05: Action Required for PolicyPak Customers using Legacy Licenses

What is happening:

The PolicyPak CSE (endpoint piece) is hardcoded to stop honoring LEGACY licenses on Feb 28, 2023… even if you have a VALID LEGACY license hitting the machine.

Why is this happening:

We started delivering UNIVERSAL licenses in Jan 2021 thus giving customers TWO YEARS to upgrade to make the switch. This is your three-month (and likely final) warning of the impending requirement.

Who is NOT affected by this:

If you are using CLOUD licensing, you are not affected.
If you already have Universal licenses in place and NO LEGACY licenses in place, you are not affected.

Who IS affected by this:

If you are using GPO or MDM / XML licensing with LEGACY licenses ONLY AND
You are using CSE version 2687 (21.1.2687.802) or later.

… Then you are affected.

Is this a security concern?

No. This is NOT a security concern.

How do I know if I’m using LEGACY licenses, UNIVERSAL licenses, or both?

Please watch this video to help you determine your position and situation plus some advice on what to do.
Video: https://kb.policypak.com/kb/article/1230-legacy-license-retirement-guidance-for-feb-28-2023/

Where can I get UNIVERSAL licenses?

When we cut keys for NEW customers who started after 2021, chances are you got ONLY Universal keys in the first place.
When we cut keys for EXISTING customers (who started BEFORE 2021) we ALWAYS provided Universal keys and SOMETIMES provided LEGACY keys.
Therefore: You should be able to pick up your EXISTING keys at portal.policypak.com . Example of how to find:
ONLY contact Support if you cannot locate your Universal license because they should already be in the PORTAL at portal.policypak.com.

In the portal, after I download my license keys, how can I tell which are UNIVERSAL and which are LEGACY keys?

Example download of VALID dates with both UNIVERSAL and LEGACY keys, but only UNIVERSAL will be honored past Feb 28, 2023:

What must I do to keep PolicyPak working if I am affected?:

There are a few strategies you can pursue to keep PolicyPak working as expected.
BEST:
- Import the Universal license and make sure it hits your endpoints. If you do not have a universal license, you may request one by opening a case at https://www.netwrix.com/sign_in.html?rf=tickets.html#/open-a-ticket
  Please do not wait until the last minute to get your license as we could have many requests to field.
- Upgrade the CSE to something recent; hopefully the latest version.
GOOD, but not as good as BEST:
- Keep using your Legacy licenses which will naturally expire Feb 28, 2023.
- Update the CSE to the latest version (3421 or later) on your endpoints.
- Use a PolicyPak ADMX setting which will give you +90 days to implement the Universal license. Screenshot: https://share.getcloudapp.com/p9uL2v7Q

Note: This ADMX setting ONLY affects CSE 3421 and later is only a stopgap measure if you literally have no way to transition from LEGACY XML to UNIVERSAL XML, but you DO have some way to update your CSE.

Please honor the philosophy of RINGS and don’t “blast out” an upgrade CSE to all of your computers at once … so you can control a rollout or a rollback. Use this guidance: https://kb.policypak.com/kb/article/1094-using-rings-to-test-and-update-the-policypak-client-side-extension-and-how-to-stay-supported/

How can I install UNIVERSAL licenses once I have downloaded them?

First, upgrade your Admin Console MMC snap in with the latest download from the portal. Only the latest Admin Consoles can import Universal licenses.
Video: https://kb.policypak.com/kb/article/1080-how-to-install-universal-licenses-for-new-customers-via-gpo-sccm-or-mdm/
TIP: You cannot import both LEGACY and UNIVERAL licenses into the same GPO. You need separate GPOs for both license types. If you try to put both licenses into the same GPO you will get the error: "Sorry but you can’t install GP and Enterprise licenses into the same GPO, please install them to different GPOs or select licenses with the same type.”

What will happen if I do nothing?:

If you are using LEGACY licenses and/or very old CSEs which ONLY process LEGACY licenses (so CSEs before 21.1.2687.802), then PolicyPak will keep working because CSEs before 21.1.2687.802 don’t understand Universal licenses anyway.
If you’re using LEGACY licenses and NEWER CSEs (21.1.2687.802 or later), you can expect PolicyPak to stop processing and stop working as if your license file expired on Feb 28, 2023.
Tip: Exact behavior when licenses expire can be seen here: https://kb.policypak.com/kb/article/230-what-happens-to-each-component-when-policypak-gets-unlicensed-or-the-gpo-or-policy-no-longer-applies/

What if I’m applying both UNIVERAL and LEGACY licenses to an endpoint?

If a computer receives both LEGACY and UNIVERSAL licenses, then you should be all set… provided you are using a CSE (build 2687 and later). on the endpoint.
Note: More modern CSEs on the endpoints are preferred.

How can I validate on a few endpoints that I am VALID and won’t expire?

Use the PPUPDATE command which will always show if you are VALID and licensing type.
Example of a machine getting Universal licenses successfully:
FAQ on error conditions: https://kb.policypak.com/kb/article/1078-how-can-i-tell-how-a-machine-is-licensed-by-gpo-mdm-or-xml-file-and-also-know-for-what-components-it-is-licensed/ .
Note: The LATEST CSE in the portal (build 3375) will also express INVALID licenses if any are applying to the machine. Example:

Anything else I should know / Bugs & Known Issues?

Item 1: PPupdate may show “Computers with ‘Computer’ in the name” while actually being licensed (CSE 3375 only.)

This bug exists only in 3375 and doesn’t exist in later version of the CSE, such as 3421 and later.

In build 3375, you might see something like this when you test PPUPDATE.

Again: this is a display bug in 3375 which has been removed in the latest CSE version. This message can safely be ignored.

As long as you can see you ARE getting licensed by the Universal key method (see section above entitled “How can I validate on a few endpoints that I am VALID and won’t expire?”) then you are free to ignore this bug.

Item 2: PolicyPak Update might show a statement which is a little misleading in CSE 3375 or earlier. The message is updated for clarity in CSE 3421 and later.

The message in CSE 3375 and earlier says:

“The license is valid. WARNING: GP licenses will no longer be accepted after Feb 28th, 2023.” Example: