Purpose         

This document outlines how to cancel a scheduled task.

Steps

In Protect choose Manage > Scheduled Tasks.

For Deployments

Select the target machine in the tree on the left. Deployments are scheduled on the target machine.

For Scans

Select the Console machine in the tree on the left. All agent-less scans are stored in the Console's scheduler. This means that even if you are scanning a different target machine, you still select the Console machine from the tree.

When the intended machine has been selected, the Scheduled Jobs should automatically populate in the list on the right.

Right click the desired job, and choose Delete.

When prompted to confirm, choose Delete.

After the job is deleted the Scheduler for the selected machine should refresh, and the scheduled task should no longer be displayed.

NOTE: You can delete all machines from a domain or workgroup at once, but this will delete all scheduled jobs within it. To do so, select the domain/workgroup from the tree in the left window pane and then right-click and select 'Delete selected job(s)' and this will delete every job within the selected domain/workgroup.

Affected Product(s)   

Shavlik Protect 9.x

Symptoms

• Cannot scan a remote machine with Protect
• Scanning a remote machine in Protect fails with the following error: 
  Error 452: Unable to connect to the remote machine

          You can see the error code listed in a scan result under the 'Machines Not Scanned' tab as well. 

Cause

This issue occurs if one or more scanning prerequisites are not met, usually due to a configuration issue. Generally, 452 indicates that the provided credential is invalid for accessing the remote system or does not have permissions for some component of the remote system.

Resolution

To resolve this issue:

1. Review and ensure you are meeting the Agentless Patch Scanning Prerequisites.
2. Reboot the Protect console machine.
3. Verify if the Server and Remote Registry services are enabled on the remote machine and that you can remotely log in to this machine.
   To test the remote registry connection:
   1. Click Start> Run, type regedit, and click OK. The Registry Editor window opens.
   2. Click File> Connect Network Registry.
4. Ensure that the Workstation service is running on the machine performing the scan.
5. Check if there is already a connection between the server and scanned device and that this connection is using a different set of credentials than the Protect patch server. In this case,the Protect patch server cannot establish the connection. If the target machine being scanned is already connected to the scanning server via a drive mapping, the scan fails
6. Try scanning the target machine using both IP and Name.
7. Test the admin share using this command:
   
   net use\\machine_name\IPC$/user:domain\ username password
   
   Note: Provide the actual name of the machine you are trying to scan, along with the same credentials that you are attempting to scan with. You can substitute machine_name with domain if you are using local credentials.
8. Check the Local Area Connection properties on the target machine to ensure that File and Printer sharing is enabled.
9. Try lowering your thread count for simultaneous machines scanned in the scan template to see if this eliminates the error. To do this, navigate to Scan template> General tab.
   
   

Additional Information

The patch below has been known to be the root cause of some error 452 failures:

MS15-027 (KB3002657) May Cause Patch Scans To Fail With Error 452

The following document may also prove helpful:

Scan Error 451 or 452 When Scanning A Machine Located In A Workgroup

Also, Microsoft provides a patch to resolve this issue in a specific scenario.

To verify if this is applicable, open a command prompt and run these commands:sc.exe \\Target_Computer_Namequery
sc.exe\\Target_IP_AddressqueryIf sc.exe using Target_Computer_Name works, but sc.exe using Target_IP_Ad does not work, you must apply these patches: In the console machine:

• For Windows Server 2008, 2008 R2 and 7, apply either SP1 or the patch described in the Microsoft Knowledge Base article 2194664.
• For Windows Server 2003 and 2003 R2, apply the patches described in the Microsoft Knowledge Base articles 975467 and 968389.

In the target machine:

• For Windows Server 2008, 2008 R2 and 7, there are no available patches and this issue is not seen to occur in these target operating systems.
• For Windows Server 2003 and 2003 R2, apply the patches described in the Microsoft Knowledge Base articles 975467 and 968389.

Affected Product(s)

Shavlik Protect, All Versions

Purpose

Many of the common Shavlik Protect scan errors can be corrected by changes to configuration or environment. This article lists the most common scan error messages and provides some guidance on correcting the issue.

