When Help > Refresh License key is selected in the Protect Console the following error is returned:

Could not establish trust relationship for the SSL/TLS secure channel with authority 'golicense.vmware.com'  or

Could not establish trust relationship for the SSL/TLS secure channel with authority 'golicense.shavlik.com'

Root Certificate Information on the Protect Console is out of date

Update Root Certificate Information on the Operating System running the Protect Console using the the following document:

Updating Root Certificates Information http://community.shavlik.com/docs/DOC-22945

WMware vCenter Protect 8.x

Shavlik Protect 9.X

After deploying patches, the Deployment Tracker shows a status of 'Unable to Verify'.

After deploying a patch, the rescan was unable to successfully scan the target machine and verify that the patch was installed.
The common causes of this are:

• Non Admin Credentials Used for Target Machine
• Network interference prevented a successful rescan.

Non Admin Credentials Used for Target Machine

When scanning a machine, Protect needs credentials to authenticate against the target. These credentials are typically setup in the Credential Manager, and assigned per machine/machine group. In the event the credentials assigned do not have Local Admin Rights, have the wrong password, or are just not provided, Protect will fail-over to use the Currently Logged On User Credentials (CLOUC). This is seen in the hf.log file:

When initiaing a scan from the Protect Console it will try in order:

1. Credentials specifically set to the machine.
2. Default credentials defined in the Credentials Manager.
3. Currently logged on user credentials (clouc).

Note: If there are no credentials in the Credential Manager set to 'Default', and no credentials are assigned to a machine specifically, it will only try to use the Currently logged on user credentials (clouc). In this instance, there is no mention of the fail-over in the hf.log.

After deploying patches, Protect initiates a re-scan of the target machine to specifically check if the deployed patches are shown as missing still.
Unlike the initial scan that took place, a re-scan will not fail over to a Currently logged on user credential (Clouc). The rescan is performed by the Console Service, and the failover would be to the System Account which would not work.What this means is that if the machine does not have functioning Local Admin Credentials, it will try to do a rescan with invalid credentials, and fail. After it fails, it will eventually stop trying and return the status of 'Unable to verify'.

To fix this, the machine needs to have credentials assigned to it that have Local Admin Rights. This can be assigned within a Machine Group if initiating a new set of scans, or on the Machine Record under Machine View (Right click > Machine Properties). Once the machine has had Local Admin Credentials assigned to it, it should be able to re-authenticate against the target machine after a deployment to verify the patches status.

More Info on Managing Credentials Here.

Network interference prevented a successful rescan.

This is typically caused when a machine loses network connectivity before a re-scan can occur. This is usually random and will not recreate in the event you rescan, redeploy any missing patches.

Shavlik Protect 9.x
vCenter Prtoect 8.x

The purpose of this documentation is to provide additional information and resolutions when the installation of Protect 9.0 with Patch 1 full product installation or Patch 1 fails with "Error 1722".

Error in Protectupdate*.log located in the %temp% directory shows "Error 1722"

MSI (s) (2C:C0) [17:53:28:738]: Note: 1: 1722 2: SetupDatabaseAction 3: C:\Program Files\LANDesk\Shavlik Protect\ST.DatabaseConfiguration.exe 4: -quiet -upgrade -consoleId <GUID> -timeout 1800

CustomAction SetupDatabaseAction returned actual error code 1 (note this may not be 100% accurate if translation happened inside sandbox)

MSI (s) (2C:C0) [17:53:32:763]: Product: Shavlik Protect -- Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action SetupDatabaseAction, location: C:\Program Files\LANDesk\Shavlik Protect\ST.DatabaseConfiguration.exe, command: -quiet -upgrade -consoleId <GUID> -timeout 1800

The error occured while running ST.DatabaseConfiguration.exe.

