2024.10

Automation asset updates

Introducing RealVNC for live streaming and remote control

If you know and love our live streaming and remote control feature, then you will already be aware that it is supported by a VNC server. Up until now, this has been TightVNC, but, with the advent of the Robot 2023.12 release, we are moving to RealVNC.

RealVNC is included in your Studio installation package, and requires no configuration whatsoever. Nothing changes on your part - if anything, things should be smoother from now on. However, this means that we will no longer be offering support for TightVNC.

For details, see the Live streaming and remote control via RealVNC section in our user guide.

Retention of recorded videos

We have changed our retention policy for recorded videos. Now, when you choose to record a job execution from the settings of its underlying process, the video is stored in Orchestrator as follows:

• for 7 days in the case of failed jobs

• for 3 days in the case of successful jobs

Hiding processes for attended users

You now have the option to hide a process from the automations list in Assistant. This way, you can prevent users from running processes that you may not want them to access. To do so, you simply need to enable the Hide process for attended users option at the process level.

Introducing the job and queue transaction side panel

In an effort to streamline access to the job and queue transaction details you are interested in, we have created a very handy side panel to aggregate information such as logs, job details, and transaction details. It is adjacent to the job and queue transaction lists, and provides you with a whole host of benefits:

• A better outlook - All the details you need are available in a side-by-side view, ideal for comparative checking.
• More screen space - The side panel can be resized or expanded to a full-sized window for enhanced visibility, and an even larger view for all your data.
• Efficient navigation - Navigation between the details of a job or transaction happens by simply clicking anywhere on a transaction row. This allows you to easily move through the list while also maintaining focus.

Viewing process folders

You can now see the folders where the processes associated to a certain package are included. This is done at the tenant level, by clicking the See processes option in the contextual menu of the desired package or package version. The resulting window displays the folders where that particular process is used. However, please note that only folders that you have view and edit access to are listed.

For details, see Viewing package processes.

Introducing historical monitoring

The Machines, Processes, and Queues sections featured in the Monitoring page, at both the folder and the tenant level, are now split up in two tabs:

• Real time (Orchestrator) provides the information that you will already be used to seeing. The content on this tab continues to be refreshed instantly.

• Historical (Insights) includes charts based on data available in Insights, that can reach up to two years back. These charts are synchronized with Orchestrator with a 20-minute cadence.

The Historical (Insights) tab provides a series of features that we are certain will be very useful to you. These include:

• Various filtering options based on the component.

• The option to download the entire dashboard or each tile in the format of your choice.

• The ability to schedule the delivery of a report to your email.

• The click-to-filter option per dashboard component.

  This is an example of the Historical (Insights) tab for processes, with a look at some of the available options:

Note:

Please be aware that the Historical (Insights) tab is only available if you have Insights enabled.

Recurring queue triggers

For optimal resource utilization and smoother workflows, we have improved our queue triggering system with a new option: After completing jobs, reassess conditions and trigger new jobs if possible. In addition, this prevents idle robots and stagnant queue items. For more details, refer to Queue triggers.

Manually deleting In Progress queue items

We are happy to announce that you can now manually delete In Progress queue items from the Transactions window. This option comes highly requested, and we are confident that it will make your automation lives easier. All you need to do is select the desired queue items, then click Remove, just like you would for items with other statuses.

Introducing CyberArk® Conjur Cloud

A new credential store is now integrated with Orchestrator: CyberArk® Conjur Cloud. This integration aims to provide a more secure and efficient way to handle credentials within Orchestrator, thus enhancing your automation capabilities.

Credential store news

Testing the credential store connection

A Test button is now available when adding a credential store. The button helps you check the connection to the configured credential store before using it.

Minor change to credential stores setup

If you have no valid credential store plugins installed, the Type field in the credential store configuration window is now empty, and the Create button is unavailable. This is a sign that you need to correct your plugin configuration before you are able to save your setup.

New option to allow OS user authentication

We have added the new Allow OS User Authentication option to CyberArk CCP. OS user authentication enhances security by using the credentials of the user logged into the Orchestrator machine.

The option is only displayed when the value of the Plugins.SecureStores.CyberArkCCP.EnableOsUserAuthentication parameter is set to true.

Personal workspace alert severity

The severity level of the User started exploring your personal workspace. alert has been increased from Info to Error. This ensures that you are notified via email whenever an administrator starts exploring your personal workspace.

Libraries feeds split view

When it comes to your libraries, you have a choice to use host feeds, tenant feeds, or both. Based on what you choose, the Libraries page of the tenant's Packages menu is populated with your feed list. Up until now, though, this view was limited if you chose to use both host and tenant feeds. Now, when you select said option, the Libraries page is split into Tenant and Host, with each section displaying its corresponding feeds.

