Have a Windows 2008 Server R2 showing MS11-019, MS14-068, MS15-085, MS12-006, MS15-055 and MS14-074 are all currently needed via Shavlik Protect 9.1.0 build 4511 with patch 2.0.1.4504.
Scanning machine manually against local WSUS server as well as against MS Windows Update shows zero patches needed. I have refreshed files and re-scanned multiple times. If I tell it to deploy all patches error out.
Thanks,
Jim
I noticed that Shavlik is now deploying Software updates/upgrades that some how upgraded our .Net 4.5 version to version 4.6. I'm trying to create a custom scan that exclude software upgrades to newer version. Is there a way I can do this? This will include any MS Office upgrade as well.
Thanks in advance.
This document explains how to create a report that shows the missing patch count for machines that have been scanned in your environment.
The "Machine Status by Patch Count" report shows only the missing patch count. It does not provide any additional information about the patches that are missing, it only displays the number count. It does not include any information on installed patches, it is a quick reference for how many patches are missing in your environment or on specific machines.
You can use the "advanced filter" option to get more specific on the scans, dates, machine names, IP ranges, domains etc.
We always recommend running reports and changing the settings in the advanced filter in order to get the closest report to what you are looking for.
There is also our Report Views Guidefor any custom reporting as our reports may not always meet the specific needs of our customers.
Shavlik Protect 9.x
Our auditors ask for AV and patch configuration documentation. Is there an easy way to pull all of the settings and schedules for updates and scans? When scans happen, when patches happen, AV settings etc.
This document will provide instructions on how to filter specific patches using a text file, as well as additional information about this feature.
Shavlik Protect 9.x
This document will provide a possible workaround for Service Pack 2 Deployment Failure For SQL Server 2008 R2 (KB2630458).
Actual: Error "Error: File not downloaded: SQLServer2008R2SP2-KB2630458-x86.exe
Error reason: File 'C:\ProgramData\LANDESK\Shavlik Protect\Console\Patches\SQLServer2008R2SP2-KB2630458-x86.exe' failed signature check: http://download.microsoft.com/download/3/D/C/3DC6663D-8A76-40A6-BCF2-2808C385D56A/SQLServer2008R2SP2-KB2630458-x86-ENU.exe
Zero patches are available and properly signed.
No patches were deployed. Please review the program logs to determine the cause.
Patch deployment canceled due to failure building deployment instructions.
Error on machine 'XXXXXXXXXXXX': Failed"
Verify the root certificates are up to date on the Protect server.
Install Security Tool MS12-A09 (Q2749655) on the Protect server, allow a reboot the perform another scan and deployment to the target client machine.
Protect 9.x
This document will explain the Event History Code Unknown Error (0xffffffff) and provide a possible fix for it.
You open the View > Event History and see 'Unknown Error (0xffffffff)' under 'Core engine/definitions
This code indicates there isn't enough disk space to download Core Engines/Definitions
The error in ST.ServiceHost.managed.log:
TaskHandler.cs:126|Failed to execute 'ST.Services.Deployment.Synchronization.DataFilesDownload.RunAsync'.: System.AggregateException: One or more errors occurred. ---> System.ComponentModel.Win32Exception: Unknown error (0xffffffff)
Clear up drive space on C:\
Protect 9.x
This document will provide details of an issue where the Tracker never updates past Scheduled and the deployment never runs on the target machine. This document is specifically related to port 5120 being used by another application thus preventing Protect from schedule the deployment job.
You perform a deployment against a machine(s), the Tracker status never updates past Scheduled and the patches never install. The patches copy to the target machine and the .bat and .cfg copy to the C:\Windows\ProPatches\Install directory. The .bat file never renames itself to .his indicating the job either didn't start or never finished. (the .bat file renames itself to .his after the deployment process is complete)
It's possible another application installed on the target machine is using 5120. You can open the scheduler log from C:\Windows\ProPatches\Scheduler\Scheduler.log and search for 'Error 10048'.
The full error is: SchedulerServer.cpp:51: Bind failed on port 5120: Error 10048: Only one usage of each socket address (protocol/network address/port) is normally permitted.
