When running a batch file as part of a custom action, the deployment never completes/the deployment hangs.

When Protect is running a deployment, it creates a batch file that is copied to the target machine. This batch file contains all the information related to that deployment, including what patches should run, and with what switches. It also includes any Custom Actions that the user defined. This batch file will be refered to as the Protect Generated Batch. When the Protect Generated Batch file is running, it initiates each task sequentially going through the list (one task must finish before the next can begin). When the Protect Generated Batch file calls the users custom batch file, the Protect Generated Batch file waits for the users custom batch file to return an exit code to indicate it is done. If the users' custom batch file is not accessed with an appropriate command, it will not return the necessary exit code for the Protect Generated Batch File to continue through its pending actions.

If the Custom Action batch file is going to run an action that following actions are dependent on (example: batch file stops a service so a custom action can run a .exe), then utilize the CALL command.
The call command will allow the custom batch file to return an exit code to the Protect Generated Batch file so it can continue on its jobs, once the custom batch file finishes.

Example: Call%PATHTOFIXES%Install\stop_services.bat


If the Custom Action batch file is going to present the end user with information that should stay open (example: a custom message that the batch file shows), then utilise the STARTcommand.
The Startcommand will begin the custom batch file, and once it has started, the Protect Generated Batch file will continue without waiting for the custom batch file to close.

Example: Start%PATHTOFIXES%Install\show_warning.bat

These are CMD commands, not Shavlik custom variables. More info on CMD commands here: http://ss64.com/nt/

Custom Action - Using the Null Patch

Shavlik Protect 9.x
vCenter Prtoect 8.x

This document outlines how to scan for the Null Patch, then use custom actions to stop a Windows Service with a batch file, and install a 3rd party program.

Custom Actions only run during a deployment. Deployments can only occur if a scan has found a missing patch it can deploy. In some situations it may not be desirable to apply missing patches to a computer, or there may be no missing patches to deploy. In either case you can scan for Custom Action patches/The Null patch. The Null patch is a file created by Shavlik, that will alwaysshow as missing, and when ran does absolutely nothing. It provides a way to run a deployment and only modify the target computer based on the custom action.

Related Document: NullPatch.exe/Noop.exe Information

This video goes over how to setup a scan to find the custom action/null patch.

A Custom Action is associated with a Deployment Template, which means it can only be used during a deployment. Now that there is a missing patch available to deploy (re: Scanning for Null Patch), this video will cover how to setup a custom action for use.

In this video, we setup a custom action to stop a service using a batch file, and then install a 3rd party program.

Shavlik Protect 9.x
vCenter Prtoect 8.x

The attached .bat file is designed to collect information that may assist the support team in diagnosing and resolving issues with the Protect application.

This batch file will collect trace log files, event logs, registry entries, config files, and other information that can provide great information to support for diagnosing problems.

This .bat can prove useful on any system where you are currently having issues with the Protect console or a Protect agent.

This file is intended only to obtain information for support purposes. It is not an officially supported tool and has not gone through QA/Testing. The user assumes any risks of running the attached file(s).

1) Download the attached Get_Protect_Info.bat.zip.

2) Extract the Get_Protect_Info.bat to the desktop of the Protect console system or agent system where you wish to obtain files for support.

3) Right click the Get_Protect_Info.bat, choose 'Run as Administrator'. For older operating systems such as XP or 2003 this will not be necessary - just run the file.

4) Allow the .bat to run through everything. It may take some time. The cmd screen that comes up when run will disappear when it is finished.

5) A folder titled 'ProtectLogs' will be created at the root of C:\, containing all the files collected by the .bat.

6) Please create a compressed file of this folder. It is suggested to use 7zip for compression. 7zip will compress to a smaller file size than the built in Windows compression, and it allows for creation of an encrypted 7z or zip file. You can download 7zip here: http://7-zip.org/download.html

7) Send the 7z or zip file of the ProtectLogs folder to support.

8) The folder C:\ProtectLogs can be deleted after this.

This .bat file may retreive some files containing sensitive system or network information. Make sure you review the files that are collected prior to sending if you believe this poses any security risk for you. This is why it is also highly recommended to place the files within an encrypted or password protected zip or 7z file before sending.