Checking the ST.DatabaseConfiguration.log shows one of the following errors:

ST.DatabaseConfiguration.log error scenario 1

2013-07-08T23:55:09.1875831Z 0005 E DatabaseInstaller.cs:561|SQL install script error: System.Data.SqlClient.SqlException (0x80131904): The operation cannot be performed on database "<DB_Name>" because it is involved in a database mirroring session or an availability group. Some operations are not allowed on a database that is participating in a database mirroring session or in an availability group.

ALTER DATABASE statement failed.

ST.DatabaseConfiguration.log error scenario 2

2013-09-13T14:21:26.0718307Z 0004 E DatabaseInstaller.cs:928|SQL or data conversion error. Failed to execute the installation.: System.Data.SqlClient.SqlException (0x80131904): Only members of the sysadmin role or the database owner may set the database compatibility level.

Fix for ST.DatabaseConfiguration.log error scenario 1:

Remove database from SQL High Availability "Mirroring/Synchronize"

Run install again.

ST.DatabaseConfiguration.log error scenario 2

2013-09-13T14:21:26.0718307Z 0004 E DatabaseInstaller.cs:928|SQL or data conversion error. Failed to execute the installation.: System.Data.SqlClient.SqlException (0x80131904): Only members of the sysadmin role or the database owner may set the database compatibility level.
Please note it may be necessary to perform the upgrade using an account with the sysadmin role in the event the account you are using now, is not the same one that originally created the database.

Shavlik Protect 9.0.1182

Hi guys,

I'm new to this forum so please be patient in case I'm asking a question that has already been asked.

i'm using Shavlik Protect in the version 9.0.0 and I'm wondering if the tool is simply extremely slow or if it's a misconfiguration on my side?

I need to patch around 300 Windows Servers in a timely fashion every second month and I'm not keen on waiting for 10 hours+ until they're completed.

e.g.: Patching one server (around 120 Patches) longs now for more than 2 hours. Patching a similar system with Windows Updates takes around 45 Minutes.

Can somebody please advice me where to tune the Shavlik-System?

Thx,

Philipp

We have systems that have been patched up to Apache Tomcat 6.0.39. When we scan these systems the Apache Tomcat 6.0.37 patch is showing up as applicable and missing which is a bug.

Please resolve.

I tried to open a case via the web portal but it gave some error on the attach files portion every time. Says something about not being associated with an account. Sorry.

I've looked at the document that list the variious error codes, but I've never seen this one before.  I'm scanning based on an AD OU, and this is only happening to some of those machines.

"The scan started and all connections and registry access appeard to work, but an unexpcted network event terminated the scan."

Any help in pointing me in the right directions would be most appreciated.

Thanks

I have a question about updating Google Chrome when there is a Group Policy setup to only allow manual Chrome updates.  Using Shavlik Protect, I can scan a machine with this setup and the scan detects a missing patch.  The patch deploys fine, copies over to the ProPatches directory.  The machine reboots after install.  But the patch doesn't actually install.  After talking with Shavlik support, I was told the fact that the patch doesn't deploy has to deal with the fact that the machine(s) have the manual update policy.  With that said, how can I deploy Google Chrome updates while still keeping the policy in place?  Any help would be appreciated.

Hello,

I'm using Shavlik Protect Standard 9.0.0 Build: 1182.

I'm just curious if there is a way to edit and/or remove credentials that are stored for accessing a system. Being a company that is either acquiring or being acquired we run into a lot of different login credentials, and this leads to lots of credential entries. As we migrate systems to domains it would be nice to be able to remove credentials that are no longer in use from the drop down list. Also in the event that information isn't correctly configured (maybe the display name was wrong), it would also be nice to fix that.

Hopefully this is something that I've overlooked and is easily modifiable.

* Side note: Anyone else find humor in the fact that the spell check tags shavlik as incorrect?

Hi.

When patching the latest Adobe Flash the 12.0.0.70 gets installed correctly on clients. But when rescanning Shavlik states that

version 12.0.0.44 is missing and wants to install that. This fails as a never version (12.0.0.70) already is installed on the client.

Can this scan error be fixed somehow?

Kind regards

Erling

The past few times  when performing a security patch scan I recieve this SQL error.

