Symptoms

Within the Event History (View > Event History) you see the following event logged:

Event Type: Distribution Server Sync: core engines/definitions

Status: Complete with details

Summary: One or more files may have failed

Within the event details or ST.ServiceHost.native.log you see the following error:

Error Setting File Security on "\\DistributionServerName\PowerShellModules": class STWin32::CWin32Exception at SecureableObject.cpp:27: Error 5: Access is denied.

Cause

The reason this may happen is because the 'PowerShellModules' folder is being created with default permissions of the local system account - "SYSTEM" or "SystemName\Administrators", and this folder then denies access to any other account that may be set for the distribution server with in Tools > Operations > Distribution Servers > Edit Distribution Server > Credential used by the console to synchronize.

Resolution

Our engineering team currently has this marked as a defect, and it should be resolved in a future release.

This folder currently does not actually have anything synchronized so the error can be ignored as long as your other files (patches & definitions) are synchronizing correctly.

Alternately, you could manually add read/write permissions for the account needed to this folder.

Affected Product(s)

Shavlik Protect 9.0.x

Shavlik Protect 9.1.x

Overview

There have been an incredibly large number of vulnerabilities this year, which unfortunately is going to cause asyntax change in MITRE CVE-ID.   The current syntax will max out at 9,999 vulnerabilities, so the change is to start adding additional digits.  When the CVE count breaks 10,000, MITRE will be adding an extra digit onto the end of their CVE-IDs.  The resulting CVE change will drive a change in how we import content for Shavlik Protect 9.1 and 9.0.

The deadline for the change is January 15, 2015, but due to the high volume of vulnerabilities releasing this year the change in format may be forced upon us early.  We have released an update for Protect 9.1 and are working on the Protect 9.0 update to prevent the format change from causing issues.  The patch will prevent import of new content from failing, avoiding an inconvenience to our customers.  Protect 9.1 Patch 2 is available now and the Protect 9.0 Patch 2 will be coming in the next couple of weeks. Although the updates do not include a security fix, this is a critical bug fix to avoid a customer outage. 

To upgrade you can follow the instructions below based on version of Protect. 

Upgrade Protect 9.1 to Patch 2:

• Download Protect v9.1 Patch 2 fromhttp://www.shavlik.com/downloads/protect/. Patch 2 includes fixes from Patch 1 as well, so customers on Protect 9.1.4446 or 9.1.4334 can upgrade with the same patch. 

Upgrade Protect 9.0 to 9.1 Patch 2 or 9.0 Patch 2:

• (Recommended) For 9.0 customers you will now see that auto update to 9.1 Patch 2 is enabled in product.  You can click the auto update link in the bottom right corner of Protect when you open it and it will download the full installer upgrading you to Protect 9.1 Patch 2.

  You must be on a Windows 7 or 2008 r2 x64 or later OS to upgrade to Protect 9.1. 

• If you are unable to upgrade to Protect 9.1 Patch 2 at this time we are in the process of releasing a similar fix for Protect 9.0.  This update will be coming in a few of months and can be applied very easily to Protect 9.0.  The change is entirely database schema related so no binaries are updated on Protect 9.0 console. 

  If you have not applied Patch 2 for either version, there will be a point in the not too distant future where you may not be able to import new content.  We would like to avoid this as much as you would, so plan for this patch update as soon as possible. 

Additional Information

Release notes for Patch 2 for Protect 9.1: Shavlik Protect Standard/Advanced 9.1 Patch 2 Release Notes

Release notes for Patch 2 for Protect 9.0: This will be update once the patch is released.

Products

Protect 9.x

Purpose

The purpose of this document is to show how to register a Shavlik Protect agent to a different Protect Console.

Procedure

Redeploy the agents using information found at Methods to install a Shavlik Protect Agentand point and register to the new Protect Console.  The machine will still show up in the old console until it is deleted from the Machine View. Delete machines from the old Protect Console using How to remove old machine information from Protect database

See Also

Agents Machines are unable to check in after the Protect Console was migrated to a different Machine.