You can use netstat -b from a CMD prompt which will show a list of ports and what program is using those ports.
This can be solved by changing the other application's port or change Shavlik's Scheduler port. This is done by going to Tools-Options-Scheduler and choosing a new port.
In many case, the Tracker update issue when stuck at Scheduled can be attributed to port 3121 being blocked from the target machine back to the Protect console. This port is needed for all Tracker communication from the target machine.
Shavlik Protect 9.x
We've just started to add Adobe Reader 11 Software Distribution to our patch groups. I keep seeing the installer hang on various systems.
Here is an example of that. I just created 12 servers, all from the same template in VMware. I joined each one to the domain, I installed the Shavlik Agent. I then scanned them all and patched them with the same group of patches.
Here you will see one server applied all 16 patches without issue. The other 11 servers are all stuck on installing Acrobat Reader 11.
If I RDP into one of the hosts that shows a few Adobe related EXE's just sitting there but not really doing anything.
If I manually kill the Adobe Self Extrator EXE, then look at the console, the remaining patches continue on.
Then upon a rescan, Adobe Reader shows as installed without issue.
Hi all.
I am a Shavlik user, and Scan show MS15-031 Missing, while I can prove it is correctly installed, inside windows "Add Remove Program" control Panel / installed hotfix view. After few search on Microsoft Web site, and Shavlik Forum . I found that it can happen the XML Shavlik Meta data, could contain error. about MS file version GDR versus LDR.
Link 1) GDR & LDR : The Next Generation - if (ms) blog++; - Site Home - TechNet Blogs
Link 2) Several incorrect detections due to GDR vs LDR version issues
I think, this is exactly what is happening to many of our scan's results. and where confusion a lot of people and cause side effect : generate lot of LOST TIME.
Who can help to validate why Shavlik scan, show missing : see bellow some evidence of my Case :
1) Shavlik reason of detection : File version is less than expected. [C:\Windows\SYSTEM32\DRIVERS\KSECDD.SYS 6.0.6002.18643 < 6.0.6002.23592]
2) Microsoft web site, statement f GDR LDR =
**************************************************************************************************
https://support.microsoft.com/en-us/kb/3046049
Windows Vista and Windows Server 2008 file information
•The files that apply to a specific product, milestone (SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
Version, Product, Milestone, Service branch
6.0.6002.18xxx Windows Vista SP2 and Windows Server 2008 SP2 GDR
6.0.6002.23xxx Windows Vista SP2 and Windows Server 2008 SP2 LDR
**************************************************************************************************
.
Then why is Shavlik scan is trying to compare 6.0.6002.23xxxx with 6.0.6002.18xxxx ????? there hot in the same server branch. so far, this seem abnormal to me.
any idea ?
best regard's
Purpose
This document will walk you through on configuring your machine so that it can be scanned while it is part of a workgroup and not in a domain.
Symptoms
Although you have the correct credentials, Protect fails to scan a machine that is not part of a domain. Errors include 451 The specified user account requires administrative rights to the target machine. or 452 Unable to connect to the remote machine or 5: Access is Denied.
Resolution
For machines using Windows operating systems that employ the use of User Account Control (this includes Windows Vista or later and Windows Server 2008 or later), you must either:
Join the machines to a domain and then perform the scan using domain administrator credentials, or
Disable User Account Control (UAC) remote restrictions on the machines.
To do this:
1. Click Start, click Run, type regedit, and then press Enter.
2. Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
3. If the LocalAccountTokenFilterPolicy registry entry does not exist, follow these steps:
a. On the Edit menu, point to New, and then click DWORD Value.
b. Type LocalAccountTokenFilterPolicy and then press Enter.
4. Right-click LocalAccountTokenFilterPolicy and then click OK.
5. In the Value data box, type 1, and then click OK.
6. Exit Registry Editor.
For more details on disabling UAC remote restrictions, see http://support.microsoft.com/kb/951016
How exactly do we configure a custom product that would be in HKLM\SOFTWARE\ on 32bit PCs and HKLM\SOFTWARE\Wow6432Node on 64bit PCs in the registry?
