Hey All,

We are currently running (3) ESXi 5.1.0

We have a VM running the shavlik protect. Whenever we scan the 3rd server (Just so happens that that server hosts the VM with shavlik on it) it will PSOD.

Wanted to know if anyone's come across that. If perhaps, shalvik is not supposed to the server it is on? or if there's some settings we missed? Any help guiding us to the right direction would be appreciated.

Purpose

Many of the common Shavlik Protect scan errors can be corrected by changes to configuration or environment. This article lists the most common scan error messages and provides some guidance on correcting the issue.

Cause

Scan errors can occur:

• If one or more of the Shavlik Protect Scanning Prerequisites have not been met 
• If one or more configuration issues are present in Shavlik Protect 
• Due to one or more environmental issues

Resolution

Affected Product(s)

Shavlik Protect All Versions

Purpose

This document outlines how to scan for the Null Patch, then use custom actions to stop a Windows Service with a batch file, and install a 3rd party program.

Scanning for null patch

Custom Actions only run during a deployment. Deployments can only occur if a scan has found a missing patch it can deploy. In some situations it may not be desirable to apply missing patches to a computer, or there may be no missing patches to deploy. In either case you can scan for Custom Action patches/The Null patch. The Null patch is a file created by Shavlik, that will always show as missing, and when ran does absolutely nothing. It provides a way to run a deployment and only modify the target computer based on the custom action.

Related Document: NullPatch.exe/Noop.exe Information

Custom action Setup & Use

This video goes over how to setup a scan to find the custom action/null patch.

A Custom Action is associated with a Deployment Template, which means it can only be used during a deployment. Now that there is a missing patch available to deploy (re: Scanning for Null Patch), this video will cover how to setup a custom action for use.

In this video, we setup a custom action to stop a service using a batch file, and then install a 3rd party program.

Affected Product(s)

Shavlik Protect 9.x

Purpose

This document outlines utilizing an included utility to troubleshoot common Agent issues.

Description

    Running STAgentManagement

1. Run Command Prompt as Administrator and change directories to the Shavlik Protect Agent folder.

Note: When not running Command Prompt as Admin, the output file may not work.

2. Enter the following command:

• STAgentManagement.exe -diag agentdiag.txt

3. A new command prompt window will open  with scrolling text, this is the STAgentManagement utilitiy runing. Once finished, Press Enter to exit. Please go to the newly created agentdiag.txt in your Shavlik Protect Agent directory and view the results.

Affected Product(s)

All

Symptoms

Patches released after April 2014 are not being detected as missing on 2012 R2 server or Windows 8.1 operating systems.

Cause

KB2919355  CU1 is not installed on the system so no updates can be applied.

From the MS KB: http://support2.microsoft.com/?kbid=2919355

Important All future security and non-security updates for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 require this update to be installed. We recommend that you install this update on your Windows RT 8.1, Windows 8.1, or Windows Server 2012 R2-based computer in order to receive continued future updates.

Resolution

Install KB2919355 on the affected systems

Affected Product(s)

Shavlik Protect: All Versions

Shavlik Patch: All Versions

Purpose

This document outlines how to run a DPDTrace. This may be necessary when troubleshooting detection issues.

Steps

DPD stands for Dynamic Product Detection.  It’s the method our scan engine uses to determine what supported products are installed on the machine.This tool was created for troubleshooting patch scan issues where we need to know what is going on during the DPD process.

.Net Framework v4.0.30319 or newer needs to be installed for this to work

1. Download DPDTrace.zip and extract the file into a folder on the root of C:\
2. Read Disclaimer.txt.
3. Open Command Prompt and change directory to C:\DPDTrace

4. Enter the following command, replacing {MACHINE_NAME} {ADMIN_USER_NAME} {PASSWORD} and {PATCHTYPE} with corresponding values. ({MACHINE_NAME} has to be the Target machine that is having the detection problem

          DPDTrace.bat {MACHINE_NAME} {ADMIN_USER_NAME} {PASSWORD} {PATCHTYPE}

5.      When the command line is run, a window titled 'Rename HF.1 Log' will appear with an OK button. Do not close this window as the scan continues.

