Endpoint Credential Manager 1.6.2606 release notes
🆕 New features
Configuration self-heal
The ECM service and Configurator now automatically detect and repair a missing or stale configuration file at startup, preventing service start failures after an upgrade. The same repair runs during installation before services start. Your customizations, including appSettings, proxy settings, and log configuration, are preserved during the repair; only version-driven sections are refreshed.
Environment variable support for ConfigCLI arguments
ConfigCLI now supports an env: prefix that resolves argument values from environment variables instead of the command line, keeping sensitive values out of process creation logs. Existing callers that pass literal values are unaffected.
Improved plugin load diagnostics
Assembly load failures are now logged with full detail, making it easier to identify and resolve cases where OS-level security tools, such as WDAC, AppLocker, or EDR solutions, block plugin loading. Previously, these failures appeared only as "Found 0 plugins" with no additional context.
✨ Enhancements
Security hardening
This release includes several security improvements across plugin loading, credential storage, transport, and logging:
- Plugins are now loaded from the install directory rather than the process working directory.
- The credential store now uses per-installation encryption entropy, replacing a previously shared value. Configuration deserialization is restricted to known types.
- Certificate revocation checking is enabled on the appliance connection, and size limits are enforced on protocol and HTTP reads.
- Log appenders now fail closed rather than falling back to an unprotected credential value.
Dependency update: log4net 3.3.1
The log4net dependency has been upgraded from 3.1.0 to 3.3.1.
🛠️ Issues resolved
| Product area | Description | Resolution |
|---|---|---|
| Configuration | Credential injection failed due to an over-strict validation check on the appliance-supplied certificate. | Credential injection now works correctly with appliance-supplied certificates. |
| Configuration | ECM experienced approximately 20 seconds of startup delay and logged spurious warnings due to scanning the wrong directory for plugins. | ECM now scans the correct directory at startup, eliminating the delay and spurious warnings. |
| Configuration | Assembly cleanup failures during plugin load caused unhandled errors. | Assembly cleanup failures during plugin load are now handled gracefully. |
| Configuration | Plugin composition failures silently terminated the service without logging. | Plugin composition failures are now logged rather than silently terminating the service. |
| Upgrade | Stale and duplicate assembly binding redirects caused compatibility issues across application configs. | Assembly binding redirects are now correct and consistent across all application configs. |
| Upgrade | The installer did not archive the existing configuration when upgrading, only when reinstalling. | The installer now archives the existing configuration on both the upgrade and reinstall paths. |
📝 Requirements
- Requires .NET Framework 4.8.
- Compatible with any BeyondTrust Secure Remote Access (SRA) version that supports ECM Protocol 1.4, 1.5, or 1.6.
- No breaking changes relative to 1.6.2601.
Before upgrading, note the following:
- Certificate revocation checking is now enforced on the appliance connection. Ensure that CRL/OCSP endpoints are reachable from the ECM host.
- Re-encrypt any plaintext credential values in log appender configuration before upgrading.
- A new ECSM.entropy file is created in the install directory and should be backed up alongside ECSM.settings.
- The service may perform one automatic restart after upgrade to load the corrected configuration; this is expected behavior.
- Configuration files are automatically preserved and updated during upgrade.
🗒️ Notes
- The SHA-256 signature for ECMBundledInstaller.exe is: 02ccd1032f9a874301a0cc3be517a9ae0735273c3773ed39b2e186b3568735bc
