MID Server upgrade fails with "Unable to kill the process" / Exit value: 1 and rolls back to previous version Issue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } A Windows MID Server upgrade (auto or manual) fails to complete and rolls back to the previously installed version. The MID Server record shows status Upgrade Failed, and the upgrade history shows the most recent attempt as Pending or Failed at the "Deploy binary files" stage. Symptoms<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The MID's agent0.log.0 (under <install>\agent\logs\) contains the following error sequence: SEVERE: Unable to run taskkill command to kill the MID Server process: Unable to kill the process with id <PID> with error message: Process exited with an error: 1 (Exit value: 1) ... Upgrade Failed. MID is running using previous version Upgrade summary: UpgradeStatus=rollback_success Key indicators that distinguish this symptom from other MID upgrade failures UpgradeStatus=rollback_success — the rollback itself succeeded; the MID came back up on the old version.The fatal error occurs during the process-kill phase of the upgrade, before binary replacement.No Access is denied / FileNotFoundException on wrapper-windows-x86-64.exe — that is a different failure (see KB0827747).No package-mismatch or missing-package errors — that is a different failure (see KB2912618). Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } zurich-07-01-2025__patch1-hotfix1a-09-24-2025_10-14-2025_2100 Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } During an upgrade, the MID Server's upgrade worker must terminate the running MID Java process so the binaries on disk can be replaced. On Windows this is done with taskkill /F /T /PID <pid>. taskkill returns Exit value: 1 when it cannot terminate the target process. The most common root causes, in order of frequency: MID service account does not have sufficient privilege to terminate its own Java process. The Windows service Log On account (typically a domain user used by the snc_mid_* service) must be able to terminate its own processes. In locked-down environments this is sometimes denied by Group Policy.EDR / Anti-virus / Endpoint Protection is blocking process termination. Products such as Cisco AMP, CrowdStrike, SentinelOne, Carbon Black, and Microsoft Defender for Endpoint can apply process-protection rules that prevent taskkill from succeeding even when the caller has nominal permission.PID mismatch / timing issue. The upgrade worker recorded a PID that no longer represents the MID process. This is transient and typically resolves on retry.Insufficient ACLs on the MID agent folder (<install>\agent\). Even when the kill succeeds, the subsequent file replacement step may fail. This commonly co-occurs with cause #1 and produces the same overall "Upgrade Failed → rollback" outcome. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Step 1 — Verify the symptom in the MID log On the MID Server host, open the most recent log under: <install>\agent\logs\agent0.log.0 Search for Unable to kill the process with id and Exit value: 1. Confirm UpgradeStatus=rollback_success appears later in the same log block. If those strings are not present, this article does not apply — review KB0696937 (MID Server upgrade process) and identify the failing stage. Step 2 — Workaround (manual upgrade retry) Use this when you need to complete the upgrade immediately. The permanent fix in Step 3 must still be applied afterward to prevent recurrence. a. Identify the MID-owned Java PIDs. From an elevated cmd: wmic process where name="java.exe" get Name,ProcessId,ExecutablePath,CommandLine Look for entries whose ExecutablePath is under the MID's agent folder (e.g. <install>\agent\jre\bin\java.exe). Ignore any java.exe instances belonging to other applications. ⚠️ Important: Do NOT use taskkill /IM java.exe — this terminates every Java process on the host, including unrelated applications. Always target by PID. b. Stop the MID Windows service (service name format snc_mid_<midname> — check services.msc): net stop "<MID service name>" c. Terminate any MID Java processes that did not stop cleanly, one PID at a time: taskkill /F /T /PID <pid> If taskkill again returns Exit value: 1, the executing console does not have rights to kill the process — re-open cmd as an Administrator and retry, or proceed to Step 3. d. Start the MID service and let it auto-upgrade, or click Upgrade under Related Links on the MID Server record. e. After upgrade completes, confirm the MID Server record shows Status: Up and the Version field matches the instance version. Step 3 — Permanent fix (prevent recurrence) Apply all three of the following on the MID host before the next scheduled instance patch: Service account permissions. Grant the MID Windows service Log On account local Administrator on the MID host. This is required for the upgrade pipeline to terminate, replace, and restart its own binaries (see KB0696937). If domain policy prevents granting local Administrator, at minimum ensure the account has the Debug programs and Replace a process level token user rights.Agent folder ACLs. Grant the service account Modify (preferred: Full control) on the entire MID install folder, e.g. <install>\agent\ and all subfolders.EDR / Anti-virus exclusions. Add the MID Server install path to your endpoint protection product's exclusion list. At minimum exclude: <install>\agent\bin\wrapper-windows-x86-64.exe<install>\agent\jre\bin\java.exeA wildcard for the agent tree: <install>\agent\* For Cisco AMP specifically, the exclusion procedure is documented in KB0827747. For other EDR products, follow the vendor's process-protection / file-scan exclusion mechanism. Step 4 — Verify Trigger one more manual upgrade (or wait for the next auto-upgrade window) and confirm: No Unable to kill the process errors in agent0.log.0Upgrade history shows UpgradeStatus=upgrade_success (not rollback_success)MID Server record shows Status: Up with the target version Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } KB0696937 — MID Server upgrade process: What actually happens when a MID Server upgrades itself?KB0596459 — Troubleshoot MID Server upgrade issues (landing page)KB0827747 — MID Server upgrade fails leaving MID Server Down, due to Cisco AMP antivirus preventing the upgrade service deleting the Wrapper executableKB2912618 — MID Server Upgrade Fails and Rolls Back After Manual Upgrade (different symptom: package mismatch / rollback_failure)KB2964799 — MID Server – Error Message CatalogPRB1386094 — MID server upgrade failed when file is locked by other process