Overview

Microsoft has released a Critical Update KB4078130 to disable mitigation against CVE-2017-5715.

MSNS18-01-4078130 / Q4078130 is a Critical Non-Security Patch that will disable the fix for variant 2 for stability issues.  You must reboot after installing the patch for it to apply on the system.

Additional Information

The Security Tool IVA18-001 ADV180002 will enable the fix again:Security Tool: Implement registry keys per Windows Server guidance to protect against speculative execution side-channel vulnerabilities

Affected Products

Ivanti Patch for Windows Servers 9.3

I have an offline deployment of Patch for Windows that I am managing.  Currently I have several clients that have Google Chrome installed (v69.0.3497.100) and P4W is saying that they are missing the 69.0.3497.92 update (bulletin CHROME-234), which is an older version than what is installed.  I've looked in the list of patches and it does not list v69.0.3497.100 anywhere (should be bulletin CHROME-235).  I've gone over to our online server and performed a Refresh Files to download the latest patch data, and this update still does not show up.  Since the .100 update came out a month ago, I am now wondering what other updates have not been added to the patch files.  Is there a way to force the availability of these updates without having to create a custom patch?

Hi. I got two questions about Ivanti Patch for windows servers. Patches - Push or pull - just to be clear.

1. Does IPM zip or compress the patches and send to the Servers/Distribution Points?
2. Does IPM push the patches to Servers/Distribution Points or does the Servers pull the patches?
3. Similarly, how does the mechanism works from Distribution Points to Servers?

/Mike

Purpose

The purpose of this document is to outline the issues surrounding FileZilla updates particularly related to the downloading of the patch files from the vendor.

Cause

Changes from the vendor, Filezilla, has caused downloads of the updates not from a Web browser to fail with an error 403 authentication error. From review, the cause is the lack of user token authentication as updates downloaded through Patch for Windows are done on behalf of a user or system account, not as the actual user. Additional findings have shown the direct download links to also reroute to the main Filezilla site versus downloading the actual installer.

Resolution

The current workaround to this issue can be found in this document: How To: Supply and Deploy Patches That Can Not Be Downloaded

Affected Product

Patch for Windows Servers 9.3

Symptom

STAgentUpdater.log

WinTrustVerifier.cpp:195 Certificate verification failed with error : -2146762748

Cause

The OS is unable to verify the digital signature. The specific error is -2146762748 which is a Mircosoft error that translates to "The subject is not trusted for the specified action"

Resolution

1) Update the Root Certificate on the client machine. You can update it manually or run a scan with Security Tools enabled against it. It's going to be MSRC-001 or MSRC-002.

2) It's possible the System Account (used to run the agent services) is having issues on the machine. You could attempt to run the agent services as a domain account as a test.

Updated:

3) it is also possible that computers were missing root CA cert VeriSign Universal Root Certification Authority. While Windows was attempting to connect to Microsoft Update to obtain this cert automatically during update install and failing. Allowing ctldl.windowsupdate.com through the firewall and network security appliances, the issue could also be corrected.

Hello everyone,

I am looking for a solution to automatically add new machines to a group.

Assuming that the new machines have no agent to install, I would like to add machines that are detected without agents during scans, in a particular group.

Do you have any idea? Maybe a script?

Thank you in advance !

Hi

When I'm running ITScript - Get date and time I only getting same time as my console!

Running Powershell on local console (sweden)
Current time at AAAA is 10/23/2018 10:52:17 AM

Running Powershell on remote server (Iran)

Local time (GMT+03:30) at \\BBBB is 10/23/2018 12:21:49 PM

(Yes it is a shift for summertime stillin sweden)

But when running ITScript - Get date and Time it gives me Local console time!!? Why?

BBBB1 0/23/2018 10:56:44 AM OU_IR -2- (Iran) UTC+3.5 10.99.1.13 Complete: 10/23/2018 10:56:41 AM

Best regard / Mike

Good morning ,

i'm new in your community,

i need help or advice to deploy a vbs file with shalik.

I did test in push to call but he vbs did not start.

Do you have a solution ?

Thank you for you help.

