Unable to update SAE 3.5 to SAE 3.5 Patch 1 (3.5.0.724) in ePO 4.6

[ykang]

Hello everyone,

I need some help here, it appears that I am facing some issue in patching my company's system from SAE 3.5 Client to the Patch 1

When I tried to update it, it shows this error
Tried Product Deployment and Product Update but no use still

Although I know that there is a Hot fix right before the Patch 1 Update, is it needed since I am already going to patch to patch 1 anyway.?

My Environment is
ePO 4.6.

Windows 7 OS (32 bit system)

Service Pack 1

Hope someone can provide me with help thanks!

My ultimate aim is to patch all the way up to the latest patch 2, so I might need a fair bit of time here. Thanks!

[londonsec · Accepted solution]

We had the same issue where users were left running 3.5.0.573.

Contacted support and got a utility to "clean up" the SAE installs.

Ended up having to do the following:

1. Push the uninstall/remove of 3.5.0.573 (or at least try to)
2. Push the SAE cleanup utility with "install" option
3. Agent wakeup
4. Push the SAE cleanup utility with "remove" option
5. Push SAE 3.5.0.1204 (you could also do 1121)

For some machines that refused to remove/upgrade/install we had to force an agent install over the existing one and then perform the 5-step process again.  Doesn't make sense but that seemed to do the trick.

Hope this helps.

[ykang]

I tried to push the uninstall/remove of 3.5.0.573 using Product Deployment, but it seems like it did not work.

The status result shows that it has failed.

Sorry, as I am still quite new to this situation, is there any solution to get pass your first point?

This was the log that was displayed:

Thanks in advance.

[llamamecomoquie]

Hi,

Are you using an Update or Deployment task?

As far as I can see it looks a Deployment task. Whats happens? if you have already the SAE 3.5 you should deploy only patch 1 (with Update task selecting SAE patches) If you try to deploy the full Package SAe 3.5 patch 1 will fail.

Can you please confirm?

Best regards,

Jose Maria

[ykang]

I am using a deployment task.
But anyway, I contacted the McAfee Support, and the steps are somewhat similar to the answer by Dennis London...

Remove the SAE.. reinstall with the latest patch.
Anyway, many thanks for helping still!

[londonsec]

At this point you will need to skip step #1 in the above process.  You have to use the SAE Clean up utility.  I have attached it here in case you haven't received it from support yet.

Check this into ePO and then run it in this order:

• Deploy the utility using the "install" option
  • Most likely you'll see the results say it failed.  This is typical for most EEDK packages.
• Perform an agent wakeup call with full properties to see if SAE was actually removed.  If it was not then you'll need to deploy this same package again but with the "remove" option instead of install.  For some reason this works when the "install" option for the utility doesn't.

Once you have successfully removed all of your 3.5.0.573 installs, I recommend removing this version of SAE from your repository to avoid any accidental deployments in the future. 

Make sure you have and are using either the 3.5.0.1121 or 3.5.0.1204 versions.

Again, hope this helps.

[londonsec]

Another thing to note is that the Access Protection Policies will actually stop the SAE Cleanup Utility I posted above.

I found it worked if you set the policy on the impacted machine(s) to have Access Protection disabled and then run the client task for the utility.

In other words:

1. Apply a policy to disable the access protection only on the impacted machines.  I typically use a tag which is associated with a policy assignment rule.
2. Perform an agent wakeup so the machine gets and enforces the new policy
3. Select the machine and perform a "run client task now" to push the SAE Cleanup Utility.
4. Monitor the task and wait for the final response.  Remember that it will say it failed but that is normal with most EEDK packages unless they actually get signed and have the proper coding to send a completion response.
5. Perform another agent wakeup call and request full properties.  Your report, query or dashboard should now show that Site Advisor has been removed.
6. Remove the tag which disabled Access Protection so your machine can go back to being better secured

Hope this helps.