Updating SES Evolution

CAUTION
Before upgrading SES Evolution to version 2.7.1, it is imperative that you first read the Migration Guide, and in particular the Prerequisites section.

To update the components of SES Evolution, obtain an Installation Center in the desired version from your MyStormshield client area, under the Downloads section and run it from a host on which a component of the solution has been installed. All components will be automatically updated.

Before updating, we recommend that you perform a full backup of your machines.

Our recommendation:

  • a complete snapshot for a virtual machine,

  • a disk image for a physical machine.

To apply the update:

  1. Log in to the machine using your domain account.
  2. Double-click on the SES_Evolution_Installation_Center.exe file.
  3. Click on Update an existing installation.
  4. Enter the address of the administration database instance and the login credentials of the super administrator account on the database.
  5. If the agent handler certificates expire within three months, they need to be renewed, and the Installation Center will inform you. Enter the Intermediate Certification Authority password for the agent handlers and click Next. After the update, you can check that the certificate has been renewed. For more information, see Renewing agent handler certificates.
  6. In the next window, the Installation Center automatically detects the components that need to be updated. Click on Start update.
  7. If the administration console requires an update, the Installation Center shows the list of users connected to the console, and the names of their workstations. A red banner appears on all open consoles, asking users to save their changes and quit the console. The update starts when all consoles are closed.
  8. If there are still consoles that remain open:
    1. Click on Force update to shut down the consoles remotely and proceed with the update. Use this option only if you are sure that there are no changes to be saved, for example if the console user is absent.
    2. Click on Cancel update if you prefer to postpone the update.

To update the agents, see the Updating agents section in the Administration guide.

If you have SES Evolution backoffice components or agents installed on operating systems that are not compatible with the solution, Stormshield strongly recommends updating all relevant servers and workstations before updating SES Evolution. For more information, see the Microsoft Documentation.

For a list of operating systems supported by SES Evolution, see the Product LifecycleSystem requirements for SES Evolution

Backend

You must update the SES Evolution backend server operating system to a compatible version.

Otherwise, if you absolutely must move the backend to another server with a supported operating system, you will need to uninstall and reinstall all SES Evolution backoffice components: backend, agent handler and administration console.

Administration console

If the operating system cannot be updated, you must uninstall the administration console from the obsolete operating system and reinstall it on a compatible system.

Agent handlers

If it is not possible to update the operating system, follow the procedure below to migrate to a new compatible server:

  1. Install a replacement version 2.5.x agent handler on a compatible operating system. For more information, see Adding a console, backend component or agent handler.

  2. In the Backoffice > Agent handlers menu of the administration console, check that the new agent handler is displayed.

  3. In the Environment > Agents > Settings > Agent handlers menu, change the Default agent handler group for each agent group with an obsolete agent handler. Replace it with the new agent handler installed in step 1 on a compatible operating system.

  4. Deploy this change to all agents via the Security > Deployment menu.

  5. In the interface of an obsolete agent, ensure that it has received the Latest policy update.

  6. Uninstall the agent handler for the server not compatible with SES Evolution. For more information, see Uninstalling SES Evolution.

    The agents are now connected to the new agent handler installed on a compatible operating system.

  7. Repeat these steps for all agent handlers installed on a non-compatible operating system.

  8. Update the SES Evolution backoffice to version 2.6 or higher. For more information, see Updating SES Evolution.

Agents

If you are unable to update the operating system of certain SES Evolution agents, follow the guidelines below:

  1. Update affected agents to the highest version 2.5.x to benefit from the latest patches and features.

  2. Move these agents to one or more dedicated agent groups whose target software version remains 2.5.x. For more information, see Creating agent groups.

The latest version 2.5.x will continue to protect workstations running obsolete systems with the compatible security policies.

CAUTION

If you keep SES Evolution agents on 32-bit operating systems, you must keep a 32-bit installer in a safe place. Otherwise, you will no longer be able to install this type of agent.