Best regards

I developed serveral powershell scripts to scan and deploy Windows patches.   Thus far the only very general information is being gathered.  Is there a method to report on the patches found missing and a listing of the deployed patches?

Example transaction script output:   What I can not seem to output is the listing of patches.   It seems I need to run a report for that information.

Scan Starting .........................

Name         : API - n.n.n.n

StartedOn    : 8/29/2018 2:58:46 PM

TemplateName : Dechert - Full Scan

Uid          : 938f3cee-720e-4705-a9b3-253939cba097

Name                 Elapsed    Ended On             Expected   Completed  Is

                     Time                            Machines   Machines   Complete

----                 ---------- --------             ---------- ---------- ----------

API - n.n.n.n   0:01:32    8/29/2018 11:00 AM   1          1          True

Name                 Installed  Missing    Missing SP Completed On         Error

                     Patches    Patches

----                 ---------- ---------- ---------- ------------         -----

xxxxxxxxxxx     542        35         0          8/29/2018 11:00 AM

Name                 Elapsed    Ended On             Expected   Completed  Is

                     Time                            Machines   Machines   Complete

----                 ---------- --------             ---------- ---------- ----------

API - n.n.n.n   0:01:32    8/29/2018 11:00 AM   1          1          True

Name                 Installed  Missing    Missing SP Completed On         Error

                     Patches    Patches

----                 ---------- ---------- ---------- ------------         -----

xxxxxxxxxx     542        35         0          8/29/2018 11:00 AM

ScanUID : 938f3cee-720e-4705-a9b3-253939cba097

Machines : 1

Update : 8/29/2018 3:00:23 PM

Complete: True

The scan took hh:mm to complete:  0:2

.

.

Scan Finished,

Deploy Starts  .........................

Deploy UID : 5ce68ec8-2639-4060-8125-369f0ef28080

Name                 Elapsed    Ended On             Expected   Completed  Is

                     Time                            Machines   Machines   Complete

----                 ---------- --------             ---------- ---------- ----------

Standard with Off... 0:40:54    8/29/2018 11:41 AM   1          1          True

Name                 Address         Overall State  Status                 Last Updated         Error Code

----                 -------         -------------  ------                 ------------         ----------

xxxxxxxxxx     n.n.n.n    Complete       Finished               8/29/2018 11:41 AM

Name                 Elapsed    Ended On             Expected   Completed  Is

                     Time                            Machines   Machines   Complete

----                 ---------- --------             ---------- ---------- ----------

Standard with Off... 0:40:54    8/29/2018 11:41 AM   1          1          True

Name                 Address         Overall State  Status                 Last Updated         Error Code

----                 -------         -------------  ------                 ------------         ----------

xxxxxxxxxx     n.n.n.n   Complete       Finished               8/29/2018 11:41 AM

The scan and deploy took hh:mm to complete:  0:43

I am now using vmware vRO to develop server deployment workflows.  Has anyone developed a method to integrate patch management with an orchestration product?

If I scan a machine that has Java 8 version 192 installed, it gets flagged as needing version 191 because 8.0.192.12 < 8.0.1910.12.

strfinfo javaw.exe returns "ProductVersion=8.0.1920.12"

but getvers javaw.exe returns "javaw.exe Version: 8,0,192,12"

Getvers is an old (2006) program; I don't know where I got it.  The point is, two programs here return 192 or 1920 which suggests the version info might be in more than one place in the file and the two places might not agree.

Ivanti Patch for Windows® Servers Standard 9.3.0 Build 4510

Definition version is 2.0.2.6245.

Purpose

The purpose of this article is to go over the issues that may arise when TLS 1.0 is disabled in the environment and how to get Shavlik Protect and Patch for Windows Servers to work with TLS 1.2.