"A database operation failed.  Please verify you can connect to the configured database."

"A SQL Server query operation timed out.  Consider increasing the command timeout in the configuration file."

Since I was not the person who installed/setup Shavlik, I'm not to sure where to begin looking to resolve this issue.  All scans I have done (about 6-7 since this error popped up) have turned out OK, all machines that are normally scanned are sucessfully scanned, and I have been able to push patches just fine, however I don't want this error to bite me in the long run.  If someone could point me in the right direction I would appreciate it.  I have linked an attachment of the error message below.

Thanks in advance

Hello Forum.   More of a general observation question than anything, seeing that this application deals with updates.   I am experiencing this on multiple Win2008R2 servers, and it's not always the same MS update #.   I have ruled out Shavlik, as it happens when I manually install an update.

When scanning thru the updates in the View Installed Updates window, I am seeing identical entries for updates.   They seem to be more prevalent for Office and Lang Packs.  Has anyone else experienced this phenomenon and received confirmation from Microsoft that this is an "known issue" or a bug with the program?

Thanks for your time.

This will help you identify agent issues caused by out of date root certificates.

• Cannot install or update agent binaries in Shavlik Protect
• Installing or updating Protect agent binaries fails
• The agent interface installs, but the the scanning engines, such as patch, threat, and asset engines, are missing

The STAgentUpdater.log file returns entries similar to:

2012-02-20T16:03:43.9185682Z 0790 W SingleFileDownload.cpp:340 Signature check failed - C:\ProgramData\Shavlik Technologies\Agent Data\protect.manifest.cab

2012-02-20T16:03:43.9653700Z 0790 E STAgentUpdater.cpp:629 Update failed with error: class STCore::CInvalidOperationException at XmlDomManagement.cpp:356: Error loading XML document from 'C:\ProgramData\Shavlik Technologies\Agent Data\Protect.manifest.xml': The system cannot locate the object specified.

<somepatch>.msi failed signature check

The root certificates on the target agent machine are expired or out of date.

To resolve this issue the root certificates of the client (agent) machine must be updated. You can apply the updates using Protect.

To Apply the Updates:

1. Create a custom patch scan template that includes the patch type filter Security Tools.
2. Run a scan on the target machine and then look for the bulletins MSRC-001 or MSRC-002.

Related Document: How to Find/Exclude Specific Patches in Scan Results.

MSRC-001 is for Windows XP and 2003. For newer operating systems, such as Vista, 2008, and Windows 7, the root certificates are automatically updated if the machine is connected to the Internet. However, if you have to apply the update manually, you should be able to deploy MSRC-002 from Protect.

You cannot update root certificates on operating systems that are not within the Microsoft support lifecycle. Ensure that you are using a supported operating system and service pack level.

In the event the computer is not connected to the internet to automatically update these files they must be downloaded/distributed manually. Though Protect designates 2 different Bulletin Id's for root certificates (MSRC-001 & MSRC-002), they both use the same patch from Microsoft. If root certificates need to be installed, but protect is unable to do so, download the patch directly from Microsoft and run.

Download Here

When you run the exe, it will run and vanish. It will not give a completion message.

Patch states it is for XP, but if you read the article below under the section "Root update package installation on disconnected environments" it states it works on other OS's as well.

Microsoft Article:Windows Root Certificate Program members

Protect Version: All

Hi,

Is there a way to export/import patch groups in Protect 9?

Thanks

Patrick

Hi,

I am using Protect to take a snapshot before deploying patches to enable an easy rollback point if required.

I have set the Delete old snapshots (age in days) to 2 days, but the snapshots are still there 4 days later (and getting huge...)

I just checked the docco and it appears that in order to trigger a snapshot removal I have to create a snapshot??

You can choose to manage snapshot retention both by the number of  snapshots and by the snapshot age. In this case, when a pre- or post-deployment  snapshot is requested, all snapshots created by VMware vCenter Protect that are  older than the specified number of days are deleted. If the number of remaining  snapshots still exceeds the maximum number specified, the oldest of those will  be deleted until only the maximum number specified remain.

