Upgrading Enforce

Before you begin

In Enforce 1.11 and later, the steps required to configure the service account are no longer necessary due to the adoption of the System User Service, which performs these tasks automatically. Additionally, the Enforce database is migrated to RDB in this release. Consequently, after upgrading to Enforce 1.11, it might take time for the database migration to complete and for RBAC privileges and other updates to sync properly. This could lead to issues and error messages when you first query Tanium Console. These issues usually resolve on their own after a few minutes, but could take up to an hour or longer depending on system resources and the amount of data to migrate.

• Read the release notesrelease notes.
• Review the Enforce requirements.

Upgrade Enforce

Update Mac Device Configuration Profile policy priorities and enforcements

When you upgrade to Enforce 2.5.127 or later, Mac Device Configuration Profile policies include macOS password settings. After the September 2023 release, Mac Device Configuration Profile policies include macOS password settings. You can configure all available settings for macOS endpoints managed by Mac Device Enrollment using one policy. With this change, Mac Password Profile policies and base policies are no longer needed.

If you created Mac Password Profile policies in an earlier version, those policies are migrated to a Mac Device Configuration Profile policy type during the upgrade to Enforce 2.5.127 and laterthe September 2023 release.

Post migration policy prioritization

Because policies are prioritized per policy type and base policies do not have an assigned priority, the migration process assigns priorities to the migrated policies, starting the prioritization after existing Mac Device Configuration Profile policies.

For example, if you have the following policies and prioritization in Enforce 2.4.230 or earlieran earlier release:

Mac Device Configuration Profile policies (created before upgrading to Enforce 2.5.127the September 2023 release)	Mac Device Password policies	Base policies
Policy priority Policy name 1 ExistingConfigPolicyA 2 ExistingConfigPolicyB 3 ExistingConfigPolicyC	Policy priority Policy name 1 PWpolA 2 PWpolB 3 PWpolC	BasePolicy

When you upgrade to Enforce 2.5.127 or later, the policies are migrated, and prioritization is set as follows: After the September 2023 release, the policies are migrated, and prioritization is set as follows:

Mac Device Configuration Profile policies
Policy priority	Policy name
1	ExistingConfigPolicyA
2	ExistingConfigPolicyB
3	ExistingConfigPolicyC
4	PWpolA
5	PWpolB
6	PWpolC
7	BasePolicy

After the upgrade, review the prioritization for all Mac Device Configuration Profile policies to ensure that the priority is set appropriately for your environment. For more information about prioritizing policies, see Prioritize policies.

Post migration policy enforcement

Existing Mac Device Configuration Profile policies and migrated Mac Device Password policies that were enforced before the upgrade maintain the same enforcements post migration. Base policies that are migrated to Mac Device Configuration Profile policies during the upgrade are not automatically added to an enforcement during the migration.

If you want to enforce a migrated base policy after the upgrade, you must create an enforcement for the resulting Mac Device Configuration Profile policy (which was previously the base profile) after the upgrade. For more information about creating enforcements, see Create enforcements.