Symptoms

Per PCI requirements, all SCHANNEL protocols are vulnerable, except for TLS 1.2. Organizations may already have a GPO in place to disable all the protocols, except for TLS 1.2 (namely SSLV2, SSLV3, TLS1.1, and TLS1.0). Issues that can arise when these channels are disabled include:

• Deployment Tracker gets stuck at Scheduled or Executing when deploying to target machines.
• Agent installation gets stuck at 50%
• Connection to Shavlik Protect SQL database cannot be established:

Attempting to recover from a broken connection in the database connection pool. Attempt: 1, connection state: Closed, error: System.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the login process. (provider: SSL Provider, error: 0 - No process is on the other end of the pipe.) ---> System.ComponentModel.Win32Exception (0x80004005): No process is on the other end of the pipe

• Commands to Shavlik Protect Agents are unsuccessful - Agents did not respond:

System.ServiceModel.CommunicationException: An error occurred while making the HTTP request to https://consolename.FQDN:3121/ST/Console/STS/ConsoleSTS. This could be due to the fact that the server certificate is not configured properly with HTTP.SYS in the HTTPS case. This could also be caused by a mismatch of the security binding between the client and the server. ---> System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. --->System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host

• Cannot download patches from vendors:

The underlying connection was closed: An unexpected error occurred on a receive. ---> System.ComponentModel.Win32Exception: The client and server cannot communicate, because they do not possess a common algorithm

Cause

No secure communication channel can be established, either because no form of TLS is enabled, or whatever is enabled is not properly configured.

Resolution

You must either enable TLS 1.0 or configure TLS 1.2 correctly using Enabling TLS 1.2 for Shavlik Protect and Ivanti Patch for Windows.

Affected Product(s)

Ivanti Patch for Windows Servers 9.3

Shavlik Protect 9.x

Purpose

This document will list common install return code errors from the vendor and possible solutions to the error.

Overview

Protect and Patch for Windows Servers (PWS) track patch deployment progress.  The View > Deployment Tracker (F9) will display the final status of the install attempt and display the return code from the vendor.

As an example return code 0 is success and return code 3010 is reboot required, but there are many other codes that can help troubleshoot patch install issues.

Downloads

• Adobe_Update_Errors.docx
• Error_codes_for_Office_update_packages.docx
• MsiExecErrorCodes.docx

Affected Product(s)

Shavlik Protect 9.x

Ivanti Patch for Windows Servers 9.3.x+

Purpose

This article provides information the affect a Patch Group can have on patch supersedence.

Description

Shavlik Protect filters out patches that have been superseded by later patches and shows only the latest applicable patch that is missing.

Resolution

• In some cases, our Content Team can workaround the issue in our data. For this reason, highly recommend all customers open a case with support:  Support Portal
  
• If the Content Team is unable to correct this, the workaround would be to remove the affected patches from the Patch Group.
  

Additional Information

For more information on patch supersedence, in Shavlik Protect, go to Help> Index> Search.  Search for:Determining Patch Replacements

Affected Product(s)

Shavlik Protect 9.x

Purpose

The purpose of this document is to instruct how to run a diagnostic patch scan when you are unable to perform a DPDTrace for a detection issue.

Overview

1. Go to Tools > Options > Logging in your console and set the Logging Levels to "All" and check the "Diagnostic patch scanning" checkbox.
   Note as the message below the Diagnostic option says, you should only turn this option on at the request of Support.

  2. Save your changes and select to restart the service now then close your console, then stop the Ivanti Patch for Windows Servers Console Service.

   3. Go to C:\ProgramData\LANDESK\Shavlik Protect\Logs and delete or move the contents of the directory.

   
  4. Restart the console service from step 2 and then open your console and scan the machine that Support has requested the diagnostic scan for using the scan template that Support specifies. For instance, if the problem patch on the machine is a security patch, you would use the security patch scan template.

   5. Save a screenshot of your scan results (similar to the screenshot above showing the machine name, definition date, scan template, Bulletin ID, and Qnumber of the patch having the issue).

   6. Go to Tools > Options > Logging and uncheck the Diagnostic Patch scanning checkbox and save your changes.

   7. Zip up the contents of the C:\ProgramData\LANDESK\Shavlik Protect\Logs folder.

   8. Send the zipped Logs folder from step 7 and the screenshot from step 5 to Support.

Additional Information

You will still need to obtain Registry Exports from the problem client machine to send to Support along with the Diagnostic Patch Scan or DPDTrace. You will find instructions for obtaining these Registry Exports here Batch File for Obtaining Registry Exports for Detection Related Issues

Affected Products

Ivanti Patch for Windows Servers 9.3

Purpose

This document contains instructions on how to add patches released between specifics dates to a Patch Group using PowerShell and the API feature.

