I developed serveral powershell scripts to scan and deploy Windows patches.   Thus far the only very general information is being gathered.  Is there a method to report on the patches found missing and a listing of the deployed patches?

Example transaction script output:   What I can not seem to output is the listing of patches.   It seems I need to run a report for that information.

Scan Starting .........................

Name         : API - n.n.n.n

StartedOn    : 8/29/2018 2:58:46 PM

TemplateName : Dechert - Full Scan

Uid          : 938f3cee-720e-4705-a9b3-253939cba097

Name                 Elapsed    Ended On             Expected   Completed  Is

                     Time                            Machines   Machines   Complete

----                 ---------- --------             ---------- ---------- ----------

API - n.n.n.n   0:01:32    8/29/2018 11:00 AM   1          1          True

Name                 Installed  Missing    Missing SP Completed On         Error

                     Patches    Patches

----                 ---------- ---------- ---------- ------------         -----

xxxxxxxxxxx     542        35         0          8/29/2018 11:00 AM

Name                 Elapsed    Ended On             Expected   Completed  Is

                     Time                            Machines   Machines   Complete

----                 ---------- --------             ---------- ---------- ----------

API - n.n.n.n   0:01:32    8/29/2018 11:00 AM   1          1          True

Name                 Installed  Missing    Missing SP Completed On         Error

                     Patches    Patches

----                 ---------- ---------- ---------- ------------         -----

xxxxxxxxxx     542        35         0          8/29/2018 11:00 AM

ScanUID : 938f3cee-720e-4705-a9b3-253939cba097

Machines : 1

Update : 8/29/2018 3:00:23 PM

Complete: True

The scan took hh:mm to complete:  0:2

.

.

Scan Finished,

Deploy Starts  .........................

Deploy UID : 5ce68ec8-2639-4060-8125-369f0ef28080

Name                 Elapsed    Ended On             Expected   Completed  Is

                     Time                            Machines   Machines   Complete

----                 ---------- --------             ---------- ---------- ----------

Standard with Off... 0:40:54    8/29/2018 11:41 AM   1          1          True

Name                 Address         Overall State  Status                 Last Updated         Error Code

----                 -------         -------------  ------                 ------------         ----------

xxxxxxxxxx     n.n.n.n    Complete       Finished               8/29/2018 11:41 AM

Name                 Elapsed    Ended On             Expected   Completed  Is

                     Time                            Machines   Machines   Complete

----                 ---------- --------             ---------- ---------- ----------

Standard with Off... 0:40:54    8/29/2018 11:41 AM   1          1          True

Name                 Address         Overall State  Status                 Last Updated         Error Code

----                 -------         -------------  ------                 ------------         ----------

xxxxxxxxxx     n.n.n.n   Complete       Finished               8/29/2018 11:41 AM

The scan and deploy took hh:mm to complete:  0:43

Purpose

This document outlines how to scan and show only specific patches in the results, or how to scan and not include certain patches in the results in Ivanti Patch for Windows Servers..

Symptoms

While scanning, certain patches are offered that are not desired.

Adding Patches to a Patch Group

1. To scan or exclude specific patches, begin by assigning the desired patches to a Patch Group. Navigate to View > Patches.

2. Locate the specific patch by searching or filtering.

3. Right click on the patch, chooseAdd to Patch Group, then choosing New Patch Group.

4. The patch a has been added to the Patch Groups tab below the search window.

5. Next create a newPatch Scan Template.

Selecting to Include the patches in your patch group (specifically scan for)

1. In thePatch Scan Templatewindow, enter aNameandDescriptionto identify the scan template. UnderBaseline or Exceptions, select Baseline and check your Patch Group.
2. Scan using theScan Templatecreated. Results will only show those patches included in thePatch Group.

Selecting to Exclude the patches in your patch group

1. In thePatch Scan Templatewindow, enter aNameandDescriptionto identify the scan template. UnderBaseline or Exceptions, select Exceptions and check your Patch Group.

     2. Scan using theScan Templatecreated. Results willexcludethose patches in thePatch Group.

Related Articles

How To: Include or Exclude Specific Patches in Scan Results in Shavlik Protect

Additional Information

Important 9.2 Upgrade Information: Review Your Patch Scan Templates And Patch Groups

Affected Product

Ivanti Patch for Windows Servers 9.3.X

Can someone advise me how I can scan devices where windows 10 1709 was freshly installed.  by default smb1v is disabled which then blocks port 445.  I don't want to have to enable this feature as it's a security issue.

surely Ivanti are aware of this

I know it's still early days for Office 2019, but is there a timeframe as to when support for patches will be added to Ivanti Patch? It'll make it a lot easier rather than keeping a central repository up to date manually every month.

