Upgrade v6 to v7 Installation Error

[T3chGuy007 16]

Hello.  I'm trying to upgrade all of my clients that are running ESET Endpoint Antivirus 6.6.2068.0 and ESET Remote Administrator Agent 6.5.522.0 using an AIO installer that I created in ESET Security Management Center.  The AIO installer is configured to use ESET Endpoint Antivirus 7.0.2100.4.  I first tried running ESMC_Installer_x64_en_US.exe --silent --accepteula but it failed.  So I ran ESMC_Installer_x64_en_US.exe and it gets to the point where it is installing the ESET Management Agent and it fails with a message that the system is infected and I should run a specialized cleaner.  The error code is MSI.8257588.  I found this KB article with my exact problem.  However, the last post from an ESET staff member said that uninstalling the old product should not be required and disabling password protection should not be required either.

I have not uninstalled the old antivirus and agent since I was hoping there is a solution that doesn't involve doing this.  Is there an update as to why I can't perform an upgrade of EEA v6 to v7 without uninstalling the old version first?

 

 

[MartinK 378]

Please check directory %temp%\eset\  for full installation MSIEXEC logs that might help to identify this issue.  You have not mentioned version of ESET Management Agent you are installing, but most of the upgrade issues mentioned in referenced topic were addressed in 7.0.577.0. There is also a chance that upgrade fails due to configuration error: any chance you used the same installer for clean installations?

Feel free to attach installation log for analysis (log from fist attempt that fails might be most interesting)

[T3chGuy007 16]

There were several log files in %temp%\eset\ so I grabbed the largest one.  Before I started the install, I cleared out the entire directory so the log file should only have one installation attempt.

I'm trying to install v7.0.577.0 of the ESET Management Agent and v7.0.2100.4 of ESET Endpoint Antivirus.  I created a new AIO installer package in ESMC to include the product + agent with no license, since one is already on the PC, and with an agent configuration and product configuration that I'm currently using for my v6 clients.  During the install, I unchecked the option for LiveGrid and clicked the option to disable detection of potentially unwanted applications.  The install failed during the agent installation.  The log file that is attached is from this installation attempt.

I then modified this new AIO package to not include any configurations and it failed at the same step.  Let me know if you need any additional log files.  Thanks!

 

Edited March 11, 2019 by T3chGuy007

[T3chGuy007 16]

I've tried additional troubleshooting with very inconsistent results.  If I remove the setup password from EEA, it sometimes upgrades, but most of the time, it fails.  The only thing that seems to work is uninstalling the old product manually and then my AIO package installs without any problems.  Even that has issues because the uninstall for EEA sometimes hangs and I have to kill the ekrn.exe process for the uninstall to finish.  I've reached out to ESET support and they suggested that try I try the Remote Deployment Tool but that doesn't work either.  It shows that the upgrade is complete but when I check the system, it is still on v6.  I keep being told to use ESMC to do the upgrade but when an ESET tech tried to do an upgrade yesterday, it never finished.  I waited for over an hour but nothing happened so I deleted the task.  Why is it that nobody from ESET can tell me why I can't use AIO packages or their Remote Deployment Tool to do these upgrades?  I think when my license expires next year, I'm moving to a different A/V product.

[Peter Randziak 1,130]

Hello @T3chGuy007,

On 3/8/2019 at 7:13 PM, T3chGuy007 said:

There were several log files in %temp%\eset\ so I grabbed the largest one.

So can you please provide us with it so we can check it? 

 

I found a similar case reported by our QA "Installation failed with error (package=0, error=8257588" ( reference for  us P_ESMC-16163) but it should be fixed in the latest version of ESMC, but not sure if it requires the newest agent as well as you have the old one ESET Remote Administrator Agent 6.5.522.0

"This seems to be caused by policy having connection settings. The custom policy in setup causes those settings to be locked, and the ConfigSetServerConnection is trying to set the setting but it's locked by policy so it fails..."

 

May I ask why do you upgrade via the All-in-one installer? 

I would recommend first to try to upgrade via the Upgrade infrastructure task, as All-in-one primary usage is for deployment, not for upgrading,...

 

Regards, P.R.

[T3chGuy007 16]

Hello.  I had the log file previously attached but I did not hear anything back from MartinK, so I removed it. 

I re-attached the log file from an AIO upgrade package that I created in ESMC.  I'm also using an AIO package to do an upgrade instead of creating a client task because when I use ESMC to upgrade, I first have to wait for the client to communicate with the server to receive the task and when it does, it just seems to take forever to start the upgrade and finish.  When I create an AIO upgrade file, I can deploy it and know it is running immediately.  This works better in my environment because I have a specific installation window on some devices and I can't be waiting for the client to communicate back to ESMC to get the upgrade task and then continue to wait for it to start and finish.

According to this KB article, I should be able to create an AIO upgrade installation package and deploy it silently, which is what I'm trying to do.  I know in the past, I've created AIO packages to do minor upgrades to EEA v6 and it worked fine.

https://support.eset.com/kb6820/#Silent_Install

As far as the AIO upgrade package goes, I've created it with agent and security product configurations and without any but it still fails at the same step.

