Varying AM and AE versions

[trevoralf]

We currently have around 170 clients running MB client 1.7, on console 1.7.0.3208.  We are seeing variations in the versions of AM and AE across the clients and can't work out why.

(I've currently got this logged with support but it's taking time to resolve with a single email back and forth every day, so I wondered if checking here might help me resolve it quicker).

With AM we're seeing a split between versions 1.80.2.1012 and 1.80.1.1011 of 60/40.

AE however is all over the place with the current version split:

1.09.2.1261  - 30%
1.08.2.2572 - 25%
1.08.2.2563 - 5%
1.08.2.1189 - 40%

Pushing a client install onto any client appears to revert them to back to the 1189 install and they don't seem to update from there (or at least the few i've tried it on in the last day or so haven't updated).  I've tried to set the policies to both internet updates and updates from the console but that doesn't seem to help and also doesn't explain why all the machines are different versions anyway.  I can see no patterns within the machines to explain why the versions are different across them all.

Any ideas would be much appreciated!

 

[trevoralf]

Problem traced to anti-virus on the firewall that was detecting the updates as false positives, matching them to a particular signature.  I've no idea why some machines updated anyway and some didn't though.

[djacobson]

Hi trevoralf, the console can only deploy the MBAE version contained within its particular package, from when that server install package was created. 1.08.2.1189 MBAE is what is "current" in the 1.7 console installer package when you do push installs but 1.09.2.1261 is our latest MBAE for over the air updating. Your MBAE versions will upgrade themselves if the autoupgrade Anti-Exploit setting is checked in your Policy \ Anti-Exploit options.

Make sure your network has the update URL whitelisted for this to happen:

https://data-cdn.mbamupdates.com

 

Clients still being on Anti-Malware 1.80.1.1011 means they were never pushed to (or the push failed) after upgrading the console. Any client out there with an old Managed client version and Anti-Malware version will need a new push install to upgrade, only Anti-Exploit can auto-upgrade. This new push will reinstall the bundled older version of Anti-Exploit included with the console at the time of its creation, until the over the air upgrade takes place to bring your MBAE back to the latest. You can also choose to only push the Anti-Malware side by leaving Anti-Exploit unchecked during your push, thereby eliminate the downgrade/wait-for-update scenario with the Anti-Exploit portion.

Management Console - 1.7.0.3208
Managed Client communicator - 1.7.0.3208 -> Must always match the console!
Anti-Malware - 1.80.2.1012
Anti-Exploit - 1.08.2.1189 -> autoupgrades to 1.09.2.1261 since 11/15/16

[trevoralf]

Hi Dyllon,

Thanks for the update - I think the AE issue is now explained by an over-cautios AV setting on our firewall.  

However, I'm not seeing what you have suggested with the AM.  I've got around 90 machines on 1.80.2.1012 and around 120 machines on 1.80.1.1011 (plus a few others on older versions).

Pushing the client back onto the 1.80.1.1011 machines isn't upgrading them to 1.80.2.1012 as your post suggests should happen.

[trevoralf]

I don't know why i bother sometimes  - I've just tried again on the same machines and now it has put the latest version on them. 

[djacobson]

Hey Trevor, sometimes they need a little time to check in and update their status. Some may need restarts as well. I'm glad it's going ok though and now they're checking in as the updated build. Keep me posted! I'll be here if you need help.

[trevoralf]

Hmm, I'm gradually being driven mad by this.  

I've picked 20 PC's that are on AM 1.80.1.1011.  My understanding from your previous posts are that they need to have the AM client re-pushed to them to get them up to 1.80.2.1012.  However, I pushed this about 6 hours ago to the 20 test machines and they are all still showing as 1.80.1.1011 - some have been restarted multiple times but are still showing the old version in the console, although if i physically walk to them and look the icon on screen says 1.80.2.1012.

Given that some of the machines have been restarted multiple times over the space of 6 hours and are still showing as the old version what else might be required to get them to show in the console?  I'm now in a position where i've no idea which machines are up to date or not.

I did completely uninstall MB from one of them, reboot and then reinstall and that shows as 1.80.2.1012 straight away but that's going to make upgrading all the machines take twice as long as i was expecting...or have i missed something and you do have to uninstall the old version before you out the new one on?   Then again, the machines themselves are showing the new version so maybe not....

 

[djacobson]

For a sanity check, are you looking at the version numbers in the Client Push Install tool or from the Client view?
 

[trevoralf]

Hi Dyllon,

Sorry for the delay in getting back to you.  The old version of AM appears on both the client view and the same version appears if i scan the machine in the Client Push Tool.  However, if i walk to the machines in question and look it shows the new version of AM.  The database version on the client view is updating and showing today's updates so it isn't that the client view isn't updating.

[djacobson]

Hey Trevor, the Client Push Install tool only shows historic data, no live data, by default. If you wish to get a more updated view, use the scan option "scan network and detect client software". That will refresh the data and give you a better view of what's out there in that feature.