Thanks!

I have started to get failed deployments on some of my servers, all the patches fail with returned 42.

I have checked but cannot find this error code anywhere.

Hey guys,

I'm experiencing some problems with Ivanti patch management … Some random servers were stuck at "Scheduled" before.

So Server 2012 R2 clients will report back and in the end it will say "Finished". But Server 2008 R2 will be stuck at Scheduled unless I turn on TLS 1.0 server settings in registry.

That's what I did, and now Server 2008 R2 clients will report back how many patches were installed, but it will always stay stuck at "Deployment operation executing". It won't do rescan and then mark it as Finished, like with Server 2012 R2.

In log files I how this error in the end:

2018-11-06T10:35:15.4789443Z 0a24 E HttpDownload.cpp:1029 WinHttpSendRequest failed: 12007.

Can anyone tell me what that 12007 error means?

I also tried to uninstall scheduler and install it again with next patch that I pushed on server, and still same result.

Any advice/suggestion is appreciated.

Purpose

This documents details how to disable Automatic Updates in Windows 10 build 1709 through a GPO

Solution

Steps for single computer:

1. Click Start, and then click Run.

2. Type gpedit.msc, and then click OK.

3. Expand Computer Configuration.

4. Right-click Administrative Templates, and then click Add/Remove Templates.

5. Click Add, click Wuau.admin the Windows\Inf folder, and then click Open.

6. Click Close.

7. Under Computer Configuration, expand Administrative Templates, expand Windows Components, and then expand Windows Update.

8. To view the policy settings, double-click the Configure Automatic Updatespolicy.

9. To turn on Automatic Updates, click Enabled or to turn off select Disabled

Steps for multiple computers:

1. From the server, click the "Start" button and select "Programs" > "Administrative Tools" > "Active Directory Users and Computers."

2. Right-click the domain name whose settings you want to change and select "Properties." Select the "Group Policy" tab.

3. Highlight the domain policy you wish to modify, which will typically be the default group policy, and then click the "Edit" button.

4. The Group Policy Object Editor will now be open. In the left window, navigate to "Computer Configuration" > "Administrative Templates" > "Windows Components" > "Windows Update."

5. In the main frame, double-click the option "Configure Automatic Updates."

6. Select "Disabled" to turn off automatic updates.

Affected Products

Windows 10 Build 1709

We are using Ivanti 9.3 version for our patch management, and I need to uninstall scheduler on about 200 machines.

Do I really have to do it one by one? When I select more servers, option for "View Schedules Tasks" is grayed out.

I do hope there is some way to uninstall Scheduler for all of those 200 servers at once ...

Is there any possibility to make it visible to the user that there are updates that need to be installed?

And is it possible to make this installation visible to the user so he knows how long the installation will take?

Thanks in advance for all input to this topic!

Disclaimer

Please read this disclaimer before using this tool:  LANDESK Share IT Disclaimer

Description

We created a GUI tool to simplify diagnostic scanning to troubleshoot patch scan issues.

The DPDTrace GUI interface requires .Net 2.0 or greater to work.

How to use the DPDTrace GUI

1. Download the latest version of the DPDTrace GUI. Download Link
2. Extract the DPDTrace.zip to the desktop of the machine you will scan from.  This can be on a server remote to the target machine or on the target machine itself.  Support may specify where to scan from depending on the issue being diagnosed.
3. Open the DPDTrace GUI by double-clicking DPDTraceGUI.exe from the extracted folder.

     4. Choose Local to scan the local machine. The IP address or the Machine Name of the local machine will automatically populate.

     5. Choose Remote to scan a remote machine. You will need to provide a valid Machine Name or IP Address to scan.

     6. Enter a username with administrator access to the target machine.

          a. The format must be DomainName\UserName or MachineName\UserName depending on how you are authenticating to the target machine.

     7. Enter a valid Password. You can choose to un-check the Hide option if you wish to see your password for troubleshooting purposes.

Protect Version: (Protect Customers)

     8. Choose the Protect scan engine version to be used during the scan.

          a. The GUI defaults to 9.2.5112 and 9.3.4510, it is OK to leave the default selection and often a good idea since it provides cross engine version data..

