Cannot Upgrade Agents after Upgrade to ESMC 7

[tomha 3]

I did an upgrade of my ERA Server to ESMC7 which went flawless.

After upgrading i tried to upgrade the agent of the Server itself and a clients agent to V7 using a ESMC Component upgrade Task. The task finished successful but the agent version stayed at 6.5.522.0.

A manual execution of the agent installer msi at the server itself installed the V7 Agent.

So does anyone know, how to get the ESMC upgrade task working on Client side to upgrade the agents, since updating the agents manually is no option?

 

[OneIT 1]

I have the same issue, @MartinK posted in another thread, that they need to reconfigure the repository Server , so that component upgrade also works.

EDIT: correct client cant be update over component upgrade task..-> see @sdnian post

 

Edited August 20, 2018 by OneIT
false info

[sdnian 6]

You can't use "ESMC Component upgrade Task" to upgrade ERA agent 6.x to ESMC agent 7. Read this document, it show how to do it.

https://support.eset.com/KB6819/

 

[Marveltec 0]

Thank you for the feedback @OneIT also having the same problem and was watching this thread for feedback.

[tomha 3]

Yes i already upgraded the agents using "run command" tasks,

Just wondering what the ESMC component upgrade task is for?

[MichalJ 434]

ESMC component upgrade task would be a preferred way to upgrade ESMC components (it´s a successor to "Remote Administrator component upgrade task). However, due to bigger architecture changes, and discontinuation of ERA Proxy we have decided to not enable it "out of the box". We will however today enable the option to use the task to upgrade ERA Agent to ESET Management Agent after a V7 server has been installed.

[Marveltec 0]

Hi @MichalJ, Thank you for your feedback looking forward to this change as all of our endpoints are remote to our hosted ESMC server so a "run command" task wont work for us.

[tomha 3]

@Marveltec: Please specify why a "run command" task mentioned in https://support.eset.com/KB6819/ "III. Agent upgrade using Run Command Client task" does not work.

[MartinK 378]

It seems that ESET repository configuration is changed so that it should be possible to upgrade Agent using components upgrade task. Could you please verify?

[tomha 3]

I can confirm, that "ESMC component upgrade task" now, was successful to upgrade a clients Agent from 6.5 to 7.0

[jedi87pl 1]

We are deploying Agent via msi installer + ini configuration file generated from era server (currently updated to v7) I've always upgrading agent adding another msi to gpo (as update packet) and new version is installing without problem. Until now. I've created the new ini file from console and putted it in same folder as new msi file. Policy is trying to apply but there is 1603 error and agent is still in 6.5.x version. It was the best way to upgrade the agent untill now. How can I upgrade client via msi and ini file now?

Edited August 20, 2018 by jedi87pl

[maniel 0]

On 8/21/2018 at 1:29 AM, jedi87pl said:

We are deploying Agent via msi installer + ini configuration file generated from era server (currently updated to v7) I've always upgrading agent adding another msi to gpo (as update packet) and new version is installing without problem. Until now. I've created the new ini file from console and putted it in same folder as new msi file. Policy is trying to apply but there is 1603 error and agent is still in 6.5.x version. It was the best way to upgrade the agent untill now. How can I upgrade client via msi and ini file now?

i have the same problem, also following error in windows logs:

Product: ESET Remote Administrator Agent -- Configuration failed.

 

[Pinni3 21]

I use msi + ini and deploy them via gpo. Just generate files (new msi and new ini) in console and it is ready to rock

[MartinK 378]

Could you please provide us value of INI file parameter P_CUSTOM_POLICY=* ? It is possible some specific value in policy breaks AGENT installation. Beware that it contains all policy data, which will most probably include sensitive information - in such case, please use private message.

 

And I forgot, any chanse someone has full MSIEXEC installation log from failed attempt?

Edited August 22, 2018 by MartinK

[jedi87pl 1]

2 hours ago, Pinni3 said:

I use msi + ini and deploy them via gpo. Just generate files (new msi and new ini) in console and it is ready to rock

I've took same steps but always error when deploying via gpo (or manualy from the same folder as GPO)

[MartinK 378]

Thanks for logs/data sent to me by private message.

Initial analysis shows there may be problem with GPO upgrade when using custom configuration. This was actually not available in previous versions, i.e. custom settings were ignored and that is why it worked correctly. During upgrade, original settings are preserved. This has been partially changed for ESMC release, but full implementation will be available in next release (even minor).

