If you have contained hosts, exclude them from agent upgrades because the upgrade process will temporarily uncontain the endpoint. The upgrade process allows selected host sets to be excluded from an upgrade. See the Endpoint Security Agent (HX) Administration Guide for more information.