Source
r/SCCM•
MrsVague

Upgrade 7-zip to 18.05 in mixed environment.

Our enterprise has a mix of Windows 7, 8.1 and 10. Windows 7 is mixed x86 and x64. Win 7 and Win8 x64 has mixed 32bit and 64bit 7-zip. 7zip is mixed several versions with no consistency.

We want to bring everyone up to v18.05 because of a vulnerability in 18.03 and previous versions explained here: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10115

Installations were being done manually and during deployment with MDT.

Goals:

  • If device does not have 7-zip installed it will not get 7zip installed now

  • Be sure <v18.05 is uninstalled and v18.05 is installed.

  • If x64 OS has 32bit application it should be replaced with 64bit application

I've pushed out applications before but not with the 2nd and 3rd goals. I'm not sure how to uninstall all old versions without knowing which versions they could be, or uninstalling 32bit application on x64 OS and installing 64bit application.

Thanks for any input.

Posted May 4, 2018, 12:38 AM UTC

216
WhatLemons•

This seems like it would be easy enough to script. I would use PSAppDeploy Toolkit to script the upgrade to version 18.05. You can easily detect the OS version, 32-bit/64-bit etc with powershell scripting.

Create an application that detects all old versions of 7-Zip. A detection rule that looks for 7z.exe less than version 18.05 should work.

Create an application for 7-Zip 18.05. Use supersedence to upgrade devices that are detected as having older versions of 7-Zip installed.

Alternatively you could also create a device collection with a query that looks for whether or not 7-Zip is installed and deploy your script to that collection.

3
InvisibleTextArea•

This is exactly what I did here. The magic you need in PSADT is:

# Install correct version based on arch
	
Switch ($is64Bit)
{
    $True
	{
		Show-InstallationProgress "Installing $appName 64bit edition. Please wait..."
		Execute-MSI -Action 'Install' -Path '7z1805-x64.msi'
    }

	$False
    {
		Show-InstallationProgress "Installing $$appName 32bit edition. Please wait..."
		Execute-MSI -Action 'Install' -Path '7z1805.msi'
	}
}

This means you only need a single deployment regardless of OS or architecture.

The MSI seems to be removing the old installs ok on my machines but YMMV and you may need to clean up machines in the pre-install section.

2
-Slaw-•

I'm curious, did you write your own OS arch detection, or is $is64Bit built-in? Very new to PSADT, here, appreciate the script.

1
InvisibleTextArea•

It's built-in.

1
-Slaw-•

Going to use the help files to learn more, thank you.

1
pitcjd01•

Could just build one app in SCCM with 2 deployment types (one for 32-bit and one for 64-bit), then deploy to a collection populated by a query against add/remove programs with name like 7-zip and version less than 18.05.

2
sielinth•

I don't think that would work considering 7-Zip is stupid. if an x64 machine has the x86 version and you install the x64 version, you'll end up with both x86 and x64 (unless that's changed in the 18XX releases)

2
[deleted]•

[deleted]

1
red_rock•

Yeah, I would not trust SCCM to be able to handle "less then 18.05".

Just deploy to all computers with 7-zip.

1
jasonsandysMSFT Enterprise Mobility MVP (configmgrftw.com)•

Side comment here: I'm glad no mentioned to use this, so I'll just mention it in case you run across it on the web somewhere: don't use Win32_Product (aliased as "product" in wmic). It's evil and has side-effects.

2
senectus•

what side-effects?

1
marek1712•

High CPU usage because every Windows Installer product gets "repaired":

https://gregramsey.net/2012/02/20/win32_product-is-evil/

1
senectus•

oh great, just lovely thanks

1
marek1712•

You're welcome :)

1
Tig75•

Use your inventory to get all versions, write a simple uninstall wrapper (powershell/vbs) to uninstall any version found. Install correct version. Set you compliance based on the version that should be installed

1