Can someone please confirm if this is correct?

The idea of creating a snapshot to remove one seems odd...

Thanks in advance,

Jamie

This document will outline the process of creating a new database for use with Protect.

1. On the Protect Console machine, open the Protect Database Setup Tool from the 'Start' menu.

2. Once the interface has opened, select the 'Create a new database' option.

3. Select the SQL server you would like to connect to and provide a new database name.

Note:If you are replacing an existing database, please be sure to provide an updated Database name.

4. Click 'Next'. The Database Setup Tool will create a new Protect database and populate it with thenecessarytables and data.

5. Click 'Finish'. This process is now complete.

Protect Version: All

An error occurs performing certain actions in Protect:

• Editing a Template
• Clicking Help > Refresh Files
• Clicking Tools > Custom Patch Editor

Related symptoms:

• Clicking Help > About will not display any file version info.

This is caused by the "C:\ProgramData\LANDesk\Shavlik Protect\Console\DataFiles\ST.CustomPatch.config" file listing a custom patch file that is no longer available.

If a custom patch .xml file was moved or renamed prior to this error occuring, move the file back/change the name to the original name.
Once the ST.CustomPatch.config file is able to locate the custom patch .xml correctly, you can choose to exclude it from Protect by going to Manage > Custom Patches.

Alternatively, find and delete: "C:\ProgramData\LANDesk\Shavlik Protect\Console\DataFiles\ST.CustomPatch.config".

Shavlik Protect 9.x

This document is meant to be a guide to link you to all requirements or pre-requisite information you may need for Shavlik Protect.

Below is a list of links to the different requirements you may need to use Protect or certain features within Protect.

Shavlik Protect 9.x

vCenter Protect 8.x

This is a list of highly recommended documents for improving general knowledge of the Shavlik Protect product. This article is not a comprehensive list of documents.

• Download Site
• Protect 9 Installation Guide
• Protect 9 Upgrade Guide
• Protect 9 Quick Start Guide
• Shavlik Protect Requirements Guide
• Firewall & Proxy Exception White-List
• Installing Prerequisite Software

• How to Activate Shavlik Protect
• Managing License Seat Usage
• Offline Activation Process
• Sales/Licensing Contact Information

• Best Practices Guide
• How To Configure Windows Firewall for Protect
• How to Create a Custom Patch
• How to manage Shavlik in an Offline network
  • Offline Environment: How To Manually Update patch data files
  • Offline Environment: How to Manually Update threat definitions
• Best Practices: Java Deployment
• Best Practices: Software Distribution
• Best Practices: Agentless Scanning & Deployment of Service Packs
• Best Practices: Using Security Tools

Installation & Upgrade

• Data Conversion error during Upgrade
• Cleaning up broken installs of Protect
• Resolving database upgrade timeout failures

Obtaining Trace Logs

• Console, Client Side (agentless), and Agent log files
• Console Install and Setup Logs
• DPD Trace (for scan detection issues)
• Listing & Purpose of All Log Files

Scanning & Detection

• Troubleshooting Patch Scan Error Codes
• Scans running slow or taking long time to complete
• Scan Results fail to import (Incomplete results)
• Why Shavlik Protect scan results may differ from Windows Update
• Java patches not shown missing or installed
• How to include or exclude specific patches in scan
• Adobe & Mozilla Incremental Updating process
• Patch install/uninstall loops (patches that always show missing)

Patch Deployment & Shavlik Scheduler

• Deployed patches appear as missing
• Deployment Tracker Status Message Values
• Service Pack Deployment Guidelines
• Reinstalling the Shavlik Remote Scheduler Service

Database Related

• Cleaning up (purging) a Protect Database
• Increasing database timeout period
• Moving/migrating Protect database

Agents

• Agent Diagnosis Commands
• Agent Install failing at 67% (registration failure)
• How to fully uninstall and reinstall an agent

