Apply new version manually on the server

[mihnehtoox]

Currently when I give the command client install in console management on the server he is installing the version of anti-exploit 1.09.2.1291, I would like to apply version 1.09.2.1334.

I have already done the stop / start procedure in the server service and replace the file manually in the folder C: \ Program Files (x86) \ Malwarebytes Management Server \ PackageTemplate \ mbae-setup.exe but when I did this procedure the client install process only stays Not installing.

With previous versions I had already done this process manually and it worked, now I do not know if the version supports this.

Can you help me?

[Rsullinger]

Hello Mihnehtoox,

 

Unfortunately you are seeing an issue that occurs when swapping that specific 1334 package into the management console. So it is not recommenced you swap the package so you do not have deployment issues. You can instead use the automatic update feature that is found under the Policy> policy client is on> anti-exploit tab or you can deploy the 1334 build through any other package deployment as well. 

[mihnehtoox]

Okay, but the anti-exploit option is enabled for automatic updating within the policy and only some machines have taken the .1334 version and when I install it on new clients via console is installing the previous version .1291

[Rsullinger]

Hello Mihnehtoox,

 

For clients that are not upgrading using the automatic updater, we can look into that and see why it is not occurring. I would just need the logs from this link:

https://forums.malwarebytes.com/topic/191468-readme-first-posts-here-need-to-include-mbae-logs/

However, that is unfortunately correct.  The management server will push out .1291 and your clients will upgrade after they are installed. 

[mihnehtoox]

These logs would be from the server?
Because the server does not have the mbae folder in the programdata.
Follow the FRST log.

Addition.txt

FRST.txt

[Rsullinger]

Helo Mihnehtoox, 

 

I should have specified better on that. I do apologize. The mbae logs and FRST will need to come from a client machine having issues with the upgrade to 1334. The logs from the mbae folder will show me what is happening when it is trying to update. 

[mihnehtoox]

Follow the logs of one of the machines that does not update the automatic mbae.

Addition.txt

FRST.txt

Malwarebytes Anti-Exploit.rar

[Rsullinger]

Hello Mihnehtoox,

 

I am noticing something in the log that I want to have you confirm, on the endpoint itself, can you go into the anti-exploit client and see if the checkbox for automatic updates is enabled? I am not seeing it even attempt to go out which makes me think it may not even be receiving that setting. 

[mihnehtoox]

Well, at least in the customer policy that the machine is in automatic updating is enabled.

Here is the image of the requested client.

 

[Rsullinger]

Hey Mihnehtoox,

Can you confirm that these urls are allowed on the clients that are having this update issue:

 

data-cdn.mbamupdates.com
sirius.mwbsys.com

both on port 443

 

Any network firewall, proxy, or next gen firewall. If you confirmed that it is not being blocked, can you restart the service once on the machine and collect the C:\ProgramData\Malwarebytes anti-exploit directory again. 

 

[mihnehtoox]

How do I do this test besides pinging IP?

[Rsullinger]

Hello Mihnehtoox,

 

Pinging is fine if you can make those sites. As long as you don't have any network firewall that would block that as well on port 443, the one other thing you would want to check is see if anything (network firewall again) would block the downloading of .exe packages. It will download the .exe and run it on the machine. 

[mihnehtoox]

Problem solved, I managed to solve.

I did the uninstallation of the Management Server I got the endpoint 1.7.7.0000 I made the installation clean, after I stopped the server service and got the unmanaged version of the exploit 1.09.2.1334 and replaced the file mbae-setup.exe in C: \ Program Files (X86) \ Malwarebytes Management Server \ PackageTemplate and I logged in and did the test to see if it installed, test successfully but in this case I did not have my database.

Then I made a backup of the previous version of the management server, I got the folder C: \ Program Files (x86) \ Malwarebytes Management Server \ App_Data and replaced in the current path, it worked perfectly with the clients database and the mbae and mbam version updated Now usually installing via console.