FileWave Version 15.5.0

A note on the Compatibility charts:  There are several states of compatibility for FileWave clients:  

• "Compatible" (the first table) indicates that we have run QA regression tests against these operating system versions, and they are fully supported
• Not being on the Compatibility chart (such as macOS 12) does not mean that platform is not supported...it just means we did not actively test against it, but we do expect it to function
  • Support of any issues experienced specifically on these platforms would be considered on a case-by-case basis (but these cases are exceedingly rare)
• "Legacy" versions mean that we don't test, but we do provide a retro-version of a client so that the device can still report in  
  • There is NO support for these platforms beyond the availability of the older client, and in almost all cases these are for OSes that are no longer supported by the developer in question
• Lastly, items do fall out of support, such as Windows XP and probably soon the older Android APK client as examples, but we always include these items in our release notes

An additional note on third-party software inclusion, such as TeamViewer:

• Partnerships we have with third party providers have their own set of system requirements for those released applications.  We test against their most recent versions, and support of those applications is limited to third-party vendor specifications. 

Fully Tested by QA

• macOS 14, 15 (Intel and Apple Silicon)
  
• Debian 12.6 x86_64 (Note that any Debian 12.x is expected to work, and applying security updates may move you to a higher version.)
  

Expected to work

• macOS 11, 12, 13 (Intel and Apple Silicon)

Virtual Appliances

• HyperV - The images are available as Generation 1 or Generation 2
• VMWare ESX - The images require vmx-19 support which means VMWare vCenter 7.0 Update 2 is the minimum version. ( https://knowledge.broadcom.com/external/article?legacyId=2007240 )
• VMWare Fusion
• VMWare Player and Workstation
• VirtualBox

All OS must be 64bit.

Fully Tested by QA

• macOS 14, 15 (Intel and Apple Silicon)
• Windows 10 (Ent/Pro 21H1 and above), 11 (Ent/Pro 21H2 and above)
  

Expected to work

• Windows Server 2022, Windows Server 2025
• macOS 11, 12, 13 (Intel and Apple Silicon)

Legacy

• macOS 10.11 → Legacy Version 13.1.5
• macOS 10.12 → Legacy Version 14.0.2
• macOS 10.13 → Legacy Version 14.5.4
• macOS 10.14 → Legacy Version 14.8.0
  
• macOS 10.15 → Legacy Version 15.0.1

Fully Tested by QA

• iOS 17.6, 18
• iPadOS 17.6, 18
• tvOS 17.6, 18
• Android 14, 15 (EMM Client)
• Chromebook
  

Expected to work

• iOS 14, 15, 16
• iPadOS 14, 15, 16
• tvOS 14, 15, 16
• Android 8 to 13 (EMM Client)
  

Legacy

• iOS 13 → Legacy Version 15.0.1
• iOS 10, 11, 12 → Legacy Version 13.1.5

All OS must be 64bit.

Fully Tested by QA

• macOS 14, 15 (Intel and Apple Silicon)
• Windows 10 (Ent/Pro 21H1 and above), 11 (Ent/Pro 21H2 and above)

Expected to work

• macOS 11, 12, 13 (Intel and Apple Silicon)

All OS must be 64bit.

Fully Tested by QA

• Debian 12.6 x86_64 (Any Debian 12.x is expected to work.)
• macOS 14, 15 (Intel and Apple Silicon)
• Windows 10 (Ent/Pro 21H1 and above), 11 (Ent/Pro 21H2 and above)

Expected to Work

• Windows Server 2022, Windows Server 2025

Virtual Appliances

• HyperV - The images are available as Generation 1 or Generation 2
• VMWare ESX - The images require vmx-19 support which means VMWare vCenter 7.0 Update 2 is the minimum version. ( https://knowledge.broadcom.com/external/article?legacyId=2007240 )
• VMWare Fusion
• VMWare Player and Workstation
• VirtualBox

The FileWave Imaging Virtual Server (IVS) is a special appliance that provides imaging support for Windows 10 and 11 UEFI and non-UEFI devices.

