MID Server upgrades can be blocked by ThreatLocker antivirus, leaving the MID Server Up but in Upgrade Failed state - Known Error

MID Server upgrades can be blocked by ThreatLocker antivirus, leaving the MID Server Up but in Upgrade Failed state Description MID Server upgrades can be blocked by ThreatLocker antivirus, leaving the MID Server Up, but in Upgrade Failed state.

Customers need to be warned of this configuration ahead of time, and implement the recommended precautions/excludes (as is currently only done for Cisco AMP antivirus).

This leaves the MID Server on the wrong version compared to the instance, and that incompatibility has generally been known to break some features and cause data loss.

Steps to Reproduce

This started being seen for Zurich upgrades in April 2026. The Windows MID Server host has ThreatLocker antivirus installed.

The upgrade progresses to the point where the seperate upgrade process has started, and the MID Server Service shuts itself down. Then during the backup steps by the rollback code, the lib folder is able to be renamed lib_old, but then the app-itapp-mid.jar file cannot be copied from lib_old to lib. The upgrade aborts, and launches the MID Server service still on the previous version.

wrapper.log shows:

INFO: Successfully renamed the folder `E:\...\agent\lib_old` to `E:\...\agent\lib` Apr 10, 2026 6:28:26 PM com.snc.dist.mid_upgrade.UpgradeMain run SEVERE: Backup process failed with exception com.snc.dist.mid_upgrade.exceptions.BackupException: Backup process failed with exception at com.snc.dist.mid_upgrade.UpgradeMain.backupTheUpgradeFolders(UpgradeMain.java:673) at com.snc.dist.mid_upgrade.UpgradeMain.run(UpgradeMain.java:390) at java.base/java.lang.Thread.run(Thread.java:840) Caused by: com.snc.dist.mid_upgrade.exceptions.RetryOperationException: [ Copying files from E:\...\agent\lib_old to E:\...\agent\lib] failed after 5 attempts. Error: E:\...\agent\lib_old\app-itapp-mid.jar -> E:\...\agent\lib\app-itapp-mid.jar at com.snc.dist.mid_upgrade.UpgradeMain.withRetry(UpgradeMain.java:1763) at com.snc.dist.mid_upgrade.UpgradeMain.backupTheUpgradeFolders(UpgradeMain.java:657) ... 2 more Caused by: java.nio.file. AccessDeniedException : E:\...\agent\lib_old\app-itapp-mid.jar -> E:\...\agent\lib\app-itapp-mid.jar at java.base/sun.nio.fs.WindowsException.translateToIOException(WindowsException.java:89) at java.base/sun.nio.fs.WindowsException.rethrowAsIOException(WindowsException.java:103) at java.base/sun.nio.fs.WindowsFileCopy.copy(WindowsFileCopy.java:209) at java.base/sun.nio.fs.WindowsFileSystemProvider.copy(WindowsFileSystemProvider.java:284) at java.base/java.nio.file.Files.copy(Files.java:1305) at org.apache.commons.io.FileUtils.copyFile(FileUtils.java:850) at org.apache.commons.io.FileUtils.doCopyDirectory(FileUtils.java:1312) at org.apache.commons.io.FileUtils.copyDirectory(FileUtils.java:699) at org.apache.commons.io.FileUtils.copyDirectory(FileUtils.java:630) at org.apache.commons.io.FileUtils.copyDirectory(FileUtils.java:531) at org.apache.commons.io.FileUtils.copyDirectory(FileUtils.java:502) at com.snc.dist.mid_upgrade.UpgradeMain.lambda$backupTheUpgradeFolders$0(UpgradeMain.java:658) at com.snc.dist.mid_upgrade.UpgradeMain.withRetry(UpgradeMain.java:1755) ... 3 more

Apr 10, 2026 6:28:26 PM com.snc.dist.mid_upgrade.UpgradeMain run INFO: Exception occurred while taking the backup of the upgrade folders. Hence aborting the Upgrade process and restarting the MID using previous binaries Apr 10, 2026 6:28:26 PM com.snc.dist.mid_upgrade.UpgradeMain executeCommand INFO: Executing command `"E:\...\agent\start.bat"`. Working dir: `E:\...\agent`. Current user: `servicenow`. Apr 10, 2026 6:30:01 PM com.snc.dist.mid_upgrade.UpgradeMain executeCommand INFO: Execution result: ExitCode=0 Output=wrapperm | Unable to install the ServiceNow MID Server_xxx service - The specified service already exists. (0x431) wrapperm | Starting the ServiceNow MID Server_xxx service... wrapperm | Waiting to start... wrapperm | ServiceNow MID Server_xxx service started .

Workaround This is expected behavior and by design in all currently supported releases.

Even if pre-upgrade checks are added in the Upgrade code as part of a fix for this Problem, the root cause still needs solving by the customer.

ThreatLocker will need configuring to prevent it blocking files in the MID Server's agent folder, sub-folders, and files.