What's New in MOVEit Automation 2025

MOVEit Automation service permissions and account types

MOVEit Automation's services now run with lower permissions for new installs and migration upgrades, enhancing security and adhering to the Principle of Least Privilege.

MOVEit Automation's services on a new MOVEit Automation installation run with lower permissions, specifically without administrator privileges. MOVEit Automation's services can now be configured on a new install to run via a Virtual Service Account (default), a Group Managed Service Account, or a Standard Windows Account. Each account type requires specific setup steps and permissions to ensure proper service operation. For details of each account type, see Prior to installing MOVEit Automation or Service Accounts.

If your environment previously relied on the MOVEit service account credentials to access UNC paths, be aware that access to these shares may be disrupted if the MOVEit Automation service is now running under a different user account. To restore access, you can either grant the new service account explicit permissions to the UNC share or use the "Run As" option to connect using alternate credentials. If the service is running as the virtual user (NT Service\MOVEitCentral), you must grant access to the MOVEit Automation server itself by specifying the server name followed by a dollar sign (for example, my-moveit-server$) when configuring share permissions.

To run MOVEit Automation's services with lower permissions after upgrading, perform the upgrade using the migration upgrade option. Direct upgrades to MOVEit Automation 2025 will not change the service user permissions. For upgrade information, see Upgrade MOVEit Automation.

MOVEit Automation writable files location updates

In line with improved security and best practices, the default location for writable files is \ProgramData\MOVEit\. This applies to new installations and upgrades to MOVEit Automation 2025.0.

When MOVEit Automation is upgraded from 2024.1, or earlier, to 2025.0, writable files are moved from \Program Files\MOVEit\ or whatever your install directory is located, to \ProgramData\MOVEit\. If other, customer-specific data is stored in \ProgramFiles\MOVEit\, the data, including any subfolders, will be moved to \ProgramData\MOVEit\.

You should update all backup and disaster recovery procedures to reflect the changes in file locations.

SFTP library update

All SFTP hosts must use the latest MOVEit SFTP library in MOVEit Automation 2025.0

SFTP host key update

For new SFTP hosts, the SFTP host definition dialog will now show the SHA2 version fingerprint for the remote Host Key instead of SHA1. Existing SFTP hosts will continue to show the SHA1 fingerprint, unless the user chooses to download a new host key. For more information, see SSH/SFTP Host Field Descriptions.

Disable custom scripting

It is now possible to disable custom scripting using the config utility. When custom scripting is disabled, custom scripts cannot be created, and tasks that use custom scripts will fail. Disabling custom scripting also disables the built-in Command Line App script. To access and edit the config utility, you must have Windows Server administrative access.

The TASKS and RESOURCES > Scripts pages display a Custom Scripting Disabled warning to alert users that any tasks relying on custom scripts will not execute successfully, and they cannot create scripts.

For more information, see Custom Scripts.

Windows Server 2025 support

MOVEit Automation supports deployment to the Windows Server 2025 operating system.

Azure Blob host update

Active Directory log on

Starting with MOVEit Automation version 2024.0, when logging on using Active Directory, you must enter your credentials in the format mydomain\myusername