Auto-retry for failed and abandoned transactions

We have split the auto-retry mechanism into two options, as follows:

• Failed items - retries any queue items that fail after creating the queue.
• Abandoned items - retries abandoned queue items based on the value specified in the Max # of retries field.

For more details, refer to Managing queues in Orchestrator.

Queue item retry related field changes

We are adding the following queue item fields:

• ManualRetryNumber

• ManualAncestorId

• ManualAncestorUniqueKey

• UniqueKey

• AncestorUniqueKey

The objective is to complete the traceability of queue item retries. All existing fields will remain in place, and will be used for automatic retries.

Checking assigned roles and permissions

Our mission of optimizing the access control framework continues with a significant improvement to the roles and permissions check window.

Up until now, all tenant and folder roles were bundled in one list, without details on permissions. Now, you not only have access to more information, but you also benefit from a friendlier view: roles are displayed in separate tenant and folder categories, all permissions included in each granted role are visible at a glance, and filtering by role or folder allows you to focus on the precise details that are of interest to you.

Changes to user-specific fields

We have made a couple of changes that should make for a cleaner user-related experience:

• The First Name and Last Name fields in the user editing window have been replaced with a single field: Full Name.
• Consequently, the First Name and Last Name columns have been removed from the tenant-level Manage access > Assign roles page.

New columns in queue transactions exports

Queue transaction exports now include two new columns: Analytics Data and Created (absolute). On top of that, transactions can now also be filtered by CreationTime via the API before performing the export.

For any questions regarding supported fields, you can check out the new Fields supported for queue transactions exports page.

Personal automations setup changes

The Personal automations setup tab featured in the role assignment window has undergone a few important changes:

• The Enable a Personal Workspace for this user option has been renamed to Create a personal workspace for this user and enable optimal Studio Web experience.

• The Create a personal workspace for this user and enable optimal Studio Web experience option is no longer selected by default when enabling personal automations.

• Deselecting the Enable user to run automations option triggers a warning message which informs you that doing so will affect any running automations, and could downgrade your Studio Web experience.

Warning message displayed when deselecting Enable user to run automations

Auditing machine maintenance actions

The Audit Data window for the Sessions component now includes the Maintenance field, which displays the status of the Maintenance option for unattended machines. 1 marks the enabled status of the machine maintenance mode, and 0 marks its disabled status.

Prepopulating name fields for processes and triggers

The configuration of processes and triggers has been improved by prefilling their name fields based on the previously selected package or process.

For processes, the Display Name field displays the name of the selected package in the format <PackageName>.

As far as triggers are concerned, the Name field displays the name of the process, followed by the trigger type in the format <ProcessName>_<TriggerType>. It is also worth mentioning that this change applies to time, queue, and API triggers, and that the Name and Process Name fields have switched positions to follow the logical flow.

Increased audit search character limit

The character limit for searching in the tenant Audit window has been increased to 64.

Administration and organization news

Renaming robot accounts

You can now rename your robot account after creating it.

Since the username of a robot account is permanent, and cannot be changed after it is set, the Username column also remains unchanged. For example, if you rename the robot from Test to Test1, only the Name column updates with the new value, leaving the Username unchanged. For more information, refer to Adding robot accounts.

Local groups renaming

Any and all name changes made to local groups at the organization level are now propagated to Orchestrator.

Please note, however, that renaming a group several times in a short timeframe means that only the last renaming event is captured in the Orchestrator audit logs. The organization-level audit includes all such events.

Directory user events handling in Orchestrator

Now, any changes made to your directory users in the Admin portal - including updates or deletions - are reflected within your Orchestrator's user list and audit logs across all tenants.

In more detail, Orchestrator now logs the updates or deletions under the following descriptor: User System Administrator updated/deleted account {user_mail}. For a full breakdown of the changes, click View Details in Audit Data.

When a directory user is deleted:

1. Any connected robots will also be automatically deleted.

2. Associated personal workspaces will become orphaned. These can still be explored, or you can choose to convert them into modern folders.

Please note, a delay may be experienced whilst synchronizing these updates to Orchestrator.

Authenticating external feeds

External feeds used for libraries can now also be secured through basic authentication credentials, as is already the case for packages.

Removing SMB storage

We removed SMB storage from Automation Suite, and therefore, we recommend using external storage instead.

Enabling feature flags by default

As part of our ongoing optimization efforts, we have removed the following feature flags and enabled them by default. Therefore, you can no longer configure any feature flags per tenant at the host level:

• Monitoring
• Prevent Auto Refresh
• QueueSlaMonitoring
• Actions
• App actions
• Test Automation
• Document Validation Actions

Using the read-only replica by default

If your database supports a read-only replica, Orchestrator will use it by default to improve performance and scalability. For more details, refer to the Orchestrator read-only replica.

