Purpose

The purpose of this document is to highlight a Microsoft Windows Task Scheduler bug that can cause your monthly scheduled console tasks to run a week early or not at all.

Symptoms

The Ivanti Patch for Windows Servers console is installed on Windows Server 2016 or Windows 10, and you have a monthly console task that is set to run on a specific occurrence of a day of the week (4th Wednesday, 2nd Saturday, etc.).  Occasionally, this task executes exactly one week early or not at all.

Cause

Microsoft has confirmed a bug in the Windows Server 2016/Windows 10 Task Scheduler that will execute scheduled tasks one week early or not at all when specific conditions are met:

• The monthly task is set to execute on a specific occurrence of a day of the week (4th Wednesday, 2nd Saturday, etc.)
• The date the task is scheduled to execute is a multiple of 7 (7th, 14th, 21st, or 28th)

If these conditions exist and the task is scheduled to execute on the 7th, the task will not run.

If these conditions exist and the task is scheduled to execute on the 14th, 21st, or 28th, the task will execute one week early.

NOTE: This bug does not affect one-time tasks scheduled for an explicit time and date or monthly tasks set for a specific day of the month.  This will only affect monthly tasks scheduled for a certain occurrence of a day of the week.

This calendar from Microsoft's TechNet post regarding the issue illustrates the affected days of 2018.  Tasks scheduled days circled in red will execute one week early, while tasks scheduled on the days circled in grey will not execute.

• NOTE: Microsoft originally stated this issue would not affect April and October as illustrated on the calendar below, but they have updated the TechNet post linked above to indicate the issue is occurring in April.  We recommend operating under the assumption this bug will surface in any month until Microsoft has released a fix for it.

Resolution

Q4343884 has been released by Microsoft to resolve this issue in Windows 10/Server 2016 build 1607

https://support.microsoft.com/en-us/help/4343884/windows-10-update-kb4343884https://support.microsoft.com/en-us/help/4343884/windows-10-update-kb4343884

Additional Information

Microsoft has acknowledged this issue and describes it further on their TechNet AskCore Japan blog:

https://blogs.technet.microsoft.com/askcorejp/2017/12/11/mouthly_tasks_issue/

Affected Product(s)

Shavlik Protect 9.2.x

Ivanti Patch for Windows Servers 9.3.x

Youtube Link to Video of issue: Shavlik Crashing on ESXi 6.x Host Patching - YouTube

Case 00877710

Message was edited by: Nick Evans Video was embedded with iframe which is causing issues. Replaced with hyperlink to video.

Hello, I am fairly new using Patch for Windows Server. I am hoping to get some guidance on an error code I received while patching.

A couple of my servers failed to install the patch for KB4457426 with a returned 32 code.

Can anyone tell me what this means?

Thank you

Symptoms

Protect is detecting a Patch that should not be detected as missing.

Resolution

NOTE: Before performing the following, please update to the latest XML data by going to Help > Refresh Files, close and reopen Shavlik Protect and then perform another scan against the machine(s) using a Security Patch or WUScan Template. The root cause of the issue may stem from custom filtering in a Scan Template or could already be fixed in a later XML release.

From The Protect Console:

1. Click on Results tab.

2. Choose the most recent scan containing the specific patch.

3. Click on the machine containing the specific patch.

4. Click on the specific patch.

5. View why Protect detects the patch as missing (Patch Information Tab).

6. Click on the linked Qnumber to be taking to documentation regarding this patch. Most of the time this will include the detection logic.

7. Browse to the location referenced in step 5 to verify the information found in step 5 and 6.

See below for more information:

Also note the Downloaded File name.

On the Target:

Browse to C:\Windows\ProPatches\Patches and find the specific patch. If you have previously deployed this patch and it failed, manually try to run the patch.

Take any screenshots of any errors such as the one below.

Information to Send to Support

If you experience these errors, please create a support case at https://success.ivanti.com/  or by calling into support.

NOTE: If you choose to call into support, please gather this information before calling in.

Gather the following information:

1. Before doing the following, please download the latest XML data by going to Help > Refresh Files.
2. The Bulletin ID & Qnumber of the patch in question. This information can be found in Step 4 above.
3. Clear your logs, and do a rescan and/or deployment.then gather the log. Please do this by following this guide for console logs: How To: Collect Shavlik Protect - Ivanti Patch for Windows Servers console, patch deployment and agent logs
   
4. A DPDTrace gives more information on how Protect detects certain patches. Please gather a DPD trace on the target machine by following this guide: DPDTrace command line logging tool used for patch detection issues
5. Screenshots from Step 5 from the console, Step 7 from the target and if applicable, the error when the patch is manually installed.