Shavlik Protect Migration Tool User Guide http://www.shavlik.com/uploadedFiles/Support/Online_Documentation/Shavlik_Protect_90/mtg-prt-9-1.pdf

Affected Product(s)

Protect 9.X

Symptoms

Shavlik Protect is detecting a newer unlicensed version of Winzip and installing it over an older licensed version of WinZip

Resolution

Some Winzip Patches will upgrade the existing installation to the next version when deployed . If you do not desire the upgrade, you will need to exclude those patches in a patch group using information in the Document How to Include or Exclude Specific Patches in Scan Results

Affected Product(s)

Protect 9.X

Symptoms

Failed Signature Check when downloading scriptcatalog.zip

Cause

The Certificate Revocation List (CRL) is out of date and Protect cannot reach the URL's to verify the certificates

Resolution

Allow the following URL's to be reached

http://gtssl-crl.geotrust.com

http://gtssl-ocsp.geotrust.com

http://crl.geotrust.com

http://ocsp.geotrust.com

http://csc3-2010-crl.verisign.com

http://ocsp.verisign.com

http://crl.verisign.com

http://csc3-2010-aia.verisign.com

You can also try the solution in the following document

How to update the Certificate Revocation List (CRL) on a disconnected Protect console server

https://community.shavlik.com/docs/DOC-23601

Purpose

This article provides a link to the Protect 9.1 Patch 2 download location and release notes.

The Shavlik Download Center provides links to:

• Product downloads
• Upgrade Guide
• Release Notes
• System Requirements
• Version History Log

Affected Product(s)

Shavlik Protect 9.1

Purpose

The purpose of this document is to show a method that you can use to get a listing of machines within a machine group (or just within machine view) into a CSV file.

Description

It's currently not possible to export a machine group directly to a text file, but you can use the steps below to get the machines exported to CSV:

1) Go into your machine group, then click on 'View in Machine View'.

2) Once it transfers you to machine view, you can expand the grouping to see all the machines listed.

3) Select all the machines (Select +A), then right click anywhere in the highlighted area, and choose 'Export selected machines to CSV'
    Note: You can also just go into View > Machines and export selected machines to CSV, you do not have to start from a machine group.

4) The resulting CSV export should be usable as a text file or you can manipulate the information when opening as a spreadsheet.

Additional Information

More reporting options are available within Protect. Please see our help documentation for more details.

Overview of Reports

Reports Dialog

Advanced Filtering

Exporting

Report Views Guide

If you want a specific feature that we don't currently have, we suggest that you submit a feature request at Shavlik Feature Request Form.

Affected Product(s)

Shavlik Protect 9.x

This document was generated from the following discussion: Possible to export machine group to .txt file?

Hi

Microsoft has released many non-security updates in Nov 2014 but the latest Protect XML has very few non-security updates.

I just wanted to check with you when can I expect latest XML with all non-security updates. This information really helps me since our patch release depends on Shavlik Protect's XML.

Also I would like to know how much time Shavlik generally takes to release the monthly XML after second Tuesday?

Regards

Srikanth Badireddy

Symptoms

You notice a patch or patches detected as missing in Protect, but failing to install. Manually running the patch throws a 'not applicable to this computer' message.

AND

Protect's scan log (HF.log) shows the following type of message in logging of file detection for the patch:

2014-10-30T17:54:10.2601591Z 0698 W PatchTest.cpp:1235 Unable to open file '\\1.1.1.1\C$\Program Files\FOLDER\file.DLL': 64.

2014-10-30T17:54:10.2757841Z 0698 V PatchTest.cpp:1272 File '\\1.1.1.1\C$\Program Files\FOLDER\file.DLL' error: 5.

Cause

The error 5 indicates that access is denied. Because Protect cannot read the file, it reports the patch as missing since the version of the file cannot be confirmed.

A security device or software such as an IPS (Intrustion Prevention System) is preventing access to a file or files that Protect needs to be able to read to determine if a patch is considered missing or installed.

Another possibility is that the account performing the scan does not have access to the file(s). Ensure that permissions to specific files/folders has not been limited for the account.

Resolution

Ensure that you are meeting all Scanning Prerequisites.

Investigate the access issue with your security team to ensure the access to systems or files is not being blocked. Change any rules within your security software or devices to allow access from the Protect console system to read all files on all machines being scanned.

Additional Information

Solution Center for Access Denied Error Messages

Affected Product(s)

Shavlik Protect 9.x

Symptoms

Shavlik Protect detects MS13-053 KB2532531 as missing but will not install.  When the patch is run manually, an error is returned that says it does not apply to the system.

Cause

The patch KB2552343 dependency must be installed in order for this patch to not be offered.

Resolution

Install KB2552343 or exclude a patch group containing Q2532531 in a patch scan template.

