install_flash_player_!3_plugin1300244.exe        The remote server returned an error  (404) not found

this patch is rated as critical

  Patch assessment (expected): 2.0.0.8542

please fix download link

Most often when I install .Net patches, they show as missing after being patched.

I decide to troubleshoot this on my current server (2012) with protect 9.1 patch 1.  It is showing that it is missing MS14-046 (Q2966828) Vulnerability in .NET framework...

I installed the patch with the standard deployment template, rebooted and rescanned.  It showed as still missing.  I checked the Cl5 log and saw nothing amiss.

I deployed the patch again, except this time with a delay.  I checked between deployment and execution and the patch file was there.  The bat file runs and there are no errors in the log file.

The post deployment scan shows the patch as missing and the comment is "File version is less than expected..."

The security auditors are not happy to see patches missing.

Thaks,

Joe

Is it possible to manage scheduled tasks in multiple domains or forests using 9.1 ?

We have multiple domains (Test, Dev etc.) that I patch using Protect.  I can define credentials for these domains to scan and patch, however, in previous versions I could not manage scheduled tasks because the system would only use my default credentials to authenticate.  Since these credentials were for a different domain, they naturally failed.  I think this would be "browse credentials"??

I thought I saw that this problem was resolved with the current version, is this true?  Is there somewhere I need to set this up?

I also have machines and domains show up in the list that no longer exist, how can I remove these?

Thanks,

Joe

Purpose

This article provides information about how patch scans with Protect may differ from Windows Update scans, specifically concerning patch severity.

Overview

Microsoft publishes severity information with each bulletin. The Shavlik Protect interface displays the Microsoft severity for each individual patch by Qnumber. Each Microsoft Bulletin includes an overall maximum severity rating listed at the top of the bulletin and it is displayed in the Security Bulletin Search page. For example, for MS05-001, the maximum severity rating is Critical.

Within each bulletin, the severity ratings are further assigned by the underlying operating system. The severity rating for the issue may be different, based on which operating system is involved. These specific settings may be viewed by expanding the Executive Summary of the security bulletin. For example, for MS05-001, the severity rating for NT4, Windows 2000, and Windows XP is Critical. The severity rating for Windows Server 2003 is Moderate.

In the Protect GUI, the vendor severity rating is displayed for each patch and it is specific to the operating system or application that is installed. For NT4, Win2K, and XP systems the vendor severity rating for MS05-001 is displayed as Critical, while the same issue for WS03 is displayed as Moderate.

Microsoft Windows Update (including Microsoft Update) categorizes updates in two buckets: High Priority and Software-Optional.

The High Priority bucket includes both security-bulletin related patches and non-security patches. The Software-Optional bucket usually includes new software applications that can be installed (such as Windows Powershellv and Windows Search).

Protect scans for and deploys all Microsoft security bulletin related patches. Each Microsoft security bulletin related patch is assigned a Microsoft severity rating (Critical, Important, Moderate, Low) as detailed in the security bulletin.

The severity rating in Protect properly reflects the rating assigned to the individual patches for the specified products, rather than the overall severity rating assigned to the bulletin as a whole.

Protect also scans for and deploys many of the Microsoft non-security related patches. These patches are for issues such as performance and scalability-manageability. In Windows Update, these patches are included in the High Priority bucket alongside their security counterparts. In Protect, these patches are included as non-security patches available to be scanned via the WUScan scan template, or in a custom template when non-security patches are selected.

Non-security patches, whether scanned from Windows Update or from Protect are NOT assigned severity ratings. (Severity ratings are only assigned by Microsoft for security patches referenced in security bulletins.)

Microsoft includes both security and non-security patches in their High Priority bucket. This sometimes leads to confusion when prioritizing the patches that need to be installed. Shavlik recommends that all security patches be considered for installation (after appropriate internal testing). Shavlik recommends installing non-security updates as required by the business situation. Non-security updates are not necessary to maintain the security posture of your system.

Another point of common confusion is the Update Type attribute that is displayed in Windows Update. This column displays Important or Recommended. This is commonly mistaken for the patch severity, however this is not related to security patch severity (Critical, Important, Moderate, Low). To see the security patch severity, click the update title on Windows Update, then click the corresponding More Information link to view the security bulletin and associated patch product severity rating.

FAQ

Why does Microsoft show some non-security updates that Protect does not show?

While Shavlik strives to maintain consistency with Windows Update non-security patches, there may be times when Microsoft has released a non-security patch and Protect has yet to support that patch. Protect prioritizes patches to include support for security patches first, then non-security patches. If you see a non-security patch on Windows Update that is not listed in the Protect product, submit a request at http://shavlik.featureidea.com/ and request that the patch be added.

Why does Protect show some non-security updates that Windows Update does not show?
Shavlik strives to add support for as many non-security patches as possible. This includes both those listed on Windows Update as well as those available from the Microsoft Download Center (that may not be available via Windows Update). Many times we identify (or customers ask us to support) relevant patches on the Microsoft Download Center that are not on Windows Update (which may or may not be supported by Windows Update in the future). In these cases, you may see Protect scanning for and recommending non-security patches that are not on Windows Update. As with all non-security updates, use your own judgment to determine if the specific patch is relevant to your organization and prioritize deployment of those patches accordingly.

