Gateway Updates via Agent

Gateway Updates via Agent

avatar
Fabian-Neidl

Hey guys,

i just have a hypothetical question. when running our updates automatically via the agents, if said updates should fail.
talking about windows server btw, how is the gateway going to behave? or is this something that can vary from not working anymore to update simply does not get installed etc.

reason for the question is, we search the right time window to let the update run, without for example soft locking our emergency team out of access on 3:00 am.

maybe you guys have had some experiences in the past.


Best Regards,

Fabian

All Comments (1)

avatar
Stephan Haupt

Hi Fabian,

Thanks for the question. It makes sense to settle this before you choose an update window.

When an update is triggered through Devolutions Agent, the Agent first downloads the Devolutions Gateway installer and checks it (integrity and prerequisites). Only then does it run the MSI silently. That gives three possible outcomes if something goes wrong:

  1. The update fails before installation starts (no access to the Devolutions CDN, proxy or download problems, failed validation). Nothing on the Gateway is changed, and it keeps running on the current version.
  2. The installation itself fails. The Gateway installer runs the upgrade as a single Windows Installer transaction, so Windows rolls the system back to the previously installed version. Please still check that the Devolutions Gateway service is running afterwards.
  3. The installation succeeds, but the new version won’t start in your environment. This is the scenario that could actually lock people out. There is no automatic return to the previous version. Windows will try to restart the service (after 15 minutes, up to three times a day), but if the cause persists, the previous version has to be reinstalled manually.


Also keep in mind that even a successful update briefly restarts the Gateway service, so any sessions open through the Gateway at that moment will be disconnected.
Our recommendations:

  • Run updates in a window when someone who can step in is available, rather than completely unattended in the middle of the night.
  • If you run several Gateways (a farm), update them one after another rather than all at once, so one stays available.
  • Keep the installer for your current Gateway version on the server, so you can reinstall it quickly if needed.
  • Before the window, make sure the Gateway server has no pending reboot, can reach the Devolutions CDN and Microsoft’s certificate revocation endpoints, and that no GPO restricts PowerShell execution, since the installer depends on that.
  • Make sure your emergency team has a documented fallback access path that doesn’t depend on the Gateway.
  • In Devolutions Server, the Update version and Bulk update windows also let you defer updates and pin a specific version: https://docs.devolutions.net/resources/devolutions-agent


If you let us know your current Gateway, Agent and Devolutions Server versions, we can check whether anything specific applies to your setup.

Best regards,
Stephan