Control the Workspace ONE Intelligent Hub Upgrade Process (Windows 10)

Have you wondered how to control the Workspace ONE hub upgrade process so that it rolls out in a manner that you decide? Well, you’re not alone. Many customers I talk to want to manage the rollout of the new version of the Hub in their environment in order to mitigate problems that may arise. They may also have change control processes they need to abide by or blackout windows where no changes are allowed to be made on clients.

We have a few different ways of handling Hub upgrades and you will need to follow one of these ways to ensure things go smoothly. You can’t just simply deploy the new version of the AirwatchAgent.msi (Hub) and install it over top of the existing Hub. This can result in broken enrollments or unexpected restarts of the machines. The Hub has gotten better over years of dealing with those sad paths, but it’s still best practice to upgrade the Hub with the proper method.

Auto Upgrade

This is the easiest and most widely used way of upgrading the Hub. I know you’re here to learn how to control the upgrade, but in case you change your mind the configuration for this is under All Settings > Devices & Users > Windows Desktop > Intelligent Hub Application. Be sure to check the Intelligent Hub Automatic Updates checkbox. Note that is on a per-OG basis so you can have some OGs with this turned on.

Manual Upgrade

It’s important to know actually how the Hub upgrade process works before we get into the real methods of deploying this at scale. If you look in C:\Program Files (x86)\Airwatch\AgentUI, you will see an executable called AW.WinPC.Updater.exe (It may also be located in C:\Program Files (x86)\Airwatch\AgentUI\Resources). This exe will look for an AirwatchAgent.msi file located in the C:\Program Files (x86)\Airwatch\AgentUI\Update folder and then take care of upgrading itself to that version. It will stop services, upgrade files, clean up old files, and keep enrollment intact throughout the process (very important!). So to do this manually, all you need to do is:

1. Copy a newer version of AirwatchAgent.msi to C:\Program Files (x86)\Airwatch\AgentUI\Update
   

2. Right-click and run C:\Program Files (x86)\Airwatch\AgentUI\AW.WinPC.Updater.exe as administrator. Note: If this is still located under the Resources folder, copy it out into the main AgentUI folder and then run it.

After a short while, your agent will be on the newer version. Remember to query for an applications sample on the device in order to refresh application inventory. With this info in mind, let’s move onto the next method of deploying this at scale.

Software Distribution

The next best way to control the Intelligent Hub upgrade process is to use Software Distribution (SFD). You get benefits like peer-to-peer, CDN, and reporting but the only caveat is that you can’t just upload the MSI as an app and install it over top. I wrote a script that can handle the copying of the AirwatchAgent to the Update folder and then calling the AW.WinPC.Updater.exe as described above.

Download the Hub

1. Grab the correct Hub version (AirwatchAgent.msi). There are a few ways to this:
   • Download it from https://getwsone.com. This will download the latest GA build of the Hub so make sure it matches your console version.
   • If you want to pick a different version, go to My.WorkspaceONE and click Login in the top right. This link should take you directly to the Intelligent Hub page.
   • Select Windows and the app version you need (i.e. 21.05). For console version select All.
   • Click on the Installs and Upgrades tab and download the Hub

Find the App GUID

Now we need to find the correct product GUID of the MSI so that SFD can correctly detect that the new version is fully installed. To do this, grab a test machine and follow the steps outlined in the Manually Steps outlined above. Or you can simply install the Hub on a clean VM without doing enrollment.

1. Once upgraded, launch an elevated PowerShell window.
2. Copy and paste this command. This will get the App GUID of the Hub version that is installed (the new upgraded version if you did the previous steps correctly)

(Get-ItemProperty HKLM:\Software\wow6432node\Microsoft\Windows\CurrentVersion\Uninstall\* | where-Object {$_.DisplayName -like "Workspace ONE Intelligent Hub*" }).PSChildname

3. Save this GUID – we’ll need it in a sec.

Create the Application

Now we can work on creating an application in Workspace ONE.

1. Download the HubUpgrade.ps1 script from here.
2. Put both it and the AirwatchAgent.msi file together in a folder by themselves.
3. Select both files, right-click and click Send to > Compressed (zipped) folder.

4. Go to Workspace ONE UEM and create a new application by going to Apps & Books > Applications > Native > Internal. Then Add > Application File.

6. Upload the zip file we just created. Once it’s done uploading click Continue. It should take you to the application configuration page.
7. Complete the Application configuration with these details:
8. Details Tab
   • Name: Workspace ONE Hub Upgrade
   • App Version: Enter your version. (I.e. 21.5.2.0)
   • Current UEM Version: Have this match the App Version.
   • Change Log: I recommend a format like: “created by bpeppin, June-29-2021”
     

6. Files Tab
   1. Uninstall Command: I recommend putting something like “n/a” because you don’t want the Hub uninstalling itself if assignments get removed.

7. Deployment Options
   1. When To Install Section (optional). I normally leave default.
   2. Install Context: Device
   3. Install Command: powershell -executionpolicy bypass -file .\HubUpgrade.ps1
   4. Admin Privelages: Yes
   5. Device Restart: Do Not Restart
   6. Retry Count, Retry Interval, Install Timeout: Leave default.
   7. When To Call Install Complete
      1. App Exists: Enter the GUID you gathered from earlier. It’s ok to include brackets.
         

8. Click Add and we are just about done. You can optionally add a logo if you’d like under the Images tab.
9. Click Save & Assign.
10. Under Distribution, create a name and fill out the details. I recommend adding a smaller Assignment Group to test and then adding more and more groups as you go.
    1. For the App Delivery method, I like to keep it set to On Demand while I test and then flip it to Auto once it’s working well.
11. Click Create, Save, and Publish.

Deploy to a Device

Now let’s deploy this to our test device.

1. Find the device in UEM and go to the Apps tab.
2. Select Workspace ONE Hub Upgrade and click Install

3. You may see a Toast message pop up on the device. If you want to remove this message and make it completely silent and edit the assignment. If you change the delivery method to Auto a new option will appear called Hide Notifications. Enable that to hide notifications.

4. After a minute or so, the Hub upgrade should complete.

5. If you refresh the Apps tab, you should see a green checkmark by the app we just installed. But if you look at the Workspace ONE Intelligent Hub Installer, which is the installed MSI as reported by application inventory, you’ll notice it is probably still on the older version. This won’t get updated until the next application sample completes. We can speed this up by clicking More Actions > Apps.

6. Once the sample comes back, it should reflect the updated version. Yay!

Conclusion

Deploying a new version of the Workspace ONE Intelligent Hub shouldn’t be a difficult process. While I still recommend going with the Auto Upgrade process as it’s is 100% automated, I understand the need to have more control. Now you know how to properly upgrade the Workspace ONE Hub on Windows 10 in a controlled and supported way. As your test groups pass validation, keep adding more and more assignment groups in increasing size until you get to 100%. Rinse and repeat with each UEM Console upgrade and you’re in business.