Agent Upgrade Fails Due to Presence Of Reg Keys From Previous Versions
search cancel

Agent Upgrade Fails Due to Presence Of Reg Keys From Previous Versions

book

Article ID: 286558

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

  • Upgrade Error returned to Console similar to:
    Agent upgrade: Failed executing Installer[C:\ProgramData\Bit9\Parity Agent\ParityHostAgent.msi] 
    Cmdline[/qN /i "C:\ProgramData\Bit9\Parity Agent\ParityHostAgent.msi" /l*v+ "\\?\globalroot\device\harddiskvolume3\programdata\bit9\parity agent\logs\ParityHostAgentInstall_TIMESTAMP.log"]. Fatal error during installation.
  • The ParityHostAgentInstall_TIMESTAMP.log logs the B9_UPGRADING_BLOCKED reason with the GUID:
    B9_UPGRADING_BLOCKED = {DA971CA3-73AA-4A57-AFB4-8155E72CEB96}
    

Environment

  • App Control Windows Agent: 8.7.x and higher
  • App Control Console: All Supported Versions

Cause

The upgrade is failing due to leftover registry keys from previous Agent versions.

When applications are installed, Windows Installer caches the required MSI files locally. These files are required for various future tasks associated with this application, such as upgrades. If the Installer Cache is cleaned up, or if SCCM does not persist the files on the endpoint, at the next upgrade not all registry keys (or sometimes files) will be removed properly.

Typically these files are cached using name randomization in C:\Windows\Installer\ (SCCM typically uses C:\Windows\ccmcache\).

Resolution

Step 1: Verify the Presence of Leftover Registry Keys

  1. Confirm the file version of the Agent that is installed via CMD: 
    "C:\Program Files (x86)\Bit9\Parity Agent\DasCLI.exe" status
    
    Example output:
    Version Information
        CLI:        8.7.8.787 6/17/2022 5:00:17 PM
        Agent:      8.7.8.787 6/17/2022 5:00:17 PM
        Kernel:     8.7.8.787 6/17/2022 5:00:17 PM
  2. Navigate to the following Registry Key, or run the following in CMD:
    reg query HKEY_CLASSES_ROOT\Installer\UpgradeCodes\BE699B28D1B16A04D9F1AA3A0C28A1C9
  3. The Registry Key should contain a single Package Code, matching the Agent version installed on the system. Example:
    • GOOD registry shows only the Package Code for the currently installed Agent 8.7.8: C56DE352F399D2544A140184D1CFDFA9
    • BAD registry shows multiple Package Codes for the current, and older, Agent versions.
  4. Note: If none of the Package Codes in this registry path match the current Agent version listed in "dascli status" then the Agent's registry has been corrupted
  • Although the Agent is otherwise fully operational, it will not be possible to upgrade until it has been cleaned up using the Agent Uninstall Tool only.
  • The actions in Step Two will not fix Agents in this state.


Step 2: Cleanup the Registry Keys

WARNING: Do not delete the Registry Keys for the currently installed Agent version, as this will corrupt it, and the Uninstall Tool will be required.

The relevant Registry Key locations to cleanup are as follows:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\<Relevant Package Code>
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\<Relevant Package Code>
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BE699B28D1B16A04D9F1AA3A0C28A1C9\<Relevant Package Code>
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-18\Installer\Features\<Relevant Package Code>
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-18\Installer\Products\<Relevant Package Code>
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-18\Installer\UpgradeCodes\BE699B28D1B16A04D9F1AA3A0C28A1C9\<Relevant Package Code>
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\<Relevant Package Code>
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\BE699B28D1B16A04D9F1AA3A0C28A1C9\<Relevant Package Code>
HKEY_CLASSES_ROOT\Installer\Features\<Relevant Package Code>
HKEY_CLASSES_ROOT\Installer\Products\<Relevant Package Code>
HKEY_CLASSES_ROOT\Installer\UpgradeCodes\BE699B28D1B16A04D9F1AA3A0C28A1C9\<Relevant Package Code>
HKEY_USERS\.DEFAULT\Software\Microsoft\Installer\Features\<Relevant Package Code>
HKEY_USERS\.DEFAULT\Software\Microsoft\Installer\Products\<Relevant Package Code>
HKEY_USERS\.DEFAULT\Software\Microsoft\Installer\UpgradeCodes\BE699B28D1B16A04D9F1AA3A0C28A1C9\<Relevant Package Code>
HKEY_USERS\S-1-5-18\Software\Microsoft\Installer\Features\<Relevant Package Code>
HKEY_USERS\S-1-5-18\Software\Microsoft\Installer\Products\<Relevant Package Code>
HKEY_USERS\S-1-5-18\Software\Microsoft\Installer\UpgradeCodes\BE699B28D1B16A04D9F1AA3A0C28A1C9\<Relevant Package Code>

 

A PowerShell script to assist in the automated cleanup of these registry entries is attached to this article. It will verify the current Agent version, and delete registry entries for any unrelated version.

Caution:

  • The script will delete registry entries and should be tested only on a small subset of machines first.
  • After downloading the file to the machine it may be required to: Right click the file > Properties > Unblock.
  • An Agent restart may be required after this completes before the upgrade will complete successfully.
  • The script is designed to create a CSV log entry of deleted entries on the desktop by default, this path is customizable by editing the script first in a text editor.
  • This is a workaround to the preventable, core issue of the installer file not being persisted on the endpoint.

Additional Information

  • If the Agent upgrade was forced through by temporarily disabling Tamper Protection on the endpoint a partial upgrade could occur that will require agent cleanup.
  • Please check to be sure the SCCM Package is properly configured to persist the files on the endpoint, as outlined in the Agent Installation Guide.
  • For more information about the SCCM Cache Folder and how to handle MSI installs please check the following external KB.
  • Alternatively, a batch script could be created to delete only specific registry entries for a specific Product Code. Example:
    REM For 8.8.0 - 8.8.2
    
    reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BE699B28D1B16A04D9F1AA3A0C28A1C9 /v 1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-18\Installer\Features\1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-18\Installer\Products\1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-18\Installer\UpgradeCodes\BE699B28D1B16A04D9F1AA3A0C28A1C9 /v 1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\BE699B28D1B16A04D9F1AA3A0C28A1C9 /v 1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_CLASSES_ROOT\Installer\Features\1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_CLASSES_ROOT\Installer\Products\1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_CLASSES_ROOT\Installer\UpgradeCodes\BE699B28D1B16A04D9F1AA3A0C28A1C9 /v 1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_USERS\.DEFAULT\Software\Microsoft\Installer\Features\1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_USERS\.DEFAULT\Software\Microsoft\Installer\Products\1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_USERS\.DEFAULT\Software\Microsoft\Installer\UpgradeCodes\BE699B28D1B16A04D9F1AA3A0C28A1C9 /v 1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_USERS\S-1-5-18\Software\Microsoft\Installer\Features\1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_USERS\S-1-5-18\Software\Microsoft\Installer\Products\1F341E9416B89A546A2CC701C68C3E52 /f &
    reg delete HKEY_USERS\S-1-5-18\Software\Microsoft\Installer\UpgradeCodes\BE699B28D1B16A04D9F1AA3A0C28A1C9 /v 1F341E9416B89A546A2CC701C68C3E52 /f &

Attachments

AgentRegClean.zip get_app