Guardian One release notes

Since version 1.5.3

• Aligned the Configuration workspace: the Step 1 cards now line up with the table and editor beneath them, the Save changes button sits level with the licensing controls, and the selected workflow tab no longer sits lower than the others.
• Corrected the Configuration tables so column headings align with the values below them and the columns fill the available width instead of leaving an empty strip, and removed a horizontal scrollbar that appeared under a table that could not scroll.
• Hardened the client build so a partially compiled application can no longer be packaged: the installer now requires every compiled executable to be present, not merely its output folder.

Since version 1.5.2

• Corrected the installed Portable portal so it reads integrity-checked retained SQLite evidence instead of requiring SQL Server repository settings, and made its TCP port configurable with a default of 8080.
• Simplified all three Configuration steps, made optional Diagnostic Tool Pack status reassuring rather than mandatory, improved large-estate tables and button visibility, and added documented transactional machine-template bulk import.
• Improved assessment reports with RAG boxes and explicit action reasons on every summary, a non-technical Manager audience, short labelled machine-summary paragraphs, humanised GUID-only storage labels and clearer bounded-log and unavailable-capacity wording.
• Added read-only checks for empty sa passwords and failed-login patterns, made tempdb the initial target database, and added explicit Microsoft ODBC Driver 18 prerequisite diagnostics.
• Corrected stopped-assessment progress, applied Guardian One icons to every executable build, expanded offline patching and central Windows evidence guidance, and refreshed reviewed documentation screenshots.

Since version 1.5.1

• Improved Configuration for larger estates with visible CSV import, screen-aware sizing, wider Diagnostic Tools columns, clearer actions, saved-setting restoration and verified-pack guidance.
• Corrected assessment progress totals and long SQL Server-name display, documented the packaged command-line scheduling route, and made installed Portable portals use their real local repository estate.
• Improved reports with explicit red, amber or green summary status, clearer action text, audience controls under their heading, and honest unavailable-evidence wording instead of reassuring zero counts.
• Expanded retained evidence for capacity history, backup governance, data classification and subscription lifecycle, with corresponding repository, report and automated-test coverage.
• Added the consent-based website download handler, private installer storage, checksum response and broader customer-page browser release checks.

Since version 1.5.0

• Fixed an issue affecting installations with more than one configured SQL Server target, where the assessment process could fail to relaunch itself for each target and stop the entire scheduled run with an unhelpful error. If a target still fails to start for any reason, Guardian One now records it as failed with a clear diagnostic and continues with the remaining targets rather than stopping the whole run. Added third-party toolkit deployment and tempdb configuration to the Configuration application, alongside the existing JSON configuration option.
• Simplified Guardian One Configuration: Windows evidence is attempted automatically during assessment with failure-safe logging; optional diagnostic-tool installation has its own Step 2; and licence request and renewed-licence installation actions are grouped together.
• Fixed Portable SQLite persistence of SQL Server decimal storage, capacity and health values, with real SQLite regression coverage.
• Decoupled monthly third-party diagnostic-script updates from the Guardian One executables. Administrators can now install a separately versioned, signed offline Diagnostic Tool Pack in Configuration Step 2; Guardian One validates provenance, licences, product and SQL compatibility, signature and every file hash, records the exact pack in assessment evidence, and retains the previous verified pack for rollback.

Since version 1.3.3

• The automatic evaluation period is now fourteen days (previously seven), still bound to the Windows machine, with Foundation, Advisor and Compliance functionality enabled and Quantum unavailable in demo mode.
• Signed production licences now take their SQL Server target capacity from the highest enabled service level - Foundation 100, Advisor 250, Compliance 500, Quantum 1,000 - counted by distinct SQL Server name, with reassessment of an already-registered instance never consuming another slot. This limit is now enforced identically whether results are stored in the Portable SQLite repository or the Full SQL Server repository.
• Added the Guardian One Assessment Progress application: a live dashboard showing servers, per-server stage, and current action during an estate run, with Pause/Resume/Stop and an operator log. This is now the primary way to run an interactive assessment; the console assessment binary remains available for unattended/scheduled runs.
• Added optional, opt-in deployment of third-party diagnostic toolkits (Brent Ozar First Responder Kit, Ola Hallengren Maintenance Solution, Erik Darling diagnostics) into tempdb or a configured application database, with automatic tempdb-only removal after each run. Off by default; existing target catalogues are unaffected.
• The Estate portal's compliance and release charts now support multi-select filtering (select more than one status or version at once) and drive the results table together.
• Added browser-style back and forward navigation buttons to the Estate portal header.
• Fixed the assessment stage counter incorrectly showing "Stage 31 of 30".
• Fixed a website deployment issue that returned 403 errors for documentation PDFs and the site logo.
• Added new documentation: moving from Demo to Full installation, patching an installation, and removing Guardian One and its remaining data.