Virtual Appliances

• HyperV - The images are available as Generation 1 or Generation 2
• VMWare ESX - The images require vmx-19 support which means VMWare vCenter 7.0 Update 2 is the minimum version. ( https://knowledge.broadcom.com/external/article?legacyId=2007240 )
• VMWare Fusion
• VMWare Player and Workstation
• VirtualBox

End user notifications: Now, admins using FileWave Anywhere or FileWave Central can send custom messages to enrolled devices, displaying them as system notifications for users. This feature empowers administrators to communicate important information directly to users' devices, enhancing engagement and user experience. More...

Keycloak IDP integration for admin login: We’ve introduced support for Keycloak as an Identity Provider (IDP) in FileWave Anywhere and Central. Administrators can now log in using their Keycloak accounts, enhancing security and simplifying credential management.

Qt 6 Upgrade: FileWave 15.5 is now using Qt 6 open-source library, which brings better support for recent operating systems, security fixes and optimizations. On macOS, FileWave Central is now a fully universal (Intel and Apple Silicon) application, Rosetta 2 is not required anymore. It also brings better support for internal web browser thanks to updated Chromium engine. Windows components are now 64-bit only.

Add to deployment: It is now possible to easily add devices or filesets to existing (or new) deployments, using new context menu options in FileWave Central.

Dark Mode improvements: Window decoration (typically window header) is now properly following dark mode setting.

API Improvements: New public API endpoints have been introduced to facilitate external service integration. These endpoints allow users to fetch results of stored inventory queries in FileWave and execute ad-hoc inventory queries via the Preview API without saving them. The results are returned as JSON objects, with customizable page sizes to enhance flexibility. Detailed Swagger documentation is available for these endpoints, ensuring clear guidance on their usage. These updates provide seamless access to inventory data for external integrations. New APIs that are now available:

• /reports/v1/reports

• /reports/v1/reports/{id}

• /notifications/v1/notifications

New Fileset dialog:  With the addition of the different new fileset types (DDM configuration, DDM asset, Winget, Autopkg…), revisiting the New Fileset dialog was required - the new one is lean and much simpler !

FileWave Appliances: There are a few key changes for someone setting up a new FileWave Server, Booster or IVS appliance that should be noted for 15.5.0.

• HyperV images are now provided as Gen1 as well as now Gen2 allowing you to take advantage of more modern HyperV features when setting up a new appliance. Gen1 images will continue to be provided for those who need them until further notice.
• fail2ban has been added to all of the Appliance images to protect them from brute force SSH attacks. Existing images will not get this, but it can be manually added if you would like. SSH shouldn't normally be exposed to the Internet, but also some attacks can happen on a protected network by an infected host.
• When setting up a new Appliance the root user is not enabled. Instead you will login via console or SSH as "fwadmin" with a password of "filewave" and you will be forced to change the password on first login. To do actions as root you will use sudo. Existing Appliances will not be changed by filewave but you can make the same changes. 
  
  

  #!/bin/bash
  
  # Ensure the script is run as root
  if [ "$EUID" -ne 0 ]; then
    echo "Please run this script with sudo or as root."
    exit 1
  fi
  
  # Prompt for the password
  echo "Creating user 'fwadmin'."
  read -s -p "Enter password for 'fwadmin': " password
  echo
  read -s -p "Confirm password: " password2
  echo
  
  # Check if passwords match
  if [ "$password" != "$password2" ]; then
    echo "Error: Passwords do not match."
    exit 1
  fi
  
  # Create the 'fwadmin' user without a password prompt
  adduser --gecos "" --disabled-password fwadmin
  
  # Set the password for 'fwadmin'
  echo "Setting password for 'fwadmin'."
  echo "fwadmin:$password" | chpasswd
  
  # Add 'fwadmin' to the sudo group
  usermod -aG sudo fwadmin
  echo "'fwadmin' has been added to the sudo group."
  
  # Lock the root account
  passwd -l root
  echo "The root account has been locked."
  
  echo "Setup complete. You can now log in as 'fwadmin' and use sudo."

  
  

MDM Command history: MDM command history is now available in inventory, allowing troubleshooting or reporting related to MDM based features.

New "Last Changed" Field in FileWave Inventory: We've added a new "Last Changed" field in FileWave Inventory.