Permission changes for viewing process folders

In December 2023, we launched an option to see the folders where the processes associated to a certain package were included. At the time, only folders that you had both view and edit access to were listed in the Processes of package window. We have now removed the need to have edit access, which means that all folders that you have view access to are listed. The edit option is, however, only enabled for folders that you also have edit access to.

User interface enhancements

Trigger execution frequency revamp

The frequency selector in the time trigger creation or editing window has been updated in both look and feel, as well as in functionality. You will notice that the menu item is now compact, and that a new option, Monthly (day of month), has been added, allowing you to select the desired date of the month.

This is a look at the previous frequency component, as well as to the new menu, along with the options it includes.

For details, see Creating a time trigger.

Changing information density in Orchestrator grids

User experience best practices, as guided by your suggestions and use cases, are always top-of-mind for the Orchestrator team. In trying to align our product design to these practices, we are improving the display density of grid information. This means that you will now see tables in a compact mode, which allows for more items to be displayed, ultimately taking better advantage of screen real-estate.

This is a comparison of the two density views:

We are confident that the high-density view will provide you with an overall better experience:

• The spacing between table rows is smaller. The information is still perfectly visible, as we have simply removed blank spaces.

• The number of rows that can fit on a single page has significantly increased, thus making more information available at a glance.

You do, however, have the option to go back to a low-density view, by deselecting High density view from the General > Application settings section of your tenant-level settings.

Folder tree no longer collapsed

During the first iteration of the jobs side panel implementation, the folder tree was automatically collapsed when the panel was expanded to a full-sized window. Now, the folder tree is persisted even while the job details window is in full-sized mode.

New deletion confirmation window

In an effort to help you prevent the inadvertent removal of important Orchestrator objects, we have decided to place more emphasis on the deletion confirmation window. This means that, when you try to remove one of these objects, you are now asked to type its exact name before being able to proceed with the deletion:

• processes,
• queues,
• folders,
• storage buckets,
• assets with value per user.

To display this window, you need to select the new Strong confirmation on delete option on the General tab of your tenant settings.

Removing icons from menus

As part of our constant effort to provide you with the best user experience, we have decided to remove icons from menus. This means that our user interface is now cleaner, more streamlined, more readable, and more accessible. We are confident that this change will allow you to focus on explicit information without distractions and the need for interpretation.

Multiple selection for filters

Orchestrator now supports multiple selection across various filters, allowing you to manipulate data more quickly and have a more streamlined workflow.

You can select multiple options for the following filters:

• The Processes tab
  • Job
  • Priority
• The Jobs tab
  • Process
  • State
  • Priority
  • Source
• The Triggers tab
  • State
  • Job Priority
• The Transactions window
  • Status
• The Users tab, under Manage Access
  • Role Assignment
• The Machines tab
  • Type
• The Robots tab
  • License Type

Displaying the webhook name

When you try to disable a webhook, its name is now displayed in the Confirm action window. Previously, it was identified by its URL.

Searching for apps in the tenant

The Type list of the Search in tenant window now also includes an App entry, allowing you to search for specific apps within a tenant.

New options on the Processes page

The Processes page now includes two new options: View Logs and View Jobs. The options allow you to easily access the logs and jobs associated to a specific process.

New option to copy the folder path

You can now easily copy a folder's path by using the Copy folder path option in the desired folder's contextual menu.

Removing CreationTime from the Audit logs

To simplify the logs, we have removed the CreationTime field from the Audit logs.

Improved identification of resource types

When searching for resources within your tenant, the Type column now displays the resource category, such as:

• Trigger (Time)
• Trigger (Queue)
• Trigger (Event)
• Machine (Template)
• Machine (ACR VM)
• Machine (ACR Serverless)

Hiding permissions for orphaned robots

To enhance operational efficiency, we have hidden the Check Folders and Permissions option for orphaned robots, where the owner no longer exists as a user in Orchestrator.

Error message improvement

We have improved the following:

• The authentication error message displayed when user interface access is disabled during sign-in.
• The error messages displayed by all Orchestrator resources. The errors now include a Trace ID, where relevant, for more efficient debugging.

Enhancing job sources

The Source filter on the Jobs page now includes Apps, Studio, and API trigger, allowing you to further filter the job to display.

API changes

Removal of API parameters

The AcceptedDomainsList, HasConnectionString, and ConnectionString parameters of the GET/odata/Tenants endpoint are now removed.

