About This Release

Endpoint Data Protection 26.2 provides new and improved features that have been implemented. During the development of this version, we have been focusing on valued feedback from our customers and partners to provide an ideal feature selection.

Build Information

• Current Status: Technical Release
• Download: Marketplace
• Initial Build Version: 26.2.0.0

Important Announcements

Before you start the update, please review the following information. 

Code Signing Certificate Provider Change

We have changed the code signing certificate provider used to sign our product binaries. Previously, our software packages were signed using certificates issued by DigiCert. Starting with Endpoint Data Protection 25.4.0.5, the software is signed with certificates issued by GlobalSign. To avoid issues with updating to the new Release version, please ensure first if your server is already trusting the GlobalSign root and intermediate certificates. Perform a right-click on the executables, select Properties and navigate to Digital Signatures. After selecting Matrix42, press Details, press View Certificate and navigate to Certification Path to check the chain. In case the certificate(s) chain is not fully trusted, please review the following article: Code Signing Certificate Provider Change – GlobalSign Root Certificate Requirement.

System Requirements and Deprecations

Over time, there have been changes to system requirements as well as deprecations of certain features. To ensure a smooth update process and avoid unexpected issues, we strongly recommend reviewing the Update Guide: Endpoint Data Protection beforehand. It provides an overview of both recent and historical changes that may impact your environment.

Overview

New Features

• Modernized Encryption at Rest Architecture
• Custom LDAP/S Certificate Source for Permanent Encryption
• Polish Language Support

New Improvements and Changes 

• Fixes and Improvements included in this Release
• Fixes and Improvements already distributed as Hotfixes
• Knowledgebase

New Features

Please find all new features and major improvements in Endpoint Data Protection 26.2 below.

Modernized Encryption at Rest Architecture

As cybersecurity requirements and regulatory expectations continue to evolve, protecting sensitive data stored within Endpoint Data Protection becomes increasingly important. To address this, Endpoint Data Protection now introduces a modernized encryption-at-rest architecture based on AES-256-GCM algorithm, where cryptographic keys are managed through a dedicated server-side key management framework. This significantly improves protection against unauthorized database access and strengthens the overall security posture of the platform.

The new architecture supports both single-server and multi-server environments and introduces comprehensive key lifecycle management capabilities, including key creation, backup and recovery, key rotation, key revocation, server migration, and the secure onboarding of additional servers. Existing encrypted data can be migrated to the new architecture, enabling organizations to adopt the enhanced protection model while maintaining operational continuity.

Together, these improvements establish a future-proof security foundation, improve compliance readiness, and provide stronger protection for sensitive information stored within Endpoint Data Protection.

For new Endpoint Data Protection installations, the modernized Encryption at Rest architecture is automatically initialized during deployment. Administrators are prompted to create and securely store a backup of the generated encryption key. For upgraded environments, adoption of the new architecture is initiated by administrators through the AdminTool, allowing the transition to be performed according to organizational requirements and operational schedules.

For a comprehensive explanation of the Encryption at Rest architecture and operational procedures, including key management, backup, recovery, server migration, and troubleshooting guidance, refer to the Modernized Encryption at Rest (EAR) Administration Guide.

Custom LDAP/S Certificate Source for Permanent Encryption

As organizations increasingly adopt Microsoft Entra ID and reduce their dependency on traditional on-premises Active Directory infrastructures, existing certificate discovery mechanisms can become a limitation for secure recipient-based encryption workflows. While Endpoint Data Protection supports certificate-based encryption for sharing encrypted files with other users, certificate discovery previously depended primarily on Active Directory and local Windows certificate stores. This made it more difficult to perform recipient-based encryption in cloud-native environments.

To address this, Endpoint Data Protection now supports custom LDAP and LDAPS directories as an additional source for certificate searches. Administrators can configure dedicated LDAP or LDAPS endpoints, allowing users to search for recipient certificates directly from these repositories when performing certificate-based encryption. 

The certificate search dialog inside the Cryption Informer has been extended with an additional option to select the desired LDAP certificate source, providing a consistent user experience across all supported sources. Certificates retrieved from custom LDAP or LDAPS repositories can be used for encryption in exactly the same way as certificates obtained from Active Directory or the Windows Certificate Store. 

To support auditing and compliance requirements, all configuration changes related to custom certificate sources are fully tracked in the audit log.

This feature enables secure recipient-based encryption in Entra ID and other cloud-native environments while preserving existing workflows and administration processes.

Polish Language Support

To further improve accessibility and support international customers, Endpoint Data Protection now includes Polish language support across both the Management Console and the Endpoint Data Protection Agent. Administrators and end users can work with the product in their preferred language, reducing language barriers and improving overall usability.

