WA 26.3.0 Release Notes

​

Highlights

• Upgrades Can Complete on the Sign-In Screen
• Report Only Mode for Continuous Authentication
• Clearer Re-Authentication Experience
• Automatic FIDO2 Sign-In Policy Configuration
• Redesigned System Tray Menu
• Updated Biometrics UI During Enrollment
• Additional PIN Events
• Bug Fixes

​

Enhancements

​

Upgrades Can Complete on the Sign-In Screen

• Upgrades can now complete while a machine is sitting at the lock screen without disrupting the sign-in surface. Previously an upgrade in that state could leave the screen blank until the next Ctrl+Alt+Del. During the brief window while the upgrade runs, the password tiles remain available, so no one is locked out of the machine.

​

Report Only Mode for Continuous Authentication

• You can now run Continuous Authentication in Report Only mode. In this mode the Windows Authenticator evaluates risk and reports what it would have done, without prompting users to re-authenticate or locking their workstation. This lets you collect telemetry, establish baselines, and tune sensitivity before switching to Enforce mode.

​

Clearer Re-Authentication Experience

• When continuous authentication risk crosses the lock threshold, the re-authentication prompt now stays on top of other windows, including full-screen apps, and plays a single chime when it first appears. The reason for the prompt and the countdown are combined into one message, and the countdown banner only turns red in the final seconds. If the prompt times out, you now see a brief transition screen explaining what is happening instead of the workstation locking with no warning.

​

Automatic FIDO2 Sign-In Policy Configuration

• When the Windows Authenticator is configured for FIDO2 login, it now enables the Windows security key sign-in policies it depends on automatically. You no longer need to push the equivalent Group Policy or Intune settings separately to every device, and devices can no longer end up in a state where TruU expects FIDO2 but Windows will not allow it. The FIDO2 requirement recorded at initial installation is also now locked in, so a later update carrying a different value cannot silently change how an enrolled user signs in.

​

Redesigned System Tray Menu

• The system tray menu has been redesigned and now follows your Windows light or dark mode setting. The privacy policy link in the tray is also now configurable, so you can point users at your own biometric privacy policy instead of the default TruU page.

​

Updated Biometrics UI During Enrollment

• Adding a face or fingerprint during enrollment now opens the redesigned Account Profile view instead of the legacy window. Enrollment looks consistent with the rest of the Windows experience, and closing the view returns you to the right step in the enrollment flow.

​

Additional PIN Events

• An event is now sent when a user’s PIN becomes locked out after too many failed attempts, and again when it is no longer locked. This makes repeated lockouts easier to spot in the Admin Console.

​

Bug Fixes

• Fixed an issue where signing in after the machine woke from sleep could take up to two minutes, or fail entirely, and got worse the longer the machine sat at the sign-in screen. Related delays after a restart or a long idle period at the sign-in screen, and slow face authentication after resuming from standby, are also resolved.
• Fixed an issue where a user could be left stuck on the Welcome screen with a loading spinner after a certificate expired message, requiring a reboot to recover.
• Fixed an issue where an upgrade could leave a device unable to sign in with a smart card, with enrollment blocked and the Get Started button disabled.
• Fixed an issue where enrollment was impossible on machines whose network adapter is attached to a Hyper-V external virtual switch or a Windows network bridge, because the device was incorrectly treated as offline.
• Fixed an issue where selecting Add Account from the lock screen while a sign-in was already in progress failed with a “Reinsert your Security Key” error. Add Account is now unavailable while a sign-in is underway.
• Fixed an issue where a re-authentication prompt could be dismissed by ending the TruU process, leaving the workstation unlocked when it should have locked.
• Fixed an issue where the “Too Many Incorrect Attempts” dialog suggested signing in with biometrics to users who had no biometrics enrolled.
• Fixed an issue where the Account Profile failed to open after a correct PIN was entered following a TruU service restart.
• Fixed an issue where the Account Profile window was cropped and shifted partly off screen after being restored from a maximized state.
• Fixed an issue where the PIN change window’s close button did nothing, and an issue where entering a confirmation PIN could cause the window to crash.
• Fixed an issue where right-clicking in the PIN field froze the sign-in window for several seconds.
• Fixed an issue where the PIN dots and cursor were sometimes drawn at half size after signing in with a local account and then switching to a TruU domain sign-in.
• Fixed an issue where an enrollment error opened a second small window that could not be closed without Task Manager.
• Fixed an issue where resuming an enrollment that had been left part-way through showed a generic unexpected error instead of returning the user to the enrollment flow.
• Fixed an issue where losing network connectivity during SSO sign-in produced a generic “Oops! Something went wrong” message instead of explaining that the device was offline.
• Fixed an issue where cancelling verification and switching away from the “My computer” sign-in option briefly displayed an unexpected error instead of a clear message.
• Fixed an issue where the Biometric Consent review page was unreadable in dark mode.
• Fixed an issue where the camera switched between the internal and external camera during a second face enrollment, even though neither camera was disconnected.
• Fixed an issue where a successful fingerprint sign-in could be reported as a failed authentication event when the user’s certificate had expired.
• Fixed an issue where keyboard model events were generated for the local Administrator account rather than only for the enrolled TruU user.
• Fixed an issue where enrolled user certificates were left behind in the Windows certificate store after the TruU Authenticator was uninstalled.
• Fixed an issue where repairing an existing installation completed successfully but then prompted for an unnecessary system restart.
• Fixed an issue where upgrading could briefly display an unexpected popup.
• Fixed an issue where the Updater Service occasionally failed to start after installation, leaving updates unprocessed until the service was restarted.
• Fixed an issue where rebooting during an update could leave two TruU entries in the Control Panel and two icons in the taskbar.
• Fixed an issue where an older version could be downloaded and installed over a newer one.
• Fixed an issue where an update that performed no work reported “The client application was installed successfully” instead of explaining that no installation was needed.
• Fixed an issue where an update could fail to install and leave the device stuck on its current version.
• Fixed an issue where the update notification layout broke in some languages, leaving the action buttons misaligned.
• Fixed an issue on Shared Workstation where the update notification referred to the TruU Authenticator instead of Frontline Access.
• Fixed an issue on Shared Workstation where the agent could crash during rapid, repeated sign-ins, causing any sign-in or unlock in progress at that moment to fail.
• Fixed an issue where an event sent after a biometric sign-in timeout was categorized incorrectly in the Admin Console.