Could you please confirm, that failed deployments were actually upgrades from previous versions and not clean installations or repairs?

If it is confirmed problems are only with upgrade, my recommendation would be to omit custom configuration, as during upgrade, current settings will be preserved, i.e. settings currently applied from ERA/ESMC policies.

[maniel 0]

so the policy would be downloaded from server after clean machine deployment (without original settings to preserve)? as opposed to upgrade scenario of course

Edited August 22, 2018 by maniel

[MartinK 378]

45 minutes ago, maniel said:

so the policy would be downloaded from server after clean machine deployment (without original settings to preserve)? as opposed to upgrade scenario of course

In case of clean installation, policies will be applied after fist successful AGENT connection to ESMC. Configuration policy in AGENT installer would only make it faster (newly installed AGENT will be connecting once a minute during first 10 minutes, regardless of interval configuration). Only situation where AGENT policy has to be present during installation is in case AGENT won;t be actually able to connect to ESMC without some specific settings, for example HTTP proxy.

[jedi87pl 1]

17 hours ago, MartinK said:

In case of clean installation, policies will be applied after fist successful AGENT connection to ESMC. Configuration policy in AGENT installer would only make it faster (newly installed AGENT will be connecting once a minute during first 10 minutes, regardless of interval configuration). Only situation where AGENT policy has to be present during installation is in case AGENT won;t be actually able to connect to ESMC without some specific settings, for example HTTP proxy.

So should i use MSI installer withouth any ini configuration file or with ini file but withouth custom Initial installer configuration (only standard server adress?)

[jedi87pl 1]

Ehhh. nevermind. Both options didn't worked  As i can see all computers affacted by first try of new Agent installation are in situtaion that registry entry saids that old agent (6.5.522.0) is installed but there are no any files, services etc. of it. So i can't use registry cleaning client task (this one which you mensioned in private mesaage) because any agent of this computers is not comunicating with ESMC). On that computers only solution that worked was starting computer in safe mode, use eset uninstaller tool, clean old agent registry entry with it) and then after restart new client is installing flawlessly. But it's not an option with about 100 clients  And those machines are conneting with ESMC but they are duplicated in Console

Any other sugestions? Any option for new msi installer release with registry cleaning tool? 

[karsayor 8]

Hi

I got the same issue (1603 error). The task "Security Management Center Components Upgrade" worked fine on our servers (2008R2 to 2016), but it did not work for client computers (Win7 to Win10). Maybe a language issue ? All computers are in french.

I tried many options. Installing trough the script manually, with the dedicated update task, installing only agent_x64.msi, ...

Edited August 29, 2018 by karsayor

[mrac 5]

Hi. I upgraded to ESMC7, then updated agents and antivirus. Most of them upgraded fine (~250 computers) but some of them had issues with agent upgrade.

1. When they had 6.5 agent, all were fine.

2. I tried to upgrade agent via task "Security management center component upgrade" and got error 1603.

3. I removed old agent by task "Stop managing" - old agent removed, folders ESET in Program Files and ProgramData disappeared, services removed too.

4. I tried to install new agent by:

a. Push task via ESMC

b. GPO-task (msi+ini)

c. bat-file (agent live installer) using psexec

In all cases installation of agent finished with error 1603.

I tried to re-install agent 6.5 and received error 1603 with it too.

Looks like issue appearing at the very beginning of installation, because it is not even creating folder ESET in Program Files, stopping earlier.

Reboot not helping. About 30-40 computers has this issue, in different offices in different countries, so I cannot use "ESET Uninstaller" tool in safe mode on them.

Any suggestions?

Also, agent v7 has some strange connectivity issues: sometimes computers and servers, which are currently available and has agent running, displaying in ESMC as last time available 20-30 minutes ago (sometimes 2-3 hours ago), so tasks on them starting with delay in several hours. After some time they appearing again as online. Never had such behavior with v6 agents...

[MichalJ 434]

What security product is installed on the target machines? Is there any endpoint running? 

[mrac 5]

On all machines was ESET Antivirus 6.6.2078.5 x64. Most computers were successfully upgraded to ESET AV 7.0.2073.1.

On problematic computers I uninstall antivirus first before removing agent (software uninstall task). Now these computers have no agent, no antivirus and I can't reinstall agent because of error 1603.

OS: Win 7 x64 and Win 10 x64 1803, US English and Russian versions. ESET products - English version only.

[karsayor 8]

On all computers we have Endpoint Security either 6.5 or 6.6. Servers are protected by File Security and they have no issue updating the agent.