Upgrading the App Control Server

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps for upgrading the App Control Server installation.

Environment

• App Control Server: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

Important Version Specific Notes

• Before upgrading to version 8.11.0 or higher, prevent accidental lockout by verifying the Server License is not expired in Settings > System Configuration > Licensing
• The first upgrade to version 8.10.2 or higher may take longer than normal, and is expected.

Required Pre-upgrade Activities

• Verify the Server Upgrade Path is supported
• Verify SQL Server is on the latest Cumulative Update.
• Verify the OER for the version upgrading to: Tech Docs > Server > Server OER
• Verify the Rules Installer is version 1.30+
• Download the latest App Control Server installer.
• Take a new, known-good, full backup of the DAS database

Upgrade Steps

1. Log in to the App Control Server as the App Control Service Account.
2. If an Agent is installed on the application server it is recommended to temporarily:
   1. Disable Tamper Protection.
   2. Move the Agent to Local Approval.
   3. For other security software on the system make sure Server Exclusions are in place. 
3. Temporarily stop the services:
   • Carbon Black App Control Reporter
   • Carbon Black App Control Services
4. Make sure any external SQL backups or external SQL scheduled tasks running against the das database are temporarily disabled during the upgrade.
   • External SQL jobs against the das database could cause locks on the database, resulting in longer upgrades or failures.
5. Execute the ParityServerSetup.exe file to initiate the upgrade.
6. After the upgrade completes
   1. Validate the Carbon Black App Control Server and Reporter Services are started.
   2. If using SQL Server Always On Availability Groups, verify MultiSubnetFailover Configuration.
   3. Log in to the Console and verify Agents are beginning to show as Connected.

Note: Upgrading the App Control Server software does not upgrade the Agent or Rules Installers. This is done through a separate process.

Additional Information

• Some upgrades require a reclassification of rules.
  • This takes place automatically after an upgrade, the Console could be down for 5-30 minutes on average while this classification takes place.
• During the Server upgrade:
  • The Console will be unavailable.
  • Agents will continue to enforce based on the Disconnected Enforcement Level specified in the Policy.
  • By default, this is the same as the Connected Enforcement Level.
  • Event information is stored locally in the Agent's cache and reported to the Server once the connection is restored.
• Newer Server versions can communicate with older Agents, and Agents typically don't need to be upgraded at the same time.
• App Control Server Install logs can be found here.
• For more detailed instructions, please refer to Tech Docs > Server > Server Installation Guide
• How to Collect Logs for Server Upgrade Failures