Hi,
Can I create a patch scan template to scan the Internet explorer version 10 or not. I need to run a report to check which computers are not on IE 10 specifically. All my clients are Windows 7.
Let me know.
Thanks,
ASif
Are there plans to deploy updates to EMET 5 or to deploy EMET with Protect?
Thanks
Patrick
The purpose of this document is to show how to troubleshoot the Error: 808 when scanning Virtual Machines (VMs) in a Machine Group.
1) In a scan result in the Operations Monitor, you receive the 808 number under the Error Code column as shown below:
The 808 error code means that Shavlik could not get a return code from the VM mounting tool when mounting the hard drive at '%s' to drive '%c' due to '%s'. What this ultimately means is that the virtual image mounting process completed but the mount process was unable to determine if the mounting was successful. This usually happens if this is your first time scanning VMs that are Hosted Virtual Machines and they have recently been created/added in the Machine Group.
To resolve the issue, the easiest thing will be to:
1) Delete the affected Machine Group.
2) Go to Manage > Credentials and delete the browse credentials for the Hosted Virtual Machines.
3) Add the browse credentials for the Hosted Virtual Machines in Credential Manager.
4) Go to New > Machine Group and click on the Hosted Virtual Machines tab. Add the Virtual Machines you wish to scan with the new Browse Credentials you placed in Step 3.
5) Save the Machine Group and scan. Scans of the Virtual Machines should be successful.
For more scan error codes, please refer to this document: Troubleshooting Shavlik Protect Patch Scan Error Messages
Shavlik Protect 9.x
Is it possible or are there plans to be able to deploy updates to (firmware) drivers with Protect?
Thanks
Patrick
Hi,
when we try to patch Java 1.7 U71 with U76 we get a new installation of Java 1.7 U76.
All test systems looks like the attached image.
Can somebody help ?
Symptoms
Deployment fails with the following error: "Deployment machine name match failed, expected 'Machine Name', actual ''
You can also see this error you the ST.Protect.Native.log located at
C:\ProgramData\LANDesk\Shavlik Protect\Logs
Deploy.cpp:1837 DeployMachine exception - class STCore::CInvalidOperationException at Deploy.cpp:1305: Deployment machine name match failed, expected 'MachineName', actual ''.
Deploy.cpp:1869 Error Deployment machine name match failed, expected 'MachineName', actual ''
Cause
The credentials in the Machine Properties are incorrect for this machine.
Solution
In Machine view highlight the machine, right click and navigate to Machine Properties. Then assign the correct credentials.
NOTE: Do not confuse Machine Property credentials (used for Patch Deployment) with Scanning admin credentials (Set up in Machine Group)
Affected Products
Protect 9.1
Many of the common Shavlik Protect scan errors can be corrected by changes to configuration or environment. This article lists the most common scan error messages and provides some guidance on correcting the issue.
Scan errors can occur:
| Error Code | Description | |
Error Code 101: Unable to determine System Language | The scan process reads the Windows ntdll.dll file to determine the language of the system. If this file is inaccessible, the prerequisite validation fails and the scan is aborted. See the following document for more information: http://community.shavlik.com/docs/DOC-23310 | |
| Error Code 105: MS_UNABLE_TO_GET_SYSTEM_DATA | This issue occurs due to an access denied message at the root of the problem, or due to other enironmental or network related issues. See the following KB: http://community.shavlik.com/docs/DOC-2233 | |
| Error Code 200: System not found. Scan not performed. | This indicates that the specified computer was not located and could not be scanned. | |
| Error Code 201: System not found. <system error message> | A network problem is preventing the specified machine from being scanned. Check to see that your computer (the scanning machine) is properly connected to the network and that you can remotely logon to the specified machine. | |
| Error Code 202: System not found. Scan not performed. | A network or system error occurred while the scan was in process. Check to see that your scanning machine is properly connected to the network and that the machine being scanned is still connected to the network. Also ensure that the remote machine is running the Server service. | |
| Error Code 230: Scan not performed. <system error message> | A general network error has occurred. See the system documentation for more information. | |
| Error Code 235: System not found, or NetBIOS ports may be firewalled. Scan not performed. | Most likely, there is no machine with the specified IP address. If a machine does exist at this address, a personal firewall or port filtering device may be dropping packets destined for TCP ports 139 and 445. See the following KB: http://community.shavlik.com/docs/DOC-2220 | |
| Error Code 261: System found but it is not listening on NetBIOS ports. Scan not performed. | A machine exists at this IP address but it is either not listening on, or is blocking access to, TCP ports 139 and 445. | |
Error Code 270: Connected to a machine with the wrong hostname or domain name. | Ensure that you are meeting all scanning prerequisites, and that you are able to resolve the target system properly by forward and reverse nslookup. Example: nslookup target_IP_address nslookup target_NetBIOS_name | |
| Error Code 301: SystemRoot share access required to scan. | Unable to connect to the remote machine’s system share. This may occur if the administrator has unshared the systemroot (typically C$ or similar) or has disabled the AutoShareServer(Wks) via the registry.