6.    When the scan has completed the command prompt window will say 'Test Complete  Please zip up HFCLi folder and send it back to us'. Please verify that an XML document has been created in the HFCLI folder. If it has, please zip up the directory "C:\DPDTrace\HFCLI" and send it back for analysis.

Symptoms

When attempting to scan a Hosted Virtual Machine or virtual machine Template, You get the error "802: Unable to open Virtual Disk (4000).

Cause

The status code (4000) translates to 4000 – VIX_E_VM_NOT_FOUND and as a result Protect is unable to reach the Hosted Virtual Machine or Virtual Machine Template.

Resolution

The most common cause for the status code (4000) is due to a special character within the datastore path. These special characters may be one of the following:

%, &, *, $, #, @, !, \, /, :, *, ?, ", <, >, |, ;, '

Please remove any of these characters from the datastore path.

Additional Information

For additional information concerning the scan Error 802: "Unable to open Virtual Disk" please visit the link below:

http://community.shavlik.com/docs/DOC-23104

Affected Product(s)

Shavlik Protect 9.x

Symptoms        

Agents are unable to patch the machine. A similar message to the one below is seen within the STPatch.log file located within:

Example:Added disable date for {MSWU-516]  [Q2529073]

Protect 9: 

    o Vista & Later: C:\ProgramData\LANDesk\Shavlik Protect\Logs

    o Earlier OS’s:  C:\Documents and Settings\All Users\Application Data\ LANDesk\Shavlik Protect\Logs

Protect 8:

    o Vista & Later: C:\ProgramData\Shavlik Technologies\Logs

    o Earlier OS’s:    C:\Documents and Settings\All Users\Application Data\Shavlik Technologies\Logs

Cause

This message indicates the patch referenced failed too many times and was flagged. Within the agent, if a patch fails to download after 11 attempts or fails to install after 3 attempts the agent will stop trying to deploy that particular patch.

This can be resolved directly on the Console by accessing View > Machines. Right-click on the machine exhibiting the issue and navigate to Agents > Clear Retry Count as outlined in the illustration below:

Alternately, this can be achieved on the agent by opening the Agent UI and navigating to Patch Administration > Clear retry count within the 'Patch' tab as seen in the illustration below:

Once the retry count has been cleared, patches should download and deploy as normal.

Affected Product(s)

Protect Version: All

Description

The scheduler does not successfully launch the deployment batch file and the following error is seen within the Scheduler.log file in the C:\Windows\ProPatches\Scheduler folder.

Error:  AcquireCreds failed: 0x8009030d

Cause

The certificate or encryption key is out of date or incorrect on the target machine.

Resolution

1. Launch the registry editor by running the ‘regedit’ command from the run application.

2. Navigate to and delete the registry key corresponding to the Protect version you are running.
    Note: It is highly recommended that a registry backup is created prior to altering.

   Protect 9x:

    32-bit machines: HKey_Local_Machine\Software\LANDesk\Shavlik Protect\Scheduler\pk

    64-bit machines: HKey_Local_Machine\Software\Wow6432Node\LANDesk\Shavlik Protect\Scheduler\pk

3. Attempt to redeploy the patches. This process will fix the certificate or encryption key and the scheduler should now work as designed.

Affected Product(s)

Protect Version: All

Overview

You are attempting to install an agent using theManual Installation Scriptand the agent fails to register with the Protect Console.

You identify the issue through the following errors:

These logs are located on the client machine: C:\ProgramData\LANDesk\Shavlik Protect\Logs

Registration.log:

Agent Registration Operation Log.

Created Monday, January 01, 2015 01:01:01AM

Error: Agent registration failed.

STAgentManagement.log:

An cookie is required to be passed in

Cause

You are using the NetBIOS name of the Protect server in the install script, but name resolution from the client machine to the Protect server fails using NetBIOS.

STPlatformUpdater.exe /wi:"/qn /l*v install.log SERVERURI=https://ProtectServer:3121 POLICY=AV AUTHENTICATIONTYPE=PASSPHRASE PASSPHRASE=PASSPHRASE”

Resolution

• Correct the NetBIOS resolution issue from the client machine to the Protect server.
• Use the FQDN of the Protect server instead of NetBIOS.
• Use the IP Address of the Protect server instead of NetBIOS.

