Looks like this is rolling out slowly across our org. Naming scheme appears to be {date}_{randomnumx5}_ax-agentupg.ps1

Our whitelisting software blocked most of it, as its unsigned powershell code being ran out of C:\Windows\Temp folder. Our security team had a field-day this morning tracking it as potential malware.

Not sure if this is normal behavior for all agent upgrades (we’re fairly new customers) but I would assume the upgrade would occur in its own amagent folder (one thats whitelisted already).

Posting this so some of our other community members have a heads up before their security department starts asking them questions

Sorry about that. This looks to be new with Agent 29. I’m talking with the engineering folks to get more details.

Is there any additional information you can share around ‘better and more secure agent’ and ‘improvements in overall functionality/reliability’? This seems like good information that (with some more details) I could share with our customers that hopefully addresses some of the issues we’ve reported over the last few months and emphasizes Automox’s commitment to releasing regular improvements - one of our reasons for switching from our legacy capability.

A couple points of feedback as well… could we get more advance notice of these upgrades? I had a customer reach out today that noticed duplicates getting created in their org, and the duplicates had 1.0-30. They didn’t realize an upgrade was happening as the chat from earlier this week didn’t appear to generate an email notification to them.

Also, if we have some customers uncomfortable with this auto-upgrade process at this time, can they opt-out their org? I have received concerns around this potentially happening during a major patch window and causing issues requiring significant effort to reschedule.

Hello Habrnero,


I can answer these questions for sure.

For the more secure: There is certain agent data that was stored as plain text on the endpoint that could be read in relation to the system information the agent uses. This is now encrypted so that information is not easily accessible.

For the reliability/Functionality: We have improved out notifications process for Mac users as well as reduced the chance for agents to show a status that they are not currently in in the Automox Dashboard (stuck commands). There are a few more (how the agent upgrades as an example) but these are the primary ones.

As for delaying the Auto-Upgrade, it depends on if they have already upgraded but we can verify that for sure. I would send in a ticket to Support@automox.com though as we don’t want to expose any personal information here.

Thanks, Brandon!

Their Org has already begun the upgrade and it isn’t an immediate conflict at this time. More of a forward-facing request that they’d like to turn off for future upgrades if that’s an option just in case it would overlap with a scheduled patching window, or if we need to make sure we catch the upcoming upgrade notifications and request an exclusion for their Org each individual time.

Hey @habrnero -

Chiming in here just to let you know that we generally batch update hosts across the platform when we release a new agent. We can always make sure to delay or ignore any sensitive hosts/orgs if that’s a better route. I don’t expect 31 to come for a few months, at least, but keep an eye out in our ‘Coming Soon’ posts.

Also, if you’d like to DM me specific orgs that should be avoided for auto-upgrades in the future, feel free!

Circling back on this one. Due to a technical issue with Agent 29, we could no longer run the update out of the amagent directory. As a workaround we chose c:\windows\temp until we could get the update issue directory solved. Unfortunately this wasn’t a best practice and triggered your security software. Hopefully we’ll get this fixed for Agent 31, but just in case it isn’t we’ll let you know so that you can either postpone the update, or get the ps script for the update whitelisted so that it doesn’t light up your secops team.

Hello, @Nic,


I requested delaying of the amagent auto-update till 1st week in January. After Jan 4th I saw the update had started kicking in. When reviewing agent version today I realized a few devices are stuck on version 1.0-29. Can I somehow initiate the agent update without uninstalling/installing the latest version?


I can’t seem to find an answer in https://intercom.help/automox/en/collections/1600168-automox-product-documentation#agent-installation


Thanks,


Jiri

Hey @Jiri_2019, The new agent should be installing automatically assuming the holds were released. Would you like to reach out via DM and let me know of the devices that are stuck? Were you able to look into the agent logs on those devices at all?

I’m happy to help.

Scott

Hey, @Scott_Schoenberger,


I looked at a log on one server (C:\ProgramData\amagent\execDir030557015) and found this info


“Agent service successfully stopped. Continuing…


Installer exited with return code 1618”

Error code 1618 from msi installer indicates that another msiexec process is already running on the machine most likely preventing the amagent update to complete. Let me review this again.

Could you please share with me some more info on how the amagent auto-update works and if there is an option to initiate the auto-update manually?

Thank you.

Jiri

Hey @Jiri_2019, There isn’t really a setting to auot-update manually, unfortunately. We do use an MSI to update the agent on Windows. So I think we would require the msiexec process to be available to auto-upgrade or even to update the agent manually. Do you have access to the machines?

Thanks @Scott_Schoenberger. I killed the msiexec process on a couple of devices and a few hours later amagent self-updated to version 30. I’ll do this on the remaining devices. All good, issue resolved. 👍