See: Scan Error 301 - SystemRoot share access required to scan For more information on restoring Admin Shares, see the Microsoft Knowledge Base article 318755. | |
| Error Code 429: DLL is not properly registered. | ||
| Error Code 430: Incorrect version of MDAC. | ||
| Error Code 451: Admin rights are required to scan. Scan not performed. | The current or specified user account performing the scan does not have administrative rights to the machine being scanned. Check to see that the specified account is a member of the local administrators group on the machine being scanned (or is a member of a group with local administrative rights). | |
| Error Code 452: Protect is unable to scan this machine. Please check to see that you have administrative rights to this machine and are able to login to this machine from your workstation. Scan not performed. | Check to see that the Server service is enabled on the remote machine and that you can remotely logon to this machine. Ensure that the Workstation service is running on the machine performing the scan. See the following KB: Error 452: Unable To Connect To The Remote Machine | |
| Error Code 501: Remote registry access denied. Scan not performed. | Check to see that the Remote Registry service is enabled on the machine being scanned. See the following KB: http://community.shavlik.com/docs/DOC-2219 | |
| Error Code 502: Scan not performed. Error reading Registry <system error message> | A general registry error has occurred. See the system documentation for more information. | |
| Error Code 503: Scan not performed. Error reading Registry. | A general registry error has occurred. No additional information is available. | |
| Error Code 553: Unable to read registry. Please ensure that the remote registry service is running. Scan not performed. | Check to see that the Remote Registry service is enabled on the machine being scanned. | |
| Error Code 621: OS of target is an unsupported version of Windows | The specified may be a non-Microsoft platform running SMB services or otherwise emulating a Microsoft product. Review the document: http://community.shavlik.com/docs/DOC-23052 | |
| Error Code 622: Machine OS is not Recognized. Please run with tracing on and send to technical support. Scan not performed. | Unable to determine the operating system of the specified machine. This may occur when scanning beta or unreleased versions of Microsoft operating systems. | |
| Error Code 623: Machine Service pack is not Recognized. Please run with tracing on and send to technical support. Scan not performed. | Unable to determine the Service Pack of the specified machine. This may occur when scanning beta or unreleased versions of Microsoft Service Packs. | |
| Error Code 701: File http://download.microsoft.com/download/ ... secure.cab was NOT downloaded. | The signed, compressed CAB file containing the security patch information could not be obtained from the specified location. This may occur if the scanning machine is not connected to a network, or is otherwise unable to access the specified file or location. If the CAB file is not obtained, an attempt is made to access the uncompressed XML file via https. | |
| Error Code 702: File https://www.microsoft.com/technet/secur ... secure.xml was NOT downloaded. Attempting to find local copy of mssecure.cab. | The uncompressed XML file containing the security patch information could not be obtained from the specified location via https. This may occur if the scanning machine is not connected to a network, or is otherwise unable to access the specified file or location. If the XML file is not obtained from the network, an attempt is made to locate an existing version of this file on the local machine. | |
| Error Code 799: Itanium class servers are not supported by Protect. | ||
Error Code 800: Unable to retrieve OS info for image | SysPrep: Enter System Out-of-Box Experience (OOBE) with Generalize checked. Generalize is not a supported switch and will cause scan failures to offline VM and Templates. | |
| Error Code 802: Could not read boot.ini file in harddrive at '%s' | Unable to read the image's boot.ini file after successfully mounting the hard disk (non-Vista systems). See: http://community.shavlik.com/docs/DOC-23104 | |
| Error Code 803: Could not find windows install directory in boot.ini file in harddrive at '%s' | The virtual image hard drive was successfully mounted and the boot.ini file was read but the scan engine was unable to locate the %systemroot% folder at the specified location (non-Vista systems). | |
