CCS Agent Product Update (APU) failed updating the 12.5 agent on the 12.5.2 Application Server or remote manager.

Products

• Control Compliance Suite Standards Server
• Control Compliance Suite

Issue/Introduction

You are unable to update remotely via an Agent Product Update (APU) job the CCS 12.5 agent on a CCS Application server (with a manager installed) or a remote CCS Manager(s) that were upgraded to CCS v12.5.2 or CCS 12.6.x.

Both the CCS Application servers (with a manager installed) and/or the remote manager(s) are at 12.5.2 (v12.50.10200.1790) or 12.6.x (12.60.10000.1300), but the CCS agents still show CCS v12.5 (v12.50.10000.1250)

APU Job fails with error similar to the one below:

Failed to start the remote update process on agent.

Update Details:
Verifying signature of the package files... Done
Done
Connecting to agent server on the agent... Stopping all jobs on the agent before beginning update operation...Done
Closing connection with the agent update server... Done
Opening connection with the agent... Done
Connecting to update server on the agent... Done
Checking if manager is installed on the agent... Done
Checking if agent is running any other updates... Done
Checking for free space on agent... Done
Stopping the update support service if it is running on the agent... Done
Attempt no. 1 : Upload and run the support service on the agent...
Attempt no. 2 : Upload and run the support service on the agent...
Attempt no. 3 : Upload and run the support service on the agent...
Failed to install updates on agent '<agent_name>'
Error uploading and running update program on agent '<agent_name>'
Error copying D:\Program Files (x86)\Symantec\CCS\Reporting and Analytics\DPS\AgentUpdate\PU\apu-12.50\windows\smime\esmupdat.exe to <agent_name>
error writing request to update server on <agent_name>
error writing data header to remote process
An established connection was aborted by the software in your host machine

 

 

Environment

Release : A CCS 12.5 or 12.5.1 Application server (with Manager) or a remote manager that was upgraded to 12.5.2 or 12.6.x

Component : Application Server and/or remote manager

Cause

The Agent Product Update uses a certificate to be able to update agents to a newer CCS version.  If 12.5 and 12.5.1 CCS agents were not updated with the new certificate with HotFix 10128 before June 30, 2021, then the certificate for the APU job expired and it would no longer work to update that agent, and the agent would have to be updated manually.

The problem with Application server with a Manager installed, and remote manager is that the agent is installed by default when a manager is installed, so can only upgrade the agent on these servers using the APU as if you installed the agent using the agent-only install media, it can break some functionality on the CCS manager.

Resolution

NOTE: As with any modifications to your Application Server and/or manager, it is recommended that you backup the Application Server and also the CCS databases (CSM_Db and CSM_Reports) at the same time before applying any modifications

Since your Application server + Manager are at 12.5.2, and the agent is at 12.5, you will need to perform the following extra step to get the new APU certificate:

1. On the 12.5.2 Application Server, install (as the CCS Service account user) the 12.5.1+HF10128 agent-only install first so that the 12.5 agent is upgraded with the new APU certificate, and is updated correctly.
   •   The Windows 12.5.1+HF10128 agent-only install media is attached to this Knowledgebase article
2.  Once you update the agent on the Application Server to 12.5.1+HF10128 with the new APU certificate, then you can use the APU to update the agent to 12.5.2 as normal.

On remote 12.5.2 managers with the 12.5 agents:

1. On the remote 12.5.2 managers, first manually upgrade the 12.5 agent using the 12.5.1+HF10128 agent install (run install 'As Administrator), then you can run the APU to update the agent to 12.5.2.

 

NOTE if you are at CCS 12.6:  If your Application Server and/or remote managers are at CCS v12.6 and the agent is still at 12.5, you can manually install the Windows 12.6 agent directly to get the new APU certificate as this issue was fixed in the 12.6 version.