Affected Product(s)

Shavlik Protect 9.x

Purpose

The purpose of this document is how to create a patch group to and to exclude those patches from your scans. This is sometimes neccesarry when scanning for patches but you do not want specific patches to be installed.

Steps

1. To scan or exclude specific patches, begin by assigning the desired patches to a Patch Group. In Protect, open Patch View.
2. Locate the specific patch by searching or filtering.
3. Right click the patch, choose Add to Patch Group, then choose New Patch Group.
4. In the Patch Group window, enter a Name and Description to identify what the Patch Group will be used for, then click Save.
5. Next create a new Patch Scan Template.
6. In the Patch Scan Template window, enter a Name and Description to identify the scan template. Under Patch type filter settings select Scan All. Under Patch filter settings select Skip Selected, then click the Patch group(s) browse button
7. In the Select Patch Groups window, add a checkmark to the Patch Group(s) that contain the specific patch to be scanned for, then click Select
8. The selected Patch Group should now show as selected in the Patch Group(s) list. Click Save.
9. Scan using the Scan Template created. Results will only show those patches included in the Patch Group.

Additional Information

How to Include or Exclude specific Patches in Scan Results

Qnumbers

Affected Product(s)

Shavlik Protect 9.x

I want to upgrade from 9.0.0 to 9.0.1304 but when I run the installer I get an error "Could not access network location \\oldserver\shavlik (this was the download location for all the patches I updated this to be \\newserver\shavlik in Tools, Operations, Patch Downlaod Directory) Any assistance would be appreciated.

Symptoms

For this issue, all items listed under symptoms are used to determine the problem. If you see the red X for any Data versions, but don't see all listed behavior mentioned here, you might be experiencing a general download issue or some other problem.

1) The main actual symptom of the "problem".

Within the Help > About Shavlik Protect information you see a red X for definition versions, but you see a newer version listed under the Definitions file list.

2) You have the core engines/definitions configured for a scheduled automatic download via Tools > Operations > Downloads.

3) You can see within View > Event History that the Core definitions download task has been running successfully.

Cause

This is expected behavior. The Protect console has not been closed/re-opened since the scheduled automatic download of definitions took place. The console cannot update Help > About in the UI until Protect is restarted because the scheduled automatic download of core definitions is  taking place outside of the Protect UI as a background task.

Resolution

Close and re-open Shavlik Protect to ensure definition information downloaded via a background task is loaded.  If this does not resolve the issue for you, try running Help > Refresh Files. Otherwise, you may be facing a different problem.

Affected Product(s)

Shavlik Protect 9.x

Symptoms

You may see a pop-up error:

Protect Setup:

Error 1603: A fatal error occurred during installation

Error 1605: This action is only valid for products that are currently installed.

Error 1612: The installation source for this product is not available. Verify that the source exists and that you can access it.

You may see a message that says "protectinstaller.msi was not found".

Purpose

This article provides information on manually un-installing Shavlik Protect. This document is generally meant for the purpose of cleaning up a bad or broken installation of the Protect application.

Cause

Occasionally, the application may not be removed completely due corruption to the Windows Installer, Installer folder or other corruption to the automated uninstall process. When this occurs a manual un-install of the application is necessary.

Resolution

You may need to use the steps below to perform a manual uninstall of the application, and then re-install as necessary.

Microsoft provides assistance with the manual uninstall process by providing a Fix it tool.  The link to the tool is:  http://support.microsoft.com/mats/Program_Install_and_Uninstall

Here are instructions on how to use the Fix it tool

1. Use the link above to navigate to the Fix it main page.
2. Click on ‘Run Now’ and choose ‘Save File’.
3. Run the EXE that is downloaded and choose ‘Accept’ on the first page.
4. Choose the second option ‘Detect problems and let me select the fixes to apply’.
5. Choose the ‘Uninstalling’ option
6. You will see a list of the installed products on the server.  Choose the product if you see it on the list for instance. ‘Shavlik Protect’.  If you do not see the product on the list then select ‘Not listed’.