| Error Code 804: Could not find system32 directory for virtual system at '%s' | The virtual image hard drive was successfully mounted and the boot.ini file was read but the scan engine was unable to locate the %systemroot%\system32 folder at the specified location (non-Vista systems). | |
| Error Code 805: Timeout when mounting hard drive at '%s' to drive '%c' | An attempt to mount the virtual image was not successful. The mounting process timed out after 60 seconds. Try scanning this image individually to see if the mount succeeds. | |
| Error Code 806: Error mounting hard drive at '%s' to drive '%c' | An attempt to mount the virtual image was not successful. This can happen if the image being mounted is encrypted, is on a compressed drive, is a template or a linked clone, or any of the vmdk files are read-only. If this is a VMware Workstation or VMware Server image, this error occurs if the image is currently powered on or suspended. | |
| Error Code 807: Error mounting hard drive at '%s' to drive '%c' with exit code %d | An attempt to mount the virtual image was not successful. The mounting process returned an unknown error code. Contact support for assistance. | |
| Error Code 808: Could not get return code from mounting tool when mounting hard drive at '%s' to drive '%c' due to %s | The virtual image mounting process completed but the mount process was unable to determine if the mounting was successful. | |
| Error Code 809: Unknown virtual image type '%s' extracted from '%s'. | The scan engine was unable to determine the virtual image type. This may occur if scanning a currently unsupported virtual image platform. | |
| Error Code 810: Could not find system32 directory for virtual image: '%s' | The virtual image hard drive was successfully mounted but the scan engine was unable to locate the image's %systemroot%\system32 folder. | |
| Error Code 811: Could not get information about drive mounted at '%s' for system:'%s' | The scan engine was unable to determine the systemroot drive letter for the mounted image. | |
| Error Code 812: Could not open mounted registry key 'HKLM\\Software\\MountedDevices' for system: '%s' | The virtual image hard drive and registry was successfully mounted but the scan engine was unable to read the mounted registry. | |
| Error Code 813: Could not enumerate the values under the key HKLM\\Software\\MountedDevices for system: '%s' | The virtual image hard drive and registry was successfully mounted but the scan engine was unable to enumerate values from the mounted registry. | |
| Error Code 814: No path to vmware-mount.exe provided! | The scan engine was unable to locate the VMware mounting tool. Please make sure that the VMware Virtual Disk Development Kit has been properly installed. | |
| Error Code 815: Could not find mounting tool at '%s' | The scan engine was unable to locate the VMware mounting tool. Please make sure that the VMware Virtual Disk Development Kit has been properly installed. | |
| Error Code 816: Could not read system file at '%s' | The vmx configuration file does not exist for the specified VMware Workstation or VMware Server image. | |
| Error Code 817: Error parsing system file at '%s' | The scan engine was unable to read the vmx file for the specified VMware Workstation or VMware Server image. Check the vmx file and ensure that it can be read in a text viewer. | |
| Error Code 818: '%s'. Unable to mount the virtual image. The virtual image is currently powered on. | The scan engine was unable to mount the virtual image because the virtual image was powered on. The scan engine is only capable of scanning images that are offline (powered off). | |
| Error Code 819: '%s'. Unknown PowerStatus '%d' | The scan engine was unable to determine the current state of the image (powered on, suspended, powered off). | |
| Error Code 820: %s'. Scanning suspended or paused images is not currently supported. | The scan engine was unable to mount the virtual image because the virtual image was suspended (paused). The scan engine is only capable of scanning images that are offline (powered off). | |
| Error Code 821: Could not open Objects key in BCD for image at '%s' | The scan engine was unable to access the boot configuration data (BCD) for this image. This error message could indicate that there is a problem with the specified image. Try powering on this image to ensure that it is still valid. This error message applies to Vista images only. | |
