Resolution

You have the ability to 'throttle' down the deployment speed through the use of the 'Copy Speed' setting in the Patch Deployment Template.

At full speed (6), the patch copy process is performed similar to a network copy, limited only by the network bandwidth. At lower speeds, a certain number of packets are pushed, then a delay is introduced, then more packets are pushed, then another delay. The more you throttle back the copy speed, the fewer packets get pushed, and the longer the delay in between each push.

Each increment is about 20 milliseconds of delay, it goes from 1 to 6 so the max would be a 1/10 second delay

Additional Information

More information on Deployment Template can be found in the help files.

Affected Product(s)

Shavlik Protect 9.2.x

Purpose

The Shavlik Content Team has created a deployment for Windows 10 Version 1511, 1607, 1703, and 1709.

Deployment of Windows 10 Version 1511, 1607, 1703, or 1709 applies to systems with Windows 10 OS. The deployment will not work for systems with OS lower than Windows 10.

Description

What considerations must be taken into account prior to deploying Windows 10 Version 1511, 1607, 1703 or 1709?

• Encryption such as BitLocker must be disabled for the deployment to be successful.  The machine must be able to fully reboot on its own to complete the deployment properly.
• The deployment of the 1511, 1607, 1703 or 1709 update is effectively a full operating system install, which includes all of the potential risks of a traditional OS upgrade. This can include, but are not limited to:
  • Blue screens (BSOD)
  • Data loss
  • Loss of existing settings
  • Program incompatibility
• Driver incompatibility can cause the update to fail. The Windows 10 app can help find some of these problematic drivers. If this is not available on the endpoint, see here for assistance.
• There are multiple versions of the 1511 ISOs. Older versions are more likely to cause blue screens, or otherwise fail. It is strongly recommended to use the most recent published version of the ISO.
  • The first release ISOs from November 2015 caused a BSOD or install failures on a number of systems. The install will then revert the machine to RTM. None of the defective ISO files made the machine unusable.
• Both the endpoint receiving the update and the console deploying it need to have sufficient hard drive space.
  • The Shavlik Protect console needs to have at least 5GB  free to download the ISO
  • The endpoint that is receiving the update needs to have at least 10GB free, but 20GB is recommended
• When patching from a unpatched RTM version of Windows 10 to 1607, our internal QA found that there is a high chance of a BSOD occurring and the update reverting to the RTM state. This can be avoided by fully patching the Windows 10 RTM machine, rebooting, and then applying the 1607 update.
• This deployment method only works to upgrade an existing Windows 10 installation.  Protect/Patch for Windows Servers cannot upgrade an older OS to Windows 10 (e.g., Windows 7 > Windows 10).

Step 1: Obtain the ISO

• The most recently published ISO that is needed for the Shavlik 1511, 1607, 1703 or 1709 deployment can be found in two places, depending on which edition needs to be deployed:
  • For Home and Pro endpoints, download the Media Creation Tool from Microsoft Tech Bench and follow the directions under "Using the tool to create installation media". Select the option to download the ISO file. "Windows 10" is the Edition for Windows 10 Professional, "Windows 10 Home Single Language" is the Edition for Windows 10 Home. This will download the most recent ISO available.

• For Enterprise and Education, obtain the correct ISO from MSDN or Microsoft Volume Licensing
  

Step 2: Prepare the ISO

• The ISO must be renamed to match the Shavlik naming scheme which includes the OS architecture, the edition, locale, and version. See below for examples
  • Windows10x86Education1511.iso
  • Windows10x64Enterprise1511_NL.iso
  • Windows10x64Enterprise1607.iso
  • Windows10x64Enterprise1703.iso
  • Windows10x64Enterprise1709.iso
  • Windows10x64Professional1709.iso
  • Windows10x86Education1709.iso
  • Windows10x64ProfessionalN1709.iso
• To find out exactly which naming scheme to use, scan the endpoint that will be receiving the update with the Shavlik Protect console or you can look up the update in View > Patches. Under "Bulletin Details", the File Name will show what the ISO needs to be renamed to. See below for an example:

• The renamed ISO must now be placed in the patch store on the Shavlik Protect console.. The default location for this is: "C:\ProgramData\LANDESK\Shavlik Protect\Console\Patches"
• For customers using distribution servers or agent-based patching, move the renamed ISO to the according Patch Store location
  

Step 3: Deploy the ISO

• Perform a patch scan of the desired machines. Once the scan is complete, go to the scan results and expand the Service Pack Missing list. For example:

• Select the 1511 (or 1607/1703/1709 depending on which version is being deployed) option to deploy the update (do not select TH2). If the TH2 option is selected, or if the ISO file for 1511/1607/1703/1709 is not named correctly or is not placed in the Patch Store, then errors will occur. For example:

• The Shavlik Protect deployment will verify different aspects of the deployment before staging it on the endpoint. It will verify that:
  • The language of the ISO dropped into that Patch Store matches the language of the endpoint's OS
  • The remote registry setting is saved
  • The status of the built-in Admin account (enabled or disabled) is saved
  • The endpoint receives all necessary scripts and files for the deployment
• The deployment of one of these updates can take up to and possibly longer than 3 hours. During this time the endpoint will boot to an installation environment after the ISO is successfully staged. Shavlik Protect has no way of interacting with this environment. If something goes wrong, the Windows 10 installer will attempt to roll back to the previous OS state, but this is not guaranteed.
• Once the deployment has been initiated, Protect will show the screen below. Since the deployment of these updates boots into a OS install environment, Shavlik Protect cannot get any feedback from it. If the description field returns 0, then all pre-deployment checks have passed and the target machine has rebooted into the OS install environment.

Step 4: Verifying the Deployment was Successful

• Once the endpoint has finished the install, use the console to re-scan the target. If the update deployment was successful, the re-scan will not show any missing service packs. See image below:

• The 1511/1607/1703/1709 deployment can also be verified by going to the target and running the "winver" command. The About Windows pop up should show Version 1511, 1607, 1703, or 1709, depending on which was deployed.

Affected Product(s)

Shavlik Protect 9.2

Ivanti Patch for Windows Servers 9.3

Does Ivanti Patch 9.3 have the capability to enter and use smart card credentials for scanning and deployments?  We recently had our admin accounts set to smart card required and I can no longer scan or deploy.

Diane W.

https://help.ivanti.com/sh/help/en_US/PWS/93/ag-pws-9-3.pdf

This guide explicitly says that Core is supported on 2008 and not on 2016. How about 2012 r2?  I have many 2012 r2 running Core with HyperV and I cannot patch them.

Hi Team

I was asked this by a customer today. Throttling of patch deployments. It looks like there used to be an option on the Deployment template called "Copy Speed". Maybe I am blind but I cant find it on the latest version.

Is there a way on 9.3 to throttle downloads ?

Thanks

Shane

Hi,

I have a new laptop running Win 10 1709 which I am unable to deploy to from Ivanti Patch 9.3.0 build 4440.

Previously with Win 10 I had to run the FIXMSSchedulerFolders script but when I run that script on this new laptop I get the Trace.log attached

Regards,

Steve

Does anyone know how to push 1709 to agents so the next time they check in they download the update?  I have the 1709 update working on machines that I scan and manually push the update, but I would like to have the remote machines that I have a hard time reaching get the update also.

Any ideas? 

Purpose

This document provides links to other documents addressing how to troubleshoot console installation, registration, configuration, and operations in Shavlik Protect.

Overview

Certificates

Shavlik Protect Console Certificates

Console Certificate Issues
How to Update the Certificate Revocation List (CRL) on a Disconnected Protect Console Server

Installation

Protect Console System Hardware Performance Guidelines

Configuring Virtual CPUs To Optimize Performance With SQL Server Express And Shavlik Protect

Protect Console Install or Upgrade fails with: This machine is managed by another console. Remove the Agent to install a Console.

Protect console install error due to .NET Framework 3.5 install failure

Protect Installs In An Unexpected Language

Download Links for Shavlik Protect Installation Files

Install - Uninstall Failures - How To Clean Up Broken Installs Of Shavlik Protect With The Microsoft Fixit Tool

Error: "Installation Failed. a Data Conversion Error Has Been Detected During the Database Upgrade Process."