The Management Console now provides a fully localized Polish user experience, including standard interface elements, dialogs, and navigation components. Administrators can select Polish as their preferred language and perform daily management tasks in a familiar and consistent environment.

In addition, Polish translations have been introduced for the Endpoint Data Protection Agent installed on managed devices. End users will see notifications, dialogs, and product interactions in Polish, providing a more intuitive experience and reducing the risk of misunderstandings during security-related operations.

By enabling both administrators and users to interact with Endpoint Data Protection in their native language, this enhancement improves usability, increases adoption, and supports organizations operating in Polish-speaking environments

New Improvements

Please find all new fixes and improvements in Endpoint Data Protection 26.2 below.

Fixes and Improvements included in this Release

Resolved Problems

• Resolved an issue where access restrictions for USB floppy drives were not enforced correctly. In affected configurations, where floppy drive access was disabled and no individual device permissions were defined, users could still access USB floppy drives even though No Access was configured and correctly displayed in the Agent and logs. With this fix, USB floppy devices are no longer treated as system disks, ensuring that configured access restrictions are now properly enforced without requiring individual device permissions. (PRB38466)
• Resolved an issue that could cause Check Agent State operations to stop progressing before all selected computers had been processed. The issue was related to internal task queue processing and could become visible when checking larger numbers of devices. The task processing logic has been improved to ensure reliable completion of agent state verification requests. (PRB39366)
• Resolved an issue where revision entries for group-based assignments were not displayed correctly in the User Management and Computer Management revision history. Under certain circumstances, changes inherited through group membership were logged only at the group level, resulting in incomplete or misleading revision information for affected users and computers. With this release, inherited changes are now correctly reflected in the revision history of the individual user or computer objects while maintaining the corresponding group-level entry. (PRB39575)
• Resolved an issue in the Network Share Encryption (NSE) component where configured "Control only listed folders" rules were evaluated even when the NSE module was disabled. The behavior has been corrected and folder list evaluation is now performed only when the NSE module is actively enabled. In addition, unnecessary encryption-state checks for folders outside the controlled NSE scope have been reduced, improving the efficiency of folder and file access operations. (PRB39549)
• Resolved an issue where Cryption Informer could incorrectly display an error message when opening unencrypted files located on unencrypted network shares. (PRB39541)

Additional Improvements

• Improved German Localization and Accessibility: As part of ongoing accessibility improvements, several remaining English user interface elements within the Endpoint Data Protection Agent have been replaced with their German equivalents when using the German language setting. This enhancement improves language consistency throughout the application and helps assistive technologies such as screen readers and text-to-speech solutions correctly interpret and pronounce user interface content. The change contributes to a more accessible user experience for German-speaking users and supports compliance with common accessibility requirements.

Fixes and Improvements already distributed as Hotfixes

• Endpoint Data Protection 26.1.0.2
  • Fixed an issue where a deadlock could appear on the EDP agent machine in conjunction with the Sysmon driver from Microsoft. While the fault lies within Sysmon, we were able to work around it by avoiding specific calls that would trigger the issue.
  • Fixed an issue that was causing delays when “Enable trusted installer engine” is checked by optimizing process information queries. (PRB39465)
  • Fixed a hang issue (>40seconds delay) caused by the Trusted Installer Engine processing a file during or immediately after the agent's initialization phase (on startup or EDP agent restart).
• Endpoint Data Protection 26.1.0.1
  • Fixed an issue where if the option to keep Cryption Informer open was enabled, silent instances would not close, leading to multiple Cryption Informer instances remaining open and visible in Task Manager.
  • Fixed an issue where retrieving Agent logs through the Console could return only partial logs. (PRB39040)
  • Fixed an issue with network performance for shared folders when EDP agent was installed. Controlled folders were erroneously checked even if NSE was not enabled for the active user, and also reduced the number of calls querying for folder encryption type. (PRB39338)
  • Fixed an issue with Cryption Informer error messages(misleading decryption‑related messages for unencrypted files) that occurred sporadically, when file operations were performed concurrently on both local disk and dfs network shares. (PRB39541)
  • Fixed a performance issue when accessing UNC paths with active EDP agent. (PRB39549)
  • Fixed an issue where User Revision did not correctly log changes originating from group-level configurations. (PRB39575)
  • Fixed an issue with group inheritance related information in the Console not showing correct access rights/permissions for users/computers, even though it was working correctly and applied as expected on the agent. (PRB39612)
  • Fixed an issue with synchronisation for Entra ID, where a sync that had a group as a root object failed with “Can't find Item in DS” error message. (PRB39633)

Knowledgebase  

The following new Knowledge Base articles have been added:

• Modernized Encryption at Rest (EAR) Administration Guide
• Troubleshooting Security Software Interactions
• Boot Failure After Windows Update KB5101650 with FDE Enabled