topic Re: Upgrading Endpoint clients using SCCM in Endpoint

Upgrading Endpoint clients using SCCM

Dan_Roddy — Thu, 14 Jun 2018 17:36:16 GMT

I need to upgrade our endpoint clients from E80.70 to E80.82 using SCCM and we are having problems with the uninstall of the old version.

Here is the syntax from the SCCM Install Behavior..Specify the command to uninstall this application:

msiexec /x {D4DE00A5-606C-414A-B712-8B85682C0E40} /qn UNINST_PASSWORD=********

Here is the command to install:

msiexec /i "EPS.msi" /q

Product code is: {D4DE00A5-606C-414A-B712-8B85682C0E40}

Note: We have no problems installing any version using the above install command via SCCM..

Thanks for any ideas!

Dan

Re: Upgrading Endpoint clients using SCCM

Steve_Lander — Thu, 14 Jun 2018 20:31:55 GMT

I have seen problems with certain endpoints not being able to uninstall, and we have worked with TAC to resolved but did not get anywhere. For us, if I encountered where if I uninstalled the endpoint, decrypted it, and did the final uninstallation, it would give me one of two errors; either the password was incorrect or it gave me an uninstallation error. In this case, we would have to rebuild the computers.

I am not sure if you can upgrade straight from E80.70 to E80.82 but its worth a try, though the ones that have problems upgrading will have the problem I just described.

Re: Upgrading Endpoint clients using SCCM

Dan_Roddy — Thu, 14 Jun 2018 20:49:07 GMT

Sorry, I should have identified the blades we have deployed. We have only 3: Anti-Bot, Forensics and Ransomware, Threat Emulation and Anti-Exploit.

So we don't have the encryption blade and I know for certain the password is good.

Thanks for your input Steve!

Re: Upgrading Endpoint clients using SCCM

Dan_Roddy — Thu, 14 Jun 2018 21:39:57 GMT

Does the uninstall string need quotes around the password, maybe?

msiexec /x {D4DE00A5-606C-414A-B712-8B85682C0E40} /qn UNINST_PASSWORD="********"

Re: Upgrading Endpoint clients using SCCM

Steve_Lander — Fri, 15 Jun 2018 12:09:04 GMT

We are pretty much using all the blades except capsule docs and VPN.

This is what I got from TAC when trying to uninstall.

For best results use the MSI that is stored in C:\ProgramData\CheckPoint\Endpoint Security
msiexec /x EPS.msi /l*v uninst.log UNINST_PASSWORD=<uninstall pass>

Re: Upgrading Endpoint clients using SCCM

Dan_Roddy — Wed, 20 Jun 2018 16:58:28 GMT

Thanks Steve, I'll give this a try.

Re: Upgrading Endpoint clients using SCCM

Dan_Roddy — Mon, 30 Jul 2018 18:53:27 GMT

Hi Steve, Is your endpoint environment Win10?

Re: Upgrading Endpoint clients using SCCM

Steve_Lander — Tue, 31 Jul 2018 12:01:36 GMT

We are on a mix of Windows 10 1703 and 1803. Things seem to work much better on 1803 though.

Re: Upgrading Endpoint clients using SCCM

Martijn_Tigchel — Thu, 30 Aug 2018 19:45:48 GMT

Couple of questions for you:

1) Considering that you are using SCCM, I assume you are running the processes with SYSTEM credentials on the PCs. Can you confirm?

2) What happens when you manually run the uninstall process with SYSTEM credentials on one of your systems? You can do this by using "psexec" from the SysInternals suite:

- open a command prompt using "Run as administrator"

- execute "psexec -s -d -i cmd.exe" to open a command prompt with SYSTEM credentials

- execute "whoami" to verify success

- execute "msiexec /x {D4DE00A5-606C-414A-B712-8B85682C0E40} /l*v uninstall.log"

You will have to manually type in the uninstall password for this session. The file "uninstall.log" will contain details of what is going on with the uninstall process. You will want to carefully examine the "uninstall.log" file. Especially the sections that start with "ISSetAllUsers" and "BlockWrongContext".

With regards to the INSTALL process you should also test this using the following command line, executed under SYSTEM credentials like SCCM would be doing (see above):

- execute "msiexec /i eps.msi /l*v install.log"

You will want to carefully review the file install.log. I will not be surprised for you to find out that the installer reverts to using a previous version of the "eps.msi" installer than the one you *think* it is using. This is because the UNINSTALL process is not always properly removing all registry keys of the previous installation and as a result the installer may revert to using the previous "install source" - which could be the version of "eps.msi" somehwere in your SCCM cache folders located in c:\Windows\ccmcache\xxx...

The installers are buggy. You need to double-check that the system is doing what you think it is doing...

Re: Upgrading Endpoint clients using SCCM

Dan_Roddy — Wed, 26 Sep 2018 20:53:53 GMT

Martijn,

Thanks for your feedback, I just found it now. I will verify and get back to you.

Best,

Dan