Bitdefender Endpoint Security Tools for Windows

Internal fixes.

The update process may fail with error -2011. You must run the update again to complete the process.

Reconfigure agent tasks used to add new modules on previous security agent versions require endpoints reboot. After rebooting and updating the endpoints to version 7.9.8.350, you must run a new Reconfigure agent task.

The Live Search feature is now compatible with ARM64 architecture CPUs.

Added support for upcoming features available with the next major GravityZone release.

Exclusions were not being taken into account when scanning registries. This issue has been fixed.

In specific cases, the security agent crashed when a new product version was available.

Addressed an internal issue that caused the product update process to fail with error -1007.

The update process may fail with error -2011. You must run the update again to complete the process.

Reconfigure agent tasks used to add new modules on previous security agent versions require endpoints reboot. After rebooting and updating the endpoints to version 7.9.8.346, you must run a new Reconfigure agent task.

The Live Search feature is now compatible with ARM64 architecture CPUs.

Added support for upcoming features available with the next major GravityZone release.

Exclusions were not being taken into account when scanning registries. This issue has been fixed.

In specific cases, the security agent crashed when a new product version was available.

The update process may fail with error -2011. You must run the update again to complete the process.

Reconfigure agent tasks used to add new modules on previous security agent versions require endpoints reboot. After rebooting and updating the endpoints to version 7.9.8.343, you must run a new Reconfigure agent task.

The Content Control module now blocks SSL connections, from non-browser processes to malicious domains. This improvement is going to be gradually enabled on all endpoints.

Added support for removing the following incompatible security products:

Enhanced support for removing the following incompatible security product:

Callback evasion notifications are now displayed for users when:

When enabled in Google Chrome and Mozilla Firefox, the Encrypted ClientHello (ECH) protocol prevented content filtering and traffic scanning.

Discovery Search Mailboxes no longer take license slots for the Security for Exchange module.

Fixed incompatibility with Ninja Agent that prevented the product from updating.

The update process may fail with error -2011. You must run the update again to complete the process.

Reconfigure agent tasks used to add new modules on previous security agent versions require endpoints reboot. After rebooting and updating the endpoints to version 7.9.7.336, you must run a new Reconfigure agent task.

The Content Control module now blocks SSL connections, from non-browser processes to malicious domains. This improvement is going to be gradually enabled on all endpoints.

Enhanced support for removing the following incompatible security product:

Callback evasion notifications are now displayed for users when:

When enabled in Google Chrome and Mozilla Firefox, the Encrypted ClientHello (ECH) protocol prevented content filtering and traffic scanning.

Discovery Search Mailboxes no longer take license slots for the Security for Exchange module.

The update process may fail with error -2011. You must run the update again to complete the process.

Reconfigure agent tasks used to add new modules on previous security agent versions require endpoints reboot. After rebooting and updating the endpoints to version 7.9.7.334, you must run a new Reconfigure agent task.

In some cases, rules configured in the policy were no longer applied after a period of time, resulting in blocked applications.

In some cases, the Firewall module crashed after changing the Network Adapter settings.

In some cases, the Support Tool generated empty or corrupted reports. This issue has been fixed.

Internal fixes.

The update process may fail with error -2011. You must run the update again to complete the process.

Reconfigure agent tasks used to add new modules on previous security agent versions require endpoints reboot. After rebooting and updating the endpoints to version 7.9.6.331, you must run a new Reconfigure agent task.

In some cases, the Support Tool generated empty or corrupted reports. This issue has been fixed.

The update process may fail with error -2011. You must run the update again to complete the process.

Reconfigure agent tasks used to add new modules on previous security agent versions require endpoints reboot. After rebooting and updating the endpoints to version 7.9.6.330, you must run a new Reconfigure agent task.

Updating your endpoints to BEST version 7.9.5.318, released on fast ring, can fail due to an issue with one of the filter drivers. Endpoints affected by the issue will be displayed as offline in Control Center since August 17, or the latest date a product update has been attempted. To fix this issue, refer to this article.