Cause

Scan errors can occur:

• If one or more of the Shavlik Protect Scanning Prerequisites have not been met 
• If one or more configuration issues are present in Shavlik Protect 
• Due to one or more environmental issues

Resolution

Affected Product(s)

Shavlik Protect, All Versions

Symptoms

• Running a patch scan in Protect  fails with Error 105.
• This message may also display:
  MS_UNABLE_TO_GET_SYSTEM_DATA

Cause

Possible causes:

• Permissions issue with access denied message.
• An environmental or network issue.
• The target Windows machine is not activated.

Resolution

This is a list of things you should check when seeing patch scan error 105 occur:

1. From the Protect console, launch Regedit and attempt to connect to the remote registry of the target machine by IP address.
   Note: Protect needs full access to the target machine's registry.
2. From the Protect console, go to the target machines c$ and browse to c:\windows\system32. Make a copy of the file ntdll.dll and view the Properties. Is anything blocking the access, or hanging the process of looking at this file? Protect may be trying to look at this file while trying to determine the machine info. The ntdll.dll file is checked first, and Protect determines the OS language.
3. The Server Service on the remote target machine is queried with an API. If this service is not running, or is not communicating in a timely fashion Protect will return a 105 error. If you restart this service you will also need to reboot the machine, but it can help to restart the Server service.
4. Disabling Antivirus or threat protection software can potentially correct Error 105. If this works you may need to make exceptions in your antivirus. Contact your antivirus vendor for steps on how to do so.
5. Use an administrator account to run patch scans.
6. Ensure firewalls are not blocking the connection.
7. Ensure you are meeting patch scanning requirements as described in Protect documentation. Please see the patch scanning prerequisites.
8. Other possible tests to determine the issue:
   • Ensure Windows is activated.
   • Scan by FQDN. 
   • Net use to ipc$ on the target system.
   • On the console machine, run these commands:
     sc \\servername query
     sc \\IPaddress query
     Note: If these commands fail, the issue may be network related.

Additional Information

Scan error 105 can often be caused by some of the same environmental issues that will cause scan error 452. It may prove helpful to review this document as well:

Error 452: Unable To Connect To The Remote Machine

Affected Product(s)

Shavlik Protect, All Versions

Purpose

How to troubleshoot 2359302 errors in the Deployment Tracker, CL5 Log, and the Windows Event Viewer

Symptoms

• Deployment Tracker in Shavlik Protect displays the Status Failed with a Description of "returned 2359302"

• c:\windows\propatches\CL5 Log on the target machine shows CommandLine.cpp:1833 CMD_TRACELOG: [Patch Install returned 2359302: Windows6.1-KB2861698-x64.msu]
• Windows Event Log show:  "Windows update  could not be installed because of error 2359302 "" (Command line: "C:WindowsSystem32WUSA.exe "C:WindowsTEMP739d98c6-b473-4611-9ecc-62da945d89eaWindows6.1-KB2388210-x64.msu" /quiet /norestart ")".  Error 2359302 = WU_S_ALREADY_INSTALLED

Cause

2359302 is a Microsoft code that signifies the patch has already been installed.

The 2359302 message is also occasionally returned in error when the Windows Update Service is not working properly  See. Eventvwr shows 2359302 ErrorCode

Resolution

Reboot the target machine to ensure the previous install attempt did not just need a reboot.

Check the patch Definition Version under the scan summary.  Sometimes a deployment is based on a older scan job that detected the patch as missing.  See How to check Protect Definition Versions for instructions to check Definitions version and to refresh files.  If Patch Assessment version is outdated, refresh files and re-scan to see if the patch is still showing as missing.  If the patch is still listed Under "Patch Missing", follow the troubleshooting steps in the document Protect Detects A Patch That Should Not Be Detected As Missing to determine if the Shavlik detection logic is in error. If the patch definition logic seems to be is in error, follow instructions under the Information to Send to Support section of the same document and open a case with Shavlik Support

If Shavlik Protect is detecting the missing patch correctly and manual installation fails, the Windows Update Service may not be working properly  Refer to the following Microsoft posts:

Eventvwr shows 2359302 ErrorCode and

Unable to install updates in Windows Vista, Windows 7, Windows Server 2008 and Windows Server 2008 R2

Additional Information

Microsoft Community Posts addressing code 2359302:

Microsoft Community - Microsoft Windows

You can't install updates in Windows Vista, Windows 7, Windows Server 2008, or Windows Server 2008 R2

Affected Product(s)

Protect 9.X

We are receiving the following error message after April 2015 Microsoft Windows Server Updates have been successfully applied.