• "Last Changed" Field: This new field records the date and time when any custom or built-in field value is updated for a client or when the client reports to the inventory.

• Field Updates: The "Last Changed" field is also updated when a new custom field is associated or disassociated with the device.

• API Integration: The "Last Changed" field is visible in existing public inventory API responses, enabling more accurate data synchronization and integration.

This feature ensures that any changes made to client data are accurately tracked, improving workflow automation and third-party integrations.

Autopkg integration

In addition to Winget support in 15.4, Autopkg, a well-known package tool in mac admin community is now supported in FileWave:

• Not need to run Autopkg ; FileWave runs autopkg, creates packages and hosts them.

• Filesets are made available via a CDN, using private to your instance links.

• Currently, autopkg repositories are selected and curated by FileWave. Please contact us if you have suggestions for other repositories or recipes.

• Package versioning is managed with revisions ; automatic upgrade is managed when selecting “latest” specific revision.

Signed Profiles: Profiles deployed using FileWave are now signed before being installed on the device. FileWave 15.5 also allows:

• modifying imported signed profiles ; in that case, existing profile signature will be removed and replaced by a new one

• exporting profiles as signed, making sure profiles can be shared without being altered

• duplicating signed profiles ; in that case, as payload UUIDS are regenerated, existing profile signature will be removed and replaced by a new one

ACME Certificate profile: ACME certificate profile can now be configured ; other payloads can reference ACME payloads the same way as SCEP payloads.

Extensible SSO: Various new options have been added to the Extensible SSO profile, allowing to define various policies like FileVault, Authentication Grace period or unlock behavior.

Login Window: Login Window Profile has been updated to replace a non-functional combobox with a checkbox labeled "Show heading information when clicking the clock." When checked, this option will allow the macOS login screen to display hostname, OS version, and IP address in rotation when the clock is clicked. If unchecked, the clock will have no effect. This update simplifies the user interface and aligns it with macOS behavior.

Network: Made sure WPA2 Enterprise is used for Passpoint interface.

Network Usage Rules: SIM Attributes can now be directly edited in the form.

Parental Control (macOS Restrictions): Options to configure Allowed Applications based on application signature have been added.

Passcode: Minor description update related to Maximum Failed Attempt behavior

Restrictions: New options:

• control if transferring eSIM to another device is allowed

• control if auto dim is available for OLED iPads

• control if Genmoji is available

• control if Image Playground is available

• control if iPhone Mirroring is available

• control if Writing Tools are available

• control if Image Wand is available

• control if Personalized Hand Writing is available

• control if Remote control and Video Conferencing is available

• control if Apps can be hidden
• control if Apps can be locked
• control if Call recording is available
• control if RCS messaging is available
• control if Mail summary is available
• control if Media Sharing is available
• prevents user notifications for content capture technologies on managed devices

Security and Privacy: New setting to control XProtect malware upload

Security and Privacy (Privacy and Consent Control): New Bluetooth service

System Extension (macOS): New options for Non Removable from UI and Non Removable System extensions settings

System Logging (macOS): It is now possible to configure system logging options profile.

VPN: New options to configure Post-Quantum Pre-shared Key (PPK) for IKE.V2

DDM configurations: FileWave 15.5 brings Apple’s new way of configuring devices, DDM configurations. While profiles are still widely used, Apple is extending DDM config every release.

To simplify device management, parts of the configurations can be shared amongst different configurations. Typical example is user credentials, used to authenticate to different services. The same credentials will be used by many configurations (caldav, mail…) ; instead of duplicating the settings, you can now create a unique Asset and use the asset in multiple configurations. Assets are available in the form of a new fileset (so you can organize them the way you need, grant permission….) and will be automatically handled as dependency of the configuration using the asset.

FileWave 15.5 introduces a first set of DDM configurations:

• CalDAV account
  

• Passcode settings

   

   

• Screen Sharing application settings (configures connections)
  
  

  

• Screen Sharing host options

  

• Software Update settings

  

More configurations will be added in future versions.