Earlier: Version 1.3.3

Detailed per-release notes for versions 1.3.4 through 1.4.2 have not yet been written up individually; the items below were the last full changelog before this consolidated entry.

Installation and update corrections

• Guardian One now runs for seven days without a working licence file, with Foundation, Advisor and Compliance functionality enabled. Quantum functionality remains unavailable in demo mode.
• The demo period is bound to the Windows machine, survives normal uninstall and reinstall, uses redundant integrity-checked state, and rejects clock rollback. A determined local administrator can ultimately defeat client-only controls.
• The public website again links directly to the interactive sample Enterprise Portal from its main navigation and home-page journey.
• Version 1.3.3 is explicitly released without Authenticode signing while the commercial certificate is pending. Windows may show Unknown publisher or SmartScreen warnings; verify the published SHA-256 checksum before execution.
• Version 1.3.3 is an explicitly authorised licence-pending release. The final approved LICENCE file is not packaged yet and will be added when approved wording is available.
• Version 1.3.2 writes installed assessment and estate reports to the writable Guardian One ProgramData report directory instead of the protected launch directory, preventing report creation from failing after a successful server extraction.
• Version 1.3.3 makes the Assessment shortcut assess every enabled configured SQL Server in an isolated process, so one failed target does not prevent later targets from being attempted.
• Version 1.3.3 makes the installed Portal open the live customer estate dashboard without exposing the public product website.
• Version 1.3.3 adds Configuration help for the optional, read-only Windows preflight and distinguishes it from SQL connectivity.
• Version 1.3.3 adds Save as… to create a validated JSON backup without changing the active installed target catalogue.
• Version 1.3.2 enables standard installed users to write portable assessment evidence, logs and reports, displays actionable startup errors, supports default SQL Server instances, and allows GUARDIAN_PORTAL_PORT to select the portal port.
• Hotfix 1.3.1 restores shared public-key discovery from every isolated component folder; existing customer licence files remain valid.
• Separated Assessment, Portal and Configuration runtimes so compiled dependencies cannot overwrite one another.
• Corrected the Portal startup failure reported as an invalid frozen encodings module.
• Changed installed runtime configuration lookup to C:\ProgramData\Guardian One\Config.
• Added support for default SQL Server instances such as SERVER-R7TECH-M, as well as named instances.
• When SQL_SERVER is not explicit, Assessment now uses the first enabled target saved by Guardian One Configuration.
• Added versioned in-place upgrade behavior that preserves customer configuration, licences, evidence, logs and reports under ProgramData.

Other changes

• Added a database-backed operations inbox for website enquiries and optional SMTP notification.
• Made a valid reply email address explicit and mandatory on the Contact us form.
• Added reproducible customer and internal release packaging linked to the exact Git commit and SHA-256 checksums.
• Signed customer licences remain authoritative and continue to enforce their issued service and expiry claims.

Compatibility and build

Customer applications remain self-contained and do not require a local Python installation. Assessment, Configuration and Progress are compiled with Nuitka on a validated Python 3.13 runtime; Portal is compiled with cx_Freeze. SQL Server targets are 2012 or later on Windows, subject to the release permission matrix.

Known considerations

• The web front end is optional and remote availability remains under customer-controlled hosting, authentication, firewall and TLS arrangements.
• SMTP delivery requires customer- or operator-approved mail-server settings. Enquiries remain stored when notification is unavailable.
• Unavailable Windows or third-party evidence is reported as not assessed and is never interpreted as a pass.
• Optional Brent Ozar procedures beyond sp_Blitz remain disabled while their result contracts are completed and validated.