Additional Information

The Microsoft bulletin at http://support.microsoft.com/kb/2552343

Under the RESOLUTION > Update information heading states the following

If you have installed security update 2532531 from the Microsoft Download Center but have not installed this update (2552343), you will be offered security update 2532531 again through Windows Update. To work around this issue, install update 2552343 from the Microsoft Download Center, or when it is offered by Windows Update.

Affected Product(s)

Protect 9.X

Symptoms

When setting up your email server for use in Protect via Tools > Operations > Email, you see the following error message:

The remote certificate is invalid according to the validation procedure.

Cause

You are attempting to use a secure connection with your mail server, but a certificate or TLS connection is incorrectly configured for the mail server.

Resolution

• Verify that any certificate required for the mail server is configured correctly and that TLS connection is available for the mail server.
• Ensure that the port is set correctly.
• Ensure that credentials provided are valid with the mail server.

A possible workaround is to set up using a mail server which does not require a secure connection.

Additional Information

This error comes up as a common problem with connecting securely with mail servers when searching online. Here are a couple threads that appeared helpful:

The remote certificate is invalid according to the validation procedure

Error message: The remote certificate is invalid according to the validation procedure

Affected Product(s)

Shavlik Protect, All Versions

Purpose

When running the Shavlik Protect in a secure environment without Internet access, it is necessary to download the latest data files on a system that has internet access and then transfer them to the console machine.

This article applies only to patch data.

Description

This article discusses both methods:

• PowerShell (Highly Recommended)
• Individual file download (All Files Are Required)

PowerShell

To use the PowerShell script:

• Download and install PowerShell 1.0 from Microsoft, if it is not already installed. For more information, see Microsoft KB article 926140.
• Shavlik NetChk Protect and VMware vCenter Protect patch files are released twice per week. To download the patch files, you can use a PowerShell script to automate the process or you can download each file individually.
• If you need a compression utility, download and install the 7-Zip extraction utility from http://www.7-zip.org/download.html.

          Shavlik does not endorse or recommend any particular third_party utility.

• Create an output directory.
• Download and extract the PowerShell script attached to this article: DownloadProtectData90.zip

  This script works for all versions of these products.

• Open a command prompt.
• Enter PowerShell by typing powershell.
• Navigate to the location where you extracted the PowerShell script.
• At the PowerShell command prompt, launch the script with this command:
  
  .\DownloadProtectData90.ps1 "<outputdirectory>" <major or minor version> "<7-zip directory>"
  
    The command begins with the characters . before the script name. These characters are required if the script is in the current working directory. If you are in a different directory, enter the full path to the script.
  
  The major/minor version argument has a two-digit value. Use the value corresponding to your version:

• Protect 9.0: 90
• Protect 9.1: 91

Example:

The command you run looks like this: .DownloadProtectData90.ps1 "C:\Data" 90 "C\:program Files\7-Zip"

The command has these elements:

• .\DownloadProtectData.ps1: This is the script itself.
• c:\Data: This is the folder to which you are downloading the data files.
• 90: This is the version of vCenter Protect or Shavlik Protect files you are downloading.

1. You may see this error:
   
   execution of scripts is disabled on this system
   
   If this occurs, enable the execution of scripts by entering this command:
   
   set-executionpolicy RemoteSigned

  This command is case-sensitive.
   
   Alternatively, you can sign the script instead of changing the execution policy. For more information, see http://www.hanselman.com/blog/SigningPowerShellScripts.aspx.    The preceding link was correct and last checked as of June 11, 2013.

Individual file download

You can manually download the necessary data files. To download the files:

1. Right-click each link and select Save Link As.
2. Save the files to the console, in the DataFiles folder. This is the default location:
   • 8.x on Vista, 2008, & Windows 7: C:ProgramData\Shavlik Technologies\NetChk\DataFiles
   • 8.x on Windows XP or 2003: C:\Documents and Settings\All Users\Application Data\Shavlik Technologies\NetChk\DataFiles
   • 9.x on Vista, 2008, & Windows 7: C:\ProgramData\LANDesk\Shavlik Protect\Console\DataFiles
   • 9.x on Windows XP or 2003: C:Documents and SettingsAll UsersApplication Data\LANDesk\Shavlik Protect\Console\DataFiles

  The Protect console requires both the .CAB and the files archived within the .CAB files for Protect to function correctly. The PowerShell script downloads the .CAB files, places the files in the output directory, and extract the files to the output directory. You need to manually extract the .CAB files using an archiving tool like 7-Zip if you choose to manually download the .CAB files.

