Policy Configurations section.
• Fixed an issue where invalid registry values, such as decimals, negative numbers, or out-of-range numbers, were accepted and could silently fail to enforce; these values are now rejected with a clear error.
• Fixed an issue where validation indicators did not display correctly for incomplete security policy settings.
• Fixed an issue where the background processing service did not recover correctly after its initial retry attempts.
• Fixed a critical bug that could cause the Enforce service to crash-loop and go fully offline when a Windows Security policy contained a malformed setting.
• Fixed an issue where an enforcement could no longer be saved or edited if one of its targeted computer groups had been deleted. Deleted computer groups are now clearly flagged on the enforcement details page so they can be removed.
• Fixed the AppLocker policy editor to display specific, actionable validation messages when an invalid path value is entered, replacing the previous generic error.
• Improved Enforce service startup reliability by adding a timeout to an internal MDM availability check, preventing the entire service from hanging if the MDM service is unresponsive.
• Security updates.

Dependency updates

• Dependency updates.

Resolved Issues

• Fixed a bug where deleted remediation policies continued to be reported as enforced.
• Fixed an issue that prevented creating or editing Windows Machine Administrative Templates policies (and other Enforce policy types) when the assigned RBAC role's write permission was scoped to a custom content set instead of the default Enforce content set.
• Fixed an issue where the AppLocker Warnings chart on the Enforce homepage would time out with an error instead of loading.
• Fixed an issue where the Enforce service could get stuck in a restart loop when it failed to register with the endpoint configuration service.
• Fixed an issue where the Enforcements page could return an error and fail to load for the whole environment when a policy's stored data did not match its policy type (which could happen when changing an existing Windows policy to a single-type policy such as SRP in place). Enforce now blocks changing a policy's type after creation, writes policy data scoped to its type, and safely skips a single unreadable policy instead of failing the entire list.
• Fixed an issue where uninstalling a module left its configuration behind in ECF, causing removed modules to still be deployed to newly installed clients.

Dependency updates

• Dependency updates.

Resolved Issues

• Fixed a critical bug that could cause the Enforce service to crash-loop and go fully offline when a Windows Security policy contained a malformed setting.
• Fixed an issue where an enforcement could no longer be saved or edited if one of its targeted computer groups had been deleted. Deleted computer groups are now clearly flagged on the enforcement details page so they can be removed.
• Fixed an issue where the AppLocker Warnings chart on the Enforce homepage would time out with an error instead of loading.
• Fixed an issue where the Enforce service could get stuck in a restart loop when it failed to register with the endpoint configuration service.
• Fixed an issue where the Enforcements page could return an error and fail to load for the whole environment when a policy's stored data did not match its policy type (which could happen when changing an existing Windows policy to a single-type policy such as SRP in place). Enforce now blocks changing a policy's type after creation, writes policy data scoped to its type, and safely skips a single unreadable policy instead of failing the entire list.
• Fixed an issue where uninstalling a module left its configuration behind in ECF, causing removed modules to still be deployed to newly installed clients.
• Fixed the AppLocker policy editor to display specific, actionable validation messages when an invalid path value is entered, replacing the previous generic error.
• Improved Enforce service startup reliability by adding a timeout to an internal MDM availability check, preventing the entire service from hanging if the MDM service is unresponsive.

Dependency updates

• Dependency updates.

Resolved Issues

• Fixed an issue where the AppLocker Warnings chart on the Enforce homepage would time out with an error instead of loading.
• Fixed an issue where the Enforce service could get stuck in a restart loop when it failed to register with the endpoint configuration service.
• Fixed an issue where the Enforcements page could return an error and fail to load when a policy's stored data did not match its policy type (which could happen when changing an existing Windows policy to a single-type policy such as SRP in place). Enforce now blocks changing a policy's type after creation, writes policy data scoped to its type, and safely skips a single unreadable policy instead of failing the entire list.