If Shavlik Protect, vCenter Protect, or Netchk Protect is listed:

1. Choose the corresponding name and click ‘Next’.
2. Choose ‘Yes, try uninstall’
3. Verify both options are check-marked and click ‘Next’.
4. You should see a screen that indicates whether Protect was uninstalled or not.
5. Click ‘Next’ and the close out of the screen.

If Shavlik Protect, vCenter Protect, or Netchk Protect is Not Listed:

1. Choose ‘Not Listed’ and click ‘Next’.
2. Enter the product code for the version of the Product installed and click ‘Next’. (Include the brackets)

     Product codes for Protect are listed below.

1. Verify both options are check-marked and click ‘Next’.
2. You should see a screen where it indicates whether the product was uninstalled or not.
3. Click ‘Next’ and the close out of the screen.

Product GUID codes:

Make sure to use the corresponding GUID for the version of Protect you are attempting to uninstall.

Protect 7.0.832.0: {C6D1AE7C-DE93-4E93-A916-C4144525C82C}

Protect 7.0.841.0: {C6D1AE7C-DE93-4E93-A916-C4144525C82C}

Protect 7.1.410.0: {90047C28-0B1B-4B30-8177-50729907EBF2}

Protect 7.2.155.0: {9B7F1E45-4C47-4E25-9EAB-098923E4171C}

Protect 7.5.2716.0: {CEA2D643-08C0-422E-9B27-B58ED9D38D07}

Protect 7.6.1482.0: {661A3308-5BE2-4E0F-A752-BDDB247DD2DB}

Protect 7.8.1340.0: {0A4D8D5E-7177-4A45-8A7F-0A5757403F97}

Protect 7.8.1388.0: {0A4D8D5E-7177-4A45-8A7F-0A5757403F97}

Protect 7.8.1392.0: {0A4D8D5E-7177-4A45-8A7F-0A5757403F97}

Protect 8.0.3756.0: {F77AFB04-D13F-48DA-BB99-A5B31B6AAE0B}

Protect 8.0.3965.1: {5A696B05-9F06-4B3D-83A0-69E848EFAC4A}

Protect 8.0.4027.2: {5A696B05-9F06-4B3D-83A0-69E848EFAC4A}

Protect 9.0.1106.0: {8045AD29-C6A4-43F5-9F1F-9560EB09F99A}

Protect 9.0.1182.0: {070964CB-00B0-4E36-A3F6-A09F76FBD197}

Protect 9.0.1182.0  {B7F5FF6F-382B-8834-3B85-B6390F7F4DA1}

Protect 9.1.4334.0: {83593D3F-ADD7-491B-82EC-1A2E6D08C385}

Protect 9.1.4472.0: {83593D3F-ADD7-491B-82EC-1A2E6D08C385}

ScriptLogic Patch Authority Ultimate 8.0.3756: {A8210996-CD25-4C8C-A2D7-207635DEDC28}

ScriptLogic Patch Authority Ultimate 8.0.4027: {86DE6110-3F1C-40EE-98D9-05CD7A4B212F}

ScriptLogic Patch Authority Ultimate 9.0.1182: {0EAD1B8A-6F58-2304-A817-34C1724CE04C}

At this point, install the latest version of Protect.

If you continue to encounter any install errors, contact Shavlik support. (http://www.shavlik.com/support/contact/)

If the Fixit tool fails to correct the error, you may need to manually delete an upgrade key located under HKEY_CLASSES_ROOT\Installer\UpgradeCodes in the registry. Then try reinstalling Protect with the latest installer.

Latest versions of Protect can be downloaded from: http://www.shavlik.com/downloads/

It is highly recommended to perform a backup of the registry before performing any modifications.

How to backup Windows Registry:  http://windows.microsoft.com/en-US/windows-vista/Back-up-the-registry

Impact / Risks

The Fixit utility is provided by Microsoft. Make sure you read any known issues or guidelines for this tool on Microsoft's site prior to use.

