Patch Scan Results Showing 1 Or 2 Missing Patches Where Many More Patches Should Be Missing

July 15, 2014, 11:48 am

≫ Next: Shavlik Protect Firewall And Proxy Exceptions URL List

≪ Previous: Protect Patch Scan fails With: Error 501 - Remote registry access denied

Symptoms

Scan results will show a limited number of missing patches, generally Microsoft Visual C++ or Studio Shell. Additionally, the scan results will not show Patches Installed or Service Packs Missing

Results will show similar to this:

The expected results:

Cause

You are running in an unlicensed limited mode and you are very limited in the actions you are allowed to perform.

Resolution

Activate Shavlik Protect with a valid license, you can do this online or manually.

Affected Product(s)

Shavlik Protect 9.X

↧

Shavlik Protect Firewall And Proxy Exceptions URL List

December 31, 2012, 11:00 pm

≫ Next: Patch Scan Error Code 101: Unable To Determine OS Language

≪ Previous: Patch Scan Results Showing 1 Or 2 Missing Patches Where Many More Patches Should Be Missing

Symptoms

Patch files fail to download
Patch definitions fail to update
Threat definitions files fail to download
Activation or License Refresh fails
Home page RSS feed fails to load
Product check for update fails

Purpose

This article provides a list of required web addresses for the Protect application.

Cause

This issue occurs if one or more web addresses required by the Protect console server are blocked.

Resolution

To resolve this issue, ensure that these Web addresses required by Protect are accessible and allowed through firewalls, proxies, or web filters:

If you require the IP addresses to create exceptions you can find the IP addresses used for XML.shavlik.com here. To obtain the IP for vendor sites you can ping the site for the current IP address or contact the vendor to obtain this information.

Affected Product(s)

Shavlik Protect, All versions

vCenter Protect 8.x

Shavlik Rebrands

↧

Patch Scan Error Code 101: Unable To Determine OS Language

December 6, 2013, 7:58 am

≫ Next: Console Hangs When Selecting A Machine In View > Machines

≪ Previous: Shavlik Protect Firewall And Proxy Exceptions URL List

Symptoms

When running a patch scan with Protect, the target machine fails to scan, and you recieve the error:

Error 101: Unable to determine OS Language

Within the hf.log you see logging similar to this:

2013-11-19T21:20:38.3196511Z 1c2c E FastFile.cpp:98 GFF - Init failed
2013-11-19T21:20:38.3196511Z 1c2c V FileInfo.cpp:330 GetVersionData failed for \\192.168.x.x\C$\WINDOWS\system32\NTDLL.DLL
Invalid dos header
5001
2013-11-19T21:20:38.3196511Z 1c2c V FileInfo.cpp:218 Using FB
2013-11-19T21:21:16.1962083Z 1c2c V Machine.cpp:942 Unable to determine language
2013-11-19T21:21:16.1962083Z 1c2c V MachineSelector.cpp:668 Prereq - FAIL - Unable to determine System Language

2013-11-19T21:21:16.1962083Z 1c2c V Registry.cpp:224 ERROR: CloseOpenKey() - RegCloseKey returned error 1727 for key Handle 0x00000000004CC7E1.
2013-11-19T21:21:16.1962083Z 1c2c I MachineSelector.cpp:712 CHFScanThreadClass - DID NOT pass Prereqs

2013-11-19T21:21:16.1962083Z 1c2c V DBOutput.cpp:53 Start output of one machine (DB)
2013-11-19T21:21:16.1962083Z 1c2c I DBOutput.cpp:71 Reason [101]

Cause

Protect's scan process uses the target system's NTDLL.DLL file to determine the operating system's language setting. If this file is inaccessible or corrupt, the prerequisite validation fails and the scan is aborted.

Resolution

1) Verify that you are using an Administrator account to run the scan, and that the account has at least read rights to the ntdll.dll file on the target system.

The path to the file is C:\Windows\System32\ntdll.dll

2) Analysis of an affected DC revealed that the Network account was given explicit denial and the Administrator’s permission was drastically reduced. The cause of the permission change is undetermined, but the DC was involved in a system state restore as part of a disaster recovery process, it could have changed prior to, or during this event. Restore the permission to the original state as inherited from the C:\Windows\System32\ folder.

3) Open a command prompt on the target system, and try re-registering the dll using the following commands:

cd C:\Windows\System32

regsvr32 ntdll.dll

4) The operating system may be corrupted. You can try the following additional steps to possibly resolve this issue:

-Reboot the target system, and see if the issue still persists.

-Run the Microsoft System File Checker tool (sfc.exe). This Microsoft article is helpful: http://support.microsoft.com/kb/929833/en-us#manually

-If you have a restore point, you could attempt a system restore. More information about using system restore can be found in the Microsoft article, here: http://windows.microsoft.com/en-US/windows7/products/features/system-restore

Affected Product(s)

Shavlik Protect 9.x

↧

Console Hangs When Selecting A Machine In View > Machines

April 30, 2015, 11:08 am

≫ Next: The Specified Network Name Is No Longer Available: Error 64

≪ Previous: Patch Scan Error Code 101: Unable To Determine OS Language

Purpose

The purpose of this document is to troubleshoot an issue that comes up when someone selects a machine after going to View > Machines.

