I have a 2 domain network that is using Ivanti P4WS, on one of the domains most of the clients have recently stopped checking in to my Ivanti server, even manual check ins fail. If I try to repush or reinstall the agent, it gets to 67% ("waiting for agent check-in") and eventually fails.
In either scenario, when I look in the STDispatch.log file, I am constantly seeing:
Authenticode.cpp:100 Verifying signature of C:\Program Files (x86)\LANDESK\Shavlik Protect Agent\STAgentUpdater.exe with CWinTrustVerifier,
followed by:
WinTrustVerifier.cpp:270 Certificate verification failed with error: -214676748.
CommandLineTask.cpp:473 Invalid executable 'C:\Program Files (x86)\LANDESK\Shavlik Protect Agent\STAgentUpdater.exe'. Application is not trusted by any OS signer.
I checked the properties of STAgentUpdater.exe, looked at the digital signatures, and verified the cert path was valid (the DigiCert Assured ID Root CA cert and the DigiCert SHA2 Assured ID Code Signing CA cert are both present and show up as OK when checking the digital signature path). I've tried putting one of the computers in a separate OU to block all GPOs, and also tried putting it on the other domain where the agents are checking in fine, and either way the same errors keep occurring. I've fully uninstalled the agent and all components, removed registry keys, and verified certificates are removed from the local machine cert store.