Announcing ProfileUnity FlexApp 6.9.5

We are pleased to introduce ProfileUnity FlexApp 6.9.5, our latest release advancing application isolation, zero-trust security, and platform compatibility across physical, virtual, DaaS, and cloud workspace environments. This update delivers significant new capabilities alongside broad stability, security, and performance improvements.

FlexApp Sandbox Isolation

• FlexApp Sandbox Isolation: FlexApp now supports application isolation using Windows Sandbox for scenarios where different versions of the same application must run side by side, or where applications (such as local AI processes) must run in an environment separate from the underlying operating system. Isolated applications run with profile persistence for both registry and file system data, a visible blue border indicator around isolated application windows, and visibility as sandbox sessions within Stratusphere UX and CommandCTRL. Isolated applications retain access to local resources including printers, storage, and clipboard. FlexApp Sandbox Isolation is also supported in FlexApp One via the --isolate flag.
• FlexApp Sandbox Isolation Console Support: A new Isolation checkbox in the FlexApp module rule dialog allows administrators to enable FlexApp Sandbox Isolation for individual application assignments directly from the console. The client installer also supports an ISOLATE=1 CLI argument to enable isolation during deployment, including automated installation of the Windows Sandbox feature.

ProfileUnity Management Console

• .NET Core 10: The ProfileUnity Management Console and License Service have been upgraded to .NET Core 10, providing improved performance, security, and long-term platform support.
• Windows Server 2025 Filters and Templates: New out-of-the-box filters for Windows Server 2025 are now included, along with a combined Windows 10/11/2016/2019/2022/2025 filter and a Windows 11 & 2025 filter. Configuration templates have been updated with new active setup Portability rules for Server 2025 environments.
• Entra ID GOV Cloud Support: Entra ID group searching for filters now supports Azure Government Cloud environments, expanding ProfileUnity's compatibility for government sector customers.
• Enhanced Application Restrictions: The Application Restrictions module now supports mixing Allow and Deny rules in any order, enabling scenarios such as broadly allowing Program Files while blocking specific executables, or blocking an application suite while permitting individual components. Application restriction events are now written to the Windows Event Log, simplifying auditing and troubleshooting. For organizations moving beyond Ivanti Workspace Control and Ivanti Environment Manager, ProfileUnity provides a modern migration path with familiar policy-based control.
• INI Content Encryption: Configuration INI file content is now encrypted by default, protecting sensitive settings from unauthorized access on the endpoint.
• Cluster-Wide Database Backups: The Database Backup button now triggers backups across all nodes in a cluster simultaneously, ensuring consistent point-in-time recovery for clustered environments.
• New Filter Conditions: A new TS Client IP filter condition allows filtering based on the IP address of the connecting RDP or ICA client, enabling location-aware policy delivery. A new DNS Lookup filter condition evaluates whether a specific DNS entry can be resolved on the endpoint, enabling flexible connectivity-based filtering.
• Out-of-Band Active Directory Functions: Active Directory-related console functions have been refactored to run out-of-band, improving console responsiveness and stability during AD queries in complex multi-domain environments.
• MongoDB Improvements: The installer now supports minor and patch-level MongoDB updates without requiring a full product upgrade. FlexDisk service notifications no longer fire when the service has been intentionally disabled, eliminating false alerts.
• 7-Zip Upgrade to 26.00: 7-Zip has been upgraded to version 26.00, providing security improvements.
• Additional Console Enhancements: ProfileDisk assignment ordering is now configurable. FlexApp package version is now displayed in the rule list and included in PDF and TXT exports. Grid headers and pagination controls are now fixed when scrolling through large data sets. Swagger API documentation is now configurable and disabled by default.