When selecting the Shavlik Patch plugin in the System Center Configuration Management console. The following error is returned

Microsoft System Center Configuration Management needs to be ran as Administrator

Shavlik Patch

Purpose

This document is a step by step guide on how to configure authenticated SMB Distribution Servers. in Shavlik Protect 9.x.

Why use a distribution server ?

Distribution servers can be used in a number of different scenarios:

• Distribution servers can be used to store patches that you wish to deploy. Distribution servers can be physically located near each group of machines you are managing. The console can copy patches to the distribution servers only, rather than to each individual machine. Each machine can then download the patches it needs from the nearest distribution server. This can greatly reduce network traffic in a distributed environment and be of huge benefit in wide-area networks. This is true in both agentless environments and agent-based environments. In agentless environments, using distribution servers means the console does not need to push patches to individual machines and individual machines do not need to download patches from patch vendor. In an agent-based environment, it can keep each machine from downloading the patches it needs from the patch vendor over the Internet.
• Distribution servers can be used to store the most up-to-date engines and XML files that are available. In a multi-console or agent-based environment, this can reduce the number of machines that need to download updated files over the Internet. If you will be configuring an agent policy that contains a threat task it is strongly recommended that you use a distribution server. The threat definition file is rather large and using a distribution server to store the file will greatly improve the download performance for your agents.
• Distribution servers allow consoles and agents to operate in environments where they do not have Internet access but still need access to the most up-to-date engines and XML files. See What is a Disconnected Console Configuration for more information.
• Distribution Servers can be used to store any custom patches you may have defined. This is particularly important for agent-based environments. See Preparing to Use Agents for more information.

Do You Need a Distribution Server ?

To determine if you should use one or more distribution servers with Shavlik Protect, apply the following formula:

• If # of machines * 10Kb > available bandwidth, then you need at least one distribution server.

Examples

Assume available bandwidth = 500 Kb:

• 100 machines: 100 machines * 10Kb = 1000Kb > 500Kb (need distribution server)
• 20 machines: 20 machines * 10Kb = 200Kb < 500Kb (do not need distribution server)

If You Need Distribution Servers, How Many ?

If (using the formula above) you determine you need one or more distribution servers, you still need to determine exactly how many distribution servers are needed. Determining the number of distribution servers that are needed is very simple. The general rule is:

• Use one distribution server for every 2500 machines

For example, if you have 7500 machines you should plan on using three distribution servers.

Apply to

• Windows Server 2012
• Shavlik Protect 9.x

Related guides

Configuring Authenticated HTTP Distribution Servers

Configuring Authenticated HTTPS (SSL) Distribution Servers

Create a shared folder on Windows Server

In order to create a shared folder open the Server Manager

On the up right corner Manage > Add Roles and Features

Follow the wizard.

Check the box File Server in File and Storage Services > File and iSCSI Services > File Server

Continue without adding new features.

You should have something like the following screenshot. And Install

After adding the File Server role, on the Server Manager's Dashboard click on File and Storage Services

Go in the Shares tab and create a new share.

Choose SMB Share

Select where you want to create the share folder.

Name the share.

Click on Customize permissions...

In the Permissions tab we will need 2 accounts :

• One for the Console which will need a read/write to add and delete the patchs.
• One for the Agents which will need only to read and download the patchs.

It is possible to use the Console credentials for the Agents but it is not recommended for security issue as these credentials will be copied on all Agents.

In the Share tab Edit the permissions for Everyone

And select Full Control

And create the share.

Add a new distribution server in Shavlik

In order to add a new distribution server in Shavlik go in Tools > Operations

Select the tab Distribution Servers

On the top panel "Distribution Servers" click New

Give a name to the Distribution Server and fill the path and credentials.

The upper panel is for the Agents connexion so we will give the read only credentials.

The lower panel for the Console so we will give the read/write credentials.

Select the created Distribution Server, choose All engines, definitions, and patch downloads from the scroll down and click Add scheduled sync:

Schedule when you want to sync the Distribution Server with the files on Internet.

We recommend to sync on Wednesday and Friday as our patch release are on Tuesday and Thursday.