Include the following registry exports from the same target machine that ran the DPDTrace.  This will not only save time, it will also greatly increase our chances of determining the root cause of the detection issue and correcting it:

NOTE: This document has a batch file that retrieves the needed registry keys: Batch File for Obtaining Registry Exports for Detection Related Issues

• HKLM\SOFTWARE\WOW6432\Microsoft\Windows\CurrentVersion\Uninstall

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

• HKLM\SOFTWARE\Classes\Installer\Products

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages

• HKLM\SOFTWARE\Classes\Installer\Patches

Please zip all files into one archive file before emailing or attaching them to the case.

NOTE: You will not be able to email the registry keys to the case as .reg files. They must be either uploaded to the case through the support portal or changed into .txt files.

Affected Product(s)

Shavlik Protect 9.x

Purpose

This document outlines how to locate the Shavlik Protect license activation key in the console and transfer this key to a new or additional Protect console.

Description

When migrating to a new Shavlik Protect server or setting up an additional Protect console machine- understanding where to find the license key and how to input it in to the new console is vital to maintaining Shavlik Protect functionality through this transition. As this process may not frequently performed by administrators, a reference/guide for this process may prove to be helpful.

Locating the License Key on Existing Protect Console

Follow the process below to obtain your license key from your console machine. After locating the key in order to prepare to transfer the key to the new console machine, copy this 25-digit license key and make it readily available.

In Shavlik Protect 9.x:

    Help>About Shavlik Protect Advanced

In the About Shavlik Protect window, the license key can be found in the main text display under

    License Key:

          Activation Key: xxxxxxxxxxxxxxxxxxxxxxxxxx

In vCenter Protect 8:

This process is nearly identical to the process in Shavlik Protect 9.x. Refer to the images above.

To locate the license key follow this path:

          Help>About VMware vCenter Protect

In the About VMware vCenter Protect window, the license key can be found in the main text display under:

          License Key:

              Activation Key: xxxxxxxxxxxxxxxxxxxxxxxxx

Note: In the event the Protect Console is no longer installed, it may still be possible to obtain the license key from the following registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\LANDesk\Shavlik Protect\Console\Activation

The AK Value will contain the Activation Key/License key.

Activating the License Key in New Console

Activation is the process by which the Protect software is validated as having been purchased.  In order for the new Protect console to fully function activation is required. Users are prompted after installing and opening Shavlik Protect to input their activation key, through the Shavlik Protect Activation window.

To transfer the license key from your previous console machine follow the directions in the window as ordered by number:

    1. Select an activation mode (on left portion of window)

          Select "Product or bundle license"

    2. Enter your activation key(s) (in center of window)

          In the text field below, paste or manually input your 25-digit Protect license key

          Click the "Add" button right of the text field.

    3. Select activation method (lower-center of window)

          Choose "Online activation" if you have an internet connection.

          Click "Activate online now"(at the lower-right corner)

If you require "Offline activation" see the following article- How to Process a Manual (Offline) Activation for Ivanti Patch for Windows 9.3 or Patch for SCCM 2.3+

If the software was previously launched and activated by selecting Trial mode, this window can be accessed through Protect by navigating to:

    Help>Enter/refresh license key...

Additional Information

• Protect 9 Installation Guide
• Protect 9 Upgrade Guide
• How to Activate Shavlik Protect
• Managing License Seat Usage
• Sales/Licensing Contact Information

Affected Product(s)

Shavlik Protect 9.x
vCenter Protect 8.x

Symptoms

• Attempting to launch Shavlik Protect fails and returns with the following error:

"The database connection could not be made. This may be caused by a temporary interruption in the database server, or the machine hosting the database could have been renamed."

• Selecting "Launch the database configuration utility" and attempting to reconnect to SQL Server and Protect database fails, returning with error:

              "Failed to connect to SQL Server '(sql server path)'. Please verify the SQL name and credentials>"

• After verifying SQL server credentials user receives same error message.

Cause

This issue will occur if the SQL Server previously on the machine has been removed. Without the SQL Server installed on the console machine, despite retaining the Protect database, Protect will be unable to function. Some users may inadvertently uninstall the server software without being aware that doing so will not permit Shavlik Protect to run. Doing so will not delete the Protect database and Protect should be able to function again after reinstalling and configuring the SQL Server.

