BigFix Platform 11.0 Patch 7 is now available!

Release Announcements Platform (Release Announcements)
1

The BigFix Team is pleased to announce the release of Version 11 Patch 7 (11.0.7.61) of the BigFix Platform. This release strengthens integrations and data access, extends compliance coverage, improves performance at scale, and broadens platform support — helping your team manage a more diverse, secure, and efficient environment. The main features in this release are as follows:

Custom content, managed like code!

  • External Repository Sites: BigFix can now connect to the Git source control system and use it as an “External Repository Site”. This provides a single, unified source of truth for custom content with clear cross-environment history and authorship tracking. It brings BigFix in line with modern DevOps practices by working with CI/CD and automation pipelines, and strengthens governance with better visibility into how content evolves. For more information please see External Repository Sites.

Bring Identity Provider users and computers information into BigFix!

  • User-based management: BigFix is now able to retrieve computer data from Active Directory and Microsoft Entra ID, such as the User associated with the Computer, the User Groups and Computer Groups it belongs to, and more. This data is made available as computer properties, allowing BigFix operators to achieve user-centric endpoint management, advanced dynamic targeting, and reporting. This simplifies governance and aligns enterprise instruments to meet business goals. For details, see User-based management.

Performance at scale!

  • Boosted BigFix Relay Scale: 11.0.7 Relays on Windows and RHEL implement architecture improvements to allow up to 20000 endpoints connected to a single Relay, whether it is non-authenticating or authenticating. This is up to a 4x improvement over previous figures! Also Persistent Connections are boosted on the same Relays: up to 20000 per Relay, a 20x improvement over the past limit. Note: BigFix 11.0.7 Root Server and Relay on RHEL now require RHEL 7.6 as minimum OS version. For more information please see BigFix Performance & Capacity Planning Resources.

  • Faster client performance on multi-core systems: A new client setting (_BESClient_Resource_ScaleWorkTimeWithCPUCores, disabled by default) lets the BigFix Client take fuller advantage of available CPU cores, helping actions and evaluations complete faster on modern multi-core hardware. For details, see List of settings and detailed descriptions and BigFix Performance & Capacity Planning Resources.

  • Faster onboarding and operation for large cloud deployments: The Plugin Portal now evaluates Fixlets, properties, and actions concurrently across computers, decouples computer registration from execution, and batches registration requests to the BigFix Server. Together, this cuts onboarding time in large-scale cloud environments and keeps policy enforcement timely even as new virtual machines register. In addition, one Plugin Portal now supports up to 100000 cloud devices. For more information please see BigFix Performance & Capacity Planning Resources.

  • Improved Console search engine: Searching objects in the Console (Fixlets/Tasks, Baselines, Analyses, Actions) is now more efficient, contributing to improving user experience.

Compliance and security, reinforced!

More resilient administration!

Expanded platform support!

BigFix Agent now supports additional platforms, extending consistent management and visibility to more of your modern infrastructure footprint:

  • New! Linux distributions on ARM processor:
    • Ubuntu 24.04, 26.04 LTS ARM 64
    • Red Hat Enterprise Linux 9, 10 ARM 64
    • Debian 13 ARM 64
  • macOS 27 (Golden Gate) ARM 64
  • Ubuntu 26.04 LTS x86 64-bit
  • VIOS 4.1.1, 4.1.2 PPC 64-bit on Power 11
  • AIX 7.2, 7.3 PPC 64-bit on Power 11
  • Red Hat Enterprise Linux 9, 10 PPC 64-bit LE on Power 11
  • SUSE Linux Enterprise Server (SLES) 15, 16 PPC 64-bit LE on Power 11

Inspector changes

  • New inspector types named “idp group” and “idp user” were added to return information about the groups and users associated with a computer joined to an Identity Provider (IdP). For details, see idp group and idp user.
  • New properties were added to the “cryptography” inspector. These properties return whether BigFix components in the deployment should operate in FIPS 140-2 or FIPS 140-3 mode. List of added properties:
    • fips_140_2 mode of
    • fips_140_3 mode of

For details, see cryptography.

  • New properties were added to the “license” inspector. These properties return whether BigFix components in the deployment should operate in FIPS 140-2 or FIPS 140-3 mode. List of added properties:
    • fips_140_2 mode of
    • fips_140_3 mode of

For details, see license.

  • New properties were added to the “client” inspector. These properties return various information if the computer is joined to an Identity Provider (IdP). List of added properties:
    • idp directory type of
    • idp distinguished name of
    • idp group of
    • idp id of
    • idp display name of
    • idp sam account name of
    • idp user of

For details, see client.

  • A new cast named “as xml string” was added to the “bes action”, “bes computer group”, “bes fixlet” and “bes property” session inspectors to convert the specified BES object to an XML string. The new cast was introduced exclusively for the BigFix Console and BigFix Explorer. It is not supported in Web Reports. For details, see bes action, bes computer group, bes fixlet and bes property.

Upgraded libraries, binaries and 3rd party tools

  • The libgit2 library was introduced at version 1.9.7.
  • The boost library was upgraded to Version 1.91.0.
  • The libcURL library was upgraded to Version 8.22.0.
  • The OpenSSL library was upgraded to Version 3.5.8.