New or modified device management options:

Admin Password management (MDM Command - macOS): Adds the ability to change the admin password from FileWave Central, for devices enrolled via Automated Device Enrollment (DEP). The admin account must have been created during enrollment using DEP profile options.

Control Await Configuration state (DEP enrolled devices): When enrolled via DEP, devices are in a specific mode where the user is not allowed to interact with the device, which will stay in this state until configuration is over. By default, FileWave releases the device as soon as possible to shorten initial setup times. FileWave 15.5 now allows controlling when the device is released:

• DEP profile has a new setting to not automatically release the device from the state

• it is possible to send the Device Configured command either manually (context menu) or via Command Policy fileset.

DEP skip keys: The following skip keys have been added to DEP profile (together with Setup Assistant Profile):

• Action Button

• Apple Intelligence

• Voice Selection

iOS application installed on Apple Silicon mac devices: iOS application filesets can now be associated to macOS devices ; if both application and device are compatible, application will be installed, as long as a license is available.Service Background (DDM status - macOS):  Background tasks based on a launch daemon are now reported in Inventory for macOS devices supporting DDM.

Return to Service (RTS) for Apple TVs: Return to Service options are now available for Apple TVs (tvOS 18+) ; this allows Wi-Fi only Apple TVs to have zero-touch wipe and re-enroll process.

Account Driven Enrollment: For iOS/iPadOS devices, supports new BYOD workflow based on Apple Account Driven Enrollment.

Chrome Extension: New version is available with 15.5 release. Extension is needed for Notifications to function properly and also contains several issues fixed. The extension should automatically update on clients.

Chrome Management in FileWave Anywhere: Verify option is now available in FileWave Anywhere for single and bulk devices action. It is also supported as a bulk action for different platforms (i.e mac and chrome). Note: “Modify Chromebook” permission is not needed to preform Verify action.

Android Lost Mode: EMM devices which are in “Missing” device state will now use Android Lost Mode mechanism. As Android Lost mode allows the end user to exit lost mode by entering device passcode, FileWave will then report in inventory the current state and the expected state. It is also possible to “Play Lost Mode Alert” on lost devices.

64-bit client for Windows

FileWave relies on several opensource components - you can find exhaustive list on each download page. Keeping these components up to date is mandatory for both security reasons and for better features. Starting with version 15.5, FileWave uses now Qt 6, which is running only on 64-bit operating systems. FileWave 15.5 can’t run on Windows 32-bit edition anymore.

The change from 32-bit to 64-bit executable on Windows has an impact on how filesets are delivered:

• On a 32-bit Windows, programs are located on c:\Program Files.
• On a 64-bit Windows, 32-bit programs are located on c:\Program Files (x86)\ while 64-bit programs are on C:\Program Files\

To facilitate the transition to the 64-bit platform, Microsoft added silent, automatic redirection. When a 32-bit program tries to access c:\Program Files\, Windows automatically redirects file system calls to C:\Program Files (x86) ; this allows legacy program to work smoothly on both platforms. This redirection applies in several concepts and is documented by Microsoft in the WOW64 (Windows On Windows 64) page.

As FileWave Agent (fwcld) 15.4 is a 32-bit application, it is impacted by the silent redirect from Windows ; files deployed using FileWave may then be deployed in a different location. A Fileset property setting allows to control wether redirection mechanism should be disabled or not.

Starting with FileWave 15.5, filesets can be configured as 32-bit or 64-bit:

This has an impact on:

• files delivery, depending on the redirection setting
• registry modifications
• script interpreter environment. Typically, Powershell can run as 32-bit or as 64-bit 

To facilitate migration:

• filesets created with FileWave 15.5 will be 64-bit by default and can be marked as 32-bit if required
• all existing filesets, created prior to 15.5, are marked as 32-bit (redirection setting is kept) and can be marked as 64-bit if required

As 64-bit applications are located in c:\Program Files instead of c:\Program Files (x86), if you have scripts calling fwcld.exe to manage "Command Line" custom fields will need to be updated to use the new path.

Firewall Script for Client Monitor

If you use Client Monitor with Windows clients then you've deployed some version of the firewall script from the KB. With the move to 64bit Windows there is a change in location for the executable used in the firewall rule. The normal Client Update Fileset will add the new rule without you needing to do anything. Read More...

