General compatibility between versions of Centrify software

In most cases, newer versions of Centrify software releases are backward-compatible with previous versions, enabling you to mix and match components from different versions and upgrade components over time when it is convenient to do so. However, there are some limitations to take into account when mixing and matching versions, and these limitations might influence which components you upgrade and how quickly you upgrade from one version to another.

In most organizations, the agents you install on managed computers are upgraded on a staggered schedule while administrative tools are upgraded at a set time to take advantage of new features.

To ensure flexibility of the upgrade process:

  • Agents are always backward-compatible with older versions of the administrative console.

    However, using an older version of the administrative console with a newer agent limits the features and functionality available. If you are using an administrative console from version 2.x to manage zones, agents from version 4.x and 5.x must use the --compat option to join 2.x-compatible zones.

  • Agents are always forward-compatible with the administrative console for one version.

    You can upgrade the administrative console without upgrading agents at the same time. However, there are limitations to features and functionality when using older agents with an upgraded console. For example, agents from version 4.x cannot be included in hierarchical zones. In addition, some features require an upgrade. For example, if you want to use the Centrify agent for Windows for access control and privilege management, you must either upgrade or remove the Centrify auditing service for Windows.

  • Group policies are not guaranteed to be compatible with different agent and administrative console versions.

    New group policies cannot be enforced on computers with an agent from a previous version of Centrify software. If a group policy is applied to a computer that has an older version of the agent, the policy is ignored. You should only apply group policies that are supported in both the agent and administrative console versions you are using.