| Error Code 822: Could not enumerate keys in 'BCD\\Objects' for image at '%s' | The scan engine was unable to enumerate information from the boot configuration data (BCD) for this image. This error message could indicate that there is a problem with the specified image. Try powering on this image to ensure that it is still valid. This error message applies to Vista images only. | |
| Error Code 823: Could find default boot section in the BCD for image at '%s' | The scan engine was unable to enumerate boot information from the boot configuration data (BCD) for this image. This error message applies to Vista images only. | |
| Error Code 824: Could not open key at 'BCD\\Objects\\%s\\Elements\\22000002' for image at '%s' | The scan engine was unable to open the boot information data from the boot configuration data (BCD) for this image. This error message applies to Vista images only. | |
| Error Code 825: Could find the Windows root in default boot section of the BCD for image at '%s' | The scan engine was unable to locate the value which stores the location of the windows directory in the boot configuration data (BCD) for this image. This error message applies to Vista images only. | |
| Error Code 826: Registry mount sentry is NULL! | The scan engine was enable to mount the virtual image's registry. The console may be running low on memory. | |
| Error Code 827: Hard-drive mount sentry list is NULL or empty! | The scan engine was unable to read the vmx file and/or this file had no hard drives configured for the image. | |
| Error Code 828: Could not mount registry for image '%s'. This could be caused by running a non supported configuration. Windows 2000 can't mount x64 registries. | The scan engine was unable to mount the registry for the virtual image. This may occur if using a Windows 2000 console and trying to mount x64 images (unsupported). | |
Error Code 829:
Error: 829 - Accessing disk ID | This error can occur due to a number of different reasons. This is an error that occurs prior to mounting the image - it is not related to mounting the image (like the errors above)
General errors:
VIX_E_FAIL = 1, | |
| Error Code 1001: IPv6 addresses are not supported. | IPv6 addresses are currently not supported. Ensure that IPv4 is enabled. | |
Error Code 1300: Not all privileges or groups referenced are assigned to the caller | The error message is a generic error stating you haven't provided an account with full privileges that may be required to perform some action. See the following document for more information: Patch Scanning Error 1300 - Not All Privileges Or Groups Referenced Are Assigned To The Caller |
Shavlik Protect, All Versions
Hi,
we use BladeLogic for our Windows Server Patch Deployment and we are currently facing at least 2 issues with the detection logic from Shavlik:
These issues are:
1. MS15-082 showing up as missing but getting not applicable error
The Patch that is reported as missing has the following Details:
Windows6.1-2008-R2-SP1-KB3075222-x64.msu-MS15-082-en-Windows Server 2008 R2 Enterprise (x64)-SP1 Q3075222 Important MS15-082 Windows Server 2008 R2 Enterprise (x64) Missing Vulnerabilities in RDP Could Allow Remote Code Execution (3080348) This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker first places...[Truncated] File version is less than expected. [C:\Windows\system32\AACLIENT.DLL 6.1.7601.18918 < 6.2.9200.21545]
However, when we try to deploy it, Windows reports "The Patch is not applicable"
2. MS15-029 showing up as missing but getting already installed
There is a V2 Version of KB3035126 which Shavlik reports as beeing installed. However the "original" Version Shows up as missing, but it can't be deployed as Windows says: "Patch is already installed"
The missing patch Details are:
Windows6.1-2008-R2-SP1-KB3035126-x64.msu-MS15-029-en-WINDOWS SERVER 2008 R2 STANDARD (X64)-SP1 Q3035126 Important MS15-029 Windows Server 2008 R2 Standard (x64) Missing Vulnerability in Windows Photo Decoder Component Could Allow Information Disclosure (3035126) This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow information disclosure if a user browses to...[Truncated] File version is less than expected. [C:\Windows\system32\WMPHOTO.DLL 6.1.7601.18742 < 6.2.9200.21371]
I know i would have to open a case with BMC, but i thought i post it here as well.
Maybe you guys are already aware of this and a fixed XML is already in the making.
Regards
Steffen
