Using SCCM to Install Malwarebytes version 1.9

[j_french]

Hi

We have updated the Malwarebytes Server and Malwarebytes management console. We generated the msi with all of the standard defaults for the client package.  When I ran the clientsetup.msi onto a machine that had Malwarebytes Managed Client v1.8 the installation installed another application the Malwarebytes Managed Client v1.9.  I was under the impression that this installation updated and replaced the existing client, so that there wouldn't be 2 versions of Malwarebytes Managed Client.  The machine now has both Malwarebytes Managed Client v1.9 and Malwarebytes Managed Client v1.8 installed. Is there an command line switch that we need to use so that when we use SCCM to silently deploy this msi, so that the installation just replaces the current version with the new version on the system? We would like to not have both Malwarebytes Managed Client v1.9 and Malwarebytes Managed Client v1.8 installed on the endpoints.  We would like to deploy the msi through an SCCM application to systems that have the version 1.8 running, and just replace that version with this new version.

 

Thank You

[j_french]

Hi
 

We updated our server and our management consoles to the newest version of Malwarebytes 1.9.  I generated an msi to update our endpoints from the server. I put a SCCM applcation together to install the Malwarebytes onto the endpoints.  However this msi doesn't replace the existing Malwarebytes 1.8 on the system, but instead installs an additional version 1.9 So, the systems have both 1.8 and 1.9 version.

I was just going to do the uninstall of the Malwarebytes 1.8 with the msiexe /x command, and then do the malwarebytes 1.9 msiexe /i command to install the newest version.  But I do that hte application doesn't seem to fully install.

It seems when the msi gets installed it isn't showing the "M" in the taskbar.  Also the C:\Program Files (x86)\Malwarebytes' Anti-Malware\ folder only contains mbabmext.dll file. The anti-ransomware and the anti-exploit seem to be installed successfully, but the anti-malware seems not to be fully installed.

What are the recommended steps of updating the endpoints to this newest version through SCCM methods (remote measures)?  Does the msi need to be copied locally?  Or can I in a script point to the msi on the network server?

 

Thanks :0)

 

[KDawg]

The expected behaviour would be for there to be only one Managed Client installed.

Please be careful though as there are two versions that start with 1.8 the older 1.8 Managed Client Version and our Current 1.80 Anti-Malware version. The 1.80 Anti-Malware is the latest and would be expected to be present in addition to the 1.9 Managed Client Version.

If we do see two Managed Clients on any endpoints we would want to run the following cleanup and reinstall:

https://support.malwarebytes.com/docs/DOC-2333

[j_french]

Kevin,

Our systems currently have: Malwarebytes Managed Client 1.8..0.3443. Installation: C:\Program Files x86\Malwarebytes Anti Malware 1.80.2.1012, Malwarebytes Anti Exploit 1.09.2.1291, Malwarebytes Managed Client 1.8.0.3443.

When I run the msi to upgrade the endpoint to version 1.9 I get: Malwarebytes' Managed Client 1.9.3671, Malwarebytes' Managed Client 1.8.0.3443, Malwarebytes Anti Exploit version 1.12.2.124; Malwarebytes Anti Ransomware 0.9.18.806-1.1.185 update package 1.1.185, Malwarebytes Anti Malware 1.80.2.1012.

If I uninstall Malwarebytes' Management Client by command in batch file msiexec /x {xxxx} and then do the installation msiexec /i  of the 1.9 version the Malwarebytes Managed Client is 1.9.3671; Malwarebytes Anti Exploit version 1.12.2.124; Malwarebytes Anti Ransomware 0.9.18.806-1.1.185 update package 1.1.185, but no anti malware. However no Malwarebytes Anti Malware is installed. The installation looks alright, expect that the endpoint has Malwarebytes' Managed Client 1.9.3671, and Malwarebytes' Managed Client 1.8.0.3443 showing in control panel program and features. 

Whats the recommended process of updating our endpoints with remote measures to the latest version 1.9? We have update the servers, management consoles, and generated the msi package that we can deploy with SCCM.

Do we need to do the cleanup utility first (no restart), and then the 1.9 installation?  Does the 1.9 contain all needed files, so that if I did do the cleanup utility first, and then the 1.9 installation that the endpoint would have all needed files?

Thank You!

 

[CoopR]

I am planning to update to 1.9 and would like to know if there is a recommended process. 

Any update?

Thanks,

 

[djacobson]

Hi @j_french, a short workaround can be to make a new installer package and not include the Anti-Malware portion. It has not changed and does not need to be installed in an upgrade. Additionally, if your endpoint's Anti-Exploit version exceeds what is bundled in the installer, it can be skipped as well.

The issue you are having has cropped up in the past with 3rd party deployment from time to time. When using 3rd party deployment the advice we gave back then, and the best way we found to avoid this, was to do an uninstall, restart, reinstall upgrade process. Though with what you are experiencing in your 1.9, we have had some trickling reports that this 1.8 and 1.9 double install can happen using the built-in push tool. We are looking at the install process but have not found the exact cause with this hiccup just yet.

If you have current examples of this, may I ask if you could post some of the logs from the upgrade attempts? Look in Windows temp, C:\Windows\Temp\MSIxxxxx.LOG, sort by date and look inside for them referring to "clientsetup.msi" (or if renamed, whatever that may be). Thanks!

[tmac4]

 I am seeing the same behavior after upgrading our server and console to version 1.9.0.3671.  Our test deployment of the new MB package is showing that those clients now have two version of Malwarebytes Managed Client installed,   V 1.7.3208 and V 1.9.3671.  I am attaching some of the upgrade attempts as suggested for your review.  please advise on the best course of action to get the new MB client deployed out.

Thank you. 

 

MSIfa0c6.LOG

MSI2b5d.LOG

MSI2999.LOG

MSIf9f11.LOG

[djacobson]

3 hours ago, tmac4 said:

Our test deployment of the new MB package is showing that those clients now have two version of Malwarebytes Managed Client installed,   V 1.7.3208 and V 1.9.3671.

 

How are you deploying this MSI?

[tmac4]

Yes, we are using an MSI files created from the Console.

[djacobson]

Sorry @tmac4, I mean how are you doing the deployment? Over the top of existing installs with the offline installers by 3rd party tools will not upgrade successfully. 3rd party deployment is best done with a remove and replace tactic.

[tmac4]

Sorry, we are using SCCM,  with the expectation that the MB managed client could be upgraded .  We were not wanting to go the route of remove and then replace route as it is more disruption for the end users.

Is there an operational issues with there being two MB managed client versions installed on the endpoints?

 

[djacobson]

Indeed there are. It will negatively effect communication, reporting, reported seat use against license count, and client submission to the database will have duplicated redundant info filling it up.

[BigA]

Hello,

just wondering if this issue has been resolved? I am experiencing the same thing. We are using SCCM to deploy out. 

[tmac4]

No resolution, other than uninstall, reboot and re-install.  We are wondering if it is worth the trouble to even continue at this point. 

[djacobson]

To reiterate, 3rd party deployment cannot upgrade an existing install. Only the MBMC client push tool can do that.