Hello everyone,
We are glad to let you know that we have released the latest build of ADManager Plus, 8050.
Features
Impact Radius: A new Impact Radius tab is now available under Risk Exposure Management to help technicians visualize the objects that could be affected if a privileged entity is compromised, enabling better assessment of the potential impacts across the environment.
Adaptive Access Review: User privileges are continuously monitored, and a certification flow is automatically triggered when high-risk or anomalous access is detected. ML-driven approve or revoke recommendations are provided along with contextual insights to support informed decisions.
WCAG Accessibility Controls: We introduced WCAG-compliant accessibility controls across the UI that enhance keyboard navigation, improve the color contrast, strengthen screen reader compatibility, and ensure a more inclusive user experience.
Attribute Dependencies: This new feature enables administrators to define conditional relationships between organizational attributes to dynamically control their visibility and selectable values in templates.
Azure app role assignment backup: You can now back up and restore Azure app role assignments, ensuring quick recovery of application permissions.
Expanded Microsoft Entra ID policy backup: Backup support has been expanded to cover additional Microsoft Entra ID policies for enhanced configuration protection:
Authentication Method Policy
Device Registration Policy
Authentication Strength Policy
IP-Based Named Location
Country-Based Named Location
Registration Campaign
Microsoft Entra ID BitLocker recovery key backup: Microsoft Entra ID BitLocker recovery keys can now be backed up and retrieved, ensuring quick access to encrypted drives.
Microsoft Entra ID local administrator password backup: Securely back up and view local administrator passwords managed through Microsoft Entra ID.
Enhancements
The Management module now includes the following enhancements:
We updated the account expiration settings to restrict the selection of Never as the account expiration value in User Creation and User Modification templates.
You can now check for duplicate users using custom functions in User Creation and User Modification templates.
We added support for Remote Room Mailbox Creation, the Remote Mailbox tab in single-user modification, and bulk provisioning of room, equipment, and linked mailboxes.
We added support for new Microsoft 365 fields in User Creation and User Modification templates.
We enhanced dynamic group updates to trigger membership updates within a maximum of 10 minutes when attributes defined in the group criteria are modified in ADManager Plus.
You can now merge security and GPO preference settings in the Merge GPOs action, with an option to preview the changes.
We added support to modify hybrid Google Workspace users using User Modification templates. We also added support to reset passwords and enable, disable, or delete Google Workspace users.
Added P.O. Box and Employee ID to the condition fields of user creation and modification rules.
Added an option to populate sAMAccountName from the Assign Values drop-down in user creation and modification rules.
The Copy User Attributes action now prompts for confirmation on whether to include privileged group memberships.
In Mailbox Management, objects in the Delegation tab are now sorted alphabetically.
Added an OU filter to dynamic group membership filters.
The Reports module now includes the following enhancements:
Custom report creation is now supported for AD, Microsoft 365, and hybrid environments, enabling flexible report generation for user objects across different setups.
Directory search is now available for AD, Microsoft 365, and hybrid environments, allowing quick and easy retrieval of user information from the top pane.
We added support to select groups by importing CSV files to generate the Detailed Group Members report.
We introduced a new LAPS Computers report under Computer Reports to display computers configured with legacy Microsoft Local Administrator Password Solution (LAPS) or Windows LAPS.
We updated the export workflow for reports generated for Search AD Objects and NTFS & Security Reports to improve reliability and consistency across PDF, XLSX, and CSV formats.
You can now view nested group members in the Permissions for Folders report.
Shares in the Servers and Permissions for Folders reports have been enhanced to refine results based on folder names.
We enhanced export settings for NTFS reports to exclude share permissions from being exported, allowing more control over exported report data.
We expanded the Add or Remove Column pop-up to support additional attributes for User, Group, Contact, Computer, and Password Reports, with certain report and attribute limitations.
Added an Applies To field to the Refine Filter in the Permissions for Folders report.
Added column customization for the Members View and Member of View in Group Reports.
The Automation module now includes the following enhancements:
We added support to send password expiration notifications on the next Nth day, as configured in the policy.
We added support to send account expiration notifications in the next Nth day, as configured in the policy.
We added support to handle duplicate primary keys from integrated applications. Users can now select the preferred primary key instead of halting the process, allowing automation to continue seamlessly.
Automation now includes additional actions to improve administrative flexibility and management capabilities.
You can now perform user automation tasks for Google Workspace users.
Added the Days Since Last Interactive Sign-in and Days Since Last Non-Interactive Sign-in filters to Microsoft 365 reports in scheduled automation.
Added criteria-builder support in the Advanced filter for selecting objects from a data source in scheduled automation.
Added support for selecting objects from the Recently Deleted Users report in scheduled automation.
Added an option to suppress the automation failure notification when a data source returns no updates.
The Event-driven Automation module now includes the following enhancements:
We added a Next N Days criterion to the Password Expiry Date option in the Decision Based on Criteria block.
We added support for setting up MFA for Microsoft 365 users.
We added a new Workflow Approval block for raising workflow requests and controlling block execution based on the approval or cancellation.
Event-driven Automation now supports enabling remote mailboxes, archive mailboxes, and mail forwarding. Delete Mailbox and Disable Mailbox have now been merged into a single action: Delete/Disable Mailbox.
Event-driven Automation now supports additional actions for Google Workspace users, including user enablement, group membership management, and license and role assignment or removal.
Added custom macro support for the Time Delay block in Orchestration Templates.
The Governance module now includes the following enhancements:
You can now share Access Certification Campaigns with technicians and manage access levels to the campaigns.
You can now create a new access certification campaign by copying an existing one.
You can now include nested groups when reviewing the entitlements of AD and Microsoft 365 groups in Access Certification Campaigns.
