An In-Depth Review of the Silent Install/Upgrade Process for NetExtender

From what I was able to research on the Internet and through various forum posts and Sonicwall KBs, the general consensus is that NetExtender cannot be managed through a RMM (Remote Monitoring & Management), but instead must be manually upgraded or uninstalled, reboot the device, then reinstall with the latest version. After extensive testing, I've determined that this assumption is false. NetExtender can be managed via a RMM and updated silently. It just needs a bit more work.

My testing has shown that there are several issues with the NetExtender installers as currently packaged by Sonicwall, and these issues are what prevents the silent update process from working as expected. I have tickets opened with Sonicwall support and have talked with management about getting these installer issues fixed to make things easier in the future. The main take-a-way is that these issues can be worked around. The update process would be much easier with functional installers, but the workarounds aren't difficult, just annoying.

First, the issues. For the EXE version of NetExtender, NXSetupU, when installing the EXE normally, the installer first performs a silent uninstall of the existing version, then installs the update. When using the silent install switch "/S", the uninstall of the existing version never happens. Instead, the installer goes straight attempting an install over the top of the existing installation. Any files in use are skipped, and you are left with a mismatched version with both old and new files as part of the installation. The version listed in the programs list is updated to the latest version number although it's still technically at the old version. The solution to this is to have the install script silently uninstall the existing version first before performing a silent install of the new.

For the MSI version, it mostly works as is. Simply install the MSI as normal with the silent install switches and everything gets updated at the next reboot. Done. There is however still a small bug in the installer. It is unlikely that you will run into this, but it should be known. The MSI version includes a driver to support pre-logon VPN connections. If you perform an uninstall of the MSI, then install the MSI without performing a reboot in between, the driver installation part will throw an error and pop-up a dialog box despite the MSI being deployed silently. So, if you push this via a RMM that runs the script as system, the install will hang as the pop-up will not be displayed to anyone. Additionally, if you are able to interact with the dialog and click OK at the failure prompt, the MSI then exits and reports as successfully installed (exit code of 0) despite the driver failing to install properly. While this is a rather large failure of the MSI installer process, you are unlikely to encounter it under normal circumstances.

With that out of the way, I'll go through the outline of my update/deployment script with powershell code snippets here and there to assist. I would post the script here, but it is a 600 line script and far too long to post in its entirety.

Step 1 - Determine if the current install is EXE or MSI. I have a function that will build a list of the installed programs by parsing the uninstall registry keys. It's based of the code from a 2017 MCP Magazine post that was tweaked a bit to run better from a RMM. I simply look at the uninstall string for NetExtender and see if it is uninst.exe (EXE) or msiexec.exe (MSI) and go from there.

Step 2 - Get the current version of NetExtender and if an update is required. Currently, there is not a way to scrape the NetExtender download page to programmatically check for the latest version. The download page is protected by Cloudflare and the download page is not listed in the robots.txt file, so access is denied via powershell. At the moment, the current version need to be set manually. Here is a code snippet that builds the various download URLs based on the current version of the software.

$CurrentVersion="10.2.339"

function Get-NetExtenderLinks {
    param (
        [Parameter(Mandatory=$true, Position=0)]
        [version]
        $CurrentVersion
    )
    if ($currentVersion){
        # build the list of download links based on the latest version number.
        $DownloadLinks=[System.Collections.ArrayList]@()
        [void]$DownloadLinks.add("https://software.sonicwall.com/NetExtender/NetExtender-x64-$($currentVersion.Major).$($CurrentVersion.Minor).$($CurrentVersion.Build).msi")
        [void]$DownloadLinks.add("https://software.sonicwall.com/NetExtender/NetExtender-x86-$($currentVersion.Major).$($CurrentVersion.Minor).$($CurrentVersion.Build).msi")
        [void]$DownloadLinks.add("https://software.sonicwall.com/NetExtender/NXSetupU-x64-$($currentVersion.Major).$($CurrentVersion.Minor).$($CurrentVersion.Build).exe")
        [void]$DownloadLinks.add("https://software.sonicwall.com/NetExtender/NXSetupU-x86-$($currentVersion.Major).$($CurrentVersion.Minor).$($CurrentVersion.Build).exe")
        $DownloadLinks
    }
}


$DownloadLinks=Get-NetExtenderLinks $CurrentVersion

Step 3 - If the installed version is older than the current version, download the EXE or MSI that matches the bitness of the system.

Step 4 - Remove the previous version if EXE, then install the latest version silently (EXE or MSI). If no version is installed currently, the script deploys the MSI.

MSI - This sets it to use the pre-logon VPN driver and to install as a machine-wide installer.

msiexec.exe /i NetExtender-x64-10.2.339.msi /quiet /qn /norestart netlogon=true ALLUSERS=2

EXE - Uninstalls the existing version silently, then install the latest version silently. This mimics the process that occurs when executing the installer via the GUI interface.

uninst.exe /S
NXSetupU-x64-10.2.339.EXE /S

The device will most likely require a reboot to complete the installation, but that is the extent of it.