In some cases, the Firewall module crashed after changing the Network Adapter settings.

Internal fixes.

The update process may fail with error -2011. You must run the update again to complete the process.

Reconfigure agent tasks used to add new modules on previous security agent versions require endpoints reboot. After rebooting and updating the endpoints to version 7.9.6.329, you must run a new Reconfigure agent task.

Updating your endpoints to BEST version 7.9.5.318, released on fast ring, can fail due to an issue with one of the filter drivers. Endpoints affected by the issue will be displayed as offline in Control Center since August 17, or the latest date a product update has been attempted. To fix this issue, refer to this article.

Added support for upcoming features available with the next major GravityZone release.

Users are now notified whenever the communication between endpoints and the GravityZone console cannot be established.

Users are now notified whenever communication with the Incidents Server cannot be established.

Implemented internal optimizations for enhanced stability of the security agent.

Osquery has been upgraded to version 5.9.1

The Integrity Monitoring module did not generate Change events for files that have been accessed and modified from another endpoint, through Server Message Block (SMB) protocol.

In some cases, the EDR module caused performance issues on Remote Desktop Servers (RDS), when users connected via Remote Desktop Protocol (RDP).

Security fixes.

The update process to version 7.9.5.322 fails with error -2011. You must run the update again to complete the process.

Reconfigure agent tasks used to add new modules on previous security agent versions require endpoints reboot. After rebooting and updating the endpoints to version 7.9.5.324, you must run a new Reconfigure agent task.

Updating your endpoints to BEST version 7.9.5.318, released on fast ring, can fail due to an issue with one of the filter drivers. Endpoints affected by the issue will be displayed as offline in Control Center since August 17, or the latest date a product update has been attempted. To fix this issue, refer to this article.

Osquery has been upgraded to version 5.9.1

Users are now notified whenever communication with the Incidents Server cannot be established.

In some cases, the EDR module caused performance issues on Remote Desktop Servers (RDS), when users connected via Remote Desktop Protocol (RDP).

Security fixes.

The update process to version 7.9.5.322 fails with error -2011. You must run the update again to complete the process.

Reconfigure agent tasks that are used to add new modules require endpoints reboot. After rebooting the endpoint, you must run the Reconfigure agent task again to complete the process.

Updating your endpoints to BEST version 7.9.5.318, released on fast ring, can fail due to an issue with one of the filter drivers. Endpoints affected by the issue will be displayed as offline in Control Center since August 17, or the latest date a product update has been attempted. To fix this issue, refer to this article.

Added support for upcoming features available with the next major GravityZone release.

Users are now notified whenever the communication between endpoints and the GravityZone console cannot be established.

The Integrity Monitoring module did not generate Change events for files that have been accessed and modified from another endpoint, through Server Message Block (SMB) protocol.

In a particular situation, the exclusions defined in Web Access Control for websites did not function as intended. This issue affected endpoints with product version 7.9.4.306.

The Antimalware module can now monitor files that use the .log and .gif extensions.

Added support for upcoming features available with the next major GravityZone release.

Added support for removing the following incompatible security products:

The Integrity Monitoring module generated Renamed events instead of Deleted events when a monitored file was deleted.

The module did not detect files transferred at the same time on a network share via Remote Desktop Protocol (RDP).

The security agent did not allow the safe removal of external storage devices when the Antimalware module was installed.

The module blocked a particular web address, which had been excluded in the policy, while the Web Proxy category was configured for blocking.

The Network Protection module blocked certain websites. The issue affected endpoints with product version 7.9.4.303, released on fast ring.

Security fixes.

The Antimalware module can now monitor files that use the .log and .gif extensions.

Added support for upcoming features available with the next major GravityZone release.

Added support for removing the following incompatible security products:

The Integrity Monitoring module generated Renamed events instead of Deleted events when a monitored file was deleted.

The module did not detect files transferred at the same time on a network share via Remote Desktop Protocol (RDP).