To force sync click Run now for each selected tasks.

There should be files in the shared folder.

If not follow this document :

Troubleshouting distribution server synchronization

Using the Distribution Server in Agent Policy

In order to use the Distribution Server we need to create a new Agent Policy or modify an exesting one.

To create an Agent Policy go in New > Agent Policy

To modify an existing Agent Policy click on the button just under Home and Agent Policies

In the popup window select Distribution Server and select your previously created Distribution Server.

Deploy or update the policy on the Agents and files will now be downloaded from the agents.

This document outlines how to locate the Shavlik Protect license activation key in the console and transfer this key to a new or additional Protect console.

When migrating to a new Shavlik Protect server or setting up an additional Protect console machine- understanding where to find the license key and how to input it in to the new console is vital to maintaining Shavlik Protect functionality through this transition. As this process may not frequently performed by administrators, a reference/guide for this process may prove to be helpful.

Follow the process below to obtain your license key from your console machine. After locating the key in order to prepare to transfer the key to the new console machine, copy this 25-digit license key and make it readily available.

In Shavlik Protect 9.x:

     Help>About Shavlik Protect Advanced

In the About Shavlik Protect window, the license key can be found in the main text display under

     License Key:

          Activation Key: xxxxxxxxxxxxxxxxxxxxxxxxxx

In vCenter Protect 8:

This process is nearly identical to the process in Shavlik Protect 9.x. Refer to the images above.

To locate the license key follow this path:

          Help>About VMware vCenter Protect

In the About VMware vCenter Protect window, the license key can be found in the main text display under:

          License Key:

               Activation Key: xxxxxxxxxxxxxxxxxxxxxxxxx

Note: In the event the Protect Console is no longer installed, it may still be possible to obtain the license key from the following registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\LANDesk\Shavlik Protect\Console\Activation

The AK Value will contain the Activation Key/License key.

Activation is the process by which the Protect software is validated as having been purchased.  In order for the new Protect console to fully function activation is required. Users are prompted after installing and opening Shavlik Protect to input their activation key, through the Shavlik Protect Activation window.

To transfer the license key from your previous console machine follow the directions in the window as ordered by number:

     1. Select an activation mode (on left portion of window)

          Select "Product or bundle license"

     2. Enter your activation key(s) (in center of window)

          In the text field below, paste or manually input your 25-digit Protect license key

          Click the "Add" button right of the text field.

     3. Select activation method (lower-center of window)

          Choose "Online activation" if you have an internet connection.

          Click "Activate online now"(at the lower-right corner)

If you require "Offline activation" see the following article- http://community.shavlik.com/docs/DOC-23010

If the software was previously launched and activated by selecting Trial mode, this window can be accessed through Protect by navigating to:

     Help>Enter/refresh license key...

• Protect 9 Installation Guide
• Protect 9 Upgrade Guide
• How to Activate Shavlik Protect
• Managing License Seat Usage
• Sales/Licensing Contact Information

Shavlik Protect 9.x
vCenter Protect 8.x

This document outlines how to run a DPDTrace. This may be necessary when troubleshooting detection issues.

DPD stands for Dynamic Product Detection.  It’s the method our scan engine uses to determine what supported products are installed on the machine.This tool was created for troubleshooting patch scan issues where we need to know what is going on during the DPD process.

Note- .Net Framework v4.0.30319 or newer needs to be installed for this to work

1. Download DPDTrace.zip and extract the file into a folder on the root of C:\
2. Read Disclaimer.txt.
3. Open Command Prompt and change directory to C:\DPDTrace

4. Enter the following command, replacing {MACHINE_NAME} {ADMIN_USER_NAME} {PASSWORD} and {PATCHTYPE} with corresponding values. ({MACHINE_NAME} has to be the Target machine that is having the detection problem

          DPDTrace.bat {MACHINE_NAME} {ADMIN_USER_NAME} {PASSWORD} {PATCHTYPE}

5.      When the command line is run, a window titled 'Rename HF.1 Log' will appear with an OK button. Do not close this window as the scan continues.

