6.9.5.9638 Release Notes (May 26, 2026)

Product Updates

ProfileUnity Management Console

  • Upgrade Blocked for Insecure MongoDB Installations: Upgrades will be blocked if the existing MongoDB installation is insecure. ProfileUnity consoles installed fresh prior to version 6.8.5 have an insecure MongoDB configuration, and this remains true even if those installations were subsequently upgraded to newer versions. If your environment falls into this category, you must follow the ProfileUnity Migration Guide before upgrading to 6.9.5.
  • MongoDB Cluster Upgrade Requirements: Upgrading existing MongoDB 7.0.x or 5.0.x clusters to 7.0.32/5.0.32 is supported under the following conditions: you are using custom certificates that include both Client Authentication and Server Authentication EKUs, or you are using the default self-signed certificates and are already running MongoDB 7.0.28/5.0.32 or later. If neither condition is met, refer to the ProfileUnity Migration Guide before proceeding.
  • Cluster-Wide Database Backups: The Database Backup button now triggers backups across all nodes in a cluster simultaneously, ensuring consistent point-in-time recovery for clustered environments.
  • FlexDisk Service Notification Suppression: Console notifications no longer alert on the FlexDisk service when it has been intentionally disabled or deleted, eliminating false alerts in environments that do not use FlexDisk.
  • FlexDisk Service Deployment Change: The installer now deploys the FlexDisk service as Manual start and Stopped by default. The service is automatically started and set to delayed-auto when an administrator enables FlexDisk Management in the console.
  • MongoDB Minor Version Upgrade Support: The installer now supports "like" version MongoDB upgrades, allowing minor and patch-level MongoDB updates to be applied without requiring a full product upgrade.
  • Out-of-Band Active Directory Functions: Active Directory-related console functions have been refactored to run out-of-band, improving console responsiveness and stability during AD queries in complex multi-domain environments.
  • .NET Core 10: The ProfileUnity Management Console and License Service have been upgraded to .NET Core 10, providing improved performance, security, and long-term platform support.
  • Entra ID GOV Cloud Support: Entra ID group searching for filters now supports Azure Government Cloud environments, expanding ProfileUnity's compatibility for government sector customers.
  • FlexApp One Default CLI Override: The --outofband option has been added to the FlexApp One default CLI override, 
  • Windows Server 2025 Filters and Templates: New out-of-the-box filters for Windows Server 2025 are now included, along with a combined Windows 10/11/2016/2019/2022/2025 filter and a Windows 11 & 2025 filter. Configuration templates have been updated with new active setup Portability rules for Server 2025 environments.
  • TS Client IP Filter Condition: A new TS Client IP filter condition allows administrators to filter based on the IP address of the connecting RDP or ICA client, enabling location-aware policy delivery.
  • DNS Lookup Filter Condition: A new DNS Lookup filter condition evaluates whether a specific DNS entry can be resolved on the endpoint, enabling flexible connectivity-based filtering scenarios.
  • FlexApp Sandbox Isolation Console Support: A new Isolation checkbox in the FlexApp module rule dialog allows administrators to enable FlexApp Sandbox Isolation for individual application assignments directly from the console.
  • ProfileDisk Assignment Ordering: Administrators can now reorder ProfileDisk assignments in the Administration section, providing explicit control over the sequence in which ProfileDisks are evaluated and applied.
  • Delete Config INI on Configuration Deletion: When deleting a configuration, administrators can now optionally delete the associated INI file from its deployment path, keeping the deployment environment consistent.
  • FlexApp Package Version in Rule List: The FlexApp package version is now displayed within the FlexApp module rule list and is included in PDF and TXT configuration exports, improving rule management visibility.
  • INI Content Encryption: Configuration INI file content is now encrypted by default, protecting sensitive settings from unauthorized access on the endpoint.
  • Swagger API Documentation Control: The Swagger API documentation endpoint is now configurable and disabled by default. Edit C:\Program Files\Liquidware Labs\ProfileUnity\ProfileUnity.Host.dll.config <add key="EnableSwagger" value="false" /> to “true” and restart the ProfileUnity Service. Add /swagger/index.html to your URL to access swagger. To access the json API schema add this to your URL /swagger/v1/swagger.json.
  • Access and Authentication in PDF Export: The console PDF export now includes Administration Access and Authentication details, including Directory Services, Authentication, and Access Management sections.
  • Scroll List Header and Footer Improvements: Grid headers and pagination controls are now fixed outside the scrollable area, remaining visible when scrolling through large data sets across all management pages.
  • Shortcuts Mutual Exclusivity Enforcement: The Process action after logon option is now automatically disabled when User Startup Group is selected as the shortcut location, preventing an unsupported configuration combination.
  • 7-Zip Upgrade to 26.00: 7-Zip has been upgraded to version 26.00, providing security improvements.
  • Hide Specific Configuration Modules: Additional configuration modules can now be hidden in the Miscellaneous section of the Administration page.