OEM Version: (OEM partners)

     9. Choose the OEM scan engine version to be used during the scan.

Patch Type:

     10. Choose Patch Type to be used during the scan.

          a. We highly suggest leaving the defaults of Security Patches and Non-Security Patches selected unless a support tech requests a change.

     11. Click Run to start the scan.

     12. You will see Command Prompt popups and popups for the Rename HF.Log utility during the scan process.  Do not close either these.

     13. All popup windows will close and a new popup will occur once the scan is complete.  Click OK.

     14. The scan diagnostic is complete and all of the trace logs, scan outputs and registry exports have been zipped to this folder:  C:\Users\UserName\Desktop\DPDTrace\SendToSupport

          a. The zip file will be named HFCLi_YearMonthDay.zip

     15. Provide this zip files to support!  If you have any issues attaching this zip to the case, please let the support tech know so they can provide you with more options.

Additional Information

A command line DPDTrace tool can be used by customers who cannot run this GUI version:  DPDTrace command line logging tool used for patch detection issues

I am using the following code to add some servers to a pre-production group and then want to kick off a scan and then deploy the missing patches to the server. This seems to be working fine if I run the powershell on server which has Ivanti patch management installed however if I try to run the same script by kicking it off from my local machine using either.

Invoke-Command-ComputerNameIVANTI01-ScriptBlock {

Code below

}

Or when using

Enter-PSSession-ComputerNameIVANTI01

Code below

***** Working running from local Ivanti patch management server *****

Import-ModuleSTProtect-PassThru

Write-Host-ForegroundColorGreen"Adding server to patch management group"

$Csv= @()

$Csv=Import-CsvC:\Scripts\Server_Build_Config_v1.0.csv

$machine=$Csv.Machine

Add-MachineGroupItem-NamePre-Production-EndpointNames$machine

sleep5

Write-Host-ForegroundColorGreen"Scanning server for security patches"

$PatchScan=Start-PatchScan-EndpointNames$machine-TemplateName"Security Patch Scan"

Write-Host-ForegroundColorYellow"Waiting for scan to complete"

$PatchScan|Wait-PatchScan

Write-Host-ForegroundColorGreen"Scan Completed"

Write-Host-ForegroundColorYellow"Deploying security patches"

$PatchScan|Start-PatchDeploy-TemplateName"No restart"

I am getting the following error message:

Exception calling "QueueAssessment" with "7" argument(s): "There was no endpoint listening at net.pipe://localhost/ST/Console/Engines/EngineOrchestrator/ that could accept the message. This is often caused by an

incorrect address or SOAP action. See InnerException, if present, for more details."

At C:\Program Files\LANDESK\Shavlik Protect\PSModules\STProtect\STProtect.PatchScan.psm1:154 char:2

+     [ST.PSModule.Protect.PatchApiProxy]::QueueAssessment($credentialU ...

+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException

    + FullyQualifiedErrorId : EndpointNotFoundException

Hi

When I'm running ITScript - Get date and time I only getting same time as my console!

Running Powershell on local console (sweden)
Current time at AAAA is 10/23/2018 10:52:17 AM

Running Powershell on remote server (Iran)

Local time (GMT+03:30) at \\BBBB is 10/23/2018 12:21:49 PM

(Yes it is a shift for summertime stillin sweden)

But when running ITScript - Get date and Time it gives me Local console time!!? Why?

BBBB 10/23/2018 10:56:44 AM OU_IR -2- (Iran) UTC+3.5  Complete: 10/23/2018 10:56:41 AM

Running Ivanti Patch for Windows® Servers Standard 9.3.0 Build 4510

Best regard / Mike

I have a Windows 2008 R2 Standard server.   I have many of these types of servers in my enviorment.   I can scan and patch the server fine but am unable to deploy NetProtect to this one box for some reason.   It gets to 67 percent then says registration failed.   Below is the log toward the bottom it says installation failed but I'm unaware of how to resolve this issue.  

IPV6 is off, Firewall is off as well.

Log attached.

I have one laptop running Windows 7 64-bit that the agent says, "cannot configure agent to listen. Listening is disabled." in the logs.  I also get an eventid 1000 and 1001 in the event log.

Log attached.

Hello,

I have recently began experiencing issues with the Shavlik Console Service stopping unexpectedly which causes the scanning to freeze up. I have included both the errors that I receive each time this happens.