The security agent did not allow the safe removal of external storage devices when the Antimalware module was installed.

The module blocked a particular web address, which had been excluded in the policy, while the Web Proxy category was configured for blocking.

Security fixes.

The Support Tool and Uninstall Tool are now console applications.

The bruteForce parameter that can be used when uninstalling the security agent is now available only for product versions starting with 7.x.

Added support for removing the following incompatible security product:

The Content Control module did not block web pages when a proxy was used. The issue affected endpoints with product version 7.9.2.290

The update process failed with error –1018 on endpoints with the Network Attack Defense module installed.

The Exchange scan was not working correctly. This issue has been fixed.

The Firewall module caused endpoints to temporarily lose network connectivity when starting services or when changing policies. This issue occurred on Windows 10 and 11 systems.

The Relay agent failed to properly remove old installation kits, leading to high disk usage.

The Sysprep tool did not work properly on endpoints with product version 7.8.3.x and higher.

Internal fixes.

The Firewall module caused endpoints to temporarily lose network connectivity when starting services or when changing policies. This issue occurred on Windows 10 and 11 systems.

The Support Tool and Uninstall Tool are now console applications.

The bruteForce parameter that can be used when uninstalling the security agent is now available only for product versions starting with 7.x.

Added support for removing the following incompatible security product:

The Content Control module did not block web pages when a proxy was used. The issue affected endpoints with product version 7.9.2.290

The update process failed with error –1018 on endpoints with the Network Attack Defense module installed.

The Exchange scan was not working correctly. This issue has been fixed.

The Relay agent failed to properly remove old installation kits, leading to high disk usage.

The Sysprep tool did not work properly on endpoints with product version 7.8.3.x and higher.

You can now create certificate hash exclusions for PowerShell scripts.

Osquery has been upgraded to version 5.8.1.

Added support for upcoming features available with the next major GravityZone release.

Added support for removing the following incompatible security products:

In some cases, the Firewall module blocked applications already excluded in the policy.

The module postponed the application of patches if the Relay server was not reachable.

The module could not quarantine Java Archive files, even though the archives could be deleted.

The Network Protection module prevented browsers from accessing web pages when Web Access Control was enabled. The issue occurred after updating the security agent to version 7.9.2.289, released on fast ring.

The local console failed to open when accessed from Start Menu. The issue occurred after updating the security agent to version 7.9.1.285.

The local console displayed the default contact information for technical support when the language was changed, instead of the details defined in the policy.

You can now create certificate hash exclusions for PowerShell scripts.

Osquery has been upgraded to version 5.8.1.

Added support for upcoming features available with the next major GravityZone release.

Added support for removing the following security products:

In some cases, the Firewall module blocked applications already excluded in the policy.

The module postponed the application of patches if the Relay server was not reachable.

The module could not quarantine Java Archive files, even though the archives could be deleted.

The local console failed to open when accessed from Start Menu. The issue occurred after updating the security agent to version 7.9.1.285.

The local console displayed the default contact information for technical support when the language was changed, instead of the details defined in the policy.

Bitdefender has optimized LSASS detection reporting for less traffic and less disk space required to store events on endpoints.

The endpoint users are no longer distracted by Integrity Monitoring status alerts whenever a Suspend or Resume task runs.

Added support for upcoming features available with the next major GravityZone release.

The Antimalware module caused a system slowdown when copying files from network shares.

Custom scan displayed incorrect paths in the local scan log when multiple scan tasks occurred at the same time.

Addressed an issue where Advanced Threat Control caused critical errors (BSOD) after updating to version 7.9.1.280 released on fast ring.

The Live Search feature was unavailable on endpoints although it was enabled in the policy.

The security agent blocked Remote Desktop connections when the Network Attack Defense module was enabled in the policy along with the Scan RDP option.

In a particular case, the Content Control module prevented PDF files from being downloaded from a website. The website remained in a loading state and eventually displayed the page as inaccessible.