Symptoms

The console will hang and become unresponsive before it needs to be shut down and restarted. This will happen once a machine is selected from the Machine View. There will be no errors in any logs because the console will not reach a point where it crashes to log the error.

Cause

There can be multiple causes for the issue:

1) Database Resources were exceeded because SQL Express can only handle 1 virtual Socket and 4 cores. To resolve this issue, follow this article:Configuring Virtual CPUs To Optimize Performance With SQL Server Express And Shavlik Protect

2) The download patch directory is over 20GB in size and needs to be cleaned up. To resolve this issue, follow the steps below.

Resolution

1) Open up the Shavlik console that is attached to the Agent.

2) Go to Manage > ITScripts.

3) Highlight the 'Console Clean Up' script under the 'Maintenance' Category and then select 'Approve'. NOTE: This script deletes patches and deployment files that are older than the specified ages (default 180 days) since they were created or downloaded.

4) Once the ITscript has been approved. Close out of the 'Manage ITScripts' window and navigate to Tools > Run Console ITScripts.

5) This will bring up the Run ITScripts window. Select the 'Console Clean Up' script from the drop-down box (default if it is the only one approved) and click Continue.

NOTE: There are two different parameters with this ITScript.

deploymentAge (removes files from the DataFiles\Installs directory that are older than the number of days specified)
patchAge (removes files from the Patches directory (as specified in Tools > Downloads > Patch Download directory that are older than the number of days specified)

If you want to change the 180 day parameters for either the deploymentAge or the patchAge:

1) Select the parameter.

2) Click the 'Edit' button.

3) Select the value to remove files from the specified directory that are older than the number of days. (This is for the number of days that the file has been sitting in the specified directory NOT how old the patch is.)

6) Confirm the target machine affected and then select when you want the script to run and then click on Run.

7) Once the run has completed, verify that patches have been cleaned up based on the parameters specified above within the Patches directory (Default: C:\Windows\ProPatches\Patches or as specified in Tools > Downloads > Patch Download directory)

8) Go to View > Machines and then select a machine and the issue should now be resolved.

Additional Information

This may happen because the Protect console is trying to assess what patches within the Patches directory have been applied to the machines and if the folder is at a large capacity, the console will hang due.

This may also happen when anything is selected within the View menu.

Affected Product(s)

Shavlik Protect 9.x

↧

The Specified Network Name Is No Longer Available: Error 64

December 20, 2013, 12:16 pm

≫ Next: Shavlik Protect is not detecting MS13-A06

≪ Previous: Console Hangs When Selecting A Machine In View > Machines

CommunityTemplate

Symptoms

A patch deployment fails with the following error after machines were moved to a different domain :

The specified network name is no longer available: Error 64

Cause

Credentials entered in Manage Credentials contained the previous domain name in the User name field

Example: OldDomain\username

Resolution

Changed the User name field under Manage Credentials to reflect the new domain membership of the target machines

Example:
Original User name field, OldDomain\Username changed to NewDomain\Username

Affected Product(s)

Shavlik Protect 9.x

↧

Shavlik Protect is not detecting MS13-A06

April 30, 2015, 10:45 am

≫ Next: Patch Deployment Failure - Deployment Tracker Never Updates Past 'Executed 0 of X'

≪ Previous: The Specified Network Name Is No Longer Available: Error 64

I have MS13-A06 in my patch template, but Shavlik Protect is not finding it as missing. Qualys is showing it as missing and after manually installing the patch Shavlik Protect is not showing as installed either. version is 9.1.0 Build: 4511.

↧

Patch Deployment Failure - Deployment Tracker Never Updates Past 'Executed 0 of X'

May 1, 2015, 8:26 am

≫ Next: Superseded Patches Show Missing During Patch Scan

≪ Previous: Shavlik Protect is not detecting MS13-A06

Symptoms

Patches fail to install and the Deployment Tracker never updates past 'Executed 0 of X'.

Cause

There may be an issue with the Windows Event Log service, the CL5.exe is dependent on this window service or it will not function properly

Resolution

To resolve this specific error\scenario you will need to get the Windows Event Log service working correctly. Often, restarting the service or the computer will correct the issue

Affected Products

Shavlik Protect: All Versions

↧

Superseded Patches Show Missing During Patch Scan

May 1, 2015, 10:13 am

≫ Next: Upgrading Protect Fails With 'Error 2: The System Cannot Find The File Specified.'

≪ Previous: Patch Deployment Failure - Deployment Tracker Never Updates Past 'Executed 0 of X'

Symptoms

Some administrators may see multiple versions of the same Patch detected as missing despite them all not needed for installation.

