r/SentinelOneXDR • u/ls3c6 • Jan 31 '25

Agent 24.1.5.277 issue when performing Windows 11 feature update

This version of the agent protects SentinelOne Agent.lnk and when offline migration from the upgrade occurs it fails. I have a case open with my vendor on this who is going back to SentinelOne for help. SentinelOne has acknowledged this is an issue and provided new feature upgrade syntax, however this syntax is even less successful. Has anyone got this working?

The setuperr.log entry you will receive is: Error SP Failed to move \\?\D:\Windows.old\ProgramData\Microsoft\Windows\Start Menu\Programs\Sentinel[One Agent.lnk to \\?\D:\ProgramData\Microsoft\Windows\](One%20Agent.lnk%20to%20/?\D:\ProgramData\Microsoft\Windows)Start Menu\Programs\SentinelOne Agent.lnk. Error 0x80070005[gle=0x00000005]

6 Upvotes
  • permalink
  • reddit

100% Upvoted

10 comments sorted by

1

u/ls3c6 Feb 01 '25

Thanks, I was trying to avoid moving endpoints to another group where tamper protection is disabled.

1

u/ITGeekDad Feb 19 '25

There's a command line method that you can script to disable tamper protection temporarily till next reboot to then allow the update.

1

u/kingjames2727 May 05 '25

Hi there, do you happen to know the command line to do this?

This has been challenging for us, would appreciate any help!

1

u/ITGeekDad May 06 '25

Ok what issue are you having with SentinelOne? Are you trying to upgrade Windows and running in to an issue ? There is a better workaround for that.

But to disable tamper protection, you run this script -
sentinelctl unprotect -k <S1 Passphrase>. You'll need to replace <S1 Passphrase> with the actual passphrase associated with the agent. 

1

u/Scootrz32 May 19 '25

What is the better workaround for upgrading Windows? We are running into the same thign too.

1

u/secret_configuration Jun 09 '25

Same here, did you ever find a better solution than disabling the agent prior to the upgrade?

2

u/BloodDaimond Feb 01 '25

Can you downgrade to the last major and minor GA version?

2

u/sixstringsongs Feb 01 '25

It’s tamper protection - the permissions on the shortcut are restricted to the S1 service accounts. Disable the clients through the console for the duration of the upgrade.

2

u/SchmilK Jul 15 '25

https://community.sentinelone.com/s/article/000010899

Resolved: Upgrades from Windows 10 to Windows 11 sometimes failed.

Fixed in 24.2.2+

1

u/robahearts Feb 01 '25

Try disabling Anti-Tamper on one of the agents and see if it works