Shavlik Protect Standard 9.0 Build: 1316 (Patch 3)

Microsoft Windows Server 2008 Standard (x64) SP2

Multiple browsers, computers, etc.  Any thoughts?  I am mainly talking about the Registered Consoles and Agent Keys tabs...

Looks like with definition 2.0.1.2160 Protect is scanning for malicious software tool version 5.23 (current) but deploying version 5.22.  Refresh files did not fix this.  I downloaded the 5.23 files from Microsoft and named them xxx5.22 and that seems to have worked.

Using my machine as an example, there were 0 patches missing prior to the new MS patches being released yesterday. After a scan and patch twice over today, 4 patches are now showing as "Missing" per Shavlik even after installing all the new patches. The problem here is that these 4 patches are already installed, and are from 2012 and 2014 that mysteriously now show as missing.

If you try to install them manually, Windows shows that the patches are already installed. If you run an MS Update, it also shows that the patches are installed. I have rebooted 3 times. Why does Shavlik think these patches are missing now?

The patches detected as missing are:

1. MS15-031 - KB3046049

2. MS14-074 - KB3003743

3. MS14-068 - KB3011780

4. MS12-006 - KB2585542

Symptoms

Protect 9.1 Patch 3 upgrade fails with the following error:

Product: Shavlik Protect -- Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action SetupDatabaseAction, location: C:\Program Files\LANDesk\Shavlik Protect\ST.DatabaseConfiguration.exe, command: -quiet -upgrade -consoleId 355702d6-33f5-4ca7-9853-202534b4bcd8 -timeout 30

The ST.DatabaseConfiguration.log located in the %temp% directory contains the following line:

2015-04-16T12:23:25.2319578Z 0004 E DatabaseState.cs:77|System.Data.SqlClient.SqlException (0x80131904): Database state cannot be changed while other users are using the database 'Protect'

Cause

The Protect database has existing connections from other users.  This frequently occurs when other Shavlik Protect Consoles share the same database.

Resolution

Stop the Protect Console Service on all Protect Consoles sharing the database and upgrade each console while each has a sole connection to the database.

Additional Information

Error 1722 has also been returned in Protect 9.0 upgrades under the following situations:

• Shavlik Protect is using a mirrored database
• Upgrade being performed using an account that does not have the sysadmin role or is not the account that originally created the database

Troubleshooting and resolution for the above scenarios are contained in the Shavlik document Protect 9.0 with Patch 1 full product installation or Patch 1 install failing with "Error 1722"

Affected Product(s)

Protect 9.X

Symptoms

• Scan attempt against a remote machine using Protect fails with the following error.

Error 235: System not found, or NetBIOS ports may be firewalled

Cause

This issue occurs if a machine with the specified IP address does not exist. If a machine does exist at this address, a personal firewall or port filtering device may be dropping packets destined for TCP ports 139 and 445.

Resolution

To resolve this issue:

1. Ensure that a machine actually exists at the specified name or IP address. To verify this, use a command prompt to ping the machine.
2. Ensure that you can remotely connect to the target system(s) over ports 139 and/or 445. To verify this, you can use the telnet command or any other method.
   
   For example, you can use a telnet command similar to:
   
   telnetmymachine 139
   
   Note: The telnet client may not be installed by default on newer Windows operating systems. You may need to add it through Windows features to use the telnet command.
3. Ensure that there is no DNS resolution issue. To verify this, open a command prompt on the Protect console machine and perform a forward and reverse nslookup of the target system.
   