For objects that are reviewed or approved by reviewers who are assigned using macros in the Certifier Assigning Rule, Access Certification Campaigns now allow them to move to the next stage immediately, without waiting for other reviewers.
A feature tour is now available to help users quickly understand and navigate the process of creating an Access Certification Campaign.
We added new group and security anomaly indicators to the Identity Risk Assessment feature to identify potential identity and access risks.
The Delegation module now includes the following enhancement:
The Admin Audit Report now logs directory, tenant, delegation, and logon activities.
The Workflow module now includes the following enhancements:
You can now configure NTFS permissions and set the folder access duration for Workflow Requester Roles.
Added an option to keep the Review button disabled for an access certification campaign request until all objects have been approved or revoked.
The Application Integrations module now includes the following enhancements:
Added support for using response header values as macros in dependent API calls across application integrations.
Added proxyAddresses to the LDAP attribute mapping while integrating applications.
REST API enhancements:
Added a notification to alert administrators when the REST API request limit is reached.
Added support to create and delete users using REST API version 2.0.
Added a Manager DN column to the response of the List AD Users REST API version 2.0.
The ModifyUser API now supports setting attribute values to blank or <not set>.
REST API responses can now return LDAP attribute names instead of product-specific headers.
We added support for creating users via the ADManager Plus Create User API by passing user details in the request body using JSON.
Other enhancements:
We added support for retrieving LAPS passwords for the local domain without requiring remote PowerShell.
We updated ADManager Plus' UI with an elegant visual theme to enhance the overall user experience.
We added support to configure additional Organization Attributes, including a P.O. Box, City, State/Province, and Zip Code.
Added support for the %technicianDisplayName% macro in the notification template message body.
Logs forwarded to Splunk now include the hostname and the technician's User Principal Name.
Issues fixed
ADMP-12915: Exporting audit reports for group-based technicians produced a blank page.
ADMP-12935: The Before N days criterion did not work while configuring LDAP filters for custom reports.
ADMP-12930: A scheduled automation task failed to execute and remained in the Yet to Execute state.
ADMP-12881: When the Privacy Settings for GDPR/HIPAA Compliance option was enabled, deleted objects were displayed as - during single object modification.
ADMP-12943: The database dump failed when the database name contained spaces.
ADMP-13003: Environment variables configured with Secure this environment variable enabled were printed in plaintext in the audit report.
ADMP-12863: The character limit for environment variable values has been increased from 250 to 1,000 characters.
ADMP-12942: The OU restriction was not applied to the MFA Registration Details report for Microsoft 365 users.
ADMP-12931: Dynamic distribution group member values were empty while exporting scheduled reports.
ADMP-13049: Non-delegated groups were visible in the SearchGroup REST API for domain-based delegation.
ADMP-12623: The + symbol in the telephone number attribute was not reflected in AD when a user was created through the ServiceDesk Plus on-demand plug-in.
ADMP-12957: Automation failed to run an orchestration action, returning a database import error.
ADMP-13000: The Mailbox Auto Reply and Remove Microsoft 365 Roles blocks did not work correctly in orchestration templates.
ADMP-13028: Archived orchestration template history could not be viewed in View History after it was restored.
ADMP-12607: Performance was optimized for File Server Management actions in Management and Automation.
ADMP-13133: Users appeared duplicated in the Select Members pop-up when a help desk technician opened it during group creation.
ADMP-13069: In the Modify Single User action, changing an email address domain automatically updated it in Microsoft 365 even when the option to update Microsoft 365 fields was disabled.
ADMP-13225: Multi-valued attributes were missing from the Search API response columns.
ADMP-12902: When adding a user to a group they already belonged to, a success message was shown instead of a message indicating the user was already a member.
ADMP-12440: When an OU was renamed in AD, the change was not synced to the DN of related objects in ADManager Plus until a domain object refresh was performed.
ADMP-13431: Many members were removed from a group in a Dynamic Group Membership schedule without any audit event.
ADMP-13498: Trusted domains were not listed in the manager selection pop-up in object creation and modification templates.
ADMP-13402: Automation and workflow tasks used the service account credentials instead of the logged-in technician's credentials.
ADMP-13465: The product UI was intermittently inaccessible and became accessible only after manually restarting the ADManager Plus service.
ADMP-13315: Significant OU-expansion slowness occurred in the Automation module, with CPU spikes correlated to OU tree expansion.
ADMP-13408: An error reading the accountExpires attribute made active user accounts appear expired, leading a scheduled automation to disable them.
ADMP-13278: After upgrading to build 8040, Android mobile app users could not log in, while iPhone users were unaffected.
ADMP-13293: A technician could create users using a template that included a group outside the delegated OU and not listed under visible groups, and users were successfully added to that group.
ADMP-13364: Technicians could not log in using their UPN because duplicates were found when two users in the domain shared the same email but had different UPNs.
ADMP-13336: High CPU utilization of around 93% occurred on the application server during event-driven automation on build 8036.
ADMP-12479: Made performance improvements to risk misconfigurations.
Security fixes
The bundled Apache Tomcat version has been upgraded to version 9.0.123.
The bundled JRE version has been upgraded to version 17.0.19.
The Microsoft SQL Server JDBC driver has been upgraded to version 12.10.2.jre11.
Click here to learn more about the new features and enhancements of ADManager Plus.
How to update to this build?
Update using the service pack.
New to ADManager Plus?
Download the fully-functional 30-day free trial now.
Have more questions about this release? Leave a comment below or reach out to support@admanagerplus.com and we'll be happy to help you out.
Regards,
The ADManager Plus team
Toll-Free: +1-312-471-2233
Email: support@admanagerplus.com