Agent 8.0.1238.0 upgrade task failed

[Zen11t 6]

After upgraded to ESET Protect I made Agent upgrade task to 3 test PC (Win 7 32 bit, Win 10 64 bit), task finished with error but Agent upgraded on the machines successfully.

trace.log last line show:

 ReadUpgradeStatus: Upgrade of Agent from version '7.2.1266.0' to '8.0.1238.0' failed. Unexpected updater service Win32ExitCode 0x42b

 

Edited December 10, 2020 by Zen11t

[Marcos 5,731]

I've seen one such report already. Allegedly upgrading Endpoint to v8 first prevented the error from being reported, however, the person claimed that agent was upgraded despite the error. The issue will be investigated further when more info from users is available.

[Zen11t 6]

I tested it now with another PC:

upgraded Endpoint 7 to v8, reboot and send agent upgrade task. It's show task failed message too, but the new V8 agent installed and working good on the machine.

trace.log show the same line.

[GRT 0]

After upgrade SMC 7.2.12.78 to Protect 8.0.1238 I made upgrade task from Agent 7.2.1266 to 8.0.12.38.

ReadUpgradeStatus: Upgrade of Agent from version '7.2.1266.0' to '8.0.1238.0' failed. Unexpected updater service Win32ExitCode 0x42b

Client: Win10, ver: 10.0.18363.1198 (64bit)

Server: 
ESET PROTECT (Server), verze 8.0 (8.0.1238.0)
ESET PROTECT (Web Console), verze 8.0 (8.0.170.0)
Microsoft Windows Server 2012 R2 Standard (64-bit)

[tomasS 5]

is there any chance to provide "ra-upgrade-agent.log"(It should be located at "C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs") or even better if someone can provide the ESET Log Collector log from the affected machine.

 

[GRT 0]

I suspect... Is there anyone, who configure Software Restriction Policies on user account folders?

tomasS: How can I send you Eset log collector?

[Marcos 5,731]

You can upload the archive generated by ELC here. Only ESET staff has access to attachments.

[GRT 0]

ees_logs.zip

[tomasS 5]

thanks for the provided log files, we are going to investigate what is happening there. We will keep you posted...

 

[MartinK 384]

Thanks for logs. As we suspected, upgrade of AGENT itself went fine, but there is some unknown problem with helper service shutdown (service that executed upgrade itself). Unfortunatelly it seems that this service is crashing during shutdown: could you please check directory:

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\

on client machine for entries related to UpdaterService.exe? There are references in system logs from client device.

[GRT 0]

AppCrash_UpdaterService.e_3f7dba9e679cb17fdebaec64c5ce9b7dfecabb_3076b009_c9e58383-e622-4fb9-8d0c-aef0f75ee25a.zip

[VorteX28 0]

The same problem. Packed trace.log and Updaterservice from WER.

Around 25% of computers failed with Agent update

D.zip

[MartinK 384]

Thanks. From provided crash dumps it seems there is some problem with processing "unicode" paths at the final stage, i.e. after AGENT is successfully upgrade.

Just for confirmation, but upgrade is performed on Windows operating systems with localized environment, i.e. paths like "Program Files" or "ProgramData" are localized and possibly using non-asci characters?

[VorteX28 0]

15 hours ago, MartinK said:

Just for confirmation, but upgrade is performed on Windows operating systems with localized environment, i.e. paths like "Program Files" or "ProgramData" are localized and possibly using non-asci characters?

They are exactly with names "Program Files" and "ProgramData" without any other non-ascii characters.

BTW after reboot Agent shows updated version. So they are actually updated.

Aaaaand now 172/173 agents updated. 1 - is a mystical PC that fails everything.

[Zen11t 6]

For me it's Programfájlok (x86) and ProgramData, but Antivirus is installed to Program Files directory.

[Guest]

On 12/16/2020 at 9:57 AM, VorteX28 said:

They are exactly with names "Program Files" and "ProgramData" without any other non-ascii characters.

BTW after reboot Agent shows updated version. So they are actually updated.

Aaaaand now 172/173 agents updated. 1 - is a mystical PC that fails everything.

Had the same setup and error (apart from0x435 at the end) but also cleared on a reboot

ReadUpgradeStatus: Upgrade of Agent from version '7.2.1266.0' to '8.0.1238.0' failed. Unexpected updater service Win32ExitCode 0x435

[Zen11t 6]

Any news about it? Will be fixed?

[Marcos 5,731]

So far all users have confirmed that despite the error agent is upgraded to v8. Yours remain at version 7 after getting the error?

[Zen11t 6]

Yes, the agent is upgraded to v8, but with a big upgrade (250+ client) I don't want to check every PC it was successfully or not.

[Marcos 5,731]

It's UpdaterService.exe from ESMC v7 which is affected. From what I understood, the file from ESET PROTECT is not affected so upgrade to any future version should work alright.

[MartinK 384]

Just to let you know, problem was indeed triggered by localized Windows operating system, i.e. operating systems where certain status messages provided by system itself contained non-ASCII characters.

Unfortunately problematic helper tool UpdaterService.exe is part of already installed version 7.2.1266.0 and therefore proper solution was not possible and upgrade from this specific version to any new version will report this kind of failure even when upgrade will be successfully. Also it has been confirmed that upgrade from version 8.0 is not affected, so there should be no such problem with future upgrades.