Client

• .NET Core 10: The ProfileUnity FlexApp client installs .NET Core 10 for the FlexApp container service.
• Wait for Applications Mode: A new mode keeps the splash screen visible until all FlexApp, FlexApp One, MSIX, and App-V modules finish processing, reducing the appearance of application pop-in during logon.
• Reduced FlexApp Mount Path Length: The FlexApp mountpoint path prefix has been shortened from C:\FADIA-T to C:\F, reducing path length for mounted packages and helping avoid path length limitations in deep directory structures. Startup.Update detects existing data in the legacy path during installation and migrates it automatically.
• Entra ID Filter STIG Compatibility: The client no longer invokes cmd.exe when processing Entra ID group filters, resolving hangs in environments where STIG or security policies restrict cmd.exe execution for standard users.
• Client License Service WMI Alternative: The client license service no longer relies on WMI, improving compatibility in environments where WMI is restricted, broken, or disabled by security policy.
• FlexApp XML Retry Logic: The client now retries XML and ICO file downloads for non-cached, non-CTL FlexApp assignments, reducing assignment failures in environments with intermittent network connectivity.
• Alternate VHDX-to-FA1 Fallback: If a VHDX file cannot be located and no alternate data filename is specified in the package XML, the client now automatically attempts to locate the corresponding FA1 file, reducing missed FlexApp playbacks.
• Application Restrictions and Elevation Wildcard Path Support: Application Restrictions and Privilege Elevation rules now support wildcards in the middle of a path string, enabling more flexible matching patterns such as C:\Program Files\*\app.exe.
• Priority Boost Disabled on RDS: Priority boosting for client and 7-Zip processes is now disabled on RDS and AVD environments, improving user session density on high-density platforms such as AppStream.
• Omnissa Rebranding: All VMware-branded registry keys, folder paths, and file names within the client have been updated to reflect the Omnissa rebranding per Omnissa KB6000745.
• 7-Zip Upgrade to 26.00: 7-Zip has been upgraded to version 26.00, providing security improvements.
• Diagnostic Tool Improvements: The Liquidware Diagnostic Tool now supports running multiple task categories in a single CLI invocation, portability path speed tests to and from cloud paths, last-line output from all client user logs in the HTML report, and updated vendor detection for Musarubra and Trellix DLLs.

FlexApp

• .NET Core 10: FlexApp has been upgraded to .NET Core 10, providing improved performance, security, and long-term platform support.
• 2024 Filter Drivers: FlexApp file system and registry filter drivers have been updated to the latest 2024 filter drivers, improving security, performance, and compatibility with current Windows versions.
• Large Reparse Point Package Efficiency: Playback performance for FlexApp packages with large numbers of reparse points has been significantly improved, reducing playback time for complex applications that previously took up to a minute to complete.
• Managed and Unmanaged FlexApp Builds: FlexApp now produces two distinct builds: a fully standalone build that bundles runtimes for use with FlexApp One, and a managed build that requires externally installed runtimes, enabling smaller FA1 package sizes for environments that manage .NET deployment separately.
• Disable Short Path Reparse Points Per Package: A new per-package option allows administrators to disable the creation of short-path reparse points on specific packages, reducing I/O overhead for applications with large numbers of reparse points where short-path support is not required.

FlexApp Packaging Console

• .NET Core 10: The FlexApp Packaging Console now installs .NET Core 10 for the FlexApp container service.
• Simplified Mount Path: The default packaging mount point path has been changed from C:\Windows\Temp\<GUID> to C:\FPC\<GUID>, reducing path length and aligning with updated paths used by other ProfileUnity components.
• Managed FlexApp Build in FA1 Bundler: The FPC build now includes the managed FlexApp build in the FA1 Bundler directory, allowing users to create smaller FlexApp One packages by managing .NET runtime installation separately.

FlexApp One

• .NET Core 10: FlexApp One has been upgraded to .NET Core 10, providing improved performance, security, and long-term platform support.
• Out-of-Band Respawn (--outofband): A new --outofband CLI argument causes FlexApp One to respawn as a child of the Container Service rather than the invoking deployment tool, ensuring the full PID tree terminates cleanly upon completion. This simplifies deployments via Microsoft Intune and Workspace ONE by Omnissa.
• 2024 Filter Driver Update: FlexApp One has been updated to use the latest 2024 Callback file system driver, improving security and compatibility with current Windows versions.
• Bundler -f Argument Now Optional: The FlexApp One Bundler can now operate without the -f argument, allowing smaller bundles that do not include flexapp.zip. This requires the main client and appropriate .NET version to be pre-installed on target endpoints.
• Simplified Shadows Path: The default Shadows path has been changed to C:\FA1, reducing path length and aligning with the updated FA-core path structure used by the client.
• 2020 Filter Driver Preservation on Upgrade: A new --keepfsdriver CLI option preserves 2020-era filter drivers during upgrade, maintaining compatibility with older bundled FlexApp One packages that require the previous driver version.