Update files for Shavlik Protect 9.0:

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STPlatformUpdater.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/AssetInstaller.msi

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/PatchInstaller.msi

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/ThreatInstaller.msi

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/cl5.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/ST.Licensing.Data.dll

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/DplyEvts.dll

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/7z.dll

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/SafeReboot.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/SafeReboot64.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STSchedEx.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STRemoteCommand.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STScheduleView.exe

http://xml.shavlik.com/data/hf7b.xml

http://xml.shavlik.com/data/pd5.xml

http://xml.shavlik.com/data/iadata.xml

http://xml.shavlik.com/data/ai_dpd.xml

http://xml.shavlik.com/data/scriptcatalog.zip

http://xml.shavlik.com/data/assetinventory.xml

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STPlatformUpdater.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/cl5.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/ST.Licensing.Data.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/DplyEvts.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/7z.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/SafeReboot.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/SafeReboot64.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STSchedEx.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STRemoteCommand.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STScheduleView.cab

http://xml.shavlik.com/data/hf7b.cab

http://xml.shavlik.com/data/pd5.cab

http://xml.shavlik.com/data/iadata.cab

http://xml.shavlik.com/data/ai_dpd.cab

http://xml.shavlik.com/data/hypervisors.cab

http://xml.shavlik.com/data/assetinventory.cab

http://xml.shavlik.com/data/Protect/v9/90/manifest/protect.manifest.cab

Update files for Shavlik Protect 9.1.4334:

http://xml.shavlik.com/data/protect/v9/91/protect/4334/7z.dll

http://xml.shavlik.com/data/hf7b.xml

http://xml.shavlik.com/data/protect/v9/91/protect/4334/cl5.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/safereboot.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/safereboot64.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stschedex.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stremotecommand.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stscheduleview.exe

http://xml.shavlik.com/data/pd5.xml

http://xml.shavlik.com/data/ai_dpd.xml

http://xml.shavlik.com/data/protect/v9/91/protect/4334/assetinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4334/patchinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4334/threatinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4334/st.licensing.data.dll

http://xml.shavlik.com/data/protect/v9/91/protect/4334/dplyevts.dll

http://xml.shavlik.com/data/iadata.xml

http://xml.shavlik.com/data/scriptcatalog.zip

http://xml.shavlik.com/data/supportedHypervisors.obf

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stplatformupdater.exe

http://xml.shavlik.com/data/assetCatalog2.obf

http://xml.shavlik.com/data/assetCatalogMetadata2.obf

http://xml.shavlik.com/data/protect/v9/91/protect/4334/7z.cab

http://xml.shavlik.com/data/hf7b.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/cl5.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/safereboot.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/safereboot64.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stschedex.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stremotecommand.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stscheduleview.cab

http://xml.shavlik.com/data/pd5.cab

http://xml.shavlik.com/data/ai_dpd.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/st.licensing.data.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/dplyevts.cab

http://xml.shavlik.com/data/iadata.cab

http://xml.shavlik.com/data/supportedHypervisors.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stplatformupdater.cab

http://xml.shavlik.com/data/assetCatalog2.cab

http://xml.shavlik.com/data/assetCatalogMetadata2.cab

http://xml.shavlik.com/data/Protect/v9/91/manifest/protect.manifest.cab

Update files for Shavlik Protect 9.1.4472:

http://xml.shavlik.com/data/protect/v9/91/protect/4446/7z.dll

http://xml.shavlik.com/data/hf7b.xml

http://xml.shavlik.com/data/protect/v9/91/protect/1048/cl5.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4446/safereboot.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4446/safereboot64.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stschedex.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stremotecommand.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stscheduleview.exe

http://xml.shavlik.com/data/pd5.xml

http://xml.shavlik.com/data/ai_dpd.xml

http://xml.shavlik.com/data/protect/v9/91/protect/4446/assetinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4446/patchinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4446/threatinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4446/st.licensing.data.dll

http://xml.shavlik.com/data/protect/v9/91/protect/4446/dplyevts.dll

http://xml.shavlik.com/data/iadata.xml

http://xml.shavlik.com/data/scriptcatalog.zip

http://xml.shavlik.com/data/supportedHypervisors.obf

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stplatformupdater.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stplatformupdater.exe

