An OnBase upgrade rarely fails loudly. It completes, every box gets ticked, and three weeks later someone notices the invoices stopped moving on the 14th.— The Reveille Perspective
Hyland ships OnBase Foundation 26.1 with a security-and-modern-experience story, and the launch webinar — OnBase 26.1: Built for What’s Next — runs September 2 at 11:00 AM EDT. Somewhere in an enterprise content management (ECM) team, an administrator is reading the feature list and doing a different calculation. Not what do we get. What breaks.
They have a Saturday window and a process owner in accounts payable who will call on Monday if one queue stalls. What makes those windows go wrong is almost never the install. It is Silent Upgrade Regression — every step succeeds, the environment comes back green, and a business process quietly stops behaving the way it did on Friday. Nobody catches it, because nobody wrote down what Friday looked like.
Core Tension
Hyland’s published upgrade checklist devotes some thirty steps to installing 26.1 and exactly one to verifying it worked — and that step points at a guide you need a Community login to read. The install is documented in public. The proof that it worked is not.
Quick answers
What’s new in OnBase 26.1?
What should I test before upgrading to OnBase 26.1?
Does OnBase 26.1 require .NET 10?
When is Distributed Disk Services being removed from OnBase?
01 — The Setup
The Buried Lede Is .NET 10
Not in the press release. In the requirements.
The 26.1 announcement leads on security: centralized key management, configurable masking of personally identifiable information, expanded encryption, a stronger password policy. One caveat before you scope a security-driven upgrade — as of late August, most of those items have no corresponding topic in Hyland’s public 26.1 documentation. Make your Hyland representative name the config location and the affected components before you put a date on the calendar.
The change that will actually decide whether your window goes long is documented, and it isn’t in the press release. Foundation 26.1 adds a Microsoft .NET Requirements page with no equivalent in Foundation 25.1: OnBase requires Microsoft .NET 10 or later. Microsoft .NET Framework 4.8 or later is still required alongside it. TLS 1.2 or later is now mandatory.
That is a server-provisioning change, a hosting-bundle change, and — if you deliver OnBase through Citrix or RDS — a golden-image change. Its blast radius runs through the Application Server, the Web Server, the Unity Scheduler Service, and every piece of custom .NET anyone has bolted on: Workflow scripts, Unity API consumers, DLL Exit Call actions, partner REST integrations. Inventory every custom assembly and the framework it targets before you schedule the window, not during it. (The full set of what Reveille checks on OnBase is published in the OnBase technical overview.)
02 — Three More on the Same Page
What Else 26.1 Actually Changes
All documented. All easy to miss until they’re expensive.
The Compromised Password Check. New in 26.1’s Security Best Practices guide and absent from 25.1’s, it validates a new password against known-breach sources and rejects a match. Hyland notes that “the password itself is not transmitted” — implying an outbound lookup that can block a password change in an egress-restricted environment. Test the Standard Authentication path specifically: if your users come in through Active Directory or single sign-on, nobody touches it until a service account expires at the worst possible moment.
Distributed Disk Services has a date now. Hyland documents that DDS will not be available in OnBase versions released after December 31, 2027, and that 26.1 supports it for existing customers only. The replacement routes Disk Group access through the Application Server or Web Server instead. If you run DDS at branch sites, 26.1 is the release where you start measuring retrieval latency on that path — not the release where you find out about it.
Check your schema number yourself. Hyland’s docs list minimum database schema 3.5-471.5 for both 25.1 and 26.1, where 24.1 to 25.1 did advance. Confirm against your own DBUtils output rather than the doc. And if you carry WorkView from before OnBase 14, the WorkView Schema Migrator has to run before the 26.1 schema upgrade.
03 — The Gap
Hyland’s Checklist Has a Testing-Shaped Hole
Thirty-odd install steps. One test step. It points at a login.
Hyland’s public Upgrade Checklist is thorough on the install: back up the database, purge transaction logs, verify all users are offline, clear orphaned licenses, upgrade the database, install clients, upgrade core components, back up again. Then, in its entirety, the verification step reads: “Test the upgraded client. Refer to the Testing an OnBase Solution guide available on Community for best practices and recommendations for testing.”