Upgrade/Migration

Protect Console Upgrade Fails With Errors 1603 or 1605

Migrate Shavlik Protect Console

Console Service

Shavlik Protect Console Service Is Not Listed In Services.msc

Unexpected Popup Error Launching An Offline Protect Console After Upgrading To Protect 9.2

Shavlik Protect 9.2 Console Service Error At Startup

Shavlik Protect Console Service Fails to Launch - The Service Responsible for Importing Scan and Agent Results Is Not Running

Operations/Crashes

Scanning A vCenter/ESXi Server Causes The Console To Crash

Console Hangs When Selecting A Machine In View > Machines

Why Can't I Open My Console?

Protect Crashes When Attempting To Access Scheduled Console Tasks

Console crashes when exporting Machine Status Summary report

Unhandled Exception Error At Startup After Performing Help > Refresh Files

When Running Protect in an Environment with FIPS You Receive the Error: the Service Responsible for Importing Scan and Agent Results Is Not Running

Logging

Logs - Gathering Console, Client Side (Agentless), and Agent Log Files for Protect

Affected Product(s)

Shavlik Protect 9.x

Can Ivanti provide a non-ftp link for agentinstaller.msi and patchinstaller.msi for version 9.3.4440.0 ?

Thanks,

John

I'm trying to deploy custom package along with a script. Deploying the package is no problem using "call %PATHTOFIXES%Custom_Package.exe" But, using the same method "call %PATHTOFIXES%Custom_script" does not.

Questions:

Can a 'custom_script' run when changing directory outside of 'C:\Windows\ProPatches\Installation\%PATHTOFIXES%'? Meaning use CD C:\Temp as an example.

Can you call a .exe within a sub-directory of %PATHTOFIXES%? For example 'call %PATHTOFIXES%\Folder\application.exe'

Overview

This article provides a list of required web addresses for the Protect application to allow:

• Patch files fail to download
• Patch definitions fail to update
• Activation or License Refresh fails
• Home page RSS feed fails to load
• Product check for update fails

URL List

Protect and Patch for Windows Servers require these URLs to be accessible through firewalls, proxies and web filters:

If you require the IP addresses to create exceptions you can find the IP addresses used for content.ivanti.com here. To obtain the IP for vendor sites you can ping the site for the current IP address or contact the vendor to obtain this information.

Affected Product(s)

Shavlik Protect, All versions

Ivanti Patch For Windows Servers, All versions

Purpose

This document provides links to other documents and knowledge sources addressing Hypervisor information and troubleshooting.

Overview

Introduction and Prerequisites

• Virtual Infrastructure Requirements for Protect
• How to verify ESXi hosts are set to allow HTTP traffic for Virtual Inventory bulletin scans
• Minimal vSphere Permissions Required for Operations in Protect

Process

• Hypervisor Patching
• Patching Process Of A Virtual Infrastructure

Troubleshooting

• VMware Server Browse Credentials Will Not Stay in Place When Switching Between Users
• Adding a vCenter or Hypervisor Host to Protect fails with - The server could not be added
• Adding ESX to Hosted Virtual Machines Tab in Machine Group Throws Error: Unsupported Namespace in Contents of SOAPBody.
• ESXi Hypervisor Bulletin Scan fails
• Scanning A vCenter/ESXi Server Causes The Console To Crash

Affected Product(s)

Ivanti Patch for Windows Servers 9.3

Shavlik Protect 9.2

Purpose

This document is meant to be a guide to link you to all requirements or pre-requisite information you may need for Shavlik Protect.

Description

Below is a list of links to the different requirements you may need to use Protect or certain features within Protect.

Affected Product(s)

Shavlik Protect 9.2

Ivanti Patch for Windows Server 9.3

Purpose

The purpose of this document is to discuss virtual machine and virtual template information and troubleshooting.