Affected Product(s)

Shavlik Protect 9.x

Hi All,

I've got a request from our security team to be able to just do reporting from Shavlik, but not be able to deploy patches or change anything.  Is there a way to set this up?

Tkx

Symptoms

• Detected patch continues to show as missing after successfully deploying.
• Patch that shows missing ends with 'U' every other deployment.

Cause

Certain patches exist as an installer and an uninstaller; these patches can cause a loop when scanning and deploying. When the installation patch is deployed it makes the uninstall patch considered to be missing. These patches are designed by their vendor in this manner to facilitate adding/removing the patch according to environmental needs. If scanning/deploying these types of patches it may appear that the patch continually is missing as it continues to add/remove per deployment. The uninstall patch will end with 'U'. These patches tend to belong to the 'Security Tools' patch type.

Example: Missing the Installation Patch

Example: After Installed, Now Missing Uninstall Patch

Resolution

Exclude the specific patch utilizing a patch group, or choose not to deploy the patches installer/uninstaller after scanning.

Refer to the following document:

How to Find/Exclude Specific Patches in Scan Results (DOC-22967).

These are known patches that offer an uninstaller.

• Q2719615(U) - MS12-A04
• Q2719662(U) - MS12-A06
• Q2794220(U) - MS12-A10
• Q2847140(U) - MS13-A02
• Q2887505(U) - MS13-A08
• Q2896666(U) - MS13-A09
• QIE9001(U) - MSIE-002

Affected Product(s)

Shavlik Protect 9.x

vCenter Protect 8.x

Purpose

This document outlines how to test that Magic Packets are successfully being sent to a target machine during a Wake-on-Lan request.

In the event Protect indicates the Wake-on-Lan request is being sent, but the target machine is not turning on, these steps can be used to test potential issues.

Note: This test makes use of a 3rd party freeware application. Shavlik has not fully tested this product so would recommend that our customer undertake their own full testing and investigation of this product.  Shavlik cannot be held liable for any issues resulting from the use of this product.

Wake-on-LAN (WoL) Requirements

Steps

• Begin by downloading WOL-Magic Packet Sender.Check the vendor’s advice (http://magicpacket.free.fr/) for the correct version of the WOL magic packet to download.
• Install WOL-Magic Packet Sender by following the prompts.

• Once WOL-Magic Packet Sender is installed, launch the application.

• Inside WOL-Magic Packet Sender, click theReceivetab.
• Click the Start button to begin listening forMagic Packets.

• In Protect, right click the machine that WOL-Magic Packet Sender was installed on, and choose Power > Wake on Lan.

• InOperation Monitor, clickSend.

• The Shavlik Protect Operations Monitor should now display if the Magic Packets were sent successfully from Protect. (This only indicates that Protect sent the Magic Packets out, it is not a reflection of if the target received them and powered on).

• On the Target machine, WOL-Magic Packet Sender should be listening for Magic Packets sent on UDP 9 (Protect uses this port for WOL). If all components in the network are properly facilitating the packets to the target, a prompt should occur indicating the Magic Packets were received.

Packets Received, but WOL Still Does Not Work?

If the test above is successful, this is an indicator that Protect is correctly sending Magic Packets to the target machine. If the test is successful, but the Wake-on-LAN feature still does not work, this is an indicator that the target machine is not processing the Magic Packets correctly. This can be caused by NIC settings, BIOS settings, or other hardware/OS components. At this point the target machine and/or components would need to be investigated with their vendor.

Affected Product(s)

Protect Version: All

Hi,

I am trying to script a post installation process, which includes running our monthly patch feature in Shavlik Protect Agent 9.1.

Can I run this in a BAT-file?

Thanks in advance.

My company has a support contract from Microsoft so we are able to download XP patches - but I don't know how to push them to our machines. Can I just create a custom patch?  If it's possible to deploy them this way, I'd like some guidance on creating custom patches.  

I note in the list of available patches Microsoft Forefront Endpoint Protection 2010 is listed but not 2012. The updates just come down via Windows update, so I guess should be supported?

I'm after KB2998627 specifically October 2014 anti-malware platform update for Endpoint Protection clients