Technical Tip: Downgrading from 7.10.1 to earlier releases may stop the Reveal Agent

Summary:

Downgrading from 7.10.1 to earlier supported versions (7.6.4 - 7.10.0 inclusive) will result in the Reveal Agent failing to start.

Impact:

Users who have upgraded to 7.10.1 and subsequently need to downgrade may find the Reveal Agent no longer starts correctly. Events cannot be reported to the Reveal platform and policy engine actions will not be available.

Root Cause:

The 7.10.1 Reveal Agent contains a new version of the libusb library which the Windows Installer incorrectly identifies as being 'older' than the version contained in previous releases. As such, during a downgrade from this version the Windows Installer will remove this component. A log of the downgrade will show a line similar to this:

MSI (s) (60:00) [12:34:56:789]: Disallowing installation of component: {AF52467C-34A0-44E5-9AB7-94DD2F80BC76} since the same component with higher versioned key file exists.

As this component is critical to the running of the Reveal Agent, it will fail to start. The agent.log file will show exit status 3221225781:

Further information can be found in this blog article.

Workaround:

Re-installing the Reveal agent with the earlier target version and selecting the 'Repair' option when prompted will reinstall the missing component.

Solution:

A successful downgrade can be achieved be modifying the Windows Installer REINSTALLMODE setting to amus via the command line, for example:

msiexec /i "C:\Users\test\Desktop\agent_x64_release_signed 7.9.1.msi" /L*v "C:\Users\test\Desktop\downgrade.log" REINSTALLMODE=amus /norestart /qn

Users should not attempt to use the Reveal platform auto-update feature to downgrade, as this will not use the correct REINSTALLMODE settings.