MAC Agent Version 11.x Release Notes | ThreatLocker Help Center

Note: Reminder to run Learning Mode after installation before securing endpoints for the minimum recommendation of 5-7 days.

Important: Use the link below to download the ThreatLocker MDM profiles required for Version 11 and above.

https://static.threatlocker.com/deployment/A/ThreatLocker+MDM+Profiles+v3.zip

From the downloaded file, extract the four .mobileconfig files:

ThreatLocker Configuration (v3).mobileconfig - Configures core security permissions for ThreatLocker's core agent. It includes the core agent's System Extension, Full Disk Access, and Notifications. These enable ThreatLocker's Application, Ringfencing, Elevation, Storage, and other security policies.

ThreatLocker Startup & Lock (v3).mobileconfig - Configures macOS Managed Login Items to enable auto starting and auto restarting of the ThreatLocker Agent. Additionally it prevents removal of ThreatLocker's System Extension and Network System Extension.

ThreatLocker Network Core (v3).mobileconfig - Configures ThreatLocker's Network Filter (labeled 'Content Filter' by macOS) in firewall mode. This enables agent enforcement of network based ThreatLocker Ringfencing and ThreatLocker Zero Trust Endpoint Firewall policies.

ThreatLocker Network ZTNA + ZTCA (v3).mobileconfig - Configures specific ThreatLocker Network Filters (Transparent Proxy & DNS Proxy). It includes configuration for the Secure Network Agent's System Extension and its Full Disk Access. These enable ThreatLocker's brokered ZTNA and ZTCA policies.

Version 11.2

Live:

Beta: 08/07/2026

New Features and Improvements

Updated the Mac Agent to utilize UDP instead of TCP for peer validation to improve communication efficiency
Improved the Mac Agent's handling of command-line parameter exclusions to correctly support special characters and array values, ensuring exclusions match as intended
Improved performance and responsiveness on macOS devices when running terminal commands and development tools
Optimized the macOS agent to reduce CPU usage during high-volume file operations on non-monitored paths
Added ability to limit Source Applications that can launch an application (portal support coming soon)
The ThreatLocker Mac Agent has been updated to support multiple languages across all customer-facing user interface windows and notifications, including new translations for Portuguese (Brazil), French, and Ukrainian (setting pulled from OS settings)

Bug Fixes

Resolved an issue where the macOS Agent would not correctly respect the precedence of Advanced Settings after a restart or a 24-hour period.

Version 11.1

Live: 8/10/2026

Beta: 07/22/2026

New Features and Improvements

Enhanced the macOS agent to support custom button colors on the Web Control blocked screen, allowing for improved branding and visual consistency
The Mac Agent has been updated to support managed override codes and includes an enhanced user interface for override mode to display code expiration details
Improved the security and reliability of sensitive data storage on macOS by transitioning to a new secure storage system with enhanced tamper protection
The Mac Agent now supports user and group-based policy enforcement, allowing for granular control of application behavior based on the specific user or group context
Improved the Mac agent installer to ensure successful installation when using specific environment configurations
Improved the macOS Agent to prevent internal authentication components from being unnecessarily logged or learned during system authentication events
Improved the Mac Agent startup process by moving private key downloads to a background task with progressive timeouts to prevent delays when the keychain is unavailable or internet connectivity is poor
Implemented support for the "Configure Application Prioritization" advanced setting on macOS, ensuring that application policy precedence correctly follows the defined order when built-in application prioritization is disabled
Improved the security of the Mac Agent by encrypting sensitive registration data during the baseline scanning process
Improved the macOS agent to ensure all application and elevation approval requests include a valid file hash and optimized resource management during hash calculation to prevent request failures
Improved the Mac Agent to ensure internal lock files are hidden from the user interface

Bug Fixes

Resolved an issue where Tamper Protection could prevent elevation via `sudo` when using non-standard binary paths or custom PAM configurations
Updated the Mac Agent to ensure Web Category policies are applied to all matching applications, rather than being restricted to only browser applications only
Resolved a conflict in the Second Look Advanced Setting feature that could cause temporary file denies during application updates
Resolved an issue where the Mac Agent's Secure Network extension could experience a crash when the internet connection was lost or the proxy service stopped
Resolved an issue where Secure Network policies for website category restrictions remained enforced while the macOS agent was in Network Monitor Mode
Resolved an issue where custom rule tags were not matching correctly ensuring proper network redirection

Version 11.0.2

Live: 07/14/2026

Beta: 07/09/2026

Bug Fixes

Resolved an issue where database locking could prevent application files from saving correctly, potentially leading to incorrect file denials

Version 11.0.1

Live: 07/01/2026

Beta: 06/18/2026

New Features and Improvements

The macOS Agent has been updated to include support for custom SaaS application tags
Made improvements to exclude Defender from Ringfencing policies and policies with "Kill Running Processes" enabled

Bug Fixes

Resolved a communication issue between the Mac Agent and ThreatLocker application that caused incorrect status reporting
Resolved an issue where the Mac Agent would intermittently lose connection to the secure network following a network change
Resolved an issue on macOS where applications installed from the App Store could execute once without a policy or approval
Resolved an issue where the DNS Proxy on macOS would stop functioning after using the Fast User Switching feature
Resolved an issue where the DNS Proxy on macOS would stop functioning after using the Fast User Switching feature