Events generated by the Data Protection rules displayed IPs instead of web addresses when keyword filters were added for web traffic.

The default policy was assigned on endpoints instead of the correct policy when assignment rules applied.  The default policy did not contain the previous assignment rules.

Multiple managed endpoints could not communicate with the GravityZone console and were listed as unmanaged.

The logging session started when gathering support tool logs using command line or from the GravityZone console remained active for long periods of time.

Addressed a specific scenario where the product caused critical errors (BSOD). The issue is now fixed.

Addressed an issue where Advanced Threat Control caused critical errors (BSOD) after updating to version 7.9.1.280 released on fast ring.

Events generated by the Data Protection rules displayed IPs instead of web addresses when keyword filters were added for web traffic.

The endpoint users are no longer distracted by Integrity Monitoring status alerts whenever a Suspend or Resume task runs.

Added support for upcoming features available with the next major GravityZone release.

The Live Search feature was unavailable on endpoints although it was enabled in the policy.

The security agent blocked Remote Desktop connections when the Network Attack Defense module was enabled in the policy along with the Scan RDP option.

In a particular case, the Content Control module prevented PDF files from being downloaded from a website. The website remained in a loading state and eventually displayed the page as inaccessible.

Custom scan displayed incorrect paths in the local scan log when multiple scan tasks occurred at the same time.

The default policy was assigned on endpoints instead of the correct policy when assignment rules applied.  The default policy did not contain the previous assignment rules.

Multiple managed endpoints could not communicate with the GravityZone console and were listed as unmanaged.

The logging session started when gathering support tool logs using command line or from the GravityZone console remained active for long periods of time.

Addressed a specific scenario where the product caused critical errors (BSOD). The issue is now fixed.

The Bitdefender Endpoint Security Service crashed during Patch Management assessment when unavailable patches were returned. The issue occurred on endpoints with version 7.8.4.269, released on fast ring.

Microsoft Office 365 was not included in the Patch Management scan. This issue is now fixed.

Policies were not being assigned on endpoints when using a location assignment rule with hostname.

An incorrect path was created when installing security agents with Relay role. This behavior led to inaccurate rules in Windows Firewall and affected versions starting with 7.7.2.x.

The security agent installation crashed on Windows Server 2016 endpoints with a very large number of certificates.

Live Search is no longer supported for x86 architecture endpoints.

Policies were not being assigned on endpoints when using a location assignment rule with hostname.

Microsoft Office 365 was not included in the Patch Management scan. This issue is now fixed.

An incorrect path was created when installing security agents with Relay role. This behavior led to inaccurate rules in Windows Firewall and affected versions starting with 7.7.2.x.

The security agent installation crashed on Windows Server 2016 endpoints with a very large number of certificates.

Live Search is no longer supported for x86 architecture endpoints.

The Content Control exclusions did not work properly when using a blocking action in Web Access Control Scheduler on endpoints with product version 7.8.3.263.

You can now execute Live Search queries using the command line interface. The Live Search feature is part of the Early Access programs.

Security content updates are now automatically performed with each product update to ensure optimal performance. 

Added support for upcoming features available with the next major GravityZone release.

Bitdefender Endpoint Security Tools has removed some processes and folders from the exclusions lists on Exchange servers to improve performance and stability. For more information, refer to the official Microsoft documentation.

In certain scenarios, endpoints encountered critical errors (BSOD) when the Advanced Threat Control module was active.

Fixed an issue that caused Content Control to create a temporary Windows profile for automatic logins.

The Content Control module prevented the GravityZone console from properly reporting blocked web addresses and the applied web rules in the Blocked Websites report.

Removed the unused caching database files on partitions smaller than 1GB.

Fixed an issue where the Antimalware module failed to report detections of infected browser plugins in certain scenarios.

Fixed an issue that caused cached DNS servers to be used for EDR submission.

Fixed an issue that caused Integrity Monitoring to generate empty reports.

The security agent caused high CPU usage on Microsoft Windows Server 2019.

