Upgrade Privilege Management for Windows

Recommended Steps

  • Step 1: Upgrade Application Groups to Match Publisher Name BeyondTrust Corporation
  • Step 2: Upgrade the Privilege Management ePO Extension
  • Step 3: Upgrade Privilege Management Reporting (if in use)
  • Step 4: Upgrade Privilege Managementfor WindowsClients
  • Step 5: Delete Old Application Definitions (Upgrade from 5.4)

 

As of release 5.5, all releases of this product are signed with BeyondTrust Corporation, rather than Avecto, as the software publisher name. If prior to 5.5 you used the QuickStart Policy Template as a starting point, it is likely that your configuration includes Application Groups which target our own applications based on a publisher match to Avecto. An upgrade to 5.5 or beyond requires you to update your configuration so that it continues to match the versions of the applications and tools that you use. We recommend you add a copy of any existing application definitions that target Avecto and update those copies to target BeyondTrust Corporation instead; the presence of both sets of application definitions ensures they continue to match both new and existing versions during the implementation of 5.5. It is critical that you roll out your configuration changes before you update your Privilege Management for Windows software to version 5.5 or later.

Step 1: Upgrade Application Groups to Match Publisher Name BeyondTrust Corporation

This section applies to upgrades to Version 5.5.

  1. Locate all Avecto matches:
    • In the policy tree, navigate to Utilities > Application Search.
    • Type Avecto into the Search applications box to filter.

Performing an application search in the Policy Catalog

  1. Create a copy of all definitions in each Application Group found that contain a publisher match on Avecto:
    • Make a note of the name of the application definition which contains a publisher match on Avecto, and click on its Application Group name in Application Search. This takes you to the Application Group.
    • Select the application definition and click Duplicate.

Duplicate the application definition found in the Application Group.

Rename one of the copies to OLD, so it’s easy to tell which to delete after the new application definitions take effect. OLD can be deleted once the 5.5 upgrade is complete.

  1. Update the new application definitions to match publisher BeyondTrust Corporation.
  2. Test the updated configuration against the new 5.5 applications.

At this point, you can continue with upgrading the remaining components.

The product code for Privilege Management for Windows version 5 was updated from version 4. This means that the Privilege Management ePO Extension must be upgraded before the Privilege Management for Windows version 5 clients are installed.

ePO will not recognize Privilege Management for Windows if you upgrade the Privilege Management for Windows clients before the Privilege Management ePO extension. In addition, ePO Threat events will be rejected if this order is not followed, although they can be recovered once the upgrade to the Privilege Management ePO Extension has been completed.

Version 5 of the Privilege Management ePO Extension is compatible with older Privilege Management for Windows clients.

The recommended order to upgrade BeyondTrust Privilege Management for Windows software is:

  • Upgrade the Privilege Management ePO Extension
  • Upgrade Privilege Management Reporting (if in use)
  • Upgrade Privilege Management Clients

If you have a requirement to upgrade BeyondTrust software in a different order from that listed above, please contact your BeyondTrust representative.

Step 2: Upgrade the Privilege Management ePO Extension

When you are upgrading, the newer version of the Privilege Management ePO Extension recognizes the existing Privilege Management ePO Extension installation and prompts you to upgrade it. We recommend upgrading, as removing the installed Privilege Management ePO Extension deletes your settings.

To upgrade the Privilege Management ePO Extension, you need to use ePO to install the latest extension from Software > Extensions. When you upload the new Privilege Management ePO Extension, ePO prompts you that this newer version of the ePO Extension will replace the previous extension. Click OK to upgrade the Privilege Management ePO Extension. You do not need to restart ePO for the upgrade to take effect. Existing registered servers, client tasks, and server tasks are not affected.

Step 3: Upgrade Privilege Management Reporting (if in use)

To upgrade the Reporting database, you need to be on the server where the database is installed.

Please use the following process to upgrade the Privilege Management Reporting database and event parser:

  1. Stop the Trellix ePolicy Orchestrator Event Parser Service. Check that all events have finished being processed. Any events that are received after these tables are empty are queued on the ePO server until the service is restarted at the end of this process.