Resolution

To resolve this issue you must:

1. Reinstall Microsoft® SQL Server Management Studio® software (the Protect installer installs SQL Server 2012 Express by default)

  2.  Reattach the Protect SQL database to the SQL server.

The remainder of this document will provide in-depth instructions on how to perform these tasks to resolve the database connection error.

Installing the SQL Server

If you will be using an Express Edition of Microsoft SQL Server, you should consider downloading and installing Microsoft SQL Server Management Studio. This free software can be used to perform backups and to manage your database. Additionally, it will make the process of reattaching the Protect database to the SQL server much simpler.

If you would like to follow the resolution outlined in this document, SQL Server Management Studio is required.

The Microsoft® SQL Server® 2012 Express installer can obtained for free at the following link:

http://www.microsoft.com/en-us/download/details.aspx?id=29062

To install both the SQL Server and the Server Management Studio Express, install the package containing the SQL Express Server and SQL Server Management Studio.

After installation, Protect will still not launch, attempts to reconnect to the SQL server will return with this error:

    "The database 'Protect' does not exist on the SQL Server  Please verify your configuration"

This error indicates that the protect database must be reattached to the SQL Express server, the easiest way to do this is through Microsoft SQL Server Management Studio. This process will be outlined in the next section of this article.

Reattaching the Protect Database to the SQL Express Server

To reattach the Protect database to the SQL Express Server, open SQL Server Management Studio.

SQL Server Management Studio can be opened by following this path:

    Start->Micrsoft SQL Server 2012->SQL Server Management Studio

The "Connect to server" window will appear at launch.

For most users- including all who originally installed SQL Express through the Protect install package- none of the fields need to be modified.

Simply click connect to proceed to the next step in the process. Doing so will close the dialog box.

The SQL server should now be visible on the left in the Object Explorer pane. If the Databases subfolder is not visible, click the plus sign to the left of the entry containing the server path to display the server contents.

Right click this Databases directory and click "Attach..."

An "Attach Databases" dialog box will open.

Click Add in the right-center of the window to proceed. Doing so will open the Locate Database Files window.

Left-click the Protect.mdf file, which is located under DATA, then click OK.

This will attach the database file and close the window.

Click OK again to exit the Attach Databases window.

In the Object Explorer pane, the Protect database should now be visible, demonstrating that the Protect database has successfully been attached to the SQL Express server.

After completing these steps, the SQL Server should be configured properly to allow the Protect console to function as before. Opening Protect should launch the program without any of the previous errors. Protect should require no more additional configuration to resume functional operation.

Note: After the completion of these steps, if any further difficulty is encountered in attempting to connect to the database by Protect, use the Database Setup Tool to make sure that Protect database is configured properly. This can be located by going to:

Start->Shavlik Protect->Database Setup Tool

Related Articles

If you receive the same error message as above and verify that the SQL Server is installed, your SQL Server service may not be running.

Launch Interface - Error - a Network-Related or Instance-Specific Error Occurred While Establishing a Connection to SQL Server.

Restore Shavlik Database from backup using SQL Server Management Studion:

http://community.shavlik.com/docs/DOC-22956

Affected Product(s)

Shavlik Protect 9.x

Symptoms

Some administrators may see multiple versions of the same Patch detected as missing despite them all not needed for installation.

An example of this is shown in the following screenshot:

Cause

This behavior is caused by Protect having been altered from its default configuration to not use replacement patches/supersedence in its patch scans.

Resolution

To resolve this, only a simple configuration change needs to be made to enable supersedence in Protect.

To do this:

- Open up Shavlik Protect.

- Go to Tools > Options > Scans.

- Check the box next to Use Replacement patches to enable supersedence in Protect and eliminate unnecessary missing patches.

- Rescan and you should see the desired patch scan results.

Affected Product(s)

Shavlik Protect 9.x

Last build 9.3.4510 (9.3 Update 1) was released 10/02/2017. When is anew build or version coming out? Whats new features or fixed bugs will be included?

Hello,

Does Ivanti or anyone have any recommendations on keeping track of software that is no longer supported?

Up until recently we were deploying Adobe Reader XI and only just found out that support was ended last year. Adobe Acrobat Reader DC has since replaced it.

Thanks,

Hello,

we organized our Workstations based ob departments from our company.  So we basicly created multiple machine groups wich are linked with OUs from our domain.

Now we are facing the followin issure:

We are not able to add systems which are currently offline/powered off.

When we try for example an enerygy status scan we can see the new System in the result list (with the status - system not found).
But when we change the view to the machine groups we notify that the system not added to the group.