Version 11.0

4/3/2026 - Beta

6/24/2026 - Live

New Features and Improvements

Improved Tamper Protection to prevent unauthorized deletion of ThreatLocker files and logs by administrators
Expanded Tamper Protection coverage to better preserve audit and forensic data.
Strengthened protection against attempts to stop or interfere with ThreatLocker services and system extensions
Restricted access to installation logs to authorized system users only
Added automatic cleanup of installation logs after successful installation
Enhanced runtime security protections for authentication components to improve resistance against tampering and unauthorized code injection
The agent now enables DAC by default, with the option to disable it available through Advanced Settings
Added support for Secure Network Policies and network configuration management
Added new registration flow to the agent, supporting pending, approved, and rejected registration states for improved device onboarding
Introduced support for a feature-centric billing model, enabling more granular purchasing and improved policy management
Added a hierarchical view option to the Realtime Unified Audit, allowing users to toggle between regular and hierarchical table views with improved sorting and filtering
Added Device Discovery feature, enabling network scanning for unprotected devices and open ports
Updated the Mac Agent to improve how Network Activity monitoring is triggered
Added tooltips to the Blocked Items List and Realtime Unified Audit buttons for improved user guidance
Added a disk space monitoring feature to the Mac Agent to alert when free space is low
Added support for configuring multiple broker servers per ZTNA and SaaS policy
Improved performance by optimizing DNS resolution processing
Improved Secure Network Web Control on Mac to ensure manually entered domains in policies are correctly matched and applied
Improved ZTCA performance on Mac Agents by implementing latency testing to automatically route traffic through the most optimal server
Improved the reliability of the Mac Agent's Secure Network Broker to ensure connection persistence and automatic recovery following network interruptions or server-side connection timeouts
Improved the performance of the Mac Agent by optimizing policy loading at startup, significantly reducing the time for the Secure Network extension to apply security rules
Updated agent log submission to a new logging endpoint and ensured logs include the correct Mac source type identifier for improved log routing and consistency
Added advanced settings to allow disabling Elevation Control and Local Admin Management features per machine or group in the Mac Agent
Improved the Mac Agent Secure Network extension’s resilience by ensuring it can automatically re-establish communication with the ThreatLocker application after an internal connection failure
Improved the Mac Agent's ability to correctly identify and match domain-based tags within Zero Trust Network Access (ZTNA) policies

Bug Fixes

Removed developer-specific path information from distributed components
Resolved an issue where the agent would prompt for admin credentials by attempting to uninstall the Secure Network Extension even when the feature was not enabled
Resolved an issue where scheduled policies on Mac endpoints were not applying the correct date and time, ensuring policy timing now works as expected in the Mac Agent
Resolved an issue where the Secure Network Extension on macOS failed to update automatically alongside the ThreatLocker agent
The agent now includes its version information in Unified Audit logs and PortalAPI responses
Updated the agent to skip processing directed broadcast network traffic, aligning its behavior with the Windows agent
Resolved an issue where newly created standard users could not use sudo; now, user creation and deletion events on macOS 14+ properly update the sudoers file
Resolved an issue where you were not able to connect to SMB share with Secure Network
Resolved issue where agent logs showed 'cannot download memberships for organization' error until first agent restart
Resolved issue where Secure Network could become broken because of memory allocation errors for DNS flows
Resolved an issue where error messages appeared during initial installation if the Secure Network feature was enabled
Resolved an issue where the Secure Network extension could lose DNS Proxy, Transparent Proxy access, and communication with the ThreatLocker application
Resolved an issue where excessive network logs were generated for Secure Network events
Updated the agent to allow uninstallation when device registration is rejected
Resolved an issue where users could not request access to blocked websites when "Allow User to Request" was enabled in Secure Network policies
Resolved an issue where the tray icon on macOS devices would remain visible after being configured to be hidden in the group settings
Resolved an issue where tags database journaling would not stop, by updating tag handling to use UUIDs for improved reliability
Resolved an issue where the Secure Network Extension on macOS failed to update automatically alongside the ThreatLocker agent
Resolved an issue in Mac Agent 11.0 where Secure Network Full Disk Access status was incorrectly shown as denied, ensuring accurate permissions display and improved user experience
Resolved an issue where the Secure Network extension could stop working and display "Cannot Allocate Memory" errors due to connection leaks; improvements now ensure proper connection handling and stability
Resolved an issue in Mac Agent 11.0 where multiple Baseline Scanner processes could run simultaneously after installation

Version 11.0.1

6/18/2026 - Beta

New Features and Improvements

The macOS Agent has been updated to include support for custom SaaS application tags, allowing for more granular policy control and identification of web-based applications
Improved exclusion logic on macOS to ensure the agent correctly honors exclusions for security products, preventing unnecessary interactions during Ringfencing or process termination events

Bug Fixes

Resolved a communication issue between the Mac Agent and ThreatLocker application that caused incorrect status reporting, and updated the status interface to more accurately reflect connection states
Resolved an issue where the Mac Agent would intermittently lose connection to the secure network for an extended period following a network change
Resolved an issue on macOS where applications installed from the App Store could execute once without a policy or approval
Resolved an issue on Mac agents where hostnames were incorrectly identified as domains in Web Control
Resolved an issue in which the Secure Network System Extension was unable to communicate after updating
Resolved an issue where the DNS Proxy on macOS would stop functioning after using the Fast User Switching feature