Other

• Issues adding machines to a group via Active Directory/OU
• Verifying Proxy Settings for Download Issues
• Role Based Administration Lockout Fix
• Understanding the Machine Groups and the Machines View

• XML (Patch Definitions) Update Information
• List of Currently Supported Products
• Feature or Change Requests

• Shavlik Protect or vCenter Protect report database timeout errors 
• In the ST.Protect.managed.log file, you see may see an error such as the following:

System.Transactions.TransactionAbortedException: The transaction has aborted. ---> System.TimeoutException: Transaction Timeout

     OR

2012-07-17T21:10:46.8328850Z 0001 W ScanSummaryPresenter.IsRecoverable|A SQL Server query operation timed out. Consider increasing the command timeout in the configuration file

Purpose

This article provides steps to increase the database timeout value in Shavlik Protect and vCenter Protect.

Resolution

To increase the database timeout period:

Note: Ensure to close the Protect application before proceeding.

Step 1:

• In Protect 8.0 that was upgraded from an earlier version, navigate to this directory:
  1. 32bit – C:\Program Files\Shavlik Technologies\NetChk
  2. 64bit – C:\Program Files (x86)\Shavlik Technologies\NetChk

• In a fresh installation of Protect 8.0, navigate to:
  1. 32bit – C:\Program Files\VMware\vCenter Protect
  2. 64bit – C:\Program Files (x86)\ VMware\vCenter Protect

• In Shavlik Protect v.9.0, navigate to:
  1. All architecture - C:\Program Files\LANDesk\Shavlik Protect

Step 2:

• Locate the ST.Data.Config file and open it using a text editor.

Step 3:

• Change this entry:
  
  st.data commandTimeout="30"
  
  To:
  
  st.data commandTimeout="3600"
  
  This increases the timeout period allotted for transactions with the database. This number is in seconds and you can set the number to a higher value as required. 3600 is the recommendation value for most timeout issues.
• Save the changes for the ST.Data.Config file.

Step 4:

• Re-open your Protect console, and test to see if the issue is resolved.

Shavlik Protect 9.x

vCenter Protect 8.x

Importing a Custom ITScript presents an error. The error, cause, and solution will vary; this doucment will cover each individually.

Note - The following errors list a specific file and/or Script name. These may vary in your environment.

Script metadata is missing or incorrect.

A script '...' already exists, but was signed by a different authority

Error

 

[Window Title]
Script Importer

 

[Main Instruction]
The script 'C:\test.ps1' failed to import.

 

[Content]
A script 'Set Target Machine Verbose Logging' already exists, but was signed by a different authority

Cause

The UID value within the ps1 files Metadata matches the value of a script that is already imported into Protect. This specific error is typically seen when the UID matches one of the Shavlik default ITScript UID values.

 

Example:
<stScript uid="333a27e3-a651-4a30-9150-63757e689a19" schemaVersion="1.0.0.0">
uid value has already been used for a ITScript called 'Set Target Machine Verbose Logging'.

Solution

Change the uid to a unique value.

The contents of file '...' may have been tampered because the hash of the file does not match the hash stored in the digital signature. The script will not execute on the system. Please see "get-help about_signing" for more details.

Error

Cause

Solution

A script '...' by author '...' already exists

Error

Cause

Solution

• Change the Name value
• Change the Author value
• Delete the Script that is already imported into Protect.

The '...' start tag on line # position # does not match the end tag of '...'. Line #, position #.

Error

Cause

Solution

The script '...' failed to import. Scripts cannot have the same ID or Name as another imported script. Please check your script to ensure it has unique metadata entries for those fields.

Error

Cause

Solution

A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file

Error

Cause

• The system Date/Time is incorrect.
• The Root Certificates on the Protect Console computer are out of date.

Solution

• Correct the system Date/Time.
• Update the root certificates.
  • Related Document: Correcting Agent issues caused by out of date root certificates

Guidelines for Creating Custom ITScripts

Shavlik Protect 9.x