Empirum 25.4 - Release and Update Notes
Table of Contents
About This Document
This document describes functional changes, bug fixes, known issues, modified behaviors and changed platform support that have been added since the last update. Please find the installation files of this version on Matrix42 Marketplace. System requirements, integration guides and instructions for installation and update are available in the Matrix42 Help Center.
Visit the Release Highlights and Insight video on the Matrix42 YouTube channel to get a short overview presentation of the major new features and changes (here).
Software Management
UEM Agent
The release version 2503.2.2 of the UEM Agent is part of the installation. Please check the Marketplace or the implace upgrade function via EMC for new versions of the UEM Agent.
Further details and information about the new features of the UEM Agent can be found here: Matrix42 Marketplace
If necessary, adjust the UEM Agent update settings of your computers before the update. After the update, the UEM Agent is configured as not released, it will only roll out automatically to computers configured for pilot rollouts.
For using optional packages as part of the distribution flags, the UEM Agent of type "Standard Feature Release" starting version 2203.1.2 or newer. The UEM Agent Extended Support Release 2006 is not supporting this function.
OS Installer
The v25.4 ISO has the latest Win PE 1.9.12 integrated, but is ONLY installed for a new installation of Empirum. However, you can use the new function in the EMC "Download latest Win PE Support Package". Further details and information about Win PE can be found here: Win PE
Inventory
Two new fields (Security -> Secure Boot Status -> Microsoft UEFI CA 2023/Windows UEFI CA 2023) have been added for determining the Windows UEFI Secure Boot certificates. These two values can be used to filter computers that meet or do not meet the new requirements for UEFI boot certificates. Further information can be found in our help section (here).
Information on the subject of "UEFI Secure Boot Certificates" can be found here: Link
Matrix42 Patch-Management
In the Management Console -> Configuration -> Patch Management, the following new columns and information have been added for patches.
- CVSS Score, VRR Score, File Size, EOL Date
These new columns can also be searched for in the patch search dialog.
The "CVSS Score" and "VRR Score" columns are also included in the Properties of a computer in the “Patches” tab.
In the catalog sync success email for a successful patch catalog sync, patches contained therein are now marked separately if they have the download type "Manual."
It is still necessary to assign and activate the "Matrix42 Patch Management Win11-Checkpoint KB 1.0" package to all Windows 11 computers.
This package is crucial for ensuring that the monthly cumulative Windows 11 security and quality updates can be installed reliably and without errors. Without activating this package, installation problems or incomplete updates may occur.
Empirum Web Konsole (EWC)
Update of Tomcat version to 9.0.108 and Java version to 24.0.2. Manual updating of the Java and Tomcat versions is described here.
Common Changes/Enhancements
EMC - Rollout Coordination View
The following features and adjustments have been added to the new rollout coordination view:
- New functionality for Log Live Analysis
- Call external programs via the context menu
- Call Remote Control via the context menu
- Patch installation errors are also marked in red color
- Horizontal scroll bar
- Easier search in filter criteria
- Sorting has been revised
- Performance optimizations
EMC - Depot
- When saving the depot, all modified packages are automatically prepared for validation and a version check is performed to ensure the consistency of the depot.
UEM Depot Sync
The software package UEM Depot Sync 3.3 is part of the ISO and must be used in combination with the SFR UEM Agent 2312.1.2 or newer. We recommend updating to the package in order to be able to use all functions as of Empirum v24.0.1. Further information can be found in our online help for UEM Depot Management here.
With version > 2.0 of the package the synchronization mechanism has been changed in many areas and does not use the tradition ways. We highly recommend to read out help article before updating to this version at our help pages.
Enterprise Service Bus
With the Empirum Release 25.4 a new Service Bus Service Version 4.27.0 is released. In this version, reported errors have been fixed and communication has been stabilized and improved. Improvements have also been implemented in conjunction with the UEM Depot Sync package 3.3.
In addition, changes have been introduced to support the new UEM feature Patch & Vulnerability Insights.
The patch status information now contains all details about installed and missing patches.
Further information on activation can be found in this article.
Empirum SDK
There is a new version of the Empirum SDK 1.3.17. Details and information about the Empirum SDK can be found here: Empirum SDK
Notification of extended maintenance period (LTSB)
Empirum version 23.0.3 is declared as LTSB version. Customers who are entitled to Matrix42 Premium Support thus receive an extended maintenance period beyond the release of version 25.4.0 at the end of September 2025.