That guide is behind a Community login — so the public checklist hands every piece of testing substance to a document most administrators will never open at 11pm on a Saturday. Which is a shame, because Hyland’s own Upgrade Guidelines are unusually honest about why manual testing under-delivers:
Hyland, on testing
“Testers almost never have time to test every single activity. Even if they do, it is difficult to know what every activity is and the right order in which to perform the activities.”
“Custom-developed applications are often not tested for impact, memory stability, or session and license leakage.”
That is an accurate description of the ceiling on manual testing, written by the vendor. The answer isn’t more testers on the Saturday. It’s having the environment produce its own evidence — the same transactions, executed the same way, on both sides of the window, with numbers attached.
04 — The List
What to Capture Before the Window
Every line needs a number, not an impression. The number is the whole point.
A baseline is what turns “it feels slower” into “Unity retrieve went from 1.4 seconds to 4.1.” Run each of these in the week before the upgrade, and again after. The right-hand column is why 26.1 in particular puts each one at risk.
| Layer | Capture before the window | Why 26.1 puts it at risk |
|---|---|---|
| Connectivity | Application Server, Database Server, File Server and LOB Server reachability | The runtime change lands on the Application Server tier first |
| Platform services | OnBase Services, AppNet, AppServer, Web Services, REST Services, IIS application pool memory, server free space | New .NET runtime, new memory profile, new hosting bundle |
| Database | Deadlocks per second, batch requests, database size, transaction log and database backup state | Schema upgrade plus a long-running window on a live estate |
| Client performance | Web Client login, search, retrieve, logout; Unity Client login, retrieve, logout — in milliseconds | The only numbers your users will argue with you about |
| Workflow | Timer errors, timers that never ran, queue depth by lifecycle | Deprecated Workflow interfaces, incl. the Workflow Timer Service and Classic Workflow |
| System processing | Disk Groups, Disk Group locks, uncommitted and committed batches, process and batch locks | Critical on DDS estates — the replacement path changes where retrieval goes |
| Capture | Untouched document count, documents awaiting export, batches over N days not exported, documents exported | Where regressions hide longest — nobody watches a queue that used to drain |
| Security | Security log events, failed Web Client transactions, document access counts, same user from different IP | New password policy path and new masking behavior |
| Unity & REST API | Obtain access token, upload, archive, retrieve properties, retrieve, delete, disconnect session | Custom .NET consumers are the .NET 10 blast radius |
| Licensing | License usage and orphaned licenses | Hyland’s pre-upgrade steps require clearing orphans; the count tells you whether you did |
After the window, run the identical set and compare. Four checks only matter on the far side: the password-change path under Standard Authentication, Disk Group retrieval latency through the Application Server if you’re moving off DDS, every custom assembly loading under the new runtime, and the Unity Briefcase redeployment reaching endpoints — whether you ship it by MSI or ClickOnce.
Where this gets automated
As the only agentless monitoring system to integrate with OnBase, Reveille comes pre-configured with over 80 OnBase-specific tests and over 85 OnBase dashboard metrics, covering Hyland OnBase 18 and above (EP#, YY.#). The list above maps onto those test categories almost line for line — which makes the baseline a scheduled run rather than a Saturday night of clicking. See Reveille for Hyland OnBase →
Take it with you
Running the 26.1 window this quarter?
The pre- and post-upgrade test list from this page, as a printable two-page checklist you can hand to whoever runs the window and whoever signs off on Monday.
The full list is on this page. The PDF is the same list, with fields to record each value.
05 — The Point
Two Ways to Find Out It Worked
One happens on Saturday. The other happens in accounts payable, in October.
In the version that goes well, the window closes at 2am, the comparison runs, and three numbers are off: Unity retrieve is up 400 milliseconds, one Workflow timer didn’t fire, and a REST consumer can’t get a token because it targets a framework that’s no longer there. All three get fixed before Monday. In the version that goes badly, everything looks fine — because “fine” was never defined — and six weeks later a process owner escalates that invoices over a certain value have been sitting in a queue since early September.
Both estates ran the same upgrade. The difference isn’t the release — it’s whether anyone made the environment prove it still worked. The question on the Monday after isn’t whether you took 26.1. It’s whether you’re reading a comparison, or waiting for the phone.
