How to Upgrade of CSP Agents with IPS Enabled

[Migration User]

I am testing prevention policies on windows servers and would like to upgrade the agent. I typically have the agent removed then installed fresh using sms or other script running remotely. SCSP Self Protection is disabled. It appears that if any protection policy is enforced, you can not remove the agent. I am not aware of a way to temporarily disable the policy via a script. Only interactively using sisipstray.exe.  Anyone know of a solution or work around?

error from uninstall log.

1: *** DetectProtectionPolicy() -> begin.
1: *** Testing for protection policy: SSS agent key exists and TestForPrevention does not.
1: *** Protection policy detected; aborting.
InstallShield 14:27:02: Setup aborted

[pete]

you can assign null policy till the upgrade. Once upgraded you can apply the required policy

[Migration User]

Disabling prevention enforcenment and reapplying the policy works the same way. I tested this and it works. I am looking for a solution to avoid having to disable prevention such as a custom pset that will give specific user the ability to remove the agent. This doesn't seem possible. I have tested this with a strict policy giving specific users/groups full rights and with the targeted prevention policy with Enable SCSP self protection disabled.

[pete]

if the strict policy is applied, it will be having settings of agent protection. Hence it will stop from upgrade.

[Migration User]

Hi Tim,

 

What Prevention policy are you working with (eaxt version) and what deployment method are u using (looks manual but may be tivoli ?).

 

I can suggest some source level changes on the policy to make it work as intended by your question. As you know me and Symc this wouldnt be supported by Symc which will likely be a game changer. But I am here to assist.

[Migration User]

Strict, shoot me an e-mail and we can discuss further.

[Migration User]

10-4