Removal of reports endpoints

Reports endpoints available for audit logs, robot logs, and queue definitions are now removed. As such, we advise against using the following:

• GET/odata/AuditLogs/UiPath.Server.Configuration.OData.Reports

• GET//odata/RobotLogs/UiPath.Server.Configuration.OData.Reports

• GET/odata/QueueDefinitions({key})/UiPathODataSvc.Reports

If you would like to retrieve such reports, we recommend these steps:

1. Initiate an export by calling the appropriate endpoint:

   • For audit logs: POST/odata/AuditLogs/UiPath.Server.Configuration.OData.Export
   • For robot logs: POST/odata/RobotLogs/UiPath.Server.Configuration.OData.Export
   • For queue definitions: POST/odata/QueueDefinitions({key})/UiPathODataSvc.Export
   Important:

   • This operation returns an ID that is necessary for the next two steps.
2. Get the status of the report by calling the GET/odata/Exports({key}) endpoint and appending the ID returned at step 1 to it.
3. Once the status is Completed, get a download link for retrieving the exported archive, by calling the GET/odata/Exports({key})/UiPath.Server.Configuration.OData.GetDownloadLink endpoint and appending the ID returned at step 1 to it.

Removing large data fields from GetAll - Jobs

The InputArguments and OutputArguments data fields have been removed from the GetAll - Jobs endpoint.

Exposing QueueItems endpoint parameters

We are exposing the CreatorJobKey and ExecutorJobKey parameters in the QueueItems endpoint, allowing you to more easily identify the job that ran a particular queue item.

Bug fixes

• The elevate permission check no longer includes permissions coming from disabled services. Thus, the following error no longer occurs when you attempt to assign permissions to other users: "Action forbidden: You selected at least one role that grants more than your set of permissions. Please remove the following role(s): {role_name} to continue. (#1437)".
• When the user interface access was disabled and a user tried to sign in, Orchestrator displayed a misleading error that the user was not authenticated.
• The screen reader version of the Create new menu included items that were greyed out in the user interface. Now, if a menu item is not available for any reason, the screen reader also skips it.
• The Monitoring page displayed the status of Automation Suite Robot machines. This no longer occurs.
• Timeouts occurred when a large number of configured robots retrieved CyberArk® credentials.
• When configuring the CyberArk credential store, the CyberArk Folder field did not support separators, the / or \ characters.
• As a result of the My profile page removal, the Orchestrator version was no longer visible in the user interface. You can now find the version at the bottom of the user profile section.
• API calls attempting to edit the details of unattended robots failed due to an unauthorized error. However, manual edits made through the user interface by the same user with identical permissions were successful.
• The Process filter on the Logs page did not include the process names of automations that were run in Studio.
• The Job details window did not display a reason for jobs stuck in a Pending status when the user-machine configuration for those jobs was not valid.
• Assets could not be retrieved from the HashiCorp Vault, which resulted in a permission denied error.
• The time format in grid exports was not always consistent. Now, it is displayed as yyyy-mm-dd hh:mm:ss.fff in all scenarios.
• The Log Details window previously did not display new-line characters correctly. Now, the window properly shows whitespace for all text values in logs, and its width has been increased for improved content visibility.
• An error was displayed in the View transactions window when you attempted to export queue items, and had filtered for a specific robot.
• HPA scaling of the Orchestrator instance caused intermittent 503 network errors.
• In an effort to improve the readability of the queue items side panel, we have changed its layout to a row format, and have made several minor font tweaks. These updates aim to solve a rendering issue which caused content to have too little space in the old side by side layout to accommodate values. The underlying issue stemmed from a rendering change meant to account for any whitespace formatting coming from automations or raw content.
• When an administrator tried to edit another administrator, it triggered an error that the authentication token was invalid, which logged out the initial user.
• Packages larger than 30 MB could not be loaded.

Common Vulnerabilities and Exposures

This release brings security updates and patches to address Common Vulnerabilities and Exposures (CVEs).

Known issues

• When you upgrade to a major version, the upgrade might fail with an error that the NLog extension UiPath.Orchestrator.Logs.Elasticsearch.dll is not compatible with the new version of Orchestrator. To avoid this issue, you should always use the latest version.
• On the Monitoring page, under the Unattended sessions and User Sessions tabs, you cannot sort items by status. Alternatively, we recommend using the Status filter instead.
• Local users part of local and mail-enabled AD/AAD groups may receive duplicate emails for alerts that have been generated for both groups.
• The live streaming connection does not always load for Robot versions up to 2024.10.1. This happens due to a TLS version mismatch between the server and Robot. For example, some systems (i.e. Windows 10) and Robot versions lower than 2024.10.1 do not support TLS 1.3.