Client

  • FlexApp Sandbox Isolation Installer Support: The client installer supports an ISOLATE=1 CLI argument to enable FlexApp Sandbox Isolation during deployment, including automated installation of the Windows Sandbox feature.

    Note: Enabling nested virtualization is required to utilize this feature when applying isolation within a virtual machine environment.

  • Omnissa Rebranding: All VMware-branded registry keys, folder paths, and file names within the client have been updated to reflect the Omnissa rebranding per Omnissa KB6000745.
  • .NET Core 10: The ProfileUnity FlexApp client installs .NET Core 10 for the FlexApp container service. 
  • Offline DNS Entry Variable Support: The OfflineTestDnsEntry setting now supports %VARIABLE% substitution and uses an improved default that attempts to resolve the domain controller, providing more reliable offline detection.
  • FlexApp XML and ICO File Retry Logic: The client now retries XML and ICO file downloads for non-cached, non-CTL FlexApp assignments, reducing assignment failures in environments with intermittent file server or network connectivity.
  • Reduced FlexApp Mount Path Length: The FlexApp mountpoint path prefix has been shortened from C:\FADIA-T to C:\F, reducing path length for mounted packages and helping avoid path length limitations in deep directory structures.
  • Elevation XML Cleanup at Logoff: On non-RDS systems, elevation whitelist and blacklist policies are now cleaned up from the elevation service XML at logoff, ensuring that removed elevation rules do not persist across user sessions on persistent desktops.
  • FADIA-T Path Migration: Startup.Update now detects existing data in the legacy C:\FADIA-T path during installation and migrates it to the new C:\F path, with automatic cleanup of old directories.
  • Entra ID Filter STIG Compatibility: The client no longer invokes cmd.exe when processing Entra ID group filters, resolving hangs in environments where STIG or security policies restrict cmd.exe execution for standard users.
  • Client License Service WMI Alternative: The client license service no longer relies on WMI, improving compatibility in environments where WMI is restricted, broken, or disabled by security policy.
  • AWS S3 and Google Storage Library Updates: The AWS S3 and Google Cloud storage libraries within lw-cloud-io have been updated to their latest versions, exposing improved upload and download performance settings.
  • 7-Zip Upgrade to 26.00: 7-Zip has been upgraded to version 26.00, providing security improvements.
  • Managed FlexApp Build Reference: The client build now references the managed FlexApp build (flexapp_managed.zip), which excludes bundled .NET runtimes, enabling smaller FA1 package sizes for environments that manage .NET separately.
  • DNS Lookup Filter Support: The client now evaluates the new DNS Lookup filter condition, determining whether a specified DNS entry is resolvable on the endpoint at logon time.
  • Priority Boost Disabled on RDS: Priority boosting for client and 7-Zip processes is now disabled on RDS and AVD environments, improving user session density on high-density platforms such as AppStream.
  • AVD App Attach Enhancement: The AVD App Attach integration has been improved so that the cmdService named pipe only connects when RDAgentBootLoader.exe is running as SYSTEM, improving reliability and eliminating spurious connections.
  • Client License Service Notification Customization: License notification messages displayed by the client license service are now configurable within the client service configuration file, allowing organizations to tailor messaging to their users.
  • Client Service LocalSystem Support: Startup.Update now supports configuring the client service to run as LocalSystem when a matching credentials file is received, simplifying deployment in environments that require service isolation.
  • Wait for Applications Mode: A new mode keeps the splash screen visible until all FlexApp, FlexApp One, MSIX, and App-V modules finish processing, reducing the appearance of application pop-in during logon for FlexApp-only customers.
  • Alternate VHDX-to-FA1 Fallback: If a VHDX file cannot be located and no AltDataFilename is specified in the package XML, the client now automatically attempts to locate the corresponding FA1 file, reducing missed FlexApp playbacks.
  • Diagnostic Tool Improvements: Multiple enhancements to the Liquidware Diagnostic Tool include: support for running multiple task categories in a single CLI invocation, portability path speed tests to and from cloud paths, last-line output from all client user logs in the HTML report, and updated vendor detection for Musarubra and Trellix DLLs.
  • Application Restrictions: Mixed Allow and Deny Rules: Application Restrictions now support mixing Allow and Deny rules in any order, enabling scenarios such as broadly allowing Program Files while blocking specific executables, or blocking an application suite while permitting individual components.
  • Application Restrictions Event Viewer Logging: Application restriction events are now written to the Windows Event Log. Allowed events are recorded to a dedicated Liquidware Application log and blocked events are written to the Windows Application log, simplifying auditing and troubleshooting.
  • File Type Associations: The file association management code has been updated with improved UCPD bypass support, restoring file association management in environments where Microsoft's UCPD.sys changes affect third-party tools.
  • ProfileDisk /AttachOnly Mount Retries: ProfileDisk mounts using /AttachOnly now implement configurable retry and timeout logic, resolving mount failures caused by temporary file locking from security agents such as Microsoft Defender for Endpoint (MsSense.exe).
  • Application Restrictions and Elevation Wildcard Path Support: Application Restrictions and Privilege Elevation rules now support wildcards in the middle of a path string, enabling more flexible matching patterns such as C:\Program Files\*\app.exe.
  • Application Restrictions Popup Notification: The popup notification when an application is blocked can now be disabled.