Additional information about this release

References

Pre-Upgrade Considerations

Important considerations to keep into account before upgrading to BigFix Platform Version 11 are:

  • BigFix Version 10.0.7 is the minimum version supporting the upgrade of the BigFix server components to Version 11.
  • You must enable the “Enhanced Security” in the BESAdmin tool before upgrading BigFix Platform to Version 11.
  • The minimum TLS supported protocol in BigFix v11 is TLS 1.2.
  • The SHA1 hashing algorithm for content and action signature will no longer be supported. SHA1 is still supported for file download in actionscript. For details, see BigFix Platform V11 Overview Page.
  • The msodbcsql18 RPM package is a prerequisite for the Server components on Linux systems. This applies to installations with an MSSQL database.
  • For detailed information on the specific changes to minimum supported versions of operating systems and databases for BigFix 11, see Detailed system requirements.
  • Before getting started with the upgrade process, stop any active application that is connected to the BigFix database (such as Web Reports, WebUI, BigFix Inventory, or BigFix Compliance).

Useful links

Upgrade Fixlets are available in BES Support version 1516 (or later).

— HCL BigFix — Platform Team

9 Likes
3

Hi,

It looks like the technical change list (https://support.bigfix.com/bes/changes/fullchangelist-110.txt) has not been updated. When I view the link the changes for 11.0.7 are not listed. The most current changes are for 11.0.6

4

Maybe browser cache?
I can see it:

=================================================
=   Changes between 11.0.6.137 and 11.0.7.61    =
=    Publication date : 2026/09/29              =
=================================================
5

So looking forward to trying out External Repository Sites, this sounds like exactly we have been missing. Bravo!

2 Likes
6

Is there anything required to enable BigFix to retrieve computer data from AD?
I recently upgraded my dev environment(Root Server, Relays, Agents) and the idp inspectors are returning nothing when I run them on a server that is AD joined. Also Automatic groups using the new Reserved properties don’t show any relevant computers.

7

@fermt, the information gathering should be automatic: User-based management

but I take it can only works with Azure AD.

8

I am using an on-premises AD with BigFix integrated via LDAP for users authentication.

9

It looks like the new goodness requires NOT checking the "is global catalog server" box in the AD setup.

Integrating the BigFix Windows server with Active Directory

User Base Management

If [sic] are using the User-based management feature, introduced in BigFix 11.0.7, and you are not getting a sufficient level of detail in your idp REST API results and inspector properties for your Active Directory, you can try the following:

  1. In the BigFix Console, in the Identity Provider Directories view, select your directory and change its Global Catalog value to No.
  2. Restart the BES Root Server service.
1 Like
10

I wonder why that is? Can anyone speak on that?

11

@adinia Could you or someone from HCL provide additional information on this?
I already upgraded my environment to the latest version. I am using an on-prem AD and the functionality to pull AD groups for users/computers doesn’t seem to be working.

12

Yes, there are a few requirements to enable data retrieval and successfully populate your inspectors and automatic groups.
First, you must explicitly configure your Active Directory as an "Identity Provider" (IDP) within the BigFix Server console, as the service only pulls data from configured sources.
Once that is set up, you need to allow time for the normal synchronization cycles to complete.
The native idp inspectors do not query AD directly; instead, they read a metadata file delivered by the server. Your clients must perform a standard gather cycle to download this newly generated file before the local inspectors or the new Reserved Properties will evaluate correctly.
Additionally, please be aware that this integration does not work with the Global Catalog. You must ensure your configuration points directly to the standard Active Directory domain ports.
For more details, you can review the official documentation regarding adding Active Directory/LDAP servers at https://help.hcl-software.com/bigfix/11.0/platform/Platform/Console/c_adding_active_directory.html and user-based management at https://help.hcl-software.com/bigfix/11.0/platform/Platform/Config/c_user_base_mgt.html.

1 Like
13

Hi team, I wanted to point out that the documentation for Repository Site Gather (gathering content from a Git repository) has undergone a major rework and is hopefully more clear, at

4 Likes
14

I feel like i'm missing something on this new feature for Tighter control over MCP Access

  • Tighter control over MCP access: A new “blockIncomingMCPRequests” option on the BigFix root server lets administrators disable incoming MCP requests, giving security teams a simple control to restrict this interface where it isn’t needed. For details, see Installing and configuring BigFix Platform MCP Server.

The Documentation states this:

Master Operators (MOs) can disable incoming MCP requests on the BigFix Root Server by setting the advanced option named blockIncomingMCPRequests to 1 (enabled). Its default value is: 0 (disabled).
When enabled, requests identified as MCP requests are rejected with HTTP 403. The BigFix Root Server identifies an MCP request by the presence of the BES-MCP-Identifier HTTP header. For backward compatibility, the legacy X-BES-MCP-Identifier header is also recognized. The BigFix Root Server must be restarted after changing this setting

Are the keywords on this "on the BigFix root server" what is important here or is this assuming the MCP server is installed on the Root server vs on a remote server?

I'm trying to think of why you would/could reject MCP requests, if you stood up the MCP server in the first place, which is why I feel like i'm missing something.

15

ATTENTION: A problem has been reported installing the 11.0.7 agent on Windows Server Core operating systems.
While investigation is in progress for problem determination and possible solutions, please hold off upgrading agent to 11.0.7 on Windows Server Core endpoints.

More info will be shared as soon as available.

Thank you

3 Likes
16

Is this the only affected OS version affected in this release?

17

I'm not aware of any other known-issues at this time, but Alessandro can answer for that.

For this issue specific to Windows Server Core, there's now a Defect Article open with a workaround at BESClient 11.0.7 Fails startup on Windows Server Core - Customer Support

The concern is that because this issue prevents the BESClient service from starting on Windows Server Core, one cannot use BigFix to work-around it; you'd have to use alternate methods to copy the requisite DLL to the affected systems.

1 Like
18

No other OS affected.
The DA will be fixed in next release 11.0.8. In case you want to install 11.0.7 agent on Windows Server Core, please look in the DA linked by Jason on how to temporarily address the problem before running the install/upgrade. Thank you

1 Like