Advance Notice: EDR Agent Windows 24.1 GA Update (Wednesday December 11)

Posted on December 6, 2024 by carlagajdecki

We are pleased to announce that Wednesday, December 11th the Endpoint Detection and Response (EDR) product will be releasing a new Windows agent. The Windows agent will see an update to 24.1 GA (24.1.4.257).

This will be released to the following consoles:

We strongly recommend upgrading to these agents as soon as possible to provide the maximum level of protection available. If you are using Automation Manager Policies (AMP) please be sure to update those to the latest available agent.

New and improved in Windows 24.1 GA (24.1.4.257):

Please be advised:  Windows Agents 24.1 and higher are compatible only with specific 64-bit Windows OS versions and is not compatible with all 32-bit Windows OS versions.

Windows Agent 22.3+ requires updated certificates. If the endpoint does not get Windows updates, you must install the certificate manually for the Agent to communicate with the Management Console. For more information, please review Agent Requirements on Windows within the EDR Help.


Windows Agent 24.1 is compatible with specific 64-bit Windows OS versions and not with 32-bit versions.

Windows Agent 24.1 is compatible only with these Windows versions:

  • Windows 8.1 64-bit
  • Windows 10 64-bit
  • Windows 11 64-bit
  • Windows Server/Storage Server 2012 R2 64-bit
  • Windows Server/Storage Server/Server Core 2016 64-bit
  • Windows Server/Server Core 2019 64-bit
  • Windows Server/Storage Server/Server Core 2022 64-bit

Windows Agent version 24.1 is not supported on:

  • Endpoints running 32-bit versions of Windows.
  • Endpoints running 64-bit versions of Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8 (not 8.1), and Windows Server 2012 (not R2).

For endpoints running those OSs, use the new Legacy Plus Windows Agent Installer.

Support for ARM-based architecture

SentinelOne released a version of the Windows Agent compatible with endpoints that utilize ARM processors.

The Windows Agent for ARM is installed like any other Windows Agent 22.1+ EXE. Please note this package is only compatible on Windows 11 with an ARM processor. Please review the full release notes for complete details.

Single proxy configuration:

You can now configure a single proxy that the Agent uses to send and receive data from all features, including Event collection, file scanning, and more. Using one proxy makes managing proxies easier and reduces the risk of potential misconfigurations and connectivity issues.

Granular Windows Agent Deployment Status Reporting

When using 24.1+ you will have full visibility in the Console on the Agent upgrade status when an Agent upgrade is triggered from the Console (both from the Update Agent action and Automatic Upgrade Policy).

We added many new return (exit codes) and detailed status messages. This is especially useful if the Windows Agent fails to upgrade because it is pending a user action.

These changes show in the Management Console:  

  • In Endpoints, we added Attention needed to the Pending actions filter.

In the Endpoint Details window, pending actions show with Attention needed information.

In Tasks, there is a new status, Pending User Action. You can search for it in the Task status filter.

Additionally, in the Single task (non-Bulk) view:

  • There are more details explaining the user action needed in the Detailed Status and Additional Information columns.

If you filter for Pending User Action tasks, click a task name to see the status, detailed status (including the return code in the Singularity™ Operations Center), additional information, and how to resolve the issue.

In Activity, you can filter Operations for Agent Update Canceled, Agent Update Failed, Agent Update Pending User Action, and Agent Update Completed.

And More….

  • SHA 256 value calculation: The Agent now calculates SHA 256 values by default:
    • Portable Executable (PE) files – up to 4 GB.
    • Non-PE files – up to 128 MB.
    • The maximum file size for SHA-1 value calculation was kept at 30 MB to preserve backward compatibility.
  • Various detection enhancements such as The Driver Blocking engine now offers the kill action for drivers whose dropper, loader, and installer are part of the same Storyline™.

 Dive into the full Release Notes on N-able Me for all the latest updates and enhancements.

This entry was posted in N-central, N-sight. Bookmark the permalink.