If a Protect Security Patch and/or WUScan scan shows my system as fully patched and Windows Update shows some missing High Priority updates, is my system really \"secure\"?
Yes*. The Protect Security Patch (default) template scans for all security patches. The WUScan scan template scans for all security patches as well as non-security patches. Both of these templates identify any missing security patches that need to be installed on your system to consider it fully patched with respect to security patches. (* Secure in this sense means fully patched for security issues. Configuration settings may still be required to fully secure your system for non patch related items).

Do I need to install all non-security High Priority items recommended by Windows Update?
No. Security bulletin related patches are the most important items to install. You should install all security bulletin related patches (pending your internal testing). Non-security patches can be installed to help address specific non-security issues as the need arises. It is not necessary to install these High Priority non-security patches to be secure.

Shavlik recommends scanning with the Security Patch Scan template and apply the patches that it finds missing. Use the non-security WUScan scan template as needed to find those non-security items that you wish to install.

What if I see a non-security High Priority patch on Windows Update that is not listed in the Protect product?
Submit your request at http://shavlik.featureidea.com/.

Why does Protect show security updates that Windows Update does not show?

The Protect application scans for security updates for both Microsoft and non-Microsoft products that Windows Update Microsoft Update does not scan for. For Microsoft products, this includes items such as Office 2000, Step by Step Interactive Training, Messenger, Services for Unix, FPSE, SQL 2000 (pre SP4), ISA Server.

The Protect application also scans for security patches on non-Microsoft products such as Sun Java, Mozilla Firefox, Apple iTunes, Adobe Acrobat and Reader, Adobe Flash, Citrix, RealPlayer, and others. Windows Update does not scan for or patch these third party products.

Purpose

An explanation of why Shavlik Protect patch scan results may show different patches needed than when running a Windows Update.

Solution

Shavlik Protect uses different detection logic to scan for patches than Windows Update and other patch vendors.A Windows Update scan has the ability to show missing Security Patches, Non-Security Patches, Security Tools, driver updates, and sometimes patches that aren't publicly downloadable.

Depending on what Scan Template you are using in Protect, the results will vary. The built-in security patch scan will only show missing security patches. The built-in WU scan will show missing security patches and non-security patches. And please note - we don't always include all non-security patches in our XML data right away either, as security patches take precedence.

You can always create a Custom Scan Template, and check security patches, non-security patches, and security tools for the most robust scan with Protect.

Shavlik uses a variety of methods to see if a target machine needs a patch.  The process is detailed in the document "Explanation of how patch scanning detection works with Shavlik Protect" which can be found here:http://community.shavlik.com/docs/DOC-2259.

Administrators can view files and registry entry criteria by searching for the patch in View > Patchesof the Shavlik Protect Console main menu.

See this online help file for more information on using Patch View:

http://www.shavlik.com/onlinehelp/Protect90HTMLHelp/Viewing_Patch_Details_(Patch_View).htm

There is also a difference in how Protect displays criticality and vendor severity. See this document for further information concerning this:
Understanding patch severity in a Shavlik Protect patch scan and why it may differ from Windows Update

Affected Products

Shavlik Protect 9.x

We have two laptop users running WIndows 8.1OS. They are logged into the internet all the time. Somehow, the Shavlik Protect cloud agents for their machines do not run properly. In my console I can see that the last checkin was in the spring.

1. Are there known issues with W8.1 and Shavlik Cloud? Maybe I should uninstall?

2. What do you recommend for fixing this on their machines?

Thanks.

How do you know if the license installed on a machine is a workstation license or a server license?

Greetings.

I've been experiencing what I'm guessing to be timeout issues with Shavlik Protect. I've had this issue for some time now and am finally fed up and looking for advice.

We are using Shavlik Protect Advanced 9.1.0 Build: 4334, Windows Server 2008 R2 SP1 and SQL Server 2008 R2. Agentless patch management.

This is what happens:

Regardless of whether its a scheduled deployment or manual, after a server has patched and rebooted, the console reports back that it is pending rescan but only on servers that do not reside locally. This happens for all servers in Europe and Asia, running English Windows. If I deploy patches to a server in Europe first, and then a US server, the US server will be stuck in that "pending rescan" state like its queued up behind the European one. If I run the US one first, no issue. If I wait 24-48 hours, they will both eventually report back.

Timeout settings are already set to the maximum of 300 and we have WAN Accelerators in place.

If I watch STPatchAssessmentSrv.exe in task manager, after issuing a patch to a non local server, it doesn't move for long lengths of time. I've gone away and come back after an hour and sometimes the information moves, other times it does not.

If I kill STPatchAssessmentSrv.exe and then rescan the local server, I'll get the results fast but that really defeats the purpose of working toward a more automated approach. Then there is the long wait time to scanning the non local servers again.

I am looking for recommendations on how to approach this situation.

Thank you.