Any help will be greatly appreciated...thanks,

Paul

Log attached.

Hi Guys,

Our Shavlik Protect 9.0 is refusing  to launch indicating that SQL query failed to execute( I didn't record the message)  After a little digging. I verified database were intact and did test connections to verify sql services were running and also check the integrity of the database.

I decided to relaunch the database setup tool to see if I can relink the database. It did indicate it has linked but when I tried to finish the installation it produces the error that :

Failed to commit or save the database installation

and the freezes the tool. After which it produces a database installtion error 

I have shrinked the database size and cleared logs and tried again but nothing was different. I have recorded the logs after those actions and here is what i got.

Any thoughts on how I can proceed or should I just call phone support to have someone look further. Thanks David

Log Attached.

Something very strange happened this morning, my deployment scheduled for 07.50 did not run, even though when I checked in scheduled console tasks at 08.25 it had gone to the bottom of the list (i.e. the time had passed). The deployment did not show in the deployment tracker so I assumed the job had failed and I was going to investigate why later. I didn't need to because at 09.10 my users started calling asking why everything had gone down, sure enough the 30 servers in this deployment had started patching at 08.50 and had gone into their reboot phase. This is our first scheduled deployment since the end of British Summer Time so I assume it's to do with that, but the Patch server has the correct time, everything looks good on the domain (clocks changed two weeks ago so we definitely would have seen problems before now), and as I say, the console was showing the task as being in the past. What should I be looking for in the logs and how can I prevent this happening in future?

Thanks in advance for your help

Lucy

Purpose

This document covers the minimum account privilege requirements for using the Patch for Windows SQL database.

Description

Below are the privileges (roles) required within SQL for a user in possible scenarios:

Database Creation:
New installations of the Patch for Windows database require an account that has at least the DB_Creator role.

If the account has nothing else but DB_Creator it will give the account the proper rights when it creates the database.  So for situations where you have a DBA involved you can have them add a windows user to SQL with DB_Creator, Patch for Windows can create the database, then after completion the DBA can remove DB_Creator from that user.

Console User:
Any Patch for Windows user must have the following roles assigned for the Patch for Windows database to use the product:

db_datareader

db_datawriter

STCatalogUpdate

STExec

This must be configured for each user who will authenticate with the Patch for Windows database. 

Upgrade Rights:
When we upgrade the product there are typically schema changes to the DB.  These changes require additional rights that are not required for day to day usage of the product.  Ensure that you are using an account with this level of rights, otherwise the DB upgrade will fail.

To successfully perform an upgrade of the Patch for Windows database the following roles will be required:

db_securityadmin

db_ddladmin

Example of how you would see this in SQL Server Management Studio. In this example, the console database is named Protect:

Additional Information

More information from the Patch for Windows product documentation:

SQL Server Pre-Installation Notes

SQL Server Post-Installation Notes

The ability to check these privileges will require a DBA or the use of SQL Server Management Studio.

Affected Product(s)

Ivanti Patch for Windows

Overview

This document provides a list of required URL addresses for Shavlik Protect and Ivanti Patch for Windows Servers to allow:

• Patch executable download.
• Patch content definition download.
• Online license activation or license refresh.
  
• Home page RSS feed.
  
• Product check for update.
  

URL List

The following URLs may be used to download updates and must allowed through firewalls, proxies and web filters:

Additional Information

• To obtain the IP for vendor sites you can ping the vendor site or contact the vendor to obtain this information. We are unable to provide a list of IP addresses due to the varied dynamic IP addresses being used by the vendors. It may be easier to create an exception for an entire domain rather than entering all specific URLs, you can usually do so by entering the exception in this format:
  • *.domain.com.

Affected Product

Ivanti Patch for Windows Servers

Hi,

I use a deployment template when deploying patches to laptops. I set my timing options to 100 seconds to wait before retrying. I pushed the updated to the laptops last Friday and scheduled the installation to begin at 5:00 pm. One of my users left the office before 5:00 pm and took his laptop with him. He logged in again on Saturday and received a notification from Ivanti around 4:00 pm that updates are getting installed in his laptop.

My question is does Ivanti will keep trying to push updates to the target machines until it is successful?

Does the deployment expire?

How many times it will try to deploy the patches before it stops trying (I thought the 100 seconds was the limit)?

Thank you  for your help in advance.

Emil