You can now execute Live Search queries using the command line interface. The Live Search feature is part of the Early Access programs.

Security content updates are now automatically performed with each product update to ensure optimal performance. 

Added support for upcoming features available with the next major GravityZone release.

In certain scenarios, endpoints encountered critical errors (BSOD) when the Advanced Threat Control module was active.

Fixed an issue that caused Content Control to create a temporary Windows profile for automatic logins.

The Content Control module prevented the GravityZone console from properly reporting blocked web addresses and the applied web rules in the Blocked Websites report.

Removed the unused caching database files on partitions smaller than 1GB.

Fixed an issue where the Antimalware module failed to report detections of infected browser plugins in certain scenarios.

Fixed an issue that caused cached DNS servers to be used for EDR submission.

Fixed an issue that caused Integrity Monitoring to generate empty reports.

The security agent caused high CPU usage on Microsoft Windows Server 2019.

Fixed an issue that prevented the Network Attack Defense module from updating security content.

GravityZone assigned the default policy instead of the new policy when applying new assignment rules.

Fixed an issue that prevented policies from being applied to endpoints.

Fixed an issue that caused the security agent to create database registry files on partitions smaller than 1 GB.

In certain scenarios, endpoints encountered critical errors (BSOD) when the Antimalware module was active.

Fixed an issue that caused the Antimalware module to prompt users to take actions on clean files.

Fixed an issue that prevented the Reconfigure Client task from being applied to BEST Linux endpoints when using Windows Relay as an update server.

Fixed an issue that prevented Content Control from blocking websites on newer editions Windows Server 2019 and Windows Server 2022.

The security agent caused high CPU usage on Microsoft Windows Server 2019.

The security agent now automatically scans USB devices before users log into the Windows system.

Added support for Windows 11 Enterprise Multi-Session (22H2).

Added support for Windows ARM64 CPUs. The following features are supported:

The following features are not yet supported:

Support for these features on Windows ARM64 will be added in time.

In some cases, the Bitdefender Endpoint Protected Service generated high RAM usage after updating endpoints to version 7.8.1.241.

Fixed an issue that caused multiple website false positives when using Bitdefender EDR.

The security agent now automatically scans USB devices before users log into the Windows system.

Added support for Windows 11 Enterprise Multi-Session (22H2).

Fixed an issue that caused multiple website false positives when using Bitdefender EDR.

The default Firewall driver has changed.

Added support for upcoming features available with the next major GravityZone release.

The information window title now reflects the product name.

The Crypto Miner threat detection has been added.

The Power User module is now available in Vietnamese.

Fixed an issue that prevented users from accessing specific websites while the SSL Scan option was enabled.

In some situations, the Advanced Threat Control module caused high memory usage and performance issues.

Fixed an issue that caused the Bitdefender Endpoint Security Service to crash when Advanced Threat Control was installed.

Fixed an issue that caused Exchange Protection to mark multiple valid emails as spam.

Fixed an issue that prevented the security agent from detecting samples during unpacking archived files.

The default Firewall driver has changed.

Added support for upcoming features available with the next major GravityZone release.

The information window title now reflects the product name.

The Crypto Miner threat detection has been added.

The Power User module is now available in Vietnamese.

Fixed an issue that prevented users from accessing specific websites while the SSL Scan option was enabled.

In some situations, the Advanced Threat Control module caused high memory usage and performance issues.

Fixed an issue that caused Exchange Protection to mark multiple valid emails as spam.

Fixed an issue that prevented the security agent from detecting samples during unpacking archived files.

Content Control detection events now contain details about the web categories of blocked websites. You can view these categories in the Event log section.

Added support for upcoming features available with the next major GravityZone release.

The product was causing high disk usage when scanning certain SSD drives.

Fixed an issue that was causing network disconnects for Intel-based NICs.

Fixed an issue that caused the IP addresses of the source of remote Windows logins (RDP) to not be recorded.

Fixed an issue that prevented endpoints from being displayed in the Amazon EC2 Integration.