http://xml.shavlik.com/data/assetCatalog2.obf

http://xml.shavlik.com/data/assetCatalogMetadata2.obf

http://xml.shavlik.com/data/protect/v9/91/protect/4446/7z.cab

http://xml.shavlik.com/data/hf7b.cab

http://xml.shavlik.com/data/protect/v9/91/protect/1048/cl5.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/safereboot.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/safereboot64.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stschedex.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stremotecommand.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stscheduleview.cab

http://xml.shavlik.com/data/pd5.cab

http://xml.shavlik.com/data/ai_dpd.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/st.licensing.data.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/dplyevts.cab

http://xml.shavlik.com/data/iadata.cab

http://xml.shavlik.com/data/supportedHypervisors.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4446/stplatformupdater.cab

http://xml.shavlik.com/data/assetCatalog2.cab

http://xml.shavlik.com/data/assetCatalogMetadata2.cab

http://xml.shavlik.com/data/Protect/v9/91/manifest/protect.manifest.cab

Additional Information

Shavlik Protect and VMware vCenter Protect consoles that have no internet connectivity, but that still try to download updates automatically can experience other issues. Shavlik recommends setting consoles with no internet connectivity to Disconnected Mode. To enable Disconnected Mode from the console application:

Version 8.x: Go to Tools and select Run Disconnected.

Version 9.x: Go to Tools and deselect Auto-Update Definitions.

Document Content Update History

11/1/2011 - Updated article for VMware vCenter Protect 8.0.x 

07/16/2013 - Updated article for Shavlik Protect 9.0.x

05/21/2014 - Updated article for Shavlik Protect 9.1.x

Products

Shavlik Protect 9.x

Symptoms

When you run Help > Refresh Files in Protect you see that some files are failing to download, but other files are downloading fine.

Within the ST.Protect.managed.user@domain.log, you may see logging such as the following for file(s) failing to download:

2014-11-10T23:10:06.9996869Z 0005 V SingleFileDownload.cs:506|Downloading from 'http://xml.shavlik.com/data/Protect/v9/91/manifest/protect.manifest.cab' to 'protect.manifest.xml (C:\Users\user\AppData\Local\Temp\ec2fdb9d-c9ce-422a-b37e-8c1867c33424st.tmp)'.

2014-11-10T23:10:07.0152958Z 0005 V FileSetDownload.cs:388|Waiting on downloads to complete, mutex 'Global\VersionsFileSet{FA4000E8-E831-4752-9F9B-7F49B46CBE09}'.

2014-11-10T23:10:07.1400928Z 0006 W SingleFileDownload.cs:673|Package containing 'protect.manifest.xml' failed. Trying discrete file.

2014-11-10T23:10:07.1400928Z 0006 V SingleFileDownload.cs:506|Downloading from 'http://xml.shavlik.com/data/Protect/v9/91/manifest/protect.manifest.xml' to 'protect.manifest.xml (C:\Users\user\AppData\Local\Temp\ec2fdb9d-c9ce-422a-b37e-8c1867c33424st.tmp)'.

2014-11-10T23:10:07.1400928Z 0006 V SingleFileDownload.cs:558|Package fallback to individual file 'http://xml.shavlik.com/data/Protect/v9/91/manifest/protect.manifest.xml'.

2014-11-10T23:10:08.5284839Z 0006 W FileIntegrityCheck.cs:83|More then one valid X509 certificate was found in the document

2014-11-10T23:10:08.5284839Z 0006 V SingleFileDownload.cs:433|Downloaded, failed signature check, and deleted 'protect.manifest.xml (C:\Users\user\AppData\Local\Temp\ec2fdb9d-c9ce-422a-b37e-8c1867c33424st.tmp)'.

2014-11-10T23:10:08.5440822Z 0006 E WorkItemManifestDownload.cs:186|Error: File not downloaded: protect.manifest.xml

Error reason: File 'C:\ProgramData\LANDESK\Shavlik Protect\Console\DataFiles\protect.manifest.xml' failed signature check: http://xml.shavlik.com/data/Protect/v9/91/manifest/protect.manifest.xml

Cause

There is a proxy or web filter blocking the download or providing a cached download of a file that Protect needs to get from the internet.