An example of this is shown in the following screenshot:

Cause

This behavior is caused by Protect having been altered from its default configuration to not use replacement patches/supersedence in its patch scans.

Resolution

To resolve this, only a simple configuration change needs to be made to enable supersedence in Protect.

To do this:

- Open up Shavlik Protect.

- Go to Tools > Options > Scans.

- Check the box next to Use Replacement patches to enable supersedence in Protect and eliminate unnecessary missing patches.

- Rescan and you should see the desired patch scan results.

Affected Product(s)

Shavlik Protect 9.x

↧

Upgrading Protect Fails With 'Error 2: The System Cannot Find The File Specified.'

May 1, 2015, 10:53 am

≫ Next: EOL Reporting

≪ Previous: Superseded Patches Show Missing During Patch Scan

Symptoms

You receive a popup error when attempting to upgrade Shavlik Protect.

Error 2: The system cannot find the file specified.

Cause

This error is caused when the Protect installation in unable to locate the necessary data files within the data file directory of Shavlik Protect. Customers who run Protect in an internet disconnected network have encountered this issue when the .CAB files were missing from the DataFiles folder.

The log snippet below indicates the upgrade is attempting to extract the Protect.manifest.xml from the Protect.manifest.cab file, but the .CAB is missing from the DataFiles folder.

CabExtracter.cpp:69 Extracting Protect.manifest.xml to C:\Users\admin\AppData\Local\Temp\9620bc4e13834427baea0160a8385aa5

CabExtracter.cpp:53 Extracted C:\Users\admin\AppData\Local\Temp\9620bc4e13834427baea0160a8385aa5 from C:\Users\admin\AppData\Local\Temp\8fb7863b36e14909bc2bc0a72e439cf1

PatchInstaller.cpp:486 class STWin32::CWin32Exception at File.cpp:43: Error 2: The system cannot find the file specified.

Resolution

The resolution is to ensure that all necessary data files are extracted to theC:\ProgramData\LANDesk\Shavlik Protect\Console\DataFiles folder. Links for all needed data files for the corresponding product version and instructions for manually downloading these files can be found in this link:

How To: Manually updating patch data files for Shavlik Protect

The alternative workaround would be to install the previous version of Protect, download the full install of Shavlik Protect and point it to the previous database. Since this install includes the data files the error should not be encountered.

Additional Information

Although this error shows up in a dialog box with "Protect 7.5 Patch" this has nothing to do with a partial installation/a previous version.

Affected Product(s)

Shavlik Protect 9.x

↧

EOL Reporting

May 4, 2015, 6:31 am

≫ Next: How To schedule Automatic Synchronization To A Distribution Server

≪ Previous: Upgrading Protect Fails With 'Error 2: The System Cannot Find The File Specified.'

Has anybody created a report that would list all the EOL products and what machines they are installed on, and if so would you be willing to share your query with me? I am both time- and SQL- challenged. Thanks so much!

↧

How To schedule Automatic Synchronization To A Distribution Server

February 24, 2014, 7:17 am

≫ Next: Correcting Issues caused by out of date root certificates? MSRC-002 not found

≪ Previous: EOL Reporting

Purpose

How to schedule the automatic synchronization of Patch Definitions, Patch install files, and Threat engines and definitions to a Distribution Server

Steps for Completion

Highlight the target Distribution Server in the Distribution Server pane. In the drop down box above the pane select what kind of files that need to be synced and click "Add scheduled sync:" A dialog box with scheduling information should appear. After selecting Save, the scheduled sync should appear in the scheduler automatic synchronization pane with the type of files being synchronized. If you select "All engines, definitions, and patch downloads", there will be a separate entry created in the middle "Scheduled automatic synchronization" pane for each relevant component.

If you want to force a synchronization select one or more scheduled synchronization entries in the Scheduled automatic synchronization pane and click Run now

Note: To synchronize all data, all three synchronization tasks must be selcted. This will immediately copy all appropriate files from the console to the specified distribution server(s).

The scheduled Synchronization process runs in the background of Protect. You may check the status by viewing the event history atView > Event History.

Affected Product(s)

Shavlik Protect 9.X

↧

Correcting Issues caused by out of date root certificates? MSRC-002 not found

May 5, 2015, 7:05 am

≫ Next: Installing Agents Using Passphrase Authentication

≪ Previous: How To schedule Automatic Synchronization To A Distribution Server

I have a disconnected system that was rebuilt by a different administrator. I reinstalled Shavlik Protect and am now trying to start the patching process again. I am getting failing signature check errors on the patches. I researched and have found I need MSRC-002. I followed the link on previous articles to download, but am getting Page Not Found from Microsoft.

Anywhere else I can get it?