   For example:
   
   nslookup machinename
   nslookup 0.0.0.0
   The results should match.
   
   If the machine cannot be properly resolved, contact your network administrator.

Affected Product(s)

Shavlik Protect 9.x

Purpose

This document will walk you through on configuring your machine so that it can be scanned while it is part of a workgroup and not in a domain.

Symptons

Although you have the correct credentials, Protect fails to scan a machine that is not part of a domain. Errors include 451 The specified user account requires administrative rights to the target machine. or 452  Unable to connect to the remote machine or 5: Access is Denied.

Resolution

For machines using Windows operating systems that employ the use of User Account Control (this includes Windows Vista or later and Windows Server 2008 or later), you must either:

Join the machines to a domain and then perform the scan using domain administrator credentials, or

Disable User Account Control (UAC) remote restrictions on the machines.

To do this:

1. Click Start, click Run, type regedit, and then press Enter.

2. Locate and then click the following registry subkey:

     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

3. If the LocalAccountTokenFilterPolicy registry entry does not exist, follow these steps:

     a. On the Edit menu, point to New, and then click DWORD Value.

     b. Type LocalAccountTokenFilterPolicy and then press Enter.

4. Right-click LocalAccountTokenFilterPolicy and then click OK.

5. In the Value data box, type 1, and then click OK.

6. Exit Registry Editor.

For more details on disabling UAC remote restrictions, see http://support.microsoft.com/kb/951016

After refreshing to XML 2.0.1.2214 and running a patch scan, our PCs are showing Bulletin MS12-001 / KB2644615 as missing.  I believe that patch was superseded by MS13-063 / KB2859537, which was subsequently superseded by MS13-077 / KB2872339.  Any idea why this patch is being detected as missing now?

Thanks.

I am trying to create a custom patch to apply a MS hotfix to my 2012 servers (Windows8.1-KB3000988-x64.msu). I have looked at the documents online, and followed them to create the custom action and custom patch, but have been unable to test it because it is not showing up as available to select in my patch group. Any suggestions? I am running Protect v9.1 Build 4511.

Purpose

The purpose of this document is to walk through the agent Patch tab, in order to understand and utilize these functions and features of agents.

Description

Patch Tab:

Add a Patch Task

• Creates a new patch task

*Note: You can add multiple patch tasks to an agent policy, each will have scan and deploy options as well as schedule options.

Patch Task Options (drop down)

• Scan and deploy options
• Schedule

Scan and Deploy Options

• Patch scan Template
  • Select or create the patch scan template that will be used to scan your machines.
• Patch Deployment
  • Deployment Template
    • Select or create the Deployment Template you want your agent machines to use.
  • Deploy patches (which needs to be checked in order to configure the deployment template)
    • You can choose to deploy all patches detected as missing.
    • Or you can select or create a Patch Group to control what patches are deployed.
  • Deploy Service Packs - An option not included in the agentless scan/deploy, allows you to automatically deploy Service Packs.

• You can choose to deploy all SPs detected as missing.
• Or you can select or create a Service Pack group to control what Service Packs are deployed.
  • You can also limit SP deployments per day. Since each Service Pack deployment requires a reboot you may want to limit deployment to only a few a day.

Schedule

• Hourly
  • Run Every - 1 to 100 hours
  • Starting time
    • Enter desired time to have the schedule run.
• Daily
  • Enter desired time to have the schedule run.
  • Days
    • Select the days of the week in which you would like the schedule to run.
  • Once Per Month
    • Day - Select the numerical date in which to have the schedule run.
    • The - Here you can select the first, second, third, ect. day of any day of the week. Meaning if you select the third Monday, the schedule will run every third Monday of the month. 
• Randomize schedule time (minutes)
  • Select how many minutes the schedule is randomized, up to 120 minutes.
• Run on boot if schedule is missed.
  • Use this setting if you would like your machines to run the task on boot if the schedule was missed.
    • You can also delay the schedule after boot by minutes, up to 120 minutes.

