Release notes

For tenant admins and partner admins.

AdminExplorer Standard and Enterprise is one client and one portal: the edition comes from your license. Portal capabilities go live without any change on your devices; device features arrive with a new client MSI. Each area below shows its status.

Portal (live since 2026-10-19/20)

• Tenants and partners: onboarding, licenses, download bundles with a per-tenant transform, and white-label portals for partners.
• Trials: a trial ordered on the website is reviewed and approved by your provider before the tenant, trial license, default policy and first download bundle are created.
• Policy and Settings editors with validation and starter policies, including the settings for Run in sandbox, installed software tracking, any application on demand and local administrator protection.
• Devices, Approvals and Audit with filters, CSV export and per-device and per-user summaries (Audit and reports).
• Microsoft Entra sign-in for your admins, with Conditional Access and an optional requirement to use it (Microsoft Entra sign-in).
• Directory Sync and Entra group targeting for approved programs, rules and Run in sandbox (Enterprise) (Entra group targeting).
• Your own app registration for sign-in and group sync, with a certificate held by the portal (Using your own app registration).
• Software views: inventory and change feed with elevation links (Installed software tracking).
• Local admins pages: compliance overview, preview of what enforce would remove, exceptions and history (Local administrator removal and protection).
• Guides in the portal, also published on this site.

Portal changes on 2026-10-20

• Device cap at enrollment: a new device is refused when the tenant’s active devices reach the limit of its license plan: the seats for Free and Trial, the seats plus max(2, 10 % of the seats rounded up) for Paid and NFR. The device gets 402 SeatsExceeded (event 3015 ClientError on the device) and retries on its own; enrolled devices and re-enrollments of a known machine are never refused. Overview and Devices show “N active of S seats” with a warning at 90 % and the refused enrollments (Licenses, seats and usage).
• Usage reports: one usage snapshot per tenant per day (active and enrolled devices, seats, tier, plan; kept 400 days). Partner admins see the seats now and the monthly peak per tenant under Usage; the vendor exports the monthly roll-up as CSV.
• Plan marker on every license: Paid, Trial, Free or NFR. Free and NFR are issued by the vendor only; a trial issued by a partner is at most 50 seats and 30 days.
• Directory Sync consent names only Global Administrator or Privileged Role Administrator, the roles that can consent to the Microsoft Graph application permissions it needs (Entra group targeting).
• Run in sandbox limited to Entra groups (Enterprise): the groups chosen for the sandbox are now synced and answered to devices like the groups of approved programs and rules, and the portal refuses new sandbox groups unless Entra group targeting is on with Directory Sync connected (Run in sandbox).
• Guide corrections: the setup script in Using your own app registration needs a Global Administrator or Privileged Role Administrator.

Portal changes on 2026-10-21

• Emergency admin account (Enterprise): a break-glass local administrator on every device, disabled except for a usage window you open by revealing its password on the device page (fresh sign-in and a reason required, shown once, audited). Turn it on under Settings, Emergency admin account; the password is rotated after use and every 30 days by default (Emergency admin account).
• Offline PIN for manual approvals (Enterprise): when a device cannot reach the portal, your helpdesk issues a one-time PIN for one pending request on the device page (Offline PIN, reason required, audited). Turn it on under Settings, Offline PIN for manual approvals (Offline PIN for manual approvals).
• Free plan: small organisations sign up at /free on the portal and get a tenant with 25 seats for 12 months without an approval step, renewed while an admin signs in and no more than 25 devices are active; audit kept 30 days; one 30-day Enterprise trial (Licenses, seats and usage).
• Code-signing pipeline (vendor side, no change on devices): the release build can sign the MSI, its executables and the sparse package once the signing identity is validated. Nothing is signed yet.
• Guides keep the Tenant and Partner sections in the portal’s sidebar.