FlexApp

  • Mount Path Update: All internal references to the legacy C:\FADIA-T path have been updated to the new shortened C:\F path structure, consistent with the updated client mountpoint paths.
  • Large Reparse Point Package Efficiency: Playback performance for FlexApp packages with large numbers of reparse points has been significantly improved, reducing playback time for complex applications that previously took up to a minute to playback.
  • Managed and Unmanaged FlexApp Builds: FlexApp now produces two distinct builds: a fully standalone build that bundles runtimes (used for FlexApp One), and a managed build that requires externally installed runtimes. This enables smaller FA1 package sizes for environments that manage .NET deployment separately.
  • VirtFs Priority Boost Disabled on RDS: VirtFs process priority boosting is now disabled on RDS and AVD environments, improving user session density on high-density platforms such as Amazon AppStream.
  • FlexApp Sandbox Isolation: FlexApp now supports Sandbox Isolation using Windows Sandbox. Isolated applications run in a contained environment with profile persistence for both registry and file system data, a visible blue border indicator around isolated application windows, and visibility as sandbox sessions within Stratusphere UX and CommandCTRL.
  • Disable Short Path Reparse Points Per Package: A new per-package option allows administrators to disable the creation of short-path reparse points on specific packages, reducing I/O overhead for applications with large numbers of reparse points where short-path support is not required.
  • .NET Core 10: FlexApp has been upgraded to .NET Core 10, providing improved performance, security, and long-term platform support. 
  • 2024 Filter Drivers: FlexApp file system and registry filter drivers have been updated to the latest 2024 filter drivers, improving security, performance, and compatibility with current Windows versions.

FlexApp Packaging Console

  • .NET Core 10: The FlexApp Packaging Console now installs .NET Core 10 for the FlexApp container service, providing improved performance, security, and long-term platform support.
  • Simplified Mount Path: The default packaging mount point path has been changed from C:\Windows\Temp\<GUID> to C:\FPC\<GUID>, reducing path length and aligning with the updated paths used by other ProfileUnity components.
  • Managed FlexApp Build in FA1 Bundler: The FPC build now includes the managed FlexApp build (flexapp_managed.zip) in the FA1 Bundler directory, allowing users to create smaller FlexApp One packages by managing .NET runtime installation separately.

