MID Server upgrade fails or MID Server is left in an inconsistent state due to Antivirus/EDR/Endpoint Protection softwareIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Endpoint protection software installed on a MID Server host, including antivirus, endpoint detection and response, and application-allowlisting or zero-trust tools, can interfere with a MID Server upgrade by scanning, locking, quarantining, or blocking files and processes that the upgrade needs to write or execute. This can cause the upgrade to fail partway through, leaving the MID Server in an inconsistent state. Symptoms that indicate this issue include:- The MID Server upgrade does not complete, and the MID Server record is stuck in Upgrading or Upgrade Failed state.- The upgrade or wrapper logs under the agent folder show errors such as file in use, access denied, or timeouts while replacing files. For Example: INFO: Successfully renamed the folder `E:\...\agent\lib_old` to `E:\...\agent\lib`Apr 10, 2026 6:28:26 PM com.snc.dist.mid_upgrade.UpgradeMain runSEVERE: Backup process failed with exceptioncom.snc.dist.mid_upgrade.exceptions.BackupException: Backup process failed with exception at com.snc.dist.mid_upgrade.UpgradeMain.backupTheUpgradeFolders(UpgradeMain.java:673) at com.snc.dist.mid_upgrade.UpgradeMain.run(UpgradeMain.java:390) at java.base/java.lang.Thread.run(Thread.java:840)Caused by: com.snc.dist.mid_upgrade.exceptions.RetryOperationException: [Copying files from E:\...\agent\lib_old to E:\...\agent\lib] failed after 5 attempts. Error: E:\...\agent\lib_old\app-itapp-mid.jar -> E:\...\agent\lib\app-itapp-mid.jar at com.snc.dist.mid_upgrade.UpgradeMain.withRetry(UpgradeMain.java:1763) at com.snc.dist.mid_upgrade.UpgradeMain.backupTheUpgradeFolders(UpgradeMain.java:657) ... 2 moreCaused by: java.nio.file.AccessDeniedException: E:\...\agent\lib_old\app-itapp-mid.jar -> E:\...\agent\lib\app-itapp-mid.jar at java.base/sun.nio.fs.WindowsException.translateToIOException(WindowsException.java:89) at java.base/sun.nio.fs.WindowsException.rethrowAsIOException(WindowsException.java:103) at java.base/sun.nio.fs.WindowsFileCopy.copy(WindowsFileCopy.java:209) at java.base/sun.nio.fs.WindowsFileSystemProvider.copy(WindowsFileSystemProvider.java:284) at java.base/java.nio.file.Files.copy(Files.java:1305) at org.apache.commons.io.FileUtils.copyFile(FileUtils.java:850) at org.apache.commons.io.FileUtils.doCopyDirectory(FileUtils.java:1312) at org.apache.commons.io.FileUtils.copyDirectory(FileUtils.java:699) at org.apache.commons.io.FileUtils.copyDirectory(FileUtils.java:630) at org.apache.commons.io.FileUtils.copyDirectory(FileUtils.java:531) at org.apache.commons.io.FileUtils.copyDirectory(FileUtils.java:502) at com.snc.dist.mid_upgrade.UpgradeMain.lambda$backupTheUpgradeFolders$0(UpgradeMain.java:658) at com.snc.dist.mid_upgrade.UpgradeMain.withRetry(UpgradeMain.java:1755) ... 3 more INFO: Exception occurred while taking the backup of the upgrade folders. Hence aborting the Upgrade process and restarting the MID using previous binaries In this example, the upgrade process was unable to copy app-itapp-mid.jar from the agent\lib_old folder to the agent\lib folder because of an AccessDeniedException. This is a typical sign that another process, such as antivirus or endpoint detection and response software, held a lock on the file at that moment, which caused the upgrade to abort and fall back to the previous binaries. - The problem is specific to certain hosts or intermittent, and correlates with hosts running antivirus or endpoint detection and response software. It resolves when that software is temporarily disabled or uninstalled.- This has previously been confirmed with Cisco Secure Endpoint, also known as Cisco AMP, documented in KB0867749, and with ThreatLocker. The same root cause can occur with any endpoint protection product. Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } All Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } During an upgrade, the MID Server replaces its own wrapper and Java runtime files and writes or extracts a large number of files under the agent installation folder, including a temporary folder used only during the upgrade. Endpoint protection software can respond to this activity in ways that break the upgrade:1. It can scan every file in real time as it is written, briefly locking each file so the upgrade process times out trying to replace it.2. It can quarantine or delete files that it flags as suspicious.3. It can block the wrapper or Java process from executing, writing files, or spawning child processes, under a default-deny or allowlisting policy. This is expected behavior of antivirus and endpoint detection and response software, not a defect in the MID Server. It occurs whenever the endpoint protection product has not been configured to trust the MID Server's own files and processes. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Work with your internal security or antivirus administration team to configure your antivirus, endpoint detection and response, or application-control product using the following generic pattern. The exact screens and terminology will differ by vendor and version. Use KB0867749, the Cisco AMP example, only as an illustration of this pattern, not as literal steps for other products. 1. Identify the MID Server installation path on the host. For example, on Windows this may be C:\ServiceNow\<mid_server_name>\, and on Linux this may be /opt/servicenow/mid/.... This path is referred to below as the MID Server installation directory.2. Exclude the MID Server folder from real-time or on-access scanning. Add a wildcard folder exclusion for the agent folder under the MID Server installation directory, for example <MID Server installation directory>\agent\* on Windows or <MID Server installation directory>/agent/* on Linux.3. Trust the core executables specifically. This is needed in addition to the folder exclusion for products that gate activity by process rather than only by folder: - The wrapper process, located at agent\bin\wrapper-windows-x86-64.exe on Windows or agent/bin/wrapper-linux-x86-64 on Linux. - The Java runtime, located at agent\jre\bin\java.exe on Windows or agent/jre/bin/java on Linux. - Mark these rules to apply to child or spawned processes as well, since the wrapper process spawns the Java process, which in turn spawns further worker processes.4. For default-deny or application-allowlisting products, such as ThreatLocker, Microsoft AppLocker, and similar zero-trust execution control tools, exclusions alone are usually not sufficient. You must explicitly allow the wrapper and Java executables listed above to run, to write files inside the agent folder, and to spawn child processes. Consult that product's documentation for application control, ring-fencing, or allow listing to determine how to add a path or publisher rule.5. Deploy or synchronize the updated policy to the MID Server host. Most products require an explicit policy push, and this may take time to propagate, so confirm the policy is active on the host before retrying the upgrade.6. Validate the configuration by confirming, through the product's local configuration file or administration console, that the new exclusion or allow rules are active. Then retry the MID Server upgrade. It is recommended to apply these exclusions or allow rules proactively, before the next MID Server upgrade, rather than reactively after a failure. This avoids leaving a MID Server in an inconsistent state that requires manual recovery. Because antivirus and endpoint detection and response vendors update their products independently of ServiceNow releases, periodically re-verify that these exclusions or allow rules are still present and honored after the antivirus product itself is upgraded. Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } KB0867749 — How to add Exclusion set for the MID Server in Cisco AMP to prevent MID Server upgrade fail. This article provides a worked example of the pattern described above for one specific product.