Portal changes on 2026-10-22

• Pricing calculator for partners (partner admins): a new Pricing page in the partner area shows, for one customer, the endpoint band that applies, the recommended list price per endpoint per month and the totals per month and per year in EUR, DKK or USD, and what your partner account pays or earns under your own partner agreement (resell or refer, deal registration). The list price is a recommendation only; you set your own resale price. The page shows prices once the vendor has published the price list and set the terms of your partner agreement on your partner record. The guide Partner pricing calculator is in the portal under Guides and is not published on this site.
• PDF quotes for partners (partner admins): from the pricing page you create a numbered one-page PDF quote for your customer at your own price, with the customer’s name, contact and reference, a term of 12, 24 or 36 months and a validity of 7 to 90 days. The PDF never shows your discount, your purchase price or your margin; what you earn is shown on the page only. All your quotes are kept; Recent quotes lists your newest 100 with Download again. Only your own partner account’s admins and the vendor see your quotes.
• Deciding a trial before the email is confirmed (partner admins): a trial request still waiting for email confirmation can now be approved or denied under Trials (leads) when you know the requester, for example when the confirmation mail was stopped by a mail filter. A warning shows the unconfirmed address, a reason is required and recorded with your sign-in email address, and denying sends no mail. Unconfirmed requests you leave alone are removed after about a day. The guide Trial requests and approval is in the portal under Guides and is not published on this site.
• Emergency admin account is managed per tenant only: the vendor’s cross-tenant overview of emergency accounts was removed. The tenant’s own pages, the device page and the reveal flow are unchanged (Emergency admin account).

Portal settings for features that need the new client are stored and sent to devices, and take effect once the devices run the client that has them: 2.0.64 or later for the features listed under 2.0.64, 2.0.66 or later for the emergency admin account, the offline PIN and Map the whole folder of the program.

Client 2.0.66 (published 2026-10-21)

Client 2.0.66 replaces 2.0.65 in the download bundles. It contains everything in 2.0.65 and is the first client with the device half of the emergency admin account and the offline PIN; install it over 2.0.65 or an earlier version, settings and enrollment are kept. The kernel driver is unchanged (AdminExplorerDriver 2.1.0.0, attested and signed by Microsoft).

• Emergency admin account (Enterprise): with the setting on, the device creates the local account (default aex-emergency) in Administrators, denies it Remote Desktop and network sign-in and keeps it disabled; it generates the password, sends it to the portal only encrypted with your tenant’s key, enables the account for the usage window after a reveal (at the next policy check, or at once with Sync now), and disables it and rotates the password after the window or 4 hours after the first sign-in. Local administrator protection never removes it. A device refuses and reports a conflict when Windows LAPS manages the same account name or the name is the built-in Administrator (Emergency admin account).
• Offline PIN (Enterprise): when the device cannot reach the portal, the waiting window says Portal unreachable. Ask your helpdesk for an offline PIN and shows a challenge code; the PIN from the helpdesk starts the program exactly as a normal approval. A PIN works for one request, on one device, once, within the validity you set; 5 wrong PINs in 15 minutes lock the offline path for 15 minutes. Every use is audited when the device is back online (Offline PIN for manual approvals).
• Approval result after the waiting window was closed: the user now sees the result as a notification (the program started, or the rejection with the approver’s comment, or the expiry) even when the “waiting for approval” window was closed (event 1023).
• Run in sandbox, Map the whole folder of the program (setting off by default): a read-only copy of the program’s whole folder is given to the sandbox, so installers with files next to them work; the device refuses folders that are too large or unsafe and names the entry that stopped the run (Run in sandbox).
• Tray menu: an & in a program’s name or menu category is shown as written instead of turning into a shortcut letter, and a ShowInMenu value of the wrong registry type is ignored with event 2007 like other malformed settings.
• Run with AdminExplorer on Windows 11 is still under Show more options: this build is unsigned and has no sparse package, as in 2.0.65.

What an admin does: deploy 2.0.66 from your download bundle (or your Intune app) over the previous version. Then, for Enterprise tenants, turn on the emergency admin account and the offline PIN in Settings if you want them; each device gets its offline PIN key at its next policy check while it is online, so turn the offline PIN on well before people travel.