I am trying to find out if I can run a scan on a set of computers and Shavlik not automatically patch them.  I want to just run the scan, see the results and patch what I want at a later time.  I have tried to find info on this and from my testing it seems this is not possible.  If it is, could someone let me know how?  Thanks..

I am new to Shavlik and have been doing some testing to get comfortable before trying any major deployments.  I performed a scan on a computer and tried to deploy two patches.  Both are stuck on "Executing" as their status and have been that way since around 3pm yesterday.  The communications should be fine between Shavlik and the computer and I am signed in with administrative credentials.  Any idea why the patches are not being completed?

Hello,

I am new to Protect and can't figure for the life of me how to push out IE 10 to all my desktops. I have tried running a software distribution scan on the machines, but it only finds patches for installed products and doesn't actually offer up IE 10 for install? Any help would be appreciated.

Thanks,

Ryan

Hi,

Per Microsoft, KB2959936 applies to the following OS

• Windows 8.1 Enterprise
• Windows 8.1 Pro
• Windows Server 2012 R2 Datacenter
• Windows 8 Enterprise
• Windows 8 Pro
• Windows Server 2012 Datacenter
• Windows 7 Professional
• Windows Server 2008 R2 Enterprise

KB article hyperlink: http://support.microsoft.com/kb/2959936

But Shavlik Protect 9.0 shows it as missing on Windows 7 Ultimate (x64) machines also.

I am wondering whether this patch applies to Win 7 Ultimate (x64) also?

Regards

Srikanth

Purpose

The purpose of this document outlines the process of using Protect to install Internet Explorer.  You can also view Software Distribution Best Practices and Informational Guide or more information about using the Software Distribution feature.

Steps

To install IE with Protect you will need to use the Software Distribution to do this.

First you will need to create a scan template to detect the version of IE you will want to install.

The first step for this is to create a patch group that contains the installer patch for IE. To do this go to view patches then in the search you will input MSIE-010 (This is for IE10, IE11 would be MSIE-011). Then you will see the QNumber QIE1061N right click on this and create new patch group.

Now you will name and save your patch group.

Next Step is to create the scan template.

Go to New\Patch Scan Template

Under the filtering tab you will need to select the “Scan Selected” under Patch Filter Settings and select your patch group.

Now on the General tab of the scan template you will want to check the box “include effectively installed patches  and leave “Both missing and installed
patches” selected

Now on the Software Distribution tab you will need to check the box “Software Distribution” so the scan template will show results for Software Distribution patches

Now you can scan the machine you want to install IE on and it should either show you the IE version is either missing so you can deploy it or it is effectively installed

Hi!  I was looking to push PowerShell 4.0 out to some pcs, but did not see it in the list for software distribution.  I do see Windows Management Framework Core Package 3.0, but not 4.0.  Am I missing something or is it not available?

Thanks,

There are two recent updates from the September 9th set that are not showing up as missing on any of my machines. MS14-052 and MS14-053 are not showing up, and I even ran a default WUScan just to make sure my template was not causing the issue.

What's odd is that the September Patch Tuesday Round Up Blog even highlighted both of them.

My weekly Nessus Scan caught them both.

Any ideas why that would be? How can I view a list of all available current patches and their statuses?

Most often when I install .Net patches, they show as missing after being patched.

I decide to troubleshoot this on my current server (2012) with protect 9.1 patch 1.  It is showing that it is missing MS14-046 (Q2966828) Vulnerability in .NET framework...

I installed the patch with the standard deployment template, rebooted and rescanned.  It showed as still missing.  I checked the Cl5 log and saw nothing amiss.

I deployed the patch again, except this time with a delay.  I checked between deployment and execution and the patch file was there.  The bat file runs and there are no errors in the log file.

The post deployment scan shows the patch as missing and the comment is "File version is less than expected..."

The security auditors are not happy to see patches missing.

Thaks,

Joe

Are there any tool / scripts to test remote access to a machine? I have tried to run GetRebootTime on domain assets but failed because of access issues. So, I am looking for a tool or script that could determine the cause of remote access being denied.

The option to export a report to html was available to us until this last version update of Shavlik.  Can you please tell me if this option will be re-added on the next version release?

Thanks.

Purpose

This document will explain how to view scheduled agent tasks by command line on client machines.

Resolution

1. Open a command prompt as an administrator and then navigate to one of these locations:

32bit OS:

"C:\Program Files\LANDESK\Shavlik Protect Agent\

64bit OS:

"C:\Program Files (x86)\LANDesk\Shavlik Protect Agent\

2. Run this command to see all shceduled jobs for this agent.

STAgentManagement.exe -schedule

Additional Commands

You may also find these switches for STAgentManagement.exe helpful too.

Affected Products

Shavlik Protect 9.x

Purpose

Many of the common Shavlik Protect scan errors can be corrected by changes to configuration or environment. This article lists the most common scan error messages and provides some guidance on correcting the issue.

Cause

Scan errors can occur:

• If one or more of the Shavlik Protect Scanning Prerequisites have not been met 
• If one or more configuration issues are present in Shavlik Protect 
• Due to one or more environmental issues

Resolution

Affected Product(s)

Shavlik Protect All Versions