 

liveinstaller_20190313120600_eraa.log

[Peter Randziak 1,130]

Hello @T3chGuy007

thank you for providing us with the log

We checked them and we found:

MSI (s) (BC!EC) [08:06:18:420]: Creating MSIHANDLE (422) of type 790531 for thread 8172

ERROR: (preps) Preparing of service failed.

 

So it seems that the agent cannot be stopped for some reason.

Please try to install the stand-alone agent on the affected machine and

1. run the installation with lvx parameter  

2. Capture the events in the system during the installation with Process monitor with advanced output enabled, after it fails export the log in native pml format

3. Enable blocking of all blocked operations by HIPS in the HIPS setup on the Endpoint 

 

Compress the logs, upload them to a safe location and send me and TomasP a PM with download details so we can check it.

Regards, P.R.

[tmuster2k 22]

I have run into this multiple times when customers do installs over the top using All in one installer. If you just run the MSI for agent or for EEA/EES/EFS over the top it will install no problem. Also if you do push install over the top via ERA/ESCM it will work. 

[T3chGuy007 16]

@tmuster2k

I downloaded the agent and antivirus .msi files from ESET's website and I first tried to deploy the agent through my patch management software and it failed.  I looked at the log file and I had several of these messages with a different .exe listed.  So I tried deploying the .msi for the antivirus and it worked.  I then tried the agent .msi again and it worked!  Thank you for the suggestion!  From now on, I'll use an AIO installer for new installs and then just download the .msi for upgrades.  Thank you again!!  

Info 1603. The file C:\Program Files\ESET\RemoteAdministrator\Agent\ERAAgent.exe is being held in use by the following process: Name: ERAAgent, Id: 3176, Window Title: '(not determined yet)'. Close that application and retry.

[Palps 3]

Hello,

@T3chGuy007 I had the same issue for each update of the Agent version sind the beginning of v6. Every time I have contacted the support but they couldn't help.
I have figured out, that the HIPS Module is blocking the deletion/stop of the process ERAAgent.exe and the service EraAgentSVC. So as a result the agent cannot be updated.
Currently I am doing the upgrade to EMA 7.0.577.0 and EEA 7.0.2100.4. For this I have changed the default policy for all clients, so that HIPS is disabled but not shown as Critical on the device itself, so that the users are not getting confused. Then I am waiting until they have rebootet and trying to do the Agent update from time to time. As soon as HIPS is disabled and a reboot has been done, the Security Management Center Components Upgrade task is working like a charm because the process and the service is not secured by the HIPS anymore.

I have figured this out by myself as the support was never able to help me. Currently we are considering to switch to another AV solution.

(Disabled HIPS)

 

(Change application statuses)

 

(Disable to show the issues on the client)

 

[T3chGuy007 16]

@Palps,

Thank you for sharing this information.  In my case, I already had HIPS disabled in the client policy and I had the application status disabled as well.  I'm not sure why using the Security Management Center Components Upgrade task was still hit and miss.  As @tmuster2k pointed out, I got all my clients updated by downloading the .msi files for EEA and ERA and then using my patch management software to deploy.  At least it is working for you though and you are able to get your clients updated.  Thanks again for the information!

[Peter Randziak 1,130]

Hello guys,

we are aware of this issue and the dev team is investigating it.

Currently there are 3 tickets with the devs opened with similar symptoms, but so far we were not able to pinpoint the root cause from the available logs so we are waiting for an image of affected system so we can debug it in-house.

 

I will try to keep you posted.

Regards, P.R.

tracking keys for ESET Staff members P_ESMC-18585 P_ESMC-18339 P_ESMC-18120

[greyjoy99 0]

Hi @Peter Randziak, is there mabye any new information regarding this issue?

Regards, M

[Marcos 5,070]

Since we were unable to reproduce the issue, would it be possible for you to prepare an image of the system for us on which the issue manifests so that we could debug it?

Disabling HIPS completely is a bad idea since it also disables crucial protection modules such as Advanced memory scanner, Exploit Blocker and Ransomware shield. If inevitable, disable just self-defense temporarily.

[T3chGuy007 16]

I just wanted to say that I've upgraded my clients from EEA 7.0.2100.4 to EEA 7.1.2045.5 by pushing out the .msi file that I downloaded from https://www.eset.com/ie/download-business/ and I didn't have any problems.  Each upgrade took about 2 minutes.  I didn't have to update EMA since v7.0.577.0 was already installed.  

[Palps 3]

Same here, I have done the upgrade from EEA 7.0.2100.4 to EEA 7.1.2045.5 via the integrated software installation task via the ESET Management Center Console. I think this was the first time ever, that an ESET upgrade was working without any issues or any additional troubleshooting/configuration for our 600 clients.

Let's see what happens when a new EMA version is released.

[DiPersiaTech 2]

Any updates on this?  Just updated from ERA 6.5 to SMC 7.0.577.0.  Same error when running the MSI to update the agent (Because the tasks are so hit or miss for us) - ERROR: (preps) Preparing of service failed.