Overview

Basic Instructions:

     1. Download AddPatchesToPatchGroupUsingDateRange.zip from this document. (download link)

     2. Extract the contents of the .zip file to a folder on the console server.

     3. Read Disclaimer.txt.

     4. Open PowerShell as an administrator.

     5. Change directory to the extracted location.

     6. Execute the following to get help. This will provide parameters and instructions on how to use the PowerShell script.

Get-Help .\AddPatchesToPatchGroupUsingDateRange.ps1 -full

Examples:

Add all patches released between two dates.

.\AddPatchesToPatchGroupUsingDateRange.ps1 "Test" "1/1/2018" "1/31/2018" "ServerName\SQLInstance" "MyDatabase"

Add all patches released within the last 30 days.

.\AddPatchesToPatchGroupUsingDateRange.ps1 "Test" ((Get-Date).AddDays(-30)) (Get-Date) "ServerName\SQLInstance" "MyDatabase"

Add security and non-security patches released within the last 30 days

.\AddPatchesToPatchGroupUsingDateRange.ps1 "Test" ((Get-Date).AddDays(-30)) (Get-Date) "ServerName\SQLInstance" "MyDatabase" "0, 1, 4"

Add .NET and Java patches released within the last 30 days

.\AddPatchesToPatchGroupUsingDateRange.ps1 "Test" ((Get-Date).AddDays(-30)) (Get-Date) "ServerName\SQLInstance" "MyDatabase" -productList ".net|Java"

Add all patches except .NET and Java released within the last 30 days

.\AddPatchesToPatchGroupUsingDateRange.ps1 "Test" ((Get-Date).AddDays(-30)) (Get-Date) "ServerName\SQLInstance" "MyDatabase" -productList ".net|Java" -excludeProductList

Additional Information

API Quick Start Guide

Affect Product

Ivanti Patch for Windows Servers

As titled. Does anybody knows if PFW will work for multiple machines with the same UUID? What's the patching logic like for such scenarios and what's the license count like? Thank you.

We have a test environment and a Production environment that are the same

We clone the production to the test and want to update this environment with the latest updates after that we need 3 weeks to test all the applications if it works then we need the same updates/patches for the production

we have to save the updates like a group or something because we need to install the same patches in de Production environment

We don't want to install new updates in de production environment because we haven't test the applications in it.

Is this possible with Ivanti?

Purpose

This document provides guidance to running a DPDTrace on servers with no internet connectivity or other issues preventing the download of WindowsPatchData.zip data file.  This file is need when using the 9.2 scan engine in the DPDTrace Tool.

Description

You attempt to run a DPDTrace following the instructions from this document:  DPDTrace Logging Tool Used For Patch Detection Issues

The DPDTrace fails to scan the target machine with this error in the ErrorA.txt file:  Could not download file (.\WindowsPatchData.zip) from URI 'http://xml.shavlik.com/data/WindowsPatchData.zip

Cause

The DPDTrace tool is unable to download the WindowsPatchData.zip file from the internet.  This could be caused by no internet connection, firewall, proxy or some other setting/device on your network/server.

Resolution

• Correct the internet connection issue.
• Manually down the WindowsPatchData.zip file from http://xml.shavlik.com/data/WindowsPatchData.zip(right-click save link as) then place the file in the DPDtrace\HF7B folder.

Additional Information

This issue may also be related toDPDTrace Tool Fails To Scan Target Machine With: Could not download file (.\hf7b.xml) from URI 'http://xml.shavlik.com/data/hf7b.xml

Affected Product(s)

DPDTrace Tool: DPDTrace command line logging tool used for patch detection issues

I am now using vmware vRO to develop server deployment workflows.  Has anyone developed a method to integrate patch management with an orchestration product?