Lira RDP Security

PRODUCT DOCUMENTATION · PLATFORM

Lira RDP platform updates

A dated record of security, reliability and operational improvements to the Lira portal and service platform. Windows-agent builds are documented separately.

Latest platform updateLira Agent 3 and Lira Access closed technical preview

Platform update history

Security and reliabilityLatest platform update

Lira Agent 3 and Lira Access closed technical preview

  • The new Agent 3 architecture now separates supervision, event collection, transport, local protection, updates and MFA. The current development build passes 660 managed contract and security checks; this is engineering evidence, not a general-availability claim.
  • Lira Access device identity has passed real standard-user acceptance on Windows 10 and Windows 11. Its ECDSA P-256 private key is generated locally in Windows CNG, is non-exportable and is restricted to SYSTEM and the owning Windows user.
  • Tenant-scoped device invitations, administrator approval, revocation and dual-key identity rotation are implemented behind a disabled feature flag. The portal cannot use this channel to execute arbitrary shell or PowerShell commands on an endpoint.
  • Lira Access remains a closed technical preview with no public installer. End-to-end client and tunnel validation, public code signing, an exact-binary stability run and independent security review remain release gates. Pilot enquiries are welcome at [email protected].
Security and reliability

Lira Agent v3 engineering preview

  • Development has started on a new Windows agent architecture for Windows Server and Windows 10/11. The design separates supervision, event collection, transport, local protection, updates and MFA so that a stalled integration cannot silently stop the whole agent.
  • The v3 control channel uses an enrollment-bound device identity, strict message contracts and replay-resistant sequencing. Local protection is designed to continue during a control-plane outage; the portal cannot run arbitrary shell commands on endpoints.
  • The portal now recognizes the v3 protocol and keeps MFA activation locked until signed provisioning and the Windows logon acceptance matrix are complete. Agent v3 is an engineering preview, is not generally available and will move through lab, pilot and limited-production stages before release.
Security and reliability

Safer Server and Endpoint installation

  • The Devices area now separates Servers, Endpoints and the combined fleet. The installation dialog provides dedicated Server and Endpoint paths with the matching MSI and PowerShell command.
  • New installations use a short-lived Install ID instead of placing enrollment secrets on the Windows service command line. Agent state and update directories are restricted to SYSTEM and Administrators, and broad Defender exclusions are no longer created.
  • Server and Endpoint packages have separate product identities and reject the wrong Windows device class. Lira Endpoint uses a restricted observation profile and reports its license consumption separately.
  • The graphical MSI wizard supports English, Ukrainian, Russian, German, Spanish and French. The installation-directory transition was corrected to prevent Windows Installer error 2819.
  • Signed bootstrap metadata binds the release channel, version, package size and SHA-256 digest. Operational alerts are now readable, failed central-firewall work recovered automatically, and agent-reported blocks receive a defined expiry. The public agent version remains 2.7.39.
Security and reliability

Windows uninstall and signed-update reliability

  • Portal-script agents now register native Windows uninstall commands and remove the service, watchdog, Credential Provider/Filter registrations and local enrollment state.
  • The RSA-PSS manifest profile was corrected for .NET interoperability, trusted update origins remain narrowly allowlisted, and competing update paths are serialized.
  • Agent 2.7.39 is the global target. Twenty-two of 25 active agents upgraded automatically; three failed closed on missing signing-root trust and remain online on 2.7.34. All six release artifacts passed Authenticode; backend regression: 552 passed, one skipped.
Security and reliability

Agent event-collection compatibility fix

  • A staged-rollout issue allowed heartbeats to continue while a response-contract error interrupted Security event collection.
  • The backend compatibility fix restored all inspected 2.7.33 collectors from their durable checkpoints without clearing Windows logs.
  • Agent 2.7.34 isolates update-check failures from collection. Twenty-two of 25 active agents now run 2.7.34 and passed signed read-only command checks. The global target is 2.7.34; three remain safely on 2.7.31 pending independent signing-root provisioning. Full backend regression: 549 passed, one skipped.
Security and reliability

Security hardening and staged agent rollout

  • Agent commands now use per-agent signed envelopes with expiry, local allowlisting and durable replay protection; legacy shared-token authentication has been retired.
  • MFA now documents and enforces explicit fail-open or fail-closed outage behavior through the Windows Credential Provider Filter while Windows LSA remains responsible for credential validation.
  • The signed update chain, tenant-scoped TOTP storage, phishing limitations, test evidence and remaining trust boundaries are documented in the public engineering report.
  • Agent 2.7.33 passed controlled Windows Server 2016 and 2022 canaries. The global target remains 2.7.31 while independent trust-root distribution and the remaining live test matrix continue.
Security and reliability

Agent connection reliability

  • Server-side routing for the primary live agent channel has been corrected for installations that had switched to polling fallback.
  • Existing agents return to the primary channel through their normal automatic retry cycle; no agent reinstall or new Windows agent build is required.
  • The polling fallback remains available during a live-channel interruption so agent status and command delivery can recover without manual re-enrollment.
Security and reliability

French portal and documentation corrections

  • French pilot metrics now show either the published country rows and privacy-threshold notice or the insufficient-data message, never both, while keeping the total observed country count distinct from the published list.
  • The French Privacy Policy now includes the AI Data Processing section explaining the deterministic engineering assistant, the optional support assistant and which operational or secret data is not attached automatically.
  • French Security Engineering badges now render as separate brand, result, review-scope and date elements, and portal-credential wording in the secure-start guide has been corrected.
  • Homepage spacing and interactive-demo copy, product and service descriptions, and the RDP MFA and Agent Installation guides have received a final professional French editorial pass.
Security and reliability

German portal and documentation localization

  • The complete German portal, including authenticated screens, validation messages, notifications and transactional email, has been editorially reviewed for professional DACH infrastructure operations.
  • German sign-in, signup and password-recovery pages now return localized initial HTML before the application loads, and language selection is retained across authentication and legal links.
  • Terminology for server fleets, agent registration, status signals, allowlists, recovery, MFA, Windows Update, Microsoft Defender and RDP certificates is now consistent across the portal, guides and release notes.
  • The public pilot metrics now distinguish the total number of observed source countries from the smaller set published after the privacy threshold is applied.
Security and reliability

Subscription and access continuity

  • The portal now warns administrators five days before a subscription ends and clearly shows the following recovery period.
  • Existing installations can reconnect for ten days after the subscription ends, allowing service to recover without reinstalling the agent after payment.
  • If protection is suspended, the saved MFA policy is retained and restored automatically when the subscription becomes active again.
  • Agent pages now distinguish the live control channel from the polling fallback and prevent unsafe removal while MFA enforcement is still active.
  • Windows Update installation now enters the in-progress state without briefly repeating an error from an earlier attempt.
Security and reliability

Portal session reliability update

  • Portal tabs left open after the session expires now redirect to sign-in on the next action instead of leaving dashboard updates pending. Sign in again to continue.
Security and reliability

Security and reliability update

  • The portal now provides authorized administrators with guided server-readiness and access-recovery assistance.
  • Registration reliability was improved for periods with multiple simultaneous new visits.
  • Browser-side security controls were strengthened to reduce the risk of unauthorized page content being executed.