FlexApp One

  • .NET Core 10: FlexApp One has been upgraded to .NET Core 10, providing improved performance, security, and long-term platform support.
  • FlexApp Sandbox Isolation: FlexApp Sandbox Isolation is now supported in FlexApp One via the --isolate flag. Enabling Windows Sandbox on endpoints is handled by administrators at scale through a deployment script prior to using this feature.
  • Simplified Shadows Path: The default Shadows path has been changed to C:\FA1, reducing path length and aligning with the updated FA-core path structure used by the client.
  • Out-of-Band Respawn (--outofband): A new --outofband CLI argument causes FlexApp One to respawn as a child of the Container Service rather than the invoking deployment tool, ensuring the full PID tree terminates cleanly upon completion. This simplifies deployments via Microsoft Intune and Workspace ONE by Omnissa.
  • Bundler -f Argument Now Optional: The FlexApp One Bundler can now operate without the -f argument, allowing smaller bundles to be created that do not include flexapp.zip. This requires the main client and appropriate .NET version to be pre-installed on target endpoints.
  • 2024 Filter Driver Update: FlexApp One has been updated to use the latest 2024 Callback file system driver, improving security and compatibility with current Windows versions.
  • 2020 Filter Driver Preservation on Upgrade: A new --keepfsdriver CLI option preserves 2020-era filter drivers during upgrade, maintaining compatibility with older bundled FlexApp One packages that require the previous driver version.

Issues Resolved

ProfileUnity Management Console

  • Fixed an issue where many users could not log on to the console or be added as a Service user when RunGroupADQueriesOutOfProcess was set to TRUE.
  • Fixed an issue where GPO Integration failed with an IImpersonationFactory binding error in multi-domain environments.
  • Fixed an issue where certain users from other domains could not log on to the ProfileUnity console.
  • Fixed an issue where domain Group searches in other domains failed in certain multi-domain combinations.
  • Fixed an issue where AVD App Attach did not sync FlexApp packages.
  • Fixed an issue where retrieving additional details from Active Directory forests took significantly longer than expected.
  • Fixed an issue where the Last Deployed Date column sorting was not functioning correctly in Configuration Management.
  • Fixed an issue where column sorting in Configuration Management and Inventory Management was case-sensitive for the Name column.
  • Fixed an issue where the RDP Client Module Desktop Size field offered an invalid 80% of screen option.

Client

  • Fixed an issue where cached AD group filters stopped working after a reboot while the endpoint was offline.
  • Fixed an issue where a FlexApp collection enumeration exception occurred during concurrent processing.
  • Fixed an issue where an ArgumentNullException was thrown when comparing an empty vhd.exe command line argument.
  • Fixed an issue where AD Group Filters ignored the group list when the endpoint was offline and no cached value existed.
  • Fixed an issue where a missing filter secret in the customer INI caused a fatal exception at startup.
  • Fixed an issue where Entra ID group calls to Microsoft Graph could hang indefinitely, blocking logon processing.
  • Fixed an issue where FlexApp continued testing for file existence and downloading files during logoff runs.
  • Fixed an issue where Bulk Mount did not perform full cleanup after a failed mount attempt.
  • Fixed an issue where elevation policies in the Shortcut module prevented deletion of UserStartMenu and PublicStartMenu LNK and URL files at logon.
  • Fixed an issue where users received a temporary profile when logging into a persistent desktop that had a ProfileDisk assigned.
  • Fixed an issue where certain Liquidware executables were blocked by Application Restriction rules.
  • Fixed an issue where newer versions of Chrome failed to load extensions when ProfileDisks are in use.
  • Fixed an issue where AppAttach applications are not installed when using ProfileDisks or FSLogix Profile Containers.

FlexApp

  • Fixed an issue where FlexApp packages failed to fully reverse playback and clean up the virtual file system on logoff.
  • Fixed an issue where the running entries API call deleted folders within the user profile.
  • Fixed an issue where copying FlexApp user data failed for on-boot packages when cloaking was enabled.
  • Fixed an issue where on-boot FlexApps with HKCU registry values containing the user profile variable do not expand correctly during user login.

FlexApp Packaging Console

  • Fixed an issue where FlexApp captures failed with a 500 Internal Server Error on Server 2022 packaging VMs.
  • Fixed an issue where a command-line help window appeared unexpectedly during FPC installation.

FlexApp One

  • Fixed an issue where corrupt disk errors occurred for VSCode FlexApp One packages.
  • Fixed an issue where duplicate shortcuts are created for managed FlexApp One packages.
  • Fixed an issue where certain arguments for application executables were not processed correctly when packaged as a FlexApp One.

ProfileUnity Component Versions

Component 6.9.5
Console UI 6.9.5.9638
FlexDisk Service 6.9.5.9357
Client.NET 6.9.5.9638
VirtFS 6.9.5.9638
LWL UserApp Player 6.9.5.9638
LWL UserApp Service 6.9.5.9638
LWL Elevation Service 6.9.5.9638
LWL License Service 6.9.5.9638
FPC 6.9.5.9638
FPC Player 6.9.5.9638
FPC VirtFS 6.9.5.9638

Known Issues and Limitations

Important: End-of-Life for ProfileUnity Versions
Liquidware provides specific information on the version support lifecycle for recent product releases. Once a version has reached End of Life, Liquidware will discontinue all sales and technical support of that version. We encourage all customers who might still be utilizing these versions to upgrade to a more recent version to take advantage of the numerous technologies & feature enhancements as well as resolved support issues. For a full list of End-of-Life dates, refer to this URL: https://www.liquidware.com/support/sections/202062243-Updates

  • Cluster Management Tasks: When performing cluster management tasks (e.g., adding/removing nodes), the ProfileUnity user account must belong to the local administrators group on all nodes.
  • AppStream Compatibility: FlexApp and FlexApp One cannot publish shortcuts to the AppStream Dynamic Application Framework in multi-session environments or non-Domain join, as AppStream does not support the Dynamic Application Framework and multi-session use simultaneously or non-domain join.
  • IPv6 Cluster Upgrade Issue: Upgrading a ProfileUnity cluster with nodes that have an IPv6 address from a valid IPv6 DHCP scope may fail. For more information, see Clustering - Error Adding Third Cluster Node.
  • 32-Bit Windows Feature Deprecation: The following features no longer support 32-bit Windows: FlexApp, FlexApp Packaging Console, ProfileDisk, Custom Folder Redirection with Hard Redirect, and Registry Redirection.
  • Internet Explorer Compatibility: Using Internet Explorer to manage the ProfileUnity console is no longer supported. Performance collection is unavailable in developer tools on Internet Explorer 11 and Legacy Edge when ProfileDisk is enabled.
  • Unsupported Operating Systems: Windows 7, Windows Server 2008 R2, and Windows Server 2012 R2 are no longer supported.
  • Outlook File Previewer: The file previewer in Office 365 (FlexApp version) does not work. However, double-clicking the file functions correctly.
  • File Path Limit: Files with more than 260 characters cannot be processed by the Portability engine.
  • Root Certificate Update Requirement: If automatic root certificate updates are disabled, the ProfileUnity Management Console installation might fail due to a data1.cab certificate error. Federal and some commercial accounts following STIG guidelines may need to manually update root certificates to avoid this issue.
  • Folder Redirection on AppData: Using Folder Redirection on the entirety of AppData Local can cause issues on Windows 10/11 and Windows Server 2016/2019/2022.
  • Portability on AppData Local: Using Portability on all of AppData Local can lead to extended login times.
  • Windows Start Menu Migration: Pinned Start Menu items from Windows 10 may not migrate to Windows 11 when using Portability.
  • ProfileDisk Compatibility from Windows 10 to Windows 11: A ProfileDisk created on Windows 10 may not function correctly on Windows 11. Portability should be used to migrate to a new ProfileDisk on Windows 11.
  • ProfileUnity Client Service Account: Persistent workstations that leverage the ProfileUnity client service to run on-boot configurations do not process new iterations of existing startup configurations when deployed. See KB article "Updates to Existing Startup Configurations Are Not Applied" for workaround.

Updating Existing Software

For guidance on upgrading or migrating to this release, see Upgrade & Migration Guidance. Liquidware recommends reviewing this topic before executing any upgrade or migration steps.