Resolution

• Can you manually download the file from Internet Explorer?
  • The ST.Protect.managed.user@domain.log should contain the link where the file is being obtained from.
  • In the example above, this is: http://xml.shavlik.com/data/Protect/v9/91/manifest/protect.manifest.cab
  • This document also contains the download URL of the files downloaded during the Refresh Files operation.
• Check if you are using a proxy and work with your networking team to ensure these downloads are not being blocked or cached.
  • Verify the settings in Internet Explorer > Tools > Internet Options > Connections > LAN Settings.
  • The website http://www.whatismyproxy.com/ is a good resource to see if a proxy is in use.
  • Refer to document: Verifying proxy settings for download issues in Shavlik Protect

Additional Information

If it's possible to allow exceptions for specific URLs in your proxy or web filter, refer to this document:

Shavlik Protect firewall and proxy exceptions URL list

Affected Product(s)

Shavlik Protect 9.x

Symptoms

Agents no longer check-in successfully after adding a patch task to the agent policy in which a service pack group is used.

Within the ST.ServiceHost.managed log file you will see logging similar to this:

2014-11-16T15:23:17.4617804Z 0073 E AgentStateService.cs:298|Failed to synchronize agent '7744157F9C758D8C31B9802ED9C66B726E34A0C3@41898420-8f7c-40f6-965a-b534f24cbcc3': System.ArgumentException: Exception of type 'System.ArgumentException' was thrown.

Parameter name: approvedServicePackName

at ST.Engines.Policy.Capabilities.Patch.ProductServicePack..ctor(Int32 productId, Int32 approvedOrdinal, String approvedServicePackName, Boolean useLatest)

at ST.Agent.Client.Policy.PatchCapabilityAdapter.CreateServicePackDeploymentOptions(PatchTask task)

at ST.Agent.Client.Policy.PatchCapabilityAdapter.CreatePatchScanOperation(PatchTask task)

at ST.Agent.Client.Policy.PatchCapabilityAdapter.CreateScheduledPatchOperations(Policy policyData)

at ST.Agent.Client.Policy.PatchCapabilityAdapter.Create(Policy policyData)

at ST.Agent.Client.Policy.PolicyAdapter.CreateCapabilities(Policy policyData, SummaryDetailCache cache)

at ST.Agent.Client.Policy.PolicyAdapter.Create(Policy policyData)

at ST.Services.Agent.Protect.UpdateAgentStateBase.GetSerializedPolicy(Policy requestedPolicy, Boolean includeLegacySignature)

at ST.Services.Agent.Protect.UpdateAgentState.<GetAgentStateAsync>d__0.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)

at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()

at ST.Services.Agent.Protect.AgentServiceStore.<RetrievePolicyPerAgentAsync>d__4.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)

at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()

at ST.Services.Agent.V81.AgentStateService.<SynchronizeInternalAsync>d__18.MoveNext()

Cause

Some possible corruption of data for service pack groups has caused fields within the selected service pack group to be left blank. When these fields are left blank it makes the agent policy invalid.

Example of what you might see when you open the service pack group being used:

Generally these fields are filled in by default.

Resolution

Shavlik has created a defect for this issue so that this behavior can be prevented in a future release of Protect.

Workaround:

Within the service pack group being used - ensure that there is a selection chosen for any fields coming up empty. Make sure to check all tabs of the service pack group.

Additional Information

From Shavlik Protect Help Documentation:

• About Service Pack Groups
• Creating and Editing a Service Pack Group
• Using a Service Pack Group

Affected Product(s)

Shavlik Protect 9.1.x

Shavlik Protect 9.0.x

Purpose

This document covers a deployment requirement with Java 7 Update 71+ when the Remove Temp Files option is enabled in the Deployment Template used during deployment.

Description

We have recently changed the deployment behavior for Java 7 Update 71+.  The changes were made to better support recent Java installer changes that were causing Java updates to fail to install.  Java 7 Update 71+ installs will now be scheduled to run at system reboot.  For this reason, the patch must remain on the server so it can be used to install the patch at restart. Enabling the Remove Temp Files option in a custom Deployment Template will remove the patch before reboot thus breaking the deployment process.

 
Deployment Template General Tab

Resolution

Use a Deployment Template where Remove Temp Files is disable. 

The target machine must restart after deploying Java 7 Update 71+.

Products

Shavlik Patch 9.x

The purpose of this document is to list the minimal permissions required for VMware host credentials (browse credentials) that are provided for operations in Protect.