Client 2.0.65 (published 2026-10-20, replaced by 2.0.66 on 2026-10-21)

Client 2.0.65 replaces 2.0.64 in the download bundles. It contains everything in 2.0.64 plus fixes from the review of Sync now and the license tooling; install it over 2.0.64 or an earlier version, settings and enrollment are kept. The kernel driver is unchanged (AdminExplorerDriver 2.1.0.0, attested and signed by Microsoft).

• Sync now when the service could not start its portal connection (event 3004): the answer comes at once, “the portal worker is not running”, instead of after a wait.
• Sync now in the tray’s Status shows the service’s reason with the result (for example a retry back-off or an HTTP status), so a temporary back-off reads differently from a real fault.
• Sync now with a driver that takes the approved list only at service start: the result line ends with “the Flow A list applies at the next service start”, so it is clear that pre-approved starts change only after the restart.
• Sync now pressed while the service is stopping reports “the service is stopping” instead of “not enrolled”.
• License tooling (vendor side, no change on devices): whether the embedded license key is the production key is read from its declaration only, and the license tool verifies every license it assembles against the embedded key by default.
• Run with AdminExplorer on Windows 11 is still under Show more options: this build is unsigned and has no sparse package, as in 2.0.64.

Client 2.0.64 (published for download on 2026-10-20, replaced by 2.0.65 the same day)

Client 2.0.64 (x64, the same MSI for every customer, delivered in your download bundle) brings these device features. Install it over the previous version; settings and enrollment are kept.

• Sync now in the tray: policy, license, audit and approved-list changes at once.
• Tray menu placement: show or hide each approved program in the tray menu and group programs in submenus.
• Any application on demand (Enterprise) with a secure-desktop confirmation by the person at the keyboard (Any application on demand).
• Entra group targeting on the device (Enterprise): group-scoped approved programs, rules and Run in sandbox.
• Installed software tracking: the device reports installs, updates and removals and links them to elevations.
• Run in sandbox: open untrusted files in Windows Sandbox without administrator rights on the device (Run in sandbox).
• Local administrator removal and protection with report and enforce modes, exceptions and a lock-out guard.

The kernel driver in this release (AdminExplorerDriver 2.1.0.0) is attested and signed by Microsoft.

On Windows 11, Run with AdminExplorer is under Show more options in the right-click menu; a later signed release adds it to the compact (top-level) menu.

Known limitations

• The client is x64 only. ARM64 is planned.
• Run in sandbox copies only the selected file into the sandbox unless Map the whole folder of the program is on (client 2.0.66 or later): without it, installers that need files next to them (an .msi with external cabinet files, a setup.exe with a payload folder) do not work in the sandbox. Run in sandbox needs Windows Pro, Enterprise or Education with hardware virtualization.
• Pending approval requests are kept in the service’s memory: a service restart drops them and the user asks again.
• Clients before 2.0.64 apply approved-list changes to pre-approved (automatic) starts at the next service restart (scheduled when the device is idle, at the latest at 03:00 local time). Client 2.0.64 with driver 2.1.0.0 applies them at the next policy pull (every 15 minutes) or at once with Sync now; the restart is only the fallback when the live update is not possible.
• The 2.0.64, 2.0.65 and 2.0.66 MSIs and their executables are not code-signed yet (the signing identity is still being validated); the kernel driver is attested and signed by Microsoft. Use hash rules (not publisher rules) for AdminExplorer in AppLocker or WDAC until the signed release.
• A program started elevated cannot start a child program that demands administrator rights through its manifest; approve that program on its own.
• Publisher rules match the signer certificate’s common name only.

Planned

• Approvals in Microsoft Teams (Enterprise, portal only, no client change): a card in a Teams channel for every new approval request with Approve and Reject buttons that open the portal, so approvers can decide from Teams on the desktop or the Teams mobile app after signing in. Optional cards for decisions. The approval mail stays as it is.
• ARM64 client.
• Malware scan of a program before it is elevated, using the antivirus already on the device.