So what can we do to add offline/powered off machines to its machine groups without powering on.

I am having an issue with schedules kicking off a week early.  See screenshot.  My schedule is set to 3rd Tuesday but it ran last night and it scheduled to run again next week.

This is the second occurrence this has happened that i have noticed.  It may have been happening before but I only noticed it once I started running check-reboot scripts in tandem.  Last time was when the 1st of the month was Thursday and it affected my (3rd Tuesday + 2 Day) schedules.

Our agents are configured to use distribution servers in agent policy settings. Any idea are the credentials used to access the distribution server saved in the agent or does the agent tries to get it from the console when performing an agent scan.

I've enabled the Office365 Client Management setting through GPO.

Are there additional settings I need to implement?

I'm probably being really dense but I'm choosing Software Catalog Report from Tools - Create Report, leaving all parameters as default, and my report just says "No data". Do i need to run some kind of data gathering job beforehand to make this work? We've been scanning and patching 400 machines for the last 4 months so we should definitely have some data available, so I'm obviously doing it wrong somehow.

Every time I go into Tools... Options... and select Distribution Servers, the Ivanti Console crashes with the attached error message.  Has anyone run into this problem before.

I know it's still early days for Office 2019, but is there a timeframe as to when support for patches will be added to Ivanti Patch? It'll make it a lot easier rather than keeping a central repository up to date manually every month.

Thanks!

I am deploying 1709 and notice if I schedule a deployment to copy the file to the machine and deploy it later that evening it will not deploy and in the Logs it says "action canceled by user" which is not true  No one touched the machine or canceled it.

Also if I stage a patch to a machine and do not deploy it and then the next day I tell it to deploy the patch it markes the old one as a .old file and redeployed the patch.

A lot happened at Dallas Interchange.  Here are the highlights:

At Dallas Interchange 2018 we introduced the latest in Ivanti technologies and shared the development roadmap for our security products. We’re excited to share some highlights from that event with you.  We’d also like to address misconceptions that arose about the future of the products we offer now.  Be assured that none of our security products have reached end-of-life (EOL).  We updated several in the past couple months, and we’ll continue to release updates throughout the year and beyond.

Please take a moment and view the attached document to learn more about security news from Interchange:

• Ivanti Security Controls, our soon-to-be new product, which brings together leading features in our security product set
• The roadmap for products Ivanti Security Controls is based on
• An update on the path forward for Ivanti Endpoint Security for Endpoint Manager
• How you migrate to Ivanti Security Controls (if you choose to)
• Ivanti Smart Advisors, another in-development solution, which correlates patch intelligence and other critical back-to-basics security data to provide real-time updates on your security posture

Download

• PatchForWindows_June_2018_Security_Product_Roadmap_Update.pdf

Purpose

This document provides best practices and guidance on scanning and deploying patches with Shavlik Protect. This will cover how to properly use many features of Protect so that you can successfully perform patching, automate patch tasks, and have a better understanding of the patching abilities of Protect.

Best Practices

The best practices have been broken into different sections. Follow the links below for each scenario/category.

Verifying Requirements and Initial Setup

Verifying and Updating Patch Definitions

Configuring Patch Scan Templates and Filtering Options

Configuring Patch Deployment Templates

Successfully Running Agentless Patch Scans & Deployments

Considerations

Patch Tuesday Survival Guide and Best Practices

Additional Information

There may be additional best practice information in the Best Practices Guide from our online documents.

A Zip file containing these guides as well as all referenced documentation (other than Microsoft links and videos) is attached below if you prefer to have a downloaded copy of all necessary documentation to get started and successfully use Protect for patch scanning and deployment.

[See attached "Patch Scan & Deployment Best Practices.zip"]

Note: Files in attachment last updated 4/7/2015.

Downloads

PatchForWindows_Patch_Scans_&_Deployment_Best_Practices.zip

Affected Product(s)

Shavlik Protect 9.x

Purpose

This document will list common install return code errors from the vendor and possible solutions to the error.

Overview

Protect and Patch for Windows Servers (PWS) track patch deployment progress.  The View > Deployment Tracker (F9) will display the final status of the install attempt and display the return code from the vendor.

As an example return code 0 is success and return code 3010 is reboot required, but there are many other codes that can help troubleshoot patch install issues.

Downloads

• Adobe_Update_Errors.docx
• Error_codes_for_Office_update_packages.docx
• MsiExecErrorCodes.docx

Affected Product(s)

Shavlik Protect 9.x

Ivanti Patch for Windows Servers 9.3.x+