Overview

Introduction/Prerequisites

Introduction to the Virtual Inventory

Virtual Machine Template Patching Requirements & Informational Document

Minimal vSphere Permissions Required for Operations in Protect

Process and Troubleshooting

How to Scan and Patch Virtual Machines

How Patch Deployment Works For Hosted Virtual Machines And Templates

Virtual Inventory

How To: Add a VM Template hosted by ESX to a Machine Group

'Resolve Machines To Scan' Error When Adding Virtual Machines Through Directory: Access Is Denied

VMware Server Browse Credentials Will Not Stay in Place When Switching Between Users

Error 808: No Disks Specified To Mount Troubleshooting

Scanning

Scan Error 830 - Unable to Connect to the Virtual Server

Scan Error 802: "Unable to open Virtual Disk"  When Attempting To Scan Hosted Virtual Machines

Scan  Error: 802 - Unable To Open Virtual Disk (4000)

Deployment

Deployment to Virtual Hosted Servers fail with Virtual Deployment Failed error - Virtual deployment error 95

Offline VM or Template Deployment fails with - Virtual Deployment Failed status

How to Increase the Deployment Timeout for Offline Hosted Virtual Machines

Issues Caused by Missing Browse Credentials

Snapshots

Snapshot Maintenance in Ivanti Patch for Windows Servers 9.3

How To: Setup Automatic Removal of Vmware Snapshots in Protect

Pre-Deployment Snapshots of Virtual Machines Are Not Taken When Enabled in Deployment Template

Affected Product(s)

Ivanti Patch for Windows Servers 9.3

Shavlik Protect 9.x

Purpose

This document provides links to other documents addressing Report and Views information and troubleshooting.

Overview

Views

View > Patches

How To: View All Patches, Software Distributions, Security Tools and Service Packs

Search for recently released patches returns No Items in View > Patches

Patch View - Office Does Not Show Service Packs

View > Machines

Where to View Protect Agent Scan\Deployments Results

How To: Set Machine Criticality

How To: Change the Location of the ProPatches Folder on the Target Machine

Agent Manager in Protect Version 9

Machine View Shows a Machine's IP Address as "::1" or "127.0.0.1" - the Localhost Address

Console Hangs When Selecting A Machine In View > Machines

Protect UI Crashes When Selecting View > Machines

How to Remove Old Machine Information from Protect Database

Agent Status And Corresponding Icons

Reports

Understanding and Creating Reports

Report Views Guide

Available Reports

Sample Protect Reports

Scan for and Report On Specific Patch(s) in Ivanti Patch for Windows Servers

How To: Create a Report for Internet Explorer Version Information

Reporting: Missing Patch Count

How To Use Advanced Reporting / Reports Advanced Filtering

Exporting Results to File or Email

How To: Set A Post Deployment Report To Be Emailed After A Deployment Completes

How To: Force A Post Deployment Report To Be Emailed After A Deployment Times Out

Condensed Patch Report CSV Header Description

Exporting To Different File Types From a Generated Report

Affected Product(s)

Ivanti Patch for Windows Servers 9.3

Shavlik Protect 9.x

Purpose

The purpose of this document is to show how to run an executable using a custom action. This can be useful if you have an executable such as a patch or a program installer that cannot be installed via the normal Ivanti processes. By using a custom action to run the executable, you can install the patch or program on multiple machines at once saving time and resources.

Overview

Because Ivanti will use a similar process as when you manually run the executable in a command prompt on the client machine(s), we highly recommend testing out the command to run the executable in a system account command prompt on the client machine(s) (please check out this document How To Test SYSTEM Account Permissions ) before trying to run the executable through a custom action. Once you have verified that the command properly runs the executable through the system account command prompt of a client machine outside of Ivanti, you should be able to use the same command into the custom action in your deployment template.

1. Move your executable file to one of your client machines then navigate to the file location in a local system account command prompt.

2. Run the correct command to run your desired executable. For my example, I will run the installation for 7-zip:

7z1602-64.exe /s

Please note that in order for an executable to be run correctly through a custom action, the executable must run silently and therefore a silent installation switch (in this case "/s") will be required. Also Ivanti does not provide any information for installation of products outside of our supported product list specified here: Ivanti Patch for Windows Servers Supported Products.

3. Place a copy of your executable on the console machine then open up your console, go to New > Deployment Template, and name the template.

4. You will need to enter in two custom action tasks for this operation. Navigate to the Custom Actions tab in your deployment template and click New to enter in your first task.

5. Leave steps 1 and 2 default in the Custom Action window then select Push File for step 3 and browse to the location of the console on your console for step 4. This completes your first task.