    Query the following tables first to check that they are empty:

    • dbo.Staging
    • dbo.Staging_ServiceStart
    • Stop
    • dbo.Staging_UserLogon

    Subsequently, query the following tables:

    • dbo.StagingTemp
    • dbo.StagingTemp_ServiceStart
    • dbo.StagingTemp_ServiceStop
    • dbo.StagingTemp_UserLogon

    Once the tables are all empty all remaining events have been processed.

  2. Disable the Copy from Staging task. The easiest way to do this is to use SQL Server Management Studio and navigate to Reporting database > Service Broker > Queues.
  3. Right-click on the PGScheduledJobQueue and click Disable Queue.
  4. Disable any of the ePO server tasks that rely on the Reporting database while you are upgrading it. For example, the Staging Server Task and Purge Server Task. These tasks will fail, as the database will be offline for a period of time.
  5. Open SQL Server Reporting Configuration Manager and connect to the database. Navigate to the Reporting link and use the dropdown to delete the top level folder.
  6. Run the Privilege Management for Windows database installer to upgrade the database. Ensure you point the installer to the existing database server and Privilege Management for Windows database name when prompted.
  7. Enable any server tasks that you previously disabled, as they rely on the Reporting database.
  8. Enable the Copy From Staging task. The easiest way to do this is to use SQL Server Management Server and navigate to Reporting database > Service Broker > Queues.
  9. Right-click on PGScheduledJobQueue and click Enable Queue.
  10. Start the Trellix ePolicy Orchestrator Event Parser Service service. Any incoming events can now be processed.
  11. You need to log off and on again to the ePO server to ensure the new database version is recognized. However, an ePO server restart is not required.

If you installed Reporting from version 5.4 or later, the default name for the database is BeyondTrustReporting. If you installed a previous version of Reporting, the default name is AvectoReporting (v5.1 - 5.3), or AvectoPrivilegeGuard for older versions. Alternatively, you may have chosen a different database name.

If you see an error message that states "Please stop CopyFromStaging from running before upgrading the database," make sure that no new events are being processed by querying the above tables and try again.

This upgrade path can be applied to both standalone Reporting configurations and to configurations spread over multiple machines.

Step 4: Upgrade Privilege Management for Windows Clients

You can upload a newer version of the Privilege Management for Windows client to ePO and deploy it as required.

Depending on the type of installation, a restart of the endpoint may be required. When installing in silent mode, a reboot occurs automatically.

The Privilege Management ePO Extension maintains backwards compatibility with the Privilege Management for Windows client. You can use a later version of the Privilege Management ePO Extension with an earlier version of the Privilege Management for Windows client. However, not all features in the Privilege Management ePO Extension are supported with earlier versions of the client.

For more information, please see the Privilege Management for Windows Administration Guide.

Step 5: Delete Old Application Definitions (Upgrade from 5.4)

Once all machines are running version 5.5, it is safe to delete the OLD application definitions created in Step 1 and to deploy that configuration.

Upgrade the Reporting Database Using SQL Scripts

Use these instructions to upgrade the Privilege Management Reporting database where you cannot use the installer or need to do a manual installation, for example, PMC in Azure. SQL scripts are provided to manage these upgrades.

To upgrade a Privilege Management Reporting database using SQL scripts:

  1. The SQL scripts are provided as part of the Reporting installers. Alternatively, you can contact BeyondTrust Technical Support for them.

There is a README file provided in this directory to assist you.

  1. Run the following SQL query to find the current version of the database. This returns the version of the database. 
    select * from DatabaseVersion

This SQL query works for Privilege Management Reporting databases 4.5 and later.

  1. Execute the upgrade script where the name is the next version number and carry on applying these until the desired version is reached.

If your current database version is 4.3.16 and you want to upgrade to version 5.0.0, execute the following scripts in order:
  1. Script_4.5.0_Updates.sql
  2. Script_5.0.0_Updates.sql

Please check the SQL log for any errors and contact BeyondTrust Technical Support if necessary.