↧

Installing Agents Using Passphrase Authentication

May 5, 2015, 12:32 pm

≫ Next: What Is The Difference Between Windows Server Operating System And Worksation Operating System License Seats

≪ Previous: Correcting Issues caused by out of date root certificates? MSRC-002 not found

Purpose

The purpose of this document is to outline the process for installing an agent using passphrase authentication. Enabling this will require users installing an agent to specify a matching passphrase during the manual agent installation process.

Symptoms

Passphrase authentication is best used when individuals without administrative credentials will be manually installing agents. For example, in large organizations it may not be feasible for one administrator to manually install agents on hundreds of different machines. Specifying a passphrase allows individuals to install agents on their own machines without the need for console credentials.

Resolution

1. To enable the passphrase you must navigate to Tools>Options within the Console.

2. Within the 'Options' window navigate to the 'Agent' tab and check the box to 'Enable passphrase in manual Agent installations' and enter a passphrase that will be used for manual agent installations. The passphrase can be any number of words or characters and is case-sensitive.

3. Once the passphrase has been set. You may launch the STPlatformUpdater.exe on the agent machine. Upon launch the agent installer will ask how you would like to register the agent. Please select the option 'I have a direct connection to the Console'.

4. Within the next screen of the installation, please input your Console name, port and select the 'Shared Passphrase' authentication type and select the 'Get Policy List' button and choose the agent policy you wish to assign. Then select 'Register'

5. Registration should be successful and your agent should now be active on the machine.

Additional Information

Methods to install a Shavlik Protect Agent

Affected Product(s)

Shavlik Protect 9.x

↧

What Is The Difference Between Windows Server Operating System And Worksation Operating System License Seats

May 6, 2015, 9:11 am

≫ Next: Exclude Service packs from scan results / reports

≪ Previous: Installing Agents Using Passphrase Authentication

Purpose

This document explains the difference between Shavlik Protect Server and Workstation License types and their usage.

Explanation

Shavlik splits the seats between Workstation and Server class operating systems. Server Operating System seats can be used for Machines running both Windows Server operating systems and Workstation operating systems. Workstation Operating System seats can only be used for machines running a Workstation OS. Examples of Windows Server Operating systems Windows Server 2003, Windows Server 2008, and Windows Server 2012. Examples of Windows Workstation Operating Systems are Windows 7 and Windows 8.X

Affected Product(s)

Shavlik Protect 9.X

↧

Exclude Service packs from scan results / reports

May 7, 2015, 8:01 am

≫ Next: Troubleshooting Shavlik Protect Patch Scan Error Messages

≪ Previous: What Is The Difference Between Windows Server Operating System And Worksation Operating System License Seats

We would like to have a report similar to the Executive Summary report however we only want to report on patches and not service packs. We have patch groups and patch scan templates that contain the patches we need and we run the scan against them, but we still see all the missing service packs on all of our scan results and reports. I don't see any option to exclude them. Any suggestions?

↧

Troubleshooting Shavlik Protect Patch Scan Error Messages

December 31, 2012, 11:00 pm

≫ Next: You've Exceeded The Number Of deployment Seats (XXX) Permitted By Your License

≪ Previous: Exclude Service packs from scan results / reports

Purpose

Many of the common Shavlik Protect scan errors can be corrected by changes to configuration or environment. This article lists the most common scan error messages and provides some guidance on correcting the issue.

Cause

Scan errors can occur:

If one or more of the Shavlik Protect Scanning Prerequisites have not been met
If one or more configuration issues are present in Shavlik Protect
Due to one or more environmental issues

Resolution

The table below lists the error codes with the known reason or solution. Most scan errors can be resolved by ensuring you are meeting requirements.

Note: You can see the scan errors listed by viewing your scan result under the 'Results' section and viewing the 'Machines Not Scanned' tab of the scan result.

