You are unable to update remotely via an Agent Product Update (APU) job the CCS 12.5 agent on a CCS Application server (with a manager installed) or a remote CCS Manager(s) that were upgraded to CCS v12.5.2 or CCS 12.6.x.
Both the CCS Application servers (with a manager installed) and/or the remote manager(s) are at 12.5.2 (v12.50.10200.1790) or 12.6.x (12.60.10000.1300), but the CCS agents still show CCS v12.5 (v12.50.10000.1250)
APU Job fails with error similar to the one below:
Failed to start the remote update process on agent.
Verifying signature of the package files... Done
Connecting to agent server on the agent... Stopping all jobs on the agent before beginning update operation...Done
Closing connection with the agent update server... Done
Opening connection with the agent... Done
Connecting to update server on the agent... Done
Checking if manager is installed on the agent... Done
Checking if agent is running any other updates... Done
Checking for free space on agent... Done
Stopping the update support service if it is running on the agent... Done
Attempt no. 1 : Upload and run the support service on the agent...
Attempt no. 2 : Upload and run the support service on the agent...
Attempt no. 3 : Upload and run the support service on the agent...
Failed to install updates on agent '<agent_name>'
Error uploading and running update program on agent '<agent_name>'
Error copying D:\Program Files (x86)\Symantec\CCS\Reporting and Analytics\DPS\AgentUpdate\PU\apu-12.50\windows\smime\esmupdat.exe to <agent_name>
error writing request to update server on <agent_name>
error writing data header to remote process
An established connection was aborted by the software in your host machine
Release : A CCS 12.5 or 12.5.1 Application server (with Manager) or a remote manager that was upgraded to 12.5.2 or 12.6.x
Component : Application Server and/or remote manager
The Agent Product Update uses a certificate to be able to update agents to a newer CCS version. If 12.5 and 12.5.1 CCS agents were not updated with the new certificate with HotFix 10128 before June 30, 2021, then the certificate for the APU job expired and it would no longer work to update that agent, and the agent would have to be updated manually.
The problem with Application server with a Manager installed, and remote manager is that the agent is installed by default when a manager is installed, so can only upgrade the agent on these servers using the APU as if you installed the agent using the agent-only install media, it can break some functionality on the CCS manager.
NOTE: As with any modifications to your Application Server and/or manager, it is recommended that you backup the Application Server and also the CCS databases (CSM_Db and CSM_Reports) at the same time before applying any modifications
Since your Application server + Manager are at 12.5.2, and the agent is at 12.5, you will need to perform the following extra step to get the new APU certificate:
On remote 12.5.2 managers with the 12.5 agents:
NOTE if you are at CCS 12.6: If your Application Server and/or remote managers are at CCS v12.6 and the agent is still at 12.5, you can manually install the Windows 12.6 agent directly to get the new APU certificate as this issue was fixed in the 12.6 version.