Security fixes.

Added support for upcoming features available with the next major GravityZone release.

In some situations, endpoints failed to reflect the scan mode set through a Reconfigure Client task. The issue occurred on version 7.6.3.210, released on fast ring.

Security fixes.

Addressed an issue where the Advanced Threat Control feature caused critical errors (BSOD).

Fixed an issue that prevented the Endpoint Detection and Response module from displaying the correct hostname of remote attackers.

Added support for upcoming features available with the next major GravityZone release.

Addressed an issue where the Advanced Threat Control feature caused critical errors (BSOD).

Fixed an issue that prevented the Endpoint Detection and Response module from displaying the correct hostname of remote attackers.

Security fixes.

Added support for upcoming features available with the next major GravityZone release.

You can now see when a patch installation is in progress. The event is available in the Event log whenever a new installation begins.

Fixed an issue that caused network disconnects for Intel-based network interface cards.

Fixed an issue that prevented Exchange Malware Detected notifications from being received in the console or by email.

The Network Attack Defense module prevented domain joined endpoints from receiving group policies.

Fixed an issue that caused filtering inconsistencies for web categories across multiple Windows 10 endpoints.

In some situations, the patch installation was performed outside the scheduled interval set in the maintenance window.

Endpoints that have used installation kits with versions up to 6.6.16.222 failed to complete maintenance operations such as uninstall, or reconfigure, after updating to version 7.6.1.202. This is now fixed.

Bitdefender Endpoint Security Tools is now available in Japanese language.

Added support for removing the following incompatible security products:

Fixed an issue that affected a few product files after an unexpected shut down.

Exclusions created using wildcards failed to work properly for websites with invalid certificates.

The Antimalware module displayed On-Access as disabled in the local interface even though it was enabled in the policy.

The Remarks column was displayed when accessing a policy with Power User however, it contained no information. The column is now available only in the GravityZone console.

Fixed an issue that caused rule-based policies to change constantly.

In some cases, the security content update process resulted in error code -1016. The issue is now fixed.

Fixed an issue that prevented the EDR module from generating incidents for remote Latent Semantic Analysis (LSA) dumps.

Bitdefender Endpoint Security Tools is now available in Vietnamese language.

The security agent was not displayed as running in Windows Security Center after updating to version 7.5.3.190 released on fast ring.

In some situations, the security agent failed to display the Exchange Protection module in the local interface even if the module was installed and running. 

Fixed an issue that caused assignment rules to apply incorrectly.

The module scanned multiple secure connections resulting in error 400 Bad Request. The issue is now fixed.

Fixed an issue that prevented scheduled patch scans and deployments to run properly.

Bitdefender Endpoint Security Tools is now available in Vietnamese language.

Fixed an issue that caused assignment rules to apply incorrectly.

The module scanned multiple secure connections resulting in error 400 Bad Request. The issue is now fixed.

Fixed an issue that prevented scheduled patch scans and deployments to run properly.

In some situations, the security agent failed to display the Exchange Protection module in the local interface even if the module was installed and running. 

Software applications are now visible in the Event log section. Under Patch Management events you can see successfully installed patches, patches that require a reboot, or failed installations.

Now users can choose between multiple time intervals to postpone a system restart. They can postpone a reboot until a more convenient time up to one day.

Added support for upcoming features available with the next major GravityZone release.

The Patch Caching Server failed to download patches and caused high CPU usage.

On-demand scans affected the indexing service of Windows 11 systems resulting in a reset of indexed items. After this, the Windows indexing process started automatically from the beginning.

When installed the security agent removed the Xpient update service due to incompatibility with the application. The issue is now fixed.

The Content Control module is now available for Windows servers including Citrix virtual apps and desktops and is designed to monitor user session traffic. For existing installations, the module is available through a Reconfigure Client task, while new installations require packages configured accordingly. For more information refer to Content Control on Windows servers.

All fixes previously delivered for workstations with version 7.5.1.172 are now also available for servers.

Security fixes.