Release notes

For tenant admins and partner admins.

AdminExplorer Standard and Enterprise is one client and one portal: the edition comes from your license. Portal capabilities go live without any change on your devices; device features arrive with a new client MSI. Each area below shows its status.

Portal (live since 2026-10-19/20)

• Tenants and partners: onboarding, licenses, download bundles with a per-tenant transform, and white-label portals for partners.
• Trials: a trial ordered on the website is reviewed and approved by your provider before the tenant, trial license, default policy and first download bundle are created.
• Policy and Settings editors with validation and starter policies, including the settings for Run in sandbox, installed software tracking, any application on demand and local administrator protection.
• Devices, Approvals and Audit with filters, CSV export and per-device and per-user summaries (Audit and reports).
• Microsoft Entra sign-in for your admins, with Conditional Access and an optional requirement to use it (Microsoft Entra sign-in).
• Directory Sync and Entra group targeting for approved programs, rules and Run in sandbox (Enterprise) (Entra group targeting).
• Your own app registration for sign-in and group sync, with a certificate held by the portal (Using your own app registration).
• Software views: inventory and change feed with elevation links (Installed software tracking).
• Local admins pages: compliance overview, preview of what enforce would remove, exceptions and history (Local administrator removal and protection).
• Guides in the portal, also published on this site.

Portal settings for features that need the new client are stored and sent to devices, and take effect once the devices run Client 2.0.

Client 2.0 (next release, not yet published for download)

The next client MSI (x64, the same file for every customer) brings these device features. They are not available on devices yet.

• Sync now in the tray: policy, license, audit and approved-list changes at once.
• Tray menu placement: show or hide each approved program in the tray menu and group programs in submenus.
• Any application on demand (Enterprise) with a secure-desktop confirmation by the person at the keyboard (Any application on demand).
• Entra group targeting on the device (Enterprise): group-scoped approved programs, rules and Run in sandbox.
• Installed software tracking: the device reports installs, updates and removals and links them to elevations.
• Run in sandbox: open untrusted files in Windows Sandbox without administrator rights on the device (Run in sandbox).
• Local administrator removal and protection with report and enforce modes, exceptions and a lock-out guard.

The kernel driver in this release (AdminExplorerDriver 2.1.0.0) is attested and signed by Microsoft.

On Windows 11, Run with AdminExplorer is under Show more options in the right-click menu; a later signed release adds it to the compact (top-level) menu.

Known limitations

• The client is x64 only. ARM64 is planned.
• Run in sandbox copies only the selected file into the sandbox: installers that need files next to them (an .msi with external cabinet files, a setup.exe with a payload folder) do not work in the sandbox yet. Run in sandbox needs Windows Pro, Enterprise or Education with hardware virtualization.
• Pending approval requests are kept in the service’s memory: a service restart drops them and the user asks again.
• With the current client, changes to the approved list reach pre-approved (automatic) starts at the next service restart, which the device schedules itself when idle, at the latest at 03:00 local time. Client 2.0 with driver 2.1.0.0 applies them at once.
• A program started elevated cannot start a child program that demands administrator rights through its manifest; approve that program on its own.
• Publisher rules match the signer certificate’s common name only.

Planned

• ARM64 client.
• Emergency administrator account per device, managed like LAPS: disabled by default, password rotated and revealed through the portal with audit.
• Malware scan of a program before it is elevated, using the antivirus already on the device.