Windows Client Upgrade Fileset

We have further enhanced the Windows Client Upgrade Fileset to try to account for additional scenarios that could lead to a failed upgrade. The updates include trimming a log file that could grow to be too large and enhancements to how the scheduled task is created and executed that performs the actual upgrade.  

FileWave Windows Imaging solution relies on PXE Boot, which delivers a tiny Linux image containing all required components to run the imaging process. Compatibility with different hardware depends on how the tiny linux image is built - mainly which Linux kernel version and embedded packages and modules.

• The list of modules and packages embedded with IVS 15.5 has been entirely revisited and supports a much broader set of hardware.
• NFS shares on the IVS 15.5 are protected in a new way. When a device boots up to image or capture its image there is a VPN session created in order to access the NFS shares. Unauthenticated access to the NFS shares was removed. This change requires clients to be able to reach the IVS on TCP/UDP 20490 rather than the previous TCP/UDP 2049 port.

Company Information

With 15.4.0 - Company information are now available in Desktop versions of the Kiosk (macOS, Windows):

Reinstall and Go To App Store actions

Reinstall and Go To App Store actions have been added in Fileset Details and Browse Filesets views:

• Go To App Store button is visible for all VPP filesets.

• Reinstall button is visible for non-VPP filesets in the following scenarios:

  • If the fileset is already installed.

  • If the installation of the fileset failed.

New design for Join Organization modal

New organization modal is showing both active and retired VPP invites. Red indicator is shown only if the action is required (pending organization(s) to join).

The following features have been deprecated from FileWave 15.5.0. They are present but will be removed in a future release:

• macOS Support: macOS 12 will be the minimum macOS supported version.
• Kiosk 1.0 for macOS/Windows - The original Kiosk is still bundled with macOS/Windows clients, but in a future version, this will be removed because Kiosk 2.0, introduced in FileWave 15.3.0, will be the only Kiosk.
• Minimum version of Server for upgrades: Upgrading FileWave server to version 16.0 will require to run FileWave 14.1.5 or later.
• FileWave Central Dashboard: The Dashboard in FileWave Central will be replaced by a view of a Grafana Dashboard to not maintain 2 Dashboard systems.
• Automatically deploy to requesting clients: In 16.0 this option for OS updates will be removed in favor of using a Smart Group like All Windows or All macOS or All iOS as part of the improvements to reporting and use of OS updates in FileWave. Improved automation related to software update will be added in a future version.

We encourage you to provide product feedback if you have any concerns: FileWave Product Management

The following features have been removed from FileWave 15.5.0:

• Windows 32-bit - With FileWave 15.5, the FileWave Client, Boosters, and Admin are 64-bit only now.
  

The following features were removed from FileWave 15.4.0 and are worth mentioning again due to being major changes:

• CentOS - As CentOS 7 being End-Of-Life on June 30, 2024, FileWave is available and supported on Debian. New versions of FileWave won't be released on CentOS after CentOS is EOL.
• Compatibility Mode: Communication between FileWave components is encrypted and has relied on TLS certificates for several years now. Back in the day, to facilitate the transition, a Compatibility Mode was introduced, allowing clients running versions older than 13.1 to still be managed by a more recent server despite not supporting proper encryption. It is now time to drop compatibility mode to enforce secured communications. This means the minimum OS versions that can be enrolled are macOS 10.11 and Windows 7 SP1 - but it is obviously not recommended to run outdated, unsecured end-of-life Operating Systems.

• Google FCM Deprecation Support:

  • • Legacy Firebase Cloud Messaging (FCM) APIs are deprecated by Google.

    • Enable (if are not already enabled) the following API to manage ChromeOS on FileWave:

      • Firebase Cloud Messaging API

      • Firebase Management API

      • More...

Bug fixes:

Fixes in 15.4.3:

macOS Upgrade Fileset (md5: 3248583970caad8e85871081533ee198)
macOS Admin (md5: fa07a9b2d5bd80557727f423e30f90b4)
macOS Booster (md5: 81ffaa06de0662ff4b6eccf6ab58020f)
macOS Server (md5: c0f1f77856b34752e8bf956d076c5e4b)

Remember that to upgrade macOS FileWave clients you should use the Upgrade Fileset. Never deploy the macOS Client installer from https://custom.filewave.com to an existing device. It is intended for new installs. 