	Error Code	Description
	Error Code 101: Unable to determine System Language	The scan process reads the Windows ntdll.dll file to determine the language of the system. If this file is inaccessible, the prerequisite validation fails and the scan is aborted. See the following document for more information: http://community.shavlik.com/docs/DOC-23310
	Error Code 105: MS_UNABLE_TO_GET_SYSTEM_DATA	This issue occurs due to an access denied message at the root of the problem, or due to other enironmental or network related issues. See the following KB: http://community.shavlik.com/docs/DOC-2233
	Error Code 200: System not found. Scan not performed.	This indicates that the specified computer was not located and could not be scanned.
	Error Code 201: System not found. <system error message>	A network problem is preventing the specified machine from being scanned. Check to see that your computer (the scanning machine) is properly connected to the network and that you can remotely logon to the specified machine.
	Error Code 202: System not found. Scan not performed.	A network or system error occurred while the scan was in process. Check to see that your scanning machine is properly connected to the network and that the machine being scanned is still connected to the network. Also ensure that the remote machine is running the Server service.
	Error Code 230: Scan not performed. <system error message>	A general network error has occurred. See the system documentation for more information.
	Error Code 235: System not found, or NetBIOS ports may be firewalled. Scan not performed.	Most likely, there is no machine with the specified IP address. If a machine does exist at this address, a personal firewall or port filtering device may be dropping packets destined for TCP ports 139 and 445. See the following KB: http://community.shavlik.com/docs/DOC-2220
	Error Code 261: System found but it is not listening on NetBIOS ports. Scan not performed.	A machine exists at this IP address but it is either not listening on, or is blocking access to, TCP ports 139 and 445.
	Error Code 270: Connected to a machine with the wrong hostname or domain name.	Ensure that you are meeting all scanning prerequisites, and that you are able to resolve the target system properly by forward and reverse nslookup. Example: nslookup target_IP_address nslookup target_NetBIOS_name
	Error Code 301: SystemRoot share access required to scan.	Unable to connect to the remote machine’s system share. This may occur if the administrator has unshared the systemroot (typically C$ or similar) or has disabled the AutoShareServer(Wks) via the registry. See: Scan Error 301 - SystemRoot share access required to scan For more information on restoring Admin Shares, see the Microsoft Knowledge Base article 318755.
	Error Code 429: DLL is not properly registered.
	Error Code 430: Incorrect version of MDAC.
	Error Code 451: Admin rights are required to scan. Scan not performed.	The current or specified user account performing the scan does not have administrative rights to the machine being scanned. Check to see that the specified account is a member of the local administrators group on the machine being scanned (or is a member of a group with local administrative rights).
	Error Code 452: Protect is unable to scan this machine. Please check to see that you have administrative rights to this machine and are able to login to this machine from your workstation. Scan not performed.	Check to see that the Server service is enabled on the remote machine and that you can remotely logon to this machine. Ensure that the Workstation service is running on the machine performing the scan. See the following KB: Error 452: Unable To Connect To The Remote Machine
	Error Code 501: Remote registry access denied. Scan not performed.	Check to see that the Remote Registry service is enabled on the machine being scanned. See the following KB: http://community.shavlik.com/docs/DOC-2219
	Error Code 502: Scan not performed. Error reading Registry <system error message>	A general registry error has occurred. See the system documentation for more information.
	Error Code 503: Scan not performed. Error reading Registry.	A general registry error has occurred. No additional information is available.
	Error Code 553: Unable to read registry. Please ensure that the remote registry service is running. Scan not performed.	Check to see that the Remote Registry service is enabled on the machine being scanned.
	Error Code 621: OS of target is an unsupported version of Windows	The specified may be a non-Microsoft platform running SMB services or otherwise emulating a Microsoft product. Review the document: http://community.shavlik.com/docs/DOC-23052
	Error Code 622: Machine OS is not Recognized. Please run with tracing on and send to technical support. Scan not performed.	Unable to determine the operating system of the specified machine. This may occur when scanning beta or unreleased versions of Microsoft operating systems.
	Error Code 623: Machine Service pack is not Recognized. Please run with tracing on and send to technical support. Scan not performed.	Unable to determine the Service Pack of the specified machine. This may occur when scanning beta or unreleased versions of Microsoft Service Packs.
	Error Code 701: File http://download.microsoft.com/download/ ... secure.cab was NOT downloaded.	The signed, compressed CAB file containing the security patch information could not be obtained from the specified location. This may occur if the scanning machine is not connected to a network, or is otherwise unable to access the specified file or location. If the CAB file is not obtained, an attempt is made to access the uncompressed XML file via https.
	Error Code 702: File https://www.microsoft.com/technet/secur ... secure.xml was NOT downloaded. Attempting to find local copy of mssecure.cab.	The uncompressed XML file containing the security patch information could not be obtained from the specified location via https. This may occur if the scanning machine is not connected to a network, or is otherwise unable to access the specified file or location. If the XML file is not obtained from the network, an attempt is made to locate an existing version of this file on the local machine.
	Error Code 799: Itanium class servers are not supported by Protect.
	Error Code 800: Unable to retrieve OS info for image	SysPrep: Enter System Out-of-Box Experience (OOBE) with Generalize checked. Generalize is not a supported switch and will cause scan failures to offline VM and Templates.
	Error Code 802: Could not read boot.ini file in harddrive at '%s'	Unable to read the image's boot.ini file after successfully mounting the hard disk (non-Vista systems). See: http://community.shavlik.com/docs/DOC-23104
	Error Code 803: Could not find windows install directory in boot.ini file in harddrive at '%s'	The virtual image hard drive was successfully mounted and the boot.ini file was read but the scan engine was unable to locate the %systemroot% folder at the specified location (non-Vista systems).
	Error Code 804: Could not find system32 directory for virtual system at '%s'	The virtual image hard drive was successfully mounted and the boot.ini file was read but the scan engine was unable to locate the %systemroot%\system32 folder at the specified location (non-Vista systems).