6. For your second task, leave steps 1 and 2 default in the Custom Action window then select After all patches for step 3 and enter in the command that you tested in your local system command prompt (in this case 7z1602-64.exe /s) in step 4. Then click Save to save your custom action tasks and deployment template.

7. You can scan your target machine with a regular patch scan template or, if you do not want to deploy any patches with your executable, simply use the null patch scan mentioned in steps 1-3 here How To: Reboot Target Machines with Using the Custom Actions Patch Type in a Custom Scan Template . After scanning, deploy with the deployment template you created.

Affected Product(s)

Ivanti Patch for Windows Servers 9.x

Shavlik Protect 9.2

Purpose

This document provides links to other documents addressing how to troubleshoot console installation, registration, configuration, and operations in Shavlik Protect.

Overview

Certificates

Shavlik Protect Console Certificates

Console Certificate Issues
How to Update the Certificate Revocation List (CRL) on a Disconnected Protect Console Server

Installation

Protect Console System Hardware Performance Guidelines

Configuring Virtual CPUs To Optimize Performance With SQL Server Express And Shavlik Protect

Protect Console Install or Upgrade fails with: This machine is managed by another console. Remove the Agent to install a Console.

Protect console install error due to .NET Framework 3.5 install failure

Protect Installs In An Unexpected Language

Download Links for Shavlik Protect Installation Files

Install - Uninstall Failures - How To Clean Up Broken Installs Of Shavlik Protect With The Microsoft Fixit Tool

Error: "Installation Failed. a Data Conversion Error Has Been Detected During the Database Upgrade Process."

Upgrade/Migration

Protect Console Upgrade Fails With Errors 1603 or 1605

Migrate Shavlik Protect Console

Console Service

Shavlik Protect Console Service Is Not Listed In Services.msc

Unexpected Popup Error Launching An Offline Protect Console After Upgrading To Protect 9.2

Shavlik Protect 9.2 Console Service Error At Startup

Shavlik Protect Console Service Fails to Launch - The Service Responsible for Importing Scan and Agent Results Is Not Running

Operations/Crashes

Scanning A vCenter/ESXi Server Causes The Console To Crash

Console Hangs When Selecting A Machine In View > Machines

Why Can't I Open My Console?

Protect Crashes When Attempting To Access Scheduled Console Tasks

Console crashes when exporting Machine Status Summary report

Unhandled Exception Error At Startup After Performing Help > Refresh Files

When Running Protect in an Environment with FIPS You Receive the Error: the Service Responsible for Importing Scan and Agent Results Is Not Running

Logging

Logs - Gathering Console, Client Side (Agentless), and Agent Log Files for Protect

Affected Product(s)

Shavlik Protect 9.x

Purpose

The purpose of this document is to discuss the message in Patch for Windows Server 9.3 that states you can only deploy certain patches if they've been acquired outside of the program.

Cause

This message is triggered when there are updates in your scan results, installed or missing, that are no longer publicly available for download from the vendor.

Resolution

Download the patch from a reputable source and follow this document to supply the patches for deployment: How To: Supply and Deploy Patches That Can No Longer Be Downloaded

Affected Product(s)

Patch for Windows Servers 9.3.X

Purpose

This document will provide helpful tips and tricks for Ivanti Patch for Windows Servers.

Prerequisites

The following information assumes that you have a basic understanding of the functionality of Ivanti Patch for Windows Servers. If you are brand new to this product we recommend you check out the following training resources:

• Ivanti Patch for Windows Servers Product Training (Formerly Shavlik Protect)
• Ivanti Webinars

Overview

Licensing

• Licensing is based on use of deployment seats. One deployment seat is taken for 45 days when:
  • You deploy to a machine in an agentless configuration
  • An agent checks in in an agentless configuration
• Because deployments to hosted virtual machines differ from deployments to physical machines, deploying to the same machine as both a hosted virtual machine and a physical machine will result in two deployment seats being taken.
• There is no way to force removal of a deployment seat. If you run out of seats you must request additional seats from your account manager or in a temporary situation request temporary seats from Support.
• For more information about licensing in Ivanti Patch for Windows Servers, please check out How To: Managing License Seat Usage with Shavlik Protect .

