Skip to main content

Netwrix Endpoint Protector Agent Support Policy

Netwrix is committed to providing high-performing solutions. To achieve this and to ensure the best customer experience, Netwrix supports and enhances only the current shipping version of the Netwrix Endpoint Protector (EPP) agent.

You can download the latest EPP agent for each OS (and the latest EasyLock client) only from the Netwrix portal. Note, some previous versions of EPP Server allowed you to acquire the agent directly from within the server. Netwrix has phased out that option in favor of this modern approach.

The following sections cover key points about the support policy and recommendations for rolling out agent updates.

note

This supportability document covers only the EPP agent and client components, not the Server. For a server-specific supportability statement, read the companion guide “Netwrix Endpoint Protector Server-Side Support Policy.”

note

EPP agents consist of two parts: the EPP agent itself and the EasyLock client. This support guide applies equally to both.

Support Policy Overview​

The Agent support policy includes the following:

  • Current Shipping Version Only: Netwrix supports only the latest available version of the EPP agent for each client OS. This ensures access to the newest features, performance improvements, and bug fixes.
  • Bug Fixes: Netwrix addresses critical bugs immediately and then re-ships the agent to the Netwrix portal, where it's available for all customers. The EPP agent has no fixed release timeline.
  • Feature Updates: Netwrix generally introduces new features alongside EPP server releases (or patches to EPP servers). The latest EPP client can accept those new directives from the fully-patched server.
  • Proactive Testing Encouraged: Netwrix advises customers to maintain endpoints on EPP agent versions released within the past year for optimal compatibility, bug fixes, and security fixes.

Staying as close as possible to the latest release reduces the risk of encountering untested upgrade paths or outdated behaviors.

Netwrix supports only the latest EPP Agent (including the EasyLock client), and applies all fixes (bugs, security updates, and so on) to the latest agent before re-shipping it to the Netwrix portal.

How to Stay Supported (Fully)​

To maintain full support and avoid disruptions, follow these recommendations:

  • Regular Updates: Keep both the EPP server and agent versions current. Staying within one version of the latest EPP server release ensures continued access to new features and fixes.
  • EPP Cumulative updates: When a new patch for EPP server version is available, test the update in your environment promptly to ensure compatibility and performance.
  • Issue Reproduction: To ensure the most accurate troubleshooting, Netwrix Support will ask you to reproduce issues using the latest agent (and server, if applicable). This ensures that testing runs against the supported configuration and that Netwrix can deliver a fix more quickly. If you can't update your production environment immediately, validate the issue in a test environment using current versions.
  • The following decision tree shows how Netwrix can help you fastest:

EPP Support Case Decision Tree

How to Get the Best Support Experience​

Upgrading every server and endpoint in your environment to the very latest version isn't always possible immediately. However, for the most accurate diagnosis and resolution of issues, Netwrix support engineers work from environments running a supported EPP Server (with the latest cumulative patches) together with the latest EPP Agent.

To make troubleshooting easier without disrupting your production environment, many customers choose to maintain a small test lab. With this approach, you can:

  • Validate updates and patches in a safe setting before full deployment
  • Test new major versions and Offline Patches ahead of time
  • Verify the latest agent’s compatibility with your systems

If needed, Netwrix can usually provide complimentary licenses for this type of lab environment.

As long as you can replicate a concern with a supported server (with latest patch) and latest client (in production or a test environment), Netwrix will then work to fix it.

When you replicate an issue in this “latest environment” — whether in production or in your lab — the Netwrix support team can work more quickly and effectively to help resolve it.

Testing and Rolling Out EPP Agent Updates​

When you are ready to deploy the EPP Agent updates to your estate, Netwrix recommends a specific method to minimize disruption and maximize confidence in your deployment.

Netwrix strongly recommends using a phased rollout strategy—commonly known as the “ring deployment model”—for agent updates. With this approach, you can identify potential issues early and isolate them before full-scale deployment.

Recommended Phased Rollout Model (Ring-Based):

This staged process helps reduce risk, allows validation across diverse environments, and limits the scope of impact if unexpected behavior occurs.

