Upgrading Tanium Clients

The following procedures describe how to upgrade the Tanium Client to a newer version on managed endpoints.

Best practices

Review the following best practices before upgrading Tanium Clients:

  • When possible, upgrade using Client Management as described in Upgrade Tanium Clients using Client Management, instead of using third-party software. In cases where third-party software is preferable or necessary, refer to the documentation for that software.
  • Upgrade without uninstalling and reinstalling Tanium Clients. If you uninstall clients, you lose any custom data that is associated with them.
  • Test the upgrade process in a lab environment that resembles the production environment as closely as possible. For example, use a lab environment that has similar Tanium Client versions, operating systems (OSs), and deployed Tanium module tools.
  • Deploy the upgrade in stages.
    • Start with non-essential endpoints.
    • Deploy the upgrade to one OS type at a time.
    • Deploy the upgrade in batches to prevent unforeseen issues from affecting too many endpoints simultaneously.
    • Consider organizing computer groups to help manage upgrade stages: see Tanium Console User Guide: Create a computer group.

Before you begin

  • Read the release notes for the target version of Tanium Client, as well as all earlier versions that were released since the currently installed version, to understand the enhancements, bug fixes, and known issues that those versions include.
  • If you deploy upgrades to endpoints that have a firewall enabled on macOS 10.14 (Mojave) or later, perform the steps under Manage pop-ups for Tanium Client upgrades.

Assess the impact of upgrading on your environment

To help plan the stages of the upgrade to minimize the impact on your environment, determine the scope of the upgrade and appropriate groups of endpoints to target:

  1. Ask the following question, where <target_client_version> is the version to which you are upgrading:

    Get Tanium Client Version from all machines with Tanium Client Version < <target_client_version>

    The question results indicate the number of endpoints that require upgrades.

  2. If you want to evaluate the impact on specific types of endpoints (such as critical servers), you can apply a drill-down question such as Operating System or Organizational Unit (see Tanium Console User Guide: Drill down into results).






Upgrade Tanium Clients using Client Management

Use client upgrades in Client Management to upgrade the Tanium Client on endpoints that have earlier versions installed. A client upgrade targets specific computer groups and upgrades any endpoints in those groups to the specified version as the endpoints become available. Create a one-time upgrade to upgrade clients within a specified window of time. Create an ongoing upgrade to keep clients upgraded to the latest version of the Tanium Client or to upgrade clients that are later added to the targeted group to a selected version.

By default, client upgrades of either type use recurring scheduled actions that have an expiration period of twenty minutes and re-issue time of every hour. This configuration allows even a one-time upgrade to upgrade endpoints that might not be online when deployment of the upgrade starts but that you expect to be online at some point during the window of time defined for the upgrade.

Manage versions of the Tanium Client available for upgrades

The Tanium Server Your Tanium Cloud instance must download and cache the installers for each version of the Tanium Client that you want to use in client upgrades. The serverTanium Cloud instance caches the latest version by default. When you synchronize the manifest and a new version is available, the serverthe Tanium Cloud instance automatically caches the new version, but it does not remove the previously cached version . You can manually cache other specific versions that you want to use in client upgrades.

Air-gapped environments: You must manually import a manifest and installation packages instead of caching versions from the online manifest.

  1. From the Main menu, go to Administration > Shared Services > Client Management.

  2. From the Client Management menu, click Client Versions.
  3. (Optional) To download the latest manifest for Tanium Client installers from content.tanium.com, click Synchronize Manifest.

    Air-gapped environments: Contact Tanium Support to obtain a ZIP file with the manifest and installation packages, and click Import Manifest to import the file.

  4. Beside each version that you want to cache for client upgrades, click Cache Packages .

    • To remove the cached packages for a version that is no longer needed and free up storage space, click Clear Package Cache beside that version. That version is not available for client upgrades until you cache it again. You cannot remove the cached packages for a version that is selected in an existing client upgrade.

    • Air-gapped environments: To delete an imported version, click Delete Version beside that version. That version is not available for client upgrades until you reimport it. You cannot delete a version that is selected in an existing client upgrade.

    To remove the cached packages for a version that is no longer needed and free up storage space, click Clear Package Cache beside that version. That version is not available for client upgrades until you cache it again.

Create a client upgrade

  1. From the Client Management menu, click Client Upgrades.
  2. Click Create Client Upgrade.
  3. Enter a Name for the client upgrade.
  4. (Optional) To deploy a version of the Tanium Client other than the latest, click Edit in the Content to deploy section, and then select the Client Version to deploy.

    Leave Auto-upgrade to latest version selected to deploy the latest version of the client. In an ongoing upgrade, this option also keeps targeted clients upgraded to the latest version as new versions become available.

  5. In the Endpoints to target section, click Computer Groups, and select the computer groups to be upgraded.
  6. Click Edit in the Deployment type and schedule section, and configure the following settings:

    • For Deployment Type, select Ongoing or One-Time.

      Use a one-time upgrade with an end time for an upgrade to a specific version so that it does not run indefinitely even after you upgrade all the Tanium Clients.

    • Select the Deployment Time Zone and configure the Start Time at which deployment of the upgrade will begin. For a one-time upgrade, configure the End Time at which deployment of the upgrade will end.

      If you are configuring a one-time upgrade, make sure that the Start Time and End Time define a period of time during which you expect each targeted endpoints to be online at some point. The upgrade window can span multiple days if necessary.

    • (Optional) Adjust the Distribute Over Time setting. This setting determines the period of time over which distribution of the upgrade action is randomized and helps balance resource use.

      Distribute the upgrade over time to prevent upgrades from occurring on all the targeted endpoints simultaneously.

  7. Click Preview to Continue and review the Version status of targeted endpoints.
  8. Click Deploy to create the upgrade. The action for the client upgrade is issued at the Start Time you configured.

    You can later edit an ongoing upgrade, or you can edit a one-time upgrade before the Start Time has passed.

Alternatively, you can create a deployment in Client Management that is configured to upgrade endpoints with an existing Tanium Client. For more information, see Deploying the Tanium Client using Client Management.

Upgrade Tanium Clients using a package

In cases where you want to upgrade the client on an individual endpoint or a small number or endpoints that do not comprise an entire computer group, you can target those endpoints and manually deploy actions that use the Client Management - Upgrade [Windows] and Client Management - Upgrade [Non-Windows] packages. For more information about deploying packages, see Tanium Console User Guide: Deploying actions.

  1. In Interact, target the endpoints on which you want to upgrade the Tanium Client. For example, ask a question that targets a specific operating system and a Tanium Client older than a certain version:
    Get Tanium Client Version from all machines with ( Is Windows contains true and Tanium Client Version < 7.4.7.1179 )
  2. In the results, drill down as necessary, and select the endpoints that you want to upgrade.
  3. Click Deploy Action.
  4. For the Deployment Package, select Client Management - Upgrade [Windows] or Client Management - Upgrade [Non-Windows], depending on the endpoints you are targeting.
  5. Select a Client Version to install.

  6. Click Show preview to continue.
  7. A results grid appears at the bottom of the page showing you the targeted endpoints for your action. If you are satisfied with the results, click Deploy Action.