Solved Issues
| Problem ID | Description |
|---|---|
| Software Management | |
| PRB38943 | Problems in BTQH/depot syn/package deployment with special characters in path names of Empirum packages |
| PRB38895 | Rollout coordination does not update automatically |
| PRB38904 | Rollout coordination: Multiple problems during/after changing the size of the Coordinator window |
| PRB39010 | Package installation: Message text for commands 'Abort' and 'Exit' not displayed in SWDepot Log |
| PRB38561 | Digital signed UEM Agent Metadata has no timestamp |
| Patch Management | |
| PRB38731 | No history for auto approved patches available |
| PRB38977 | Some PM Alarm Messages are not working |
| PRB39005 | Error during fixing process |
| Inventory | |
| PRB38631 | One-time user logon in combination with inventory-scan brings license issues |
| Misc | |
| PRB38969 | Empirum Service Bus - Error, Insufficient privileges for service account user after updating from Empirum 25.0 to 25.0.1 |
| PRB39011 | Vulnerability in Win RAR detected, please update |
| PRB39043 | For a reinstallation in EWC no button on the last page isn't repsonding anymore |
| PRB38848 | Status "failed" and "failure", only rows with status "failure" is marked at red |
| PRB39067 | EWC - new computer cannot be created |
| PRB39073 | One-Click-Filters in EWC are not changeable anymore |
| PRB39074 | If a refresh within EWC is done, then EWC stopps working |
Known Issues
| Problem ID | Description |
|---|---|
| OS Installer | |
| The feature "WinPE http/s Support" has current restrictions and don't support the client certificate from the agent template. Also Disk Imaging is not possible over http/s. |
Improvements and Fixes after Initial Release
- New Import/Export and Edit of Package Variables in EMC
- The existing export function for Empirum packages has been expanded so that when an Empirum package is exported, the defined prerequisites of the package are also transferred to the export format and are available again during import. This eliminates the need for subsequent adjustments. Similarly, existing variables can now be linked to the Empirum package so that these linked variables are also included in the export.
- Patch Management – Differential Catalog Sync
- Patch catalog synchronization is now always differential, meaning that only the data between the last update and the current catalog needs to be processed. This results in faster processing and drastically reduces the resource requirements for catalog synchronization.
- Support of new CA Certificates for WinPE Boot Configuration
- The WinPE startup configuration has been extended to allow WinPE startup images to be created that are compatible with the new CA certificates.
- Move PBU writing logic from Driver to BTQH (x64) service
- The BTQH (x64) service now takes over the creation of the PBU file, replacing the Empirum Driver service. The Driver service will no longer be needed in the future and will be removed in a future release.
- Inventory: Show monitor information from Linux devices
- The Empirum Linux Inventory now also collects monitor information. This additional monitor information is now also displayed in the EMC.
- RollOut Coordination improvements
- Several optimizations were made in rollout coordination.
- Administration - Status and log dialog are no longer closed when switching to other modules
- In the administration, status and log dialog boxes are no longer closed when switching to other modules.
- Enhance Package Wizard for MSIX/APPX and PowerShell packages
- The current package wizard has been enhanced with the ability to create distribution-ready packages for MSIX apps and MSIX app bundles.
- Enhance Empirum API for better automation with ESMP
- The Empirum API has been extended to allow additional information such as assignments and assigned objects (groups, templates, etc.) to be read and processed.
- Extend ESB messages model for operating system Server 2025
- The Empirum Service Bus message model has been expanded to include the Server 2025 operating system.
- Inventory Service overwrites available data with N/A
- Available inventory data with N/A as the value will no longer be overwritten by the inventory service.
- Sync OS drivers files based on file hashes (requires Depot Sync 3.4)
- All operating system driver files are now integrated into the current depot synchronization process with a file hash. This results in a reduction in synchronization time and load.
- Add OS support for macOS 26 (Tahoe) for packages (requires a new UEM Agent for macOS - available soon)
- The OS support for macOS 26 (Tahoe) has been added for software packages. A new UEM agent for macOS is required to use this feature in full. This will be available soon.
Changed or no longer supported Features and Platforms
- RSync is no longer enabled by default in the "Subdepot Webservice Configuration" package. If it is not enabled, the RSync components are automatically removed from the depot.
- When saving changes in EMC -> Configuration -> Depot, a version check is now performed automatically to ensure the consistency of the depot.
- The inventory configuration option for Solaris has been removed.
Scheduled discontinuations for Version V26.1
- EmpSync will no longer be part of an Empirum installation (SubDepot package) for a new installation.
- RSync will no longer be part of an Empirum installation (SubDepot package) for a new installation.
Preliminary actions before installation
When you are downloading a Matrix42 hotfix or patch, the downloaded file may have a 'Zone.Identifier' information attached (depending on your browsers security configuration).
Please remove this 'Zone.Identifier', otherwise some problems with these files can occur (files are not loading correctly or are blocked in the properties after downloading and must be unblocked manually):
- Right-click the blocked file, and then click Properties.
- In the "General - Security" tab, click "Unblock".
To avoid the 'Zone.Identifier' in future please add the address 'https://m42marketplacemediathek.blob.core.windows.net' as a 'trusted zone' in the Internet Explorer.
Installation Steps
- Log on to the Matrix42 Empirum Master Server using an administrative account.
- Make sure, that a backup of your location database and your installation directory (e.g. D:\Empirum) does exist.
- Copy the Matrix42_Empirum_25.4.iso to a temporary folder of the Empirum Master Server.
- Run the Autorun.exe with elevated rights (Run as administrator).
- After successful installation, the server must be restarted.
All necessary Empirum Services on the Master Server will be uninstalled during the installation.
Post-installation Steps
Due to changes to custom information for a computer object, affected INI files are rewritten. The hashes of the Matrix42 software packages will be recreated. Depending on the number of objects, this may take some time and affect the utilization of the working memory (BTQH service).
Check whether there is already an Empirum Hotfix Installer and install it if necessary. You can find this information here
- Start Empirum DBUtil and logon to Emp Location and your location database.
Confirm the location table structure update. - Update your location DB using the Update Tables action.
- Select the services (except PXE/TFTP, Device Discovery) which are required for your installation and then click Install.
- Now install the services PXE/TFTP, Device Discovery (if used) on the master server.
- Reinstall the Device Discovery service on all Empirum depot servers (if used).
- If the Empirum Service Bus service is used and installed, you must now reinstall it again.
- On the Empirum Server run EMC > Configuration > Software Management > Depot > Tools > Check Versions to apply the changes of updated package properties (Personal Backup and Patch Management).
- Reinstall the Empirum Subdepot package and Empirum Subdepot PXE services (if used) on existing Empirum depot servers. You can use the Subdepot PXE Service package instead of updating the services via DBUtil manually.
- Reinstall the Empirum package Empirum Management Console 25.0 (EMC) on all affected computers. The EMC will be updated on your Empirum master server automatically during the update.
ODBC Driver Update to "ODBC Driver 13 for SQL Server" is only necessary when using Microsoft SQL Server 2012-2017:
ODBC Driver Update to "ODBC Driver 17.10.4.1 for SQL Server" is only necessary when using Microsoft SQL Server 2019 / 2022:
An overview of all ODBC driver can be found here
Matrix42 Empirum v25.4 Directory Structure (not relevant for Cloud Customers)
The following files are stored with the extension *.old:
Post-command for OS-Installation:
- Configurator\User\UEMAgent.bat → Configurator\User\UEMAgent.old
If you have made adjustments in the original batch files, transfer them to the *.bat file. Then delete the *.old file.
If you have not made any adjustments, delete the *.old file.
If you have already saved a UEMAgent.old file, it will be automatically deleted and a new copy of the existing UEMAgent.bat will be created!
During the update, the content of the directorys
- C:\Empirum\Manual is moved to Manual_Backup.
- C:\Empirum\Configurator\Pre Packages is moved to Pre Packages.old.
- C:\Empirum\Configurator\Packages\Matrix42\Packaging Center\25.4\Pre Packages is moved to Prepackages.old.
If you have not made any adjustments to the original directories, you can delete the _Backup or .old directories.
Updated Software Packages (also relevant for cloud customers)
The following Empirum software packages are updated but are not assigned a new version number. You need to update (reinstall) the following packages:
Infrastructure Packages:
- Empirum Subdepot 25.4
- Empirum Subdepot PXE Service 25.4
- UEM Depot Sync X.X
Client Packages:
- Empirum Management Console 25.4
- Empirum Inventory 25.4
- Empirum Packaging Center 25.4
- Empirum Web Console 25.4
- Matrix42 Patch-Management Client Scan 25.4
- Matrix42 Patch-Management Client Fix 25.4