Upgrade Did Not Start After Download And Unapproved ParityHostAgent.msi Events

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Upgrade errors returned to Console similar to:

  Agent upgrade: Failed executing Installer[C:\ProgramData\Bit9\Parity Agent\ParityHostAgent.msi] Cmdline[/qN /i "C:\ProgramData\Bit9\Parity Agent\ParityHostAgent.msi" /l*v+ "\\?\globalroot\device\harddiskvolume4\programdata\bit9\parity agent\logs\ParityHostAgentInstall_TIMESTAMP.log"]. Upgrade did not start after download.

• Events with the SubType New unapproved file to computer similar to:

  Computer computer discovered new file c:\programdata\bit9\parity agent\parityhostagent.msi [HASH].
  
  Publisher[Carbon Black, Inc. (IneligibleForApproval: CounterChainIdx[1] CertId[528] ValidationError[01010040:CERT_TRUST_REVOCATION_STATUS_UNKNOWN:CERT_TRUST_IS_PARTIAL_CHAIN:CERT_TRUST_IS_OFFLINE_REVOCATION])]

• In some instances, air gapped or otherwise network limited machines, may also include references in the High Debug Trace.bt9 similar to

  b9GlobalStore::DoesCountersignerChainMeetApprovalRequirements: CertId[381] Publisher[DigiCert SHA256 RSA4096 Timestamp Responder 2025 1] is invalid ValidationError[01010040] Microsoft[False]
  
  b9GlobalStore::DoesSignatureMeetApprovalRequirements: Publisher[Carbon Black, Inc.] CertId[377] contains invalid countersigner Publisher[DigiCert SHA256 RSA4096 Timestamp Responder 2025 1] CertId[381] Valid[0] PublicKeySize[4096] Algorithm[sha256RSA]
  
  Event String[1811] Subtype[1300] Params[C:\ProgramData\Bit9\Parity Agent\ParityHostAgent.msi][Unsigned][] File[] Process[ (XXXX)] User[] CLVer[XXXX] RuleId[0] CalculatedTime[XXXX] State[00000008]
  
  SoftwareUpgrade: Not executing upgrade[C:\ProgramData\Bit9\Parity Agent\ParityHostAgent.msi], reason[Unsigned]

Environment

• App Control Agent: All Supported Versions
• App Control Console: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

The endpoint(s) were unable to communicate with the remote Certificate Authority to complete validation of the Counter Chain certificates.

Resolution

1. Log in to the Console and temporarily disable Agent Upgrades in System Configuration > Advanced Options.
   • Agents will not receive new Configlist entries with the changes while in the Upgrade Cycle.
2. Manually issue an approval of the Counter Chain Certificates to prevent the Unsigned errors.
3. In some instances, a File Rule may also be necessary 
   1. Get the SHA256 of the \Parity Server\hostpkg\ParityHostAgent.msi file from the application server hosting the Console. 
   2. Navigate to Rules > Software Rules > Files
   3. Click Add File Rule and use the following details:
      • Rule Name: Agent <VERSION> Upgrade
      • Rule Type: Approval
      • Hash Value: <HASH>
      • Policies: All Current and Future Policies
   4. Click Save & Exit
4. Wait for endpoints to receive the Configlist changes before enabling Agent Upgrades and attempting the upgrade again.

Additional Information

• This issue may be seen with "Postponed until system updates are completed" behavior as well.
• Troubleshooting Agent Install or Upgrade Issues