Description 

Required Roles

These permissions are set within vSphere.

At the vCenter level (if used):

A role is needed with at least *Global->Licenses checked at the root level (vCenter level) to be able to see the license.Otherwise one role that matches the ESX host level below at all levels.

At the ESX host level: (propagated to all sub levels)

Make sure the permissions listed are checked

*Datastore->Browse (Datastore.Browse)

*Global->Licenses (Global.Licenses)

*Resource->Assign Virtual machine to resource pool (Resource.AssignVMToPool)

*Virtual Machine->Interaction->Acquire guest control ticket (VirtualMachine.Interact.GuestControl)

*Virtual Machine->Interaction->Device Connection (VirtualMachine.Interact.DeviceConnection)

*Virtual Machine->Interaction->Power Off (VirtualMachine.Interact.PowerOff)

*Virtual Machine->Interaction->Power On (VirtualMachine.Interact.PowerOn)

*Virtual Machine->Provisioning->Allow disk access (VirtualMachine.Provisioning.DiskRandomAccess)

*Virtual Machine->Provisioning->Mark as template (VirtualMachine.Provisioning.MarkAsTemplate)

*Virtual Machine->Provisioning->Mark as virtual machine (VirtualMachine.Provisioning.MarkAsVM)

*Virtual Machine->State->Create snapshot (VirtualMachine.State.CreateSnapshot)

*Virtual Machine->State->Remove snapshot (VirtualMachine.State.RemoveSnapshot)

Additional Information

Some additional information worth noting:

-Protect needs to connect to the vCenter server to be abel to patch VM templates.

-VMware tools must be installed on VMs and VM templates.

-It is required to provide a local administrator account for the target system set in the machine group (to deploy to offline VMs).

Virtual Machine Template Patching Requirements & Informational Document

Patching process of a virtual infrastructure

Products

Shavlik Protect 9.x

Symptoms

You are able to successfully scan a machine, but when you attempt to deploy to the machine it fails.

Cause

This can happen because when you scan the machine it will use the default credentials - which are valid. Then when you attempt a deployment it will use the credentials assigned in the Machine Properties. If the Machine Properties credentials are no longer valid the deployment will fail.

Resolution

Change machine property credentials.

• Click View > Machines.
• Right click one of the selected machines and choose Machine Properties.
• In Machine Properties select 'Assign credential for the selected machines' then choose the desired credential.

You can also choose to leave the Credential in Machine Properties left blank. This way the deployment will use default credentials or credentials assigned via machine group when performing the deployment.

Affected Product(s)

Protect 9.X

Hello

We are having some problems in bring some of our systems up to date. We have 2 security products, Nessus and Shavlik. When we scan with Nessus it shows that we need to install some apache patches but when we scan with shavlik it does not show the apache patches as missing.

Does anyone know why this might happen?

Thanks

Regards

Roy

I am getting an error when trying to send patches to a specific machine. Error is "Failed - Deployment machine name match failed, expected '1YJXN22' actual"

I have checked credentials and they are correct. this machine is new but has accepted patches until last week. any suggestions?

Purpose

This document provides documentation to our clients on how Java deployments in Protect have changed recently and why these changes had to be made, as well as providing best practices to ensure proper deployment of Java patches.

Symptoms

Shavlik Protect users may have experienced issues deploying recently released Java patches (Java 7 Update 71), or noticed changes in the deployment mechanism. In some cases Java deployment status may repeatedly return the status "Reboot may be required\Installation failed". In other cases Java patch deployments that previously worked without a reboot may not show up as installed in Protect as installed until a reboot is completed. Understanding changes made to Java deployment in Protect and how to respond to them can help administrators keep Java fully patched in their environment.

Description

Due to changes in recently released Java patches (Java 7 Update 71+) that caused silent patch installations to fail - changes had to be made to the way Shavlik deploys these and future Java patches. These changes had to be made to ensure continued support of Java patches in Shavlik Protect.

Java update installs will now be scheduled to run at system reboot. This means that deployments that do not require a reboot will not complete until a reboot is processed. Additionally, because deployments are processed at boot using a deployment template that removes temporary files will ensure failure. (For more information see the following document: Remove Temp Files option may cause Java 7 Update 71 and later fail to install).

Resolution

To ensure successful patching, deployments of Java 7 Update 71+ should use a Deployment Template that will reboot the client and does not remove temp files.

Product

Shavlik Protect 9.x