Multiple Cortex XDR Agent Upgrades Failing with "The installer has timed out" Error

[Z.Zikri]

Hi team,

We are currently encountering a mass upgrade failure across multiple endpoints during both Auto Upgrade and Manual Server Upgrade attempts. While a single endpoint successfully upgraded using our standard profile and group configuration, the remaining endpoints consistently fail.

Issue Summary:

• Symptom: The upgrade tasks transition to a "Failed" status with the specific error message: "The installer has timed out."

• Scope: Multiple endpoints are affected within the same policy group, ruling out a general console or profile configuration issue.

• Suspected Root Cause: We suspect local MSI database corruption on the affected endpoints from previous installation cycles, causing the upgrade package to fail when attempting to stop services or verify the existing installation signature.

Next Steps & Planned Action: To resolve this efficiently across all affected endpoints, we intend to execute a clean wipe using Palo Alto's official cleaner tool followed by a fresh agent installation. We are currently coordinating with the accounts team to orchestrate this mass deployment via Microsoft Intune.

If anyone has successfully pushed a console-side workaround for this specific timeout loop without running a local cleaner script, please share your insights.

Thank you!

[susekar]

Hello @Z.Zikri ,

Greetings for the day.

Yes, there is a console-side workaround for mass upgrade failures caused by MSI database corruption or service timeout issues, provided the agents are running version 8.7 or higher.

1. Automatic Remediation via Support Exception (SUEX)
The most efficient option is to request a Support Exception from Palo Alto Networks Engineering to enable the Automatic CleanAndInstall feature.Once enabled, re-initiate the upgrade for the affected endpoints from the Action Center or All Endpoints page.

2. Manual Remediation via Live Terminal
For specific endpoints, you can use Live Terminal to run:

cytool clean_and_install -cs "{\"ExecutionMode\":2}"

3. Check Parallel Upgrade Limit
If the issue is related to upgrade timeouts, check the parallel upgrade limit under:

Settings → Configurations → General → Agent Configurations → Agent Upgrade

-The default limit is 500, and it can be increased up to 2000 if required.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar