Upgrade MBMC for new AE Client

[tdhaslett]

I see that there is a new AE client (1.09.2.1134) available to push from the MBMC, but the MC is the same version as my current console with AE 1.08.2.1189, so when I attempt to run the MC install to get it to start pushing the new AE client, it tells me that it is the same version as the existing and will not install.

I have some questions related to this:

1. Is the proper way to get the new AE client in the console to uninstall my current 1.7.0.3208 MC and install the "new" 1.7.0.3208 MC that includes the 1.09.2.1334 AE client?
2. Where in the documentation does it explain how to upgrade the console? I could not find it.

[djacobson]

The MBAE package that the console pushes out gets updated when new console versions are released. Right now for console 1.7.0.3208, the highest MBAE installer is 1.08.2.1189.

To upgrade MBAE outside of that you would use the auto-upgrade MBAE option in your policy, which is what would normally get you to the latest, 1.09.2.1334.

You can also complete this by forcing it on those machines using the newer unmanaged MBAE installer (it'll still be console managed after installing), to do so, you can leverage one of the following options:

1. Using the MBAE Standalone MSI Installer to upgrade specific endpoints via Active Directory GPO.
   • Command to execute: “msiexec /i mbae-setup-1.xx.2.xxxx.msi /quiet”.
   • This has the benefit of only upgrading the MBAE agent without having to re-deploy the communications agent and MBAM agents.
      
2. Using the MBAE Standalone EXE Installer to upgrade specific endpoints
   • Manually: By running the MBAE EXE installer locally on the endpoint (i.e. double-click).
   • Remotely: By running the MBAE EXE installer silently over the network using command-line options and relying on existing deployment tools like SCCM, psexec, etc. (for ex “psexec \\targetcomputer -u DOMAIN\administrator -p mypassword -d\\FILESERVER\Installers\mbae-setup-1.xx.2.xxxx.exe /log /SP- /VERYSILENT /SUPPRESSMSGBOXES”).
     TIP: The command "psexec \\*" will execute the installer command on all workstations belonging to the Domain.

 

You can get a hold of the latest MBAE installer by grabbing a new package here:

https://downloads.malwarebytes.org/file/mbes_for_business

It'll be located in Unmanaged \ Windows \ mbae-setup-1.09.2.1334 in exe or msi. 

 

[djacobson]

Console upgrade instructions can be found on our KB portal:

https://support.malwarebytes.com/customer/portal/articles/1835539-?b_id=6520

[tdhaslett]

Awesome! A lot of great information in there! I don't recall seeing that Auto-Upgrade option before, but I now have it enabled on all of my policies.

Also great to know that I can use my deployment (PDQ) server to push the unmanaged AE client update and still have it be managed. Does that work for the AM client also? If I recall, it won't upgrade the Managed Client, correct?

Any chance those console upgrade instructions will be added the Admin manual?

Thanks Dyllon!

 

[djacobson]

It does not work this way for Anti-Malware or the Managed Client communicator, unfortunately. When there are updates for those portions of the agent software, they'll be paired with a console upgrade, and from there, available within the built-in push tool or the offline package creator for use with third party deployment, like your PDQ.

For including upgrade steps in the Admin guide, I'll bring that request to the technical writers and see if we can get that in there!

[AndyPP]

Overwrite mbae-setup.exe in .\PackageTemplate on server, to have the console deploy the latest version, and/or include it in export.

To use PDQ Deploy, exporting an MSI ensures they are preconfigured with address of server i.e. Anti-Malware managed can be deployed by PDQ.

[djacobson]

@AndyPP, that process does not work for upgrades, only new deployments. It is not reliable enough and so it is unsupported. Users can do this at their own risk as it has the potential to break the push utility.