Affected Product(s)

Shavlik Protect 9.x

Hi - we have about 80 pc's that need to be patched but are not on the domain (but are on the network). Would need to fight through firewalls, ports etc to talk. Is this something that the Shavlik agent would be able to handle? Any direction or links to white papers would be appreciated.

Purpose

The purpose of this document is to walk through the agent General Settings tab in order to understand and utilize these functions and features of agents.

Description

General Settings Tab:

Allow the user to

• See an icon in the notification area
  • This setting allows the end user to see an icon in the system tray. If unchecked you will not have the ability to perform any actions on the agent.
• Preform manual operations
  • This setting allows the end user to manual initiate actions using the Agent interface. Actions like initiating a Patch Task, Asset scan, Threat Scan or Power actions.
• Cancel operations
  • This setting allows the end user to stop actions initiated either manually or by schedule.
• Manage quarantine
  • This setting allows the end user to manage quarantined items.
• Temporarily disable Active Protection
  • Allows the end user to suspend Active Protection for a specific amount of time from the Agent interface.
• Disable Active Protection
  • Allows the end user to disable Active Protection altogether.
• Turn off notifications when Active Protection blocks known risks
  • Allows the end user to "Disable notifications" within the Agent Interface.

Logging

• Logging Level:
  • Basic - Logs just the minimum information.
  • All - Logs all possible information.
• Maximum log size:
  • By default this setting is set to 5MB and is configurable up to 50MB.

Check-in Interval: This setting indicates how often an agent machine will check-in

• Minutes - Select an interval between 10 and 600 to control how often an agent machine will check-in.
• Days - Optionally you can opt to have your agent check-in only once a day at a specified time.
  • Distribute check-ins over (minutes): Use this setting to send check-ins over a span of time instead of all at one time.
    

Engine, data, and patch download location

• Vendor over Internet - Forces agents to get all XML information and patches from the vendor over the internet.
• Distribution Server - Forces agents to get all XML information and patches from a previously configured Distribution Server.
  • By Agent IP range - You can choose to have your distribution servers setup via IP range and force the agent to use a Distribution Server based on the IP address of the agent machine.
  • Use Vendor Backup - When set to get information from Distribution Servers you can set this setting to allow the agent to obtain XML information and patches from the internet if they are not available on the Distribution Server.

Network

• Sync with the Protect Cloud - Check this if you would like to have your agents sync with the Protect Cloud in the event they are not located on the local network. Does require additional configuration.
• Agent listens for update on port - Configurable option to change the port number the agent listens and receives updates on.
• Internet proxy credentials - If your environment uses a proxy here you can specify your proxy credentials.
  

Affected Product(s)

Shavlik Protect 9.x

Purpose

The purpose of this document is to provide the necessary steps to schedule automatic definition downloads.

Resolution

1. From within the Console select the Tools menu followed by the Operations option.

2. Within the Operations window, navigate to the Schedule Automatic Downloads option. You may select to schedule automatic downloads for Core engines/definitions and/or Threat engines/definitions. Once you have selected the definitions you wish to update click the 'Add' button.

Note: You may setup both Core engines/definitions and Threat engines/definitions, however they must be done in two separate actions.

3. The scheduler window will now allow you to select the download days and times. When finished. Click 'Save'.

Note: Shavlik releases new XML data every Tuesday and Thursdays.

4. The scheduled download will now appear within the Schedule Automatic Downloads portion of the Operations menu.

5. This process is now complete. You may alter the days and times by highlighting the scheduled task and selecting the 'Edit' button.

Affected Product(s)

Shavlik Protect 9.x

I am a new user in an existing installation of Shavlik Protect. Whenever I attempt to open Protect, it tells me the the following error: "Unable to connect to SQL Server '(local)\SQLEXPRESS'. Cannot open database "Protect" requested by the login. The login failed. Login failed for user1.

Any help would be greatly appreciated. I have been going around and around on this for a few days and getting nowhere.

Hello,

After patching to the latest release of Shavlik Protect I get the following error message when I try to browse the network to add pc's to specific groups. "The list of servers for this workgroup is not currently available."

I have already confirmed that the "computer browser" service is started and it is set to automatic.

Any ideas?

Thanks