  1. Initial Test Group (2–5%) Begin by deploying the new agent version to a small, controlled group of endpoints (e.g., IT staff or low-risk devices). Use this group to evaluate basic functionality, check for regressions, and validate compatibility in your environment.
  2. Wider Deployment (10–50%) If you find no significant issues in the test group, expand the rollout to a larger segment of your organization. This middle ring can include a broader cross-section of users and departments to ensure confidence across varied use cases and endpoint types.
  3. Full Deployment (51–100%) After you verify the agent in real-world conditions and it meets your internal validation criteria, proceed with full deployment to the remaining environment.

The following diagram shows the ring model for agent deployment.

EPP Ring Deployment Model

You may define your own rings using EPP Smartgroups, MDM, SCCM, or any other deployment method that supports targeted rollouts. The exact percentages and ring boundaries are flexible—adapt them based on your organization's risk tolerance, endpoint diversity, and operational goals.

For more detail on the “ring” model and how to adapt it to Endpoint Protector rollouts, refer to this Netwrix resource: Using Rings to Test and Update the Endpoint Policy Manager Client-Side Extension and/or Cloud Client (And How to Stay Supported)

Note: While this guide references Netwrix Endpoint Policy Manager, the same ring-based principles apply to Netwrix Endpoint Protector agent deployments.

How to Stay Supported​

Not all customers can update immediately. Keep the following in mind:

  • The latest EPP server always has the newest features and directives that it can deliver to the agent. Therefore the latest agent is always the best choice.
  • Reproduction of Issues: If you encounter a bug or problem, the Netwrix support team will require you to replicate the issue on the latest agent version. Netwrix Support needs logs from this latest agent version to proceed with troubleshooting.
  • Regular Updates Recommended: While you can continue to use older agent versions, Netwrix highly recommends staying (at least) on versions released within the past six months. This ensures you benefit from the latest fixes and features. Only the latest EPP agent is within Full Support.
  • Testing on Clean Machines: To facilitate accurate troubleshooting, maintain a 'clean' testing machine with minimal software installed. Use this machine for pre-rollout testing and issue validation.

Lifecycle of Updates​

For planning purposes, here is the typical Netwrix cadence for shipping:

  • Regular Agent Updates: Netwrix releases new agent versions approximately every 4–6 weeks. These releases include bug fixes, performance improvements, and feature updates that don't require a server update.
  • Agent updates along with EPP server: If a new feature ships in EPP server which requires the EPP agent, Netwrix aims to ship the matching EPP agent at nearly the same time as the EPP server.

Note: This could mean that Netwrix releases a bugfix for the agent on a Monday and, if EPP server ships with a new feature, replaces the agent in the Netwrix portal the same week. This likely won’t happen often, but it’s possible. In this case, you’re welcome to use the “bugfix only” release, or the newest EPP agent, which shipped with support for any new EPP server features.

  • Notification of Updates: Netwrix notifies customers of new versions via the Netwrix Community only
  • Hotfixes: Through hotfix releases, Netwrix may address critical issues that affect a single customer in an unusual scenario. These hotfix releases work the same as any other EPP agent release: Netwrix replaces the existing EPP agent version in the portal with a fix that helps this one customer and anyone else affected by the bug. In these cases, Netwrix makes the latest EPP agent available immediately in the Netwrix portal and may or may not pair it with a broad announcement if it doesn’t affect many customers and isn't a security concern.

Client OS Supportability Statement​

Netwrix develops and tests Netwrix Endpoint Protector (EPP) Agents against actively supported operating systems to ensure security, compatibility, and reliability. This means the agent support lifecycle aligns with the vendor‑published support timelines for each platform.

Following the official operating system vendor policies lets Netwrix:

  • Deliver stable, fully tested updates
  • Ensure compatibility with the latest OS features and security updates
  • Avoid security and reliability risks associated with unsupported operating systems

The following outlines the current Netwrix OS support approach for Windows, macOS, and Linux environments, including version requirements, exceptions, and links to vendor documentation for up‑to‑date lifecycle information.

