Upgrading the App Control Server

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps for upgrading the App Control Server installation.

Environment

• App Control Server: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

WARNING: Before upgrading to version 8.11, check that your license has not expired on the System Configuration > Licensing page Failure to validate that the license is still active could result in a locked web console immediately after the upgrade

NOTE: The latest Cumulative Update for SQL Server must be installed before upgrading App Control Server. Please review the SQL Server Upgrade instructions.

1. Before proceeding with the steps below please be sure to first:
   • Verify the Server Upgrade Path is supported
   • Verify SQL Server is on the latest Cumulative Update.
   • Verify the OER for the version upgrading to: Tech Docs > Server > Server OER
   • Verify the Rules Installer is version 1.26+
   • Download the latest App Control Server installer.
   • The first upgrade to 8.10.2 (or higher) may take longer than normal and is expected.
2. Take a new, known-good, full backup of the DAS database
3. Log in to the App Control Server as the App Control Service Account.
4. If an Agent is installed on the application server it is recommended to temporarily:
   1. Temporarily disable Tamper Protection.
   2. Temporarily move the Agent to Local Approval.
   3. For other security software on the system make sure server exclusions are in place. 
5. Stop the services:
   • Carbon Black App Control Reporter
   • Carbon Black App Control Services
6. Make sure any external SQL backups or external SQL scheduled tasks running against the das database are temporarily disabled during the upgrade.
   • External SQL jobs against the das database could cause locks on the database, resulting in longer upgrades or failures.
7. Perform upgrade of the App Control Server software using ParityServerSetup.
8. Validate the Carbon Black App Control Server and Reporter Services are started
9. Log in to the Console and verify Agents are beginning to show as Connected.

Note: Upgrading the App Control Server software does not upgrade the Agent or Rules Installers. This is done through a separate process.

Additional Information

• Some upgrades require a reclassification of rules.
  • This takes place automatically after an upgrade, the Console could be down for 5-30 minutes on average while this classification takes place.
• During the Server upgrade:
  • The Console will be unavailable.
  • Agents will continue to enforce based on the Disconnected Enforcement Level specified in the Policy.
  • By default, this is the same as the Connected Enforcement Level.
  • Event information is stored locally in the Agent's cache and reported to the Server once the connection is restored.
• For upgrading the App Control Agents, please see the relevant user guide for the version installed.
• Because newer Server versions can communicate with older Agents, Agents typically don't need to be upgraded at the same time.
• App Control Server Install logs can be found here.
• For more detailed instructions, please refer to Tech Docs > Server > Server Installation Guide