Upcoming IQService Changes: Explicit Enablement and TLS Required for Privileged Services

Announcements Product News
,
1

Summary

As part of our ongoing investment in strengthening identity infrastructure across the platform, we’re introducing IQService improvements that give administrators clearer, more explicit control over key capabilities and align their configuration with current security standards.

This builds on our earlier advisory making TLS mandatory for IQService. That update disabled before/after script execution when TLS was not configured. This upcoming update extends the same security model to additional privileged services.

This post provides early notice of what is changing and when to expect it. We’ll publish a detailed configuration guide closer to release, including exact steps for manually managed and auto-updated environments.

Impacted Services

This update affects the following privileged services:

  • ScriptExecutor (Service to executes native before\after scripts)

  • gMSAPasswordData (Service for gMSA password retrieval)

  • EventLog and Win32File ( Windows service to query event logs and file shares permissions respectively)

If your environment uses any of these services today, this update applies to you.

What’s Changing

Two things are changing for these privileged services:

  1. Explicit enablement will be required. Privileged services will no longer run implicitly because IQService is installed and reachable. Administrators must explicitly enable each service they use.

  2. TLS will be required. These privileged services will run only when TLS is explicitly and exclusively configured on the IQService instance. Non-TLS communication must not be enabled.

This continues the security direction we announced with mandatory TLS in May 2025 and extends it to these additional privileged services. Day-to-day IQService behavior is otherwise unchanged.

Expected Date

Targeting: Mid August 2026

We’ll share the confirmed release date and version as the release approaches.

What This Means for You

If you use ScriptExecutor, gMSAService, or RPCService (Windows Event Log access) today, plan ahead on two fronts:

  • TLS - if TLS is not yet configured on your IQService instance, start planning your rollout now. TLS will be required for these services to continue working.

  • Explicit enablement - each service will need to be turned on explicitly instead of running by default. We’ll share the exact steps in the next update.

To avoid disrupting existing operations, this update will roll out in two phases. First, a follow-up post targeted for Mid August will provide step-by-step manual configuration guidance, so customers can plan and apply changes on their own schedule. Auto-update will follow roughly 60 days later targeted for late September/early October, once customers have had sufficient time to complete the required prerequisites.

Recommended Steps to Take Now

  1. Identify which services are in use in your environment: ScriptExecutor, gMSAService, and/or RPCService (Windows Event Log access).

  2. Confirm whether TLS is configured on every IQService instance in use. If it is not, start planning your rollout using the TLS configuration guide.

  3. Watch for the August follow-up post, which will include the specific configuration steps needed to avoid service interruption.