	Error Code 805: Timeout when mounting hard drive at '%s' to drive '%c'	An attempt to mount the virtual image was not successful. The mounting process timed out after 60 seconds. Try scanning this image individually to see if the mount succeeds.
	Error Code 806: Error mounting hard drive at '%s' to drive '%c'	An attempt to mount the virtual image was not successful. This can happen if the image being mounted is encrypted, is on a compressed drive, is a template or a linked clone, or any of the vmdk files are read-only. If this is a VMware Workstation or VMware Server image, this error occurs if the image is currently powered on or suspended.
	Error Code 807: Error mounting hard drive at '%s' to drive '%c' with exit code %d	An attempt to mount the virtual image was not successful. The mounting process returned an unknown error code. Contact support for assistance.
	Error Code 808: Could not get return code from mounting tool when mounting hard drive at '%s' to drive '%c' due to %s	The virtual image mounting process completed but the mount process was unable to determine if the mounting was successful.
	Error Code 809: Unknown virtual image type '%s' extracted from '%s'.	The scan engine was unable to determine the virtual image type. This may occur if scanning a currently unsupported virtual image platform.
	Error Code 810: Could not find system32 directory for virtual image: '%s'	The virtual image hard drive was successfully mounted but the scan engine was unable to locate the image's %systemroot%\system32 folder.
	Error Code 811: Could not get information about drive mounted at '%s' for system:'%s'	The scan engine was unable to determine the systemroot drive letter for the mounted image.
	Error Code 812: Could not open mounted registry key 'HKLM\\Software\\MountedDevices' for system: '%s'	The virtual image hard drive and registry was successfully mounted but the scan engine was unable to read the mounted registry.
	Error Code 813: Could not enumerate the values under the key HKLM\\Software\\MountedDevices for system: '%s'	The virtual image hard drive and registry was successfully mounted but the scan engine was unable to enumerate values from the mounted registry.
	Error Code 814: No path to vmware-mount.exe provided!	The scan engine was unable to locate the VMware mounting tool. Please make sure that the VMware Virtual Disk Development Kit has been properly installed.
	Error Code 815: Could not find mounting tool at '%s'	The scan engine was unable to locate the VMware mounting tool. Please make sure that the VMware Virtual Disk Development Kit has been properly installed.
	Error Code 816: Could not read system file at '%s'	The vmx configuration file does not exist for the specified VMware Workstation or VMware Server image.
	Error Code 817: Error parsing system file at '%s'	The scan engine was unable to read the vmx file for the specified VMware Workstation or VMware Server image. Check the vmx file and ensure that it can be read in a text viewer.
	Error Code 818: '%s'. Unable to mount the virtual image. The virtual image is currently powered on.	The scan engine was unable to mount the virtual image because the virtual image was powered on. The scan engine is only capable of scanning images that are offline (powered off).
	Error Code 819: '%s'. Unknown PowerStatus '%d'	The scan engine was unable to determine the current state of the image (powered on, suspended, powered off).
	Error Code 820: %s'. Scanning suspended or paused images is not currently supported.	The scan engine was unable to mount the virtual image because the virtual image was suspended (paused). The scan engine is only capable of scanning images that are offline (powered off).
	Error Code 821: Could not open Objects key in BCD for image at '%s'	The scan engine was unable to access the boot configuration data (BCD) for this image. This error message could indicate that there is a problem with the specified image. Try powering on this image to ensure that it is still valid. This error message applies to Vista images only.
	Error Code 822: Could not enumerate keys in 'BCD\\Objects' for image at '%s'	The scan engine was unable to enumerate information from the boot configuration data (BCD) for this image. This error message could indicate that there is a problem with the specified image. Try powering on this image to ensure that it is still valid. This error message applies to Vista images only.
	Error Code 823: Could find default boot section in the BCD for image at '%s'	The scan engine was unable to enumerate boot information from the boot configuration data (BCD) for this image. This error message applies to Vista images only.
	Error Code 824: Could not open key at 'BCD\\Objects\\%s\\Elements\\22000002' for image at '%s'	The scan engine was unable to open the boot information data from the boot configuration data (BCD) for this image. This error message applies to Vista images only.
	Error Code 825: Could find the Windows root in default boot section of the BCD for image at '%s'	The scan engine was unable to locate the value which stores the location of the windows directory in the boot configuration data (BCD) for this image. This error message applies to Vista images only.
	Error Code 826: Registry mount sentry is NULL!	The scan engine was enable to mount the virtual image's registry. The console may be running low on memory.
	Error Code 827: Hard-drive mount sentry list is NULL or empty!	The scan engine was unable to read the vmx file and/or this file had no hard drives configured for the image.
	Error Code 828: Could not mount registry for image '%s'. This could be caused by running a non supported configuration. Windows 2000 can't mount x64 registries.	The scan engine was unable to mount the registry for the virtual image. This may occur if using a Windows 2000 console and trying to mount x64 images (unsupported).
	Error Code 829: Error: 829 - Accessing disk ID Error: 829 - Accessing disk ID, Code:16054 – Invalid connection	This error can occur due to a number of different reasons. This is an error that occurs prior to mounting the image - it is not related to mounting the image (like the errors above) General errors: VIX_E_FAIL = 1, VIX_E_OUT_OF_MEMORY = 2, VIX_E_INVALID_ARG = 3, VIX_E_FILE_NOT_FOUND = 4, VIX_E_OBJECT_IS_BUSY = 5, VIX_E_NOT_SUPPORTED = 6, VIX_E_FILE_ERROR = 7, VIX_E_DISK_FULL = 8, VIX_E_INCORRECT_FILE_TYPE = 9, VIX_E_CANCELLED = 10, VIX_E_FILE_READ_ONLY = 11, VIX_E_FILE_ALREADY_EXISTS = 12, VIX_E_FILE_ACCESS_ERROR = 13, VIX_E_REQUIRES_LARGE_FILES = 14, VIX_E_FILE_ALREADY_LOCKED = 15, VIX_E_NOT_SUPPORTED_ON_REMOTE_OBJECT = 20, VIX_E_FILE_TOO_BIG = 21, VIX_E_FILE_NAME_INVALID
	Error Code 1001: IPv6 addresses are not supported.	IPv6 addresses are currently not supported. Ensure that IPv4 is enabled.
	Error Code 1300: Not all privileges or groups referenced are assigned to the caller	The error message is a generic error stating you haven't provided an account with full privileges that may be required to perform some action. See the following document for more information: Patch Scanning Error 1300 - Not All Privileges Or Groups Referenced Are Assigned To The Caller

