Experience on Updating the U-Series Appliance software (BI/PWS & AM)

I keep my appliances updated.

At first, I had a lot of issues where I ended up just deleting the appliance from AWS and creating a new one. This was easier than troubleshooting the root cause of the failures. By failures, I mean the appliance was unusable.

I saw problems where the appliance running Windows Server 2022, would not even allow a logon due to OS corruption. 

What I’ve learned is, you MUST follow the process in the document you mentioned above. Then, don’t get impatient. Let it finish because if you don’t, you will have problems.

Always do  1 appliance at a time starting with the admin appliance. You should have a setup where there is the admin appliance, then at least 2 appliances on a load balancer. Once the admin appliance is updated and back in service, remove 1 appliance from the load balancer and update it. Add it back to the load balancer and then remove the second appliance, update and restore full service.

If you are upgrading the BeyondInsight software, 25.2 to 25.3, etc. you will want to do this off hours because the upgrade will update a table in the database with the new version number when you do the admin appliance. this will create a lot of issues on the other appliances until they match the same version.

Unfortunately, I work in retail so the only time I can do this work is midnight to 4am pst since all our distribution centers are closed during that time. Keep that in mind when you do an upgrade. I also HIGHLY recommend you have all your critical accounts in a separate password safe. Keepass, a single appliance with SQL on it so you have a dev instance, whatever it takes, make SURE you don’t lose access to your btadmin account for each appliance, the website as well. The last thing you need is to be sitting at your desk at 2am staring at your monitor while wondering how you will ever get the upgrade finished when you can’t access the btadmin account.

Expect problems.

The last upgrade I did, it took 14 hours and a rebuild of both end user facing appliances. You will have problems, plan for it. If at all possible, test the upgrade on a dev system first. Only thing to think about with the dev instance is if you have 3 appliances in prod, dev should have 3 appliances as well because the active/active is what causes the most headaches. You can shut down two of the nodes in dev until you need to test an upgrade. Make sure you talk to BeyondTrust before spinning up appliances you don’t have a license for though. That 14 hour upgrade I mentioned, it took less than an hour in dev because I only have 1 appliance for dev.
I’m currently 1 version behind because I am gun shy about doing the upgrade after the 14 hour upgrade.

The KB is great and works flawless.

Just run through the KB in details before starting your task and ensure you have Backup done.

I typically Power off the UVM and take a full VM backup, a lot faster to return to that point compared to using the restore function if things fail, but I still do a regular backup.

Else I have not had any issues accomplishing this.