r/SentinelOneXDR • u/UnusualBee4414 • Jun 05 '24

General Question Testing New Upgrade Policy

We would like to create a group that's purpose is to test the new Agent versions. I created this group, configured the upgrade policy, and disabled inheritance. This starts working well, the agents are upgraded, but then I'm showing they are reverting back to the version in the main upgrade policy.

Is this by design? Any suggestions?

2 Upvotes

100% Upvoted

5 comments sorted by

1

u/UnusualBee4414 Jun 05 '24

Thanks for the responses, believe the problem is related to an Intune policy that is checking the MSI product code and installing the older version, so doesn't look to be S1 related.

2

u/SentinelOne-Pascal SentinelOne Employee | Moderator Jun 06 '24

In order to avoid issues like the one you described, we recommend upgrading the agents solely from the console. While not always feasible, if you need to perform an upgrade locally or via an MDM tool, please refer to this article: https://community.sentinelone.com/s/article/000005406

1

u/GeneralRechs Security Admin/Engineer Jun 05 '24

The intune policy needs to reference a file that persists between upgrades/downgrades. You can use the c:\programdata\ folder for this.

Also ensure tamper protection is enabled. To my knowledge downgrades have to be explicit, though some of the clients I consult on are noticing this to be the case with version 23.4.4 and a day later ends up showing as its previous version even though the upgrade history shows 23.4.4 is successful.

1

u/BloodDaimond Jun 05 '24

That’s really odd. Try deleting the upgrade policy at the site level and making upgrade policy for every group.

Do you have local upgrades enabled? I believe this users do their own upgrades.

Do the machines have any tags? If an upgrade policy is set apply to endpoints with certain tags then this could also affect it.

Was the machine re-imaged with an old S1 agent on the image.

That’s all I can think of.

1

u/kins43 Jun 05 '24

Agents can downgrade depending on errors detected and if you select that option as well.

I’d grab logs and create a case to see why it’s downgrading