Affected Product(s)

Shavlik Protect, All Versions

↧

You've Exceeded The Number Of deployment Seats (XXX) Permitted By Your License

April 27, 2015, 8:24 am

≫ Next: Managing Protect With Multiple Administrators

≪ Previous: Troubleshooting Shavlik Protect Patch Scan Error Messages

Purpose

This document explains the causes of the "Maximum number of machines allowed by license exceeded" error and how issues related to the error can be resolved

Symptoms

The following errors occur during a deployment attempt when Shavlik Protect detects that a deployment license seat is not available for a target server:

You may see the following messages:

You've exceeded the number of deployment seats (XXX) permitted by your license.
Your license does not support deployment of this patch. Deployment licenses exceeded
Maximum number of machines allowed by license exceeded. Contact your sales representative to extend your license. Error Code 297

Cause

The number of machines receiving deployments in the last 45 days has exceeded the number of license seats purchased. Please refer to the documentHow to: Managing License seat usage with Shavlik Protect
There are instances when license exceeded errors occur and the Licensed Capabilities underHelp > About Shavlik Protect still show that seats are available. The usual cause of this scenario is that a deployment to a Server Operating System machine is being attempted when the Server License count has been exceeded and only workstation licenses are available. In very rare instances, the license count in the Shavlik Protect database is incorrect and intervention from Shavlik support is required.

Resolution

If additional licenses need to be purchased, contact sales at 1-800-690-6911 option 2
If a machine has been retired or renamed within 45 days of the last patch deployment, contact support support at 1-800-690-6911 Option 3 to discuss options.
If server licenses are available and the license exceeded message is still being received, contact support at 1-800-690-6911 Option 3 to troubleshoot.

Affected Product(s)

Protect 9.X

↧

Managing Protect With Multiple Administrators

May 4, 2015, 3:38 pm

≫ Next: Throttling The Copy Speed Of A Deployment In Shavlik Protect

≪ Previous: You've Exceeded The Number Of deployment Seats (XXX) Permitted By Your License

Purpose

In some environments, there may be multiple administrators tasked with overseeing patch management. When using multiple administrators with Protect- understanding how this works and the best practices for such a configuration can help this process run more smoothly. This document explains how Protect handles multiple administrators and shares some best practices for using Protect with multiple admins.

Description

How Shavlik Protect Manages Multiple Administrators

Shavlik Protect contains a number of built-in checks to guard against simultaneous and conflicting commands from different administrators. For example:

The program will not allow duplicate group names or template names
The program will not allow simultaneous updates to any groups, templates, distribution servers, or agent policies by different administrators. If this situation should occur the second administrator will receive a warning message similar to the following:

Only one console will be authorized to use the Database Maintenance tool. If an administrator at another console wants to perform maintenance on the database, that administrator must take ownership of that task before the program will allow the administrator to continue.
- Note: The 'Take Ownership' button is only displayed if you have two or more consoles that share one database. If your organization uses multiple Shavlik Protect consoles that share the same database, only one console will be authorized to use the Database Maintenance tool. If an administrator at another console wants to perform maintenance on the database, that administrator must take ownership of the task before the program will allow the administrator to continue. Any existing maintenance tasks will be allowed to complete before ownership is transferred to another administrator.

Best Practices When Using Multiple Administrators

Recommendations

You should upgrade your hardware platform by increasing the number of processors and the amount of installed memory on the console machine. This will increase performance in those instances when two or more administrators are logged on at the same time and performing tasks.
- Minimum suggested hardware requirements for two administrators: 2 processor cores and 4 GB RAM
- For a high performance system, use 16 processor cores and 32 GB RAM
- For each additional administrator, add 1 processor core and 1 GB RAM
When two administrators log on to the same console they must use different accounts. The same account can be used only when logging on to different consoles.
If you edit a group that is typically used by another administrator you should notify that person about the change.
Each administrator should create their own credentials and assign them to machines.
Each administrator should define default credentials that are the same as their logon credentials. This will eliminate problems that may occur if the administrator forgets to assign machine credentials.

Potential Issues When Using Multiple Administrators

Usage Issues

You must take a few common sense precautions when using multiple administrators. Even though Shavlik Protect contains a number of built-in safety checks, it cannot guard against all possibilities. The program may act in unpredictable ways if the following occur:

If two administrators try to scan the same machine group or ESXi Hypervisor at the same time.

The machines will be scanned twice, causing potential performance issues. In addition, there may be administrative rights errors due to the multiple connections.

If two or more administrators try to deploy patches or bulletins to the same machine at the same time.

The most likely result is that one deployment task will succeed and the other will fail. But because the deployment that succeeds will likely perform a restart of the target machines, the machines may be in an unknown state when the other deployment fails.

Credential Issue

When you create credentials and assign them to machines, those credentials belong to your administrator account. If a different administrator (Administrator B) logs on and uses Shavlik Protect, they will not have access to the machine credentials you provided. The second administrator must provide their own machine credentials.One of the ways this can be confusing is if Administrator B fails to provide their own machine credentials and tries to schedule a patch deployment from a scan that was performed by Administrator A. The deployment can be successfully scheduled if default credentials are available, but the actual patch deployment will likely fail because the patch deployment requires machine credentials -- credentials that were provided by Administrator A but that are not available to Administrator B.Recommendations:

Each administrator should create their own credentials and assign them to machines
Each administrator should define default credentials that are the same as their logon credentials. This will eliminate some of the problems that may occur if the administrator forgets to assign machine credentials.

Virtual Inventory Consideration

Unlike machine groups (which can be viewed by all administrators), vCenter Servers and ESXi Hypervisors can only be viewed by the administrator that added them to Shavlik Protect. If two different administrators want to manage the same vCenter Server or ESXi Hypervisors, both administrators must add the item to the Virtual Inventory list.

Additional Information

How Credentials work in Protect

Affected Products

Shavlik Protect 9.x

↧

Throttling The Copy Speed Of A Deployment In Shavlik Protect

December 31, 2012, 11:00 pm

≫ Next: Recurring Scheduled Tasks Fail After Password Change

≪ Previous: Managing Protect With Multiple Administrators

Resolution

You have the ability to 'throttle' down the deployment speed through the use of the 'Copy Speed' setting in the Patch Deployment Template.

At full speed (6), the patch copy process is performed similar to a network copy, limited only by the network bandwidth. At lower speeds, a certain number of packets are pushed, then a delay is introduced, then more packets are pushed, then another delay. The more you throttle back the copy speed, the fewer packets get pushed, and the longer the delay in between each push.

Each increment is about 20 milliseconds of delay, it goes from 1 to 6 so the max would be a 1/10 second delay

Additional Information

More information on Deployment Template can be found in the help files.

Affected Product(s)

Shavlik Protect 9.x

↧

Recurring Scheduled Tasks Fail After Password Change

April 13, 2015, 1:33 pm

≫ Next: Flash Player 17 - wrong file

≪ Previous: Throttling The Copy Speed Of A Deployment In Shavlik Protect

Symptoms

Recurring Scheduled Tasks are failing after password for the user specified in "User to run as" was changed in Active Directory.

The "User to run as" field is found in Job Properties under Manage>Scheduled Tasks

The Scheduled Tasks log tab shows a status 1326 when the task was last attempted.

The ST.Activation.managed.SYSTEM@NT AUTHORITY log shows the following error:

"Failed to check access to 'xxx.x.x.x', error: 1326".

System error code 1326 signifies "Logon failure: The user name or password is incorrect." This error code may also display as "ERROR_LOGON_FAILURE" or as the value 0x52E.

Cause

In the Properties of a Recurring Scheduled Task, the value in the "User to run as" field and its accompanying password are static and cannot be changed. When the permissions on the target are changed, the recurring task is unusable to scan and deploy the changed target.

Resolution

New recurring tasks must be created for target machines that are affected by jobs that use outdated credentials.

Additional Information

When a password is changed for a user in Active Directory, the change also must be made under the credential for that user under Manage>Credentials. The user name in the "User to run as" field is obtained from the credential information in the Machine Group used to initially schedule the task.

Affected Product(s)

Protect 9.X

↧