The second step in the upgrade process is to upgrade the AppDefense Guest Module. You can upgrade both Windows and Linux virtual machine (VM) having guest module installed. You can upgrade the Linux VM same as Windows VM. If you have enabled AppDefense Service (SaaS), upgrade all the guest VMs within a service to the same version at the same time.

If you have subscribed to the AppDefense Service (SaaS), you can upgrade the guest module from the AppDefense Manager as well. For details, refer to Step 3: Upgrade Guest Module from SaaS for Windows.


A new upgrade bundle is available.


  1. Log in to the vSphere Client.
  2. Go to the guest VM (Windows or Linux) where you want to upgrade, and on the Summary tab, scroll down to the AppDefense panel. If necessary, expand the panel.
    Alternatively, you can also use the Configure > AppDefense > Security tab.

  3. Click Upgrade AppDefense.
    A confirmation dialog box appears.
  4. AppDefense driver is now divided into two parts, glxgi.sys driver which ensures Guest Integrity, and giappdef.sys driver which ensures guest monitoring for processes and network events. You can schedule the reboot to upgrade the guest integrity driver as per your convenience. Guest monitoring is enabled even without a reboot.
    • If you want to reboot the VM immediately after upgrade, select the check box under Advanced.
    • If you do want to reboot the VM immediately after upgrade, deselect the check box under Advanced.
    Note: Linux VM is not rebooted. If you select Windows VM to reboot during upgrade, reboot can take five minutes.
    • For VMware Tools earlier than 11.0.0: Mandatory reboot occurs after upgrade.
    • For VMware Tools version 11.0.0 or later: Optional reboot after upgrade.
  5. Click OK.
    A new task for the upgrade appears in the Recent Tasks pane. After the task is complete, the AppDefense Guest Module is upgraded and displays the latest version of guest integrity and guest monitoring drivers. After upgrade, giappdef.sys driver and the gisvc service which helps with In-Memory Process Forensics (IMPF), automatic upgrades, collecting process metadata, and so on, starts running, even without a reboot.
  6. If not done earlier, reboot the virtual machine as per your convenience.
    After rebooting the virtual machine, the guest integrity driver is upgraded to the latest version.


AppDefense Guest Module upgraded and displays the latest version.

You can verify the upgraded guest module driver versions. Go to VM > Summary > AppDefense widget. To verify upgraded version of the guest drivers, point to the version number.