Database

• While Patch will be installed with SQL Express by default, you should install a full version of Microsoft SQL Server if you plan on the database containing more than 10 GB of data as that is the SQL Express limit.
• You can view the instance and database that your console is connected to at the bottom of Help > About in the Ivanti Patch for Windows Servers console.
• If you are using a local database, you can check the actual database file by going to C:\ProgramFiles\Micrsoft SQL Server\...\Data.

View > Event History

• View > Event History shows the status and information for tasks executed in the background such as scheduled console tasks, database maintenance, and distribution server syncs.
• You can see inforamtion about a certain event in View > Event History by clicking on the event and looking at the information in a pain underneath the event window.

View > Patches

• Search for the numbers in KBs such as "9405382" instead of "KB9405382" or "Q9405382"
  
• When searching for a specific KB, Q number, or Bulletin ID, make sure that you have the most recent data in your console and all options selected in your filters as is discussed in this document How To: View All Patches, Software Distributions, Security Tools and Service Packs in Protect 9.2

View > Machines

• View > Machines is a view of the database and therefore any machine that you have ever successfully scanned will show up here unless you right click the machine and select to delete it.
• Only machines that have been successfully scanned through a particular machine group agentlessly will show up associated with that particular group in View > Machines. This is discussed in further detail here Understanding Machine Groups and the Machines View

Agentless Scan and Deployment

Scanning

• You can only scan the amount of machines that you are licensed for at one time. For example, if you have a license for 3000 workstations and 200 servers, you can only scan 3000 workstations and 200 servers at one time.
• Ensure that you meet the prerequisites discussed in the Configuration Requirements section under System Requirements in the Patch administration guide https://help.ivanti.com/sh/help/en_US/PWS/93/ag-pws-9-3.pdf before scanning.
• You can find information on almost any scan error here Troubleshooting Shavlik Protect Patch Scan Error Messages

Deployment

• Ensure that Windows Automatic Updates is disabled on machines that you deploy to. You can disable Windows Automatic Updates via Group Policy or locally following the steps here Best Practice: Windows Automatic Updates.
• If you have antivirus or malware prevention software on your clients and you see strange behavior in your deployments or reboots, whitelist the items under the Agentless Deployments section in this document Antivirus Exclusions For Patch Deployments
• If your deployment remain at the status scheduled in your console, but patches are installed on your clients, follow the steps in this document to fix your deployment tracker Deployment Tracker Stuck At Scheduled During Deployment But Patches Install
• We include the following deployment logs in C:\Windows\ProPatches\Logs:
  • STDeploy.log - This gives feedback on the deployment process itself.
  • STDeploycore.log - This gives feedback on the specific patch installation and you can find patch return codes by doing a search in the log for the word "Return".
  • STdplyevnts.log - This gives feedback on the deployment tracker.
  • Safereboot.log This gives feedback on the reboot process.
  • Keep in mind that all log times are in GMT.
• For more information on our deployments please see Shavlik Protect 9.2 Deployment Process Workflow and Troubleshooting

Agents

• It is recommended that you check the items mentioned in this document Agent Status Message: "Agent didn't respond" before installing agents that you intend to control from the console.
  
• You can control agents on your network from the console by right clicking a particular machine with an agent installed in View > Machines, selecting Agent from the menu and then selecting a desired task.
• When using a cloud agent, you can force a change to the agent over the cloud quickly by going to Tools > Options (Operations in Protect 9.2) > Protect Cloud Sync > Force Full Update Now.

Additional Resources

• Protect Console Information and Troubleshooting
• Agent Information and Troubleshooting
• Protect Cloud Agent Information and Troubleshooting
• ESXI Host - Hypervisor Information and Troubleshooting
• Hosted Virtual Machine and Template Information and Troubleshooting
• Report and Views Information and Troubleshooting
• Patch Scanning Information and Troubleshooting
• Shavlik Protect Deployment Information and Troubleshooting
• Custom Action, Custom Patch, and ITScript Information and Troubleshooting
• Troubleshooting Detection Issues in Shavlik Protect

Affected Product(s)

Ivanti Patch for Windows Servers (Shavlik Protect) 9.2, 9.3