The scanner now supports sudo elevation when connecting over SSH with credentials of the Any type. You can scan Unix and Linux targets that require elevation without maintaining a separate credential type for each host.

A new Alert event record reports the status of the Scanner extension deployment to a target, so you can confirm that the extension reached each target and troubleshoot deployments that did not complete.

You can now configure selected scanner runtime options directly through Phoenix.Client, without editing configuration files on the scanner host.

The scanner supports multiple encryption types for Resource Brokers installation secrets, giving you more flexibility to align agent installation with your organization's encryption standards.

The scanner tightens access to its own resources and to directory traffic:

• The scanner updates the ACL for the Discovery folder to restrict access to Administrators and SYSTEM.
• The scanner updates the ACL for the BDA registry key to restrict access to Administrators and SYSTEM.
• LDAP queries no longer default to plaintext when the registry flag is absent.
• The scanner no longer performs silent anonymous LDAP binds when credential authentication fails.
• Executable signature verification is improved. If verification fails, the service starts but refuses to scan instead of failing the MSI installation with error 1603.

Remote Agent communication and service handling are more robust:

• Encryption between the Remote Agent client and server is improved.
• Remote Agent binary verification is restored and enabled by default.
• The Remote Agent no longer stops the RemoteRegistry service when other services depend on it.
• The Remote Agent returns and logs errors instead of discarding them.

Several changes reduce scan and queueing time:

• SCOM enumeration moves to the Phoenix extension.
• A DNS stall before scan start is eliminated, improving queueing speed.
• Linux service enumeration requests only the required systemctl properties, speeding up Linux target scans.
• Remote Agent deployment expands archived files in memory before copying them to the target.
• Throughput between the Remote Agent service and client is improved.

Target naming and group enumeration are more reliable:

• Domain group enumeration uses the domain the target is joined to rather than the domain of the scanning credential.
• The UseBIProvidedName option is honored across the shared name and DNS resolution layer and all 29 target-ops classes, including the Windows registry name.

The agent is easier to install and script:

• The scanner and Remote Agent are retargeted to .NET 10 and no longer require Core Hosting.
• Phoenix.Service ships as a self-contained, single-file bundle.
• Phoenix.Client ships as a self-contained, single-file bundle.
• BTDiscovery.cmd is now a pass-through command file, which simplifies scripting.