Processor Architecture Support​

The EPP Client supports both x86-64 and ARM64 processor architectures across all three supported platforms:

  • Windows — x86-64 and ARM64 (Windows on ARM)
  • macOS — x86-64 (Intel) and ARM64 (Apple Silicon)
  • Linux — x86-64 and ARM64 (RHEL 10.x and Ubuntu 26.04)

This ensures consistent Data Loss Prevention (DLP) coverage regardless of the underlying CPU architecture, including on Apple Silicon Macs, Windows on ARM devices, and ARM-based Linux servers.

Windows Client and Server OS Support​

Netwrix Endpoint Protector (EPP) Agent supports all Microsoft Windows client and server operating systems that remain within Microsoft’s Mainstream Support or Extended Security Update (ESU) phase. This includes:

Extended Support Behavior

When a Windows OS transitions from Mainstream to Extended Support, Netwrix will adopt a “Best Effort” support model, which includes:

  • Providing assistance with known issues, where possible
  • Continuing agent operation, assuming compatibility
  • Avoiding development of new fixes or enhancements for those platforms

However, legacy operating systems may lack compatibility with modern security components that current environments increasingly require, such as updated encryption libraries or secure communications mechanisms. These limitations are outside Netwrix’s control and may impact agent reliability or feature availability.

Windows 10 End of Life Note​

Windows 10 has reached end of support. Netwrix will treat Windows 10 the same as other Extended Support operating systems:

  • Netwrix won't commit development fixes for OS-specific issues
  • Operation is “best effort” only
  • Netwrix notes any known incompatibilities in the Netwrix Community Release Notes

Source: Microsoft announcement

General Guidance

Netwrix strongly encourages customers to plan migrations to supported operating systems ahead of published Microsoft end-of-life (EOL) timelines. This ensures continued compatibility, access to full product capabilities, and ongoing support.

Important: Netwrix doesn't support EPP on early builds of Windows 10 64bit, Windows 10 32bit, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2008, Windows 7, Windows XP, or any earlier versions. The final EPP Agent build with “best effort” support for these operating systems is 5.9.4.0 (Windows version 6.2.3.1010). Netwrix won't produce future builds for them.

macOS Clients​

For macOS endpoints, Netwrix follows Apple’s official macOS support policy. Netwrix tests and certifies each EPP Client release against the current macOS release and the three prior major versions (n‑3), consistent with Apple’s three‑year maintenance cycle.

More information:

Linux Clients​

Netwrix delivers DLP coverage across a wide set of Linux distributions, spanning officially certified, on-request, and community-compatible builds. The EPP Client for Linux is kernel neutral: it doesn't rely on kernel-level modules, which keeps it broadly compatible across Linux distributions and kernel versions without a rebuild for each one. See Kernel Independence in the Agent documentation for details.

Netwrix tests and certifies the EPP Client for Linux against:

  • Ubuntu LTS versions that are still within their official support lifecycle
  • Red Hat Enterprise Linux versions that are still within their official support lifecycle (highest minor release for each version only.)

References:

Netwrix doesn't build an EPP Client for the following Linux distributions by default:

  • Debian
  • Fedora
  • SUSE
  • OpenSUSE
  • SLED Linux Enterprise Server
  • Pardus OS
  • AWS Linux 2

Netwrix builds a Client for the latest version of any of these, or for a custom Linux distribution, on request, as a Feature Request (FR) through Netwrix Support.

Netwrix Product Management reviews and prioritizes these requests, which may involve a billable service. After approval, Netwrix builds the client using a Quick Test process in QA, and you're responsible for verifying that all functionality works as expected.

note

For Ubuntu-based distributions outside the officially tested and certified list, such as Mint Linux, and RHEL-based distributions such as Rocky Linux, Oracle Linux, or CentOS, the EPP Client installer built for the corresponding base version generally works without additional configuration. In some cases, the Linux administrator might need to manually adjust dependencies to match the base distribution. For installation steps, see Linux install guide under Agent Install Parameters in the Agent documentation.

Final Thoughts​

Using a supported operating system and staying up to date with the latest version of the Netwrix Endpoint Protector agent ensures optimal performance, access to the latest features, and a smoother support experience. By leveraging a phased rollout strategy and maintaining a proactive update schedule, your organization can confidently manage EPP updates and maintain robust data protection.
For assistance with your rollout strategy, contact the Netwrix support team.