Windows Upgrade Fileset (md5: 6b8be5bb4aa7b49e620e436b0e34b90d)
Windows Admin (md5: 0888f119ead03619ebbba7f4622dd503)
Windows Booster (md5: d5ab85c6991b7929e6fc2e1690b91751)

Remember that to upgrade Windows FileWave clients you should use the Upgrade Fileset. Never deploy the Windows Client installer from https://custom.filewave.com to an existing device. It is intended for new installs.

Kiosk on iOS / iPadOS is now automatically installed from a CDN. (Read More)

The FileWave Inventory extension for Chromebook has to be installed via the Google Admin Console for your domain. Please see Quickstart Guide for Chromebooks for detailed instructions

Debian Linux Installers (md5: adf1cf6995a0923de6f7fae7bdb5048d)
Debian Linux Server (md5: 3b10d63df0d7c9592502c60b398e5458)
Debian Linux Booster (md5: 512302baf6d352afdceca6ac264e4bf3)

For any of the below upgrades you would want to console or SSH to your Server/Booster/IVS and then run the command listed to upgrade the relevant component.

If you are using a FileWave appliance that before 15.4.0 the SSH access was with the user "root" and for any appliance setup from 15.4.0 or later the user is "fwadmin" and you would have been forced to set the password on first login.

Upgrading the FileWave Server
To install or upgrade the FileWave Server, use the following :

curl -fsSL https://kb.filewave.com/attachments/411 | sudo bash -s -- -v 15.5.0 -r 1 -p -y

Upgrading a Booster
To install or upgrade the FileWave Booster, use the following or Booster Auto-Upgrade :

curl -fsSL https://kb.filewave.com/attachments/412 | sudo bash -s -- -v 15.5.0 -r 1 -p -y

Upgrading a IVS
To upgrade the FileWave IVS, use the following:

curl -fsSL https://kb.filewave.com/attachments/408 | sudo bash -s -- -v 15.5.0 -r 1 -p -y

OVA Images
These three images are OVA images suitable for VMWare or other systems that use OVAs:
VMware and VirtualBox (OVA) Server Appliance (md5: 04ca58d741d4943b5c1eaa61dee3bd9b)
VMware and VirtualBox (OVA) Booster Appliance (md5: a60eed781b80c56755040f4d4ea1ae7d)
VMware and VirtualBox (OVA) Imaging Appliance (md5: fcc38d772cdf1e862ccf089a05be6d35)

HyperV Images
These three images are Hyper-V images suitable for Microsoft Hyper-V (Gen 1):
Hyper-V (VHD) Server Appliance (md5: 832be21c369d082e75c2852d7449afb3)
Hyper-V (VHD) Booster Appliance (md5: bf93cd727614a28b9cb926abd79158fa)
Hyper-V (VHD) Imaging Appliance (md5: a0d2541405914c84e5b38b82771b7773)

These three images are Hyper-V images suitable for Microsoft Hyper-V (Gen 2):
Hyper-V (VHD) Server Appliance (md5: a59de4edb35a65505d8383ab6d4c1ca8)
Hyper-V (VHD) Booster Appliance (md5: c3f4e46d59e04b514c2829fee7255dc9)
Hyper-V (VHD) Imaging Appliance (md5: 0c34d4051526594c86ec38aee47347e6)

To get started with the FileWave Server appliance please see: 1. Installation and Setup | FileWave KB
For a Booster you would setup networking just like you do with Server and then: Booster Installation | FileWave KB
For more information about importing the IVS appliance please see: Importing FileWave Appliances

Please note that the below is only to be used when Support has identified that they are needed to fix an issue. Normally these Client packages are not used. Pushing the PKG or MSI below from FileWave can break a client.

macOS Client (md5: a20567dc69e94394f3a9d17f513c7b92)
Windows Client (md5: 037884b744e435348d55fe39fc45410f)