Windows Sensors 3.6.x and 3.7.x versions fail to upgrade via the Carbon Black Console with "SYSTEM_ERROR" failure

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Audit and Remediation
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Workload

Issue/Introduction

Windows Sensors 3.6.x and 3.7.x versions and older fail to upgrade to 4.0.x sensor version when scheduled via the Carbon Black Cloud upgrade job with "SYSTEM_ERROR" failure. The confer.log file has upgrade messages like:

<DATE> <TIME>:<THREAD>      INFO      CldApiSendSwUpgrade: starting download kit filename: C:\Program Files\Confer\confer-upgrade-setup.msi.tmp
<DATE> <TIME>: <THREAD>      INFO      CCurlWrapper::DiscoverConnectionInfo: Connection context attributes: Protocol[0x800 : TLS1.2] Cipher[AES_128] CipherStrength[128] Hash[SHA256] HashStrength[0] Exchange[ECDH_EPHEM] ExchangeStrength[256]
<DATE> <TIME>: <THREAD>      ERROR     CldApiSendSwUpgrade: error = 26: 
<DATE> <TIME>: <THREAD>      ERROR     SendCloudRequest: flag: CloudSwUpgrade: web server error, will not retry

Environment

• Carbon Black Cloud Console: Current Version
• Carbon Black Cloud Windows Sensor: 3.6.x and 3.7.x
• Microsoft Windows OS: Supported Versions

Cause

CldApiSendSwUpgrade: error = 26 is `SI_ERR_WEB_SERVER_ERROR_NO_RETRY` meaning the backend is telling the sensor not to retry. This appears to be an HTTP 405 network error and related to a failure to download the upgrade installer package. 3.8.2 Windows Sensor fixes this issue by moving to new sensor kit CDN update to a more reliable mechanism that has built in retries and feedback loop.

Resolution

Since 3.7.x and lower are End of Life sensor versions, Microsoft Windows endpoints should be manually upgraded to supported Windows Sensors.