6.     When the scan has completed the command prompt window will say 'Test Complete  Please zip up HFCLi folder and send it back to us'. Please verify that an XML document has been created in the HFCLI folder. If it has, please zip up the directory "C:\DPDTrace\HFCLI" and send it back for analysis.

The Protect Console expiration date is different than the expiration date shown in the Protect Agent.

(Protect Console Expiration Date)

(Protect Agent Expiration Date)

Agent seats are held for 45 days from the last time they successfully checked in. This is to allow a seat to be reclaimed by the Console in the event an Agent goes unused for a prolonged period of time. The Agent's expiration date will be 45 days from the last time it successfully checked in.

If the Agent has an expiration date older than 45 days from today, initiating an Agent Check In should refresh its expiration date.

Shavlik Protect 9.x
vCenter Prtoect 8.x

- Protect crashes with an "unexpected error" during the patch deployment or download process.

- In the ST.Protect.Managed.xxx log file you see an error similar to the following:

2013-09-27T16:45:23.0890496Z 0022 I WorkItemController.cs:399|Download patches for deployment Started

2013-09-27T16:45:23.1202506Z 0022 I Patch.cs:102|Nonexistent file 'C:\ProgramData\Shavlik Technologies\NetChk\Patches\ccsetup405_slim.exe'.

2013-09-27T16:45:23.3230571Z 0022 V FileSetDownload.cs:457|Started ''.

2013-09-27T16:45:23.3386576Z 0022 V SingleFileDownload.cs:481|Downloading from 'http://www.piriform.com/ccleaner/download/slim/downloadfile' to 'C:\Users\administrator.HPDDM\AppData\Local\Temp\st7e7884f3-959c-4e83-91ea-a93abfb2e839.tmp'.

2013-09-27T16:45:23.7910721Z 0023 C Launcher.CurrentDomainUnhandledException|System.ComponentModel.Win32Exception (0x80004005): An error occurred during encode or decode operation

at ST.NativeWrappers.ManagedCrypto.IsSigned(String filePath)

at ST.Engines.Catalog.Patch.IsSigned(String filePath)

at ST.Engines.Catalog.SingleFileDownload.CheckSignature()

at ST.Engines.Catalog.SingleFileDownload.HandleCompletedFile(Object sender, AsyncCompletedEventArgs eventArgs)

at ST.Engines.Catalog.SingleFileDownload.ClientDownloadFileCompleted(Object sender, AsyncCompletedEventArgs e)

at System.Net.WebClient.OnDownloadFileCompleted(AsyncCompletedEventArgs e)

at System.Net.WebClient.DownloadFileOperationCompleted(Object arg)

at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(Object state)

at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean ignoreSyncCtx)

at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()

at System.Threading.ThreadPoolWorkQueue.Dispatch()

at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()

The reason for the crash is two-fold:

1) The application being downloaded most likely has a static URL and downloads may have been disabled or invalid due to changes on the vendor's side.

2) Protect is not properly handling reason 1. This is currently marked as a defect and Protect's handling of the invalid URL should be fixed in a future release.

Most likely there is a newer version of the affected application that is causing the crash. Once the new version has been added to Protect's XML (patch definitions) it should resolve the problem.

Check for updates to patch definitions with the links in this document: http://community.shavlik.com/docs/DOC-23176

If you are running into this issue and do not see it fixed after an XML update or wish to verify with support that it will be fixed, please open a case here:

http://support.shavlik.com

Update 3/27/14

The crash will no longer occur in Shavlik Protect version 9.1. Instead you will see the deplyment of the patch fail, and an error such as the following will be provided:

Error: File not downloaded: ccsetup411_slim.exe

Error reason: File 'C:\ProgramData\LANDesk\Shavlik Protect\Console\Patches\ccsetup411_slim.exe' failed signature check: http://www.piriform.com/ccleaner/download/slim/downloadfile

Zero patches are available and properly signed.

No patches were deployed. Please review the program logs to determine the cause.

Patch deployment canceled due to failure building deployment instructions.

Error on machine 'WIN-4VAC13D975C': Failed

Shavlik Protect 9.0

Certain Hot Fixes are missing from Protect.

One of the criteria for a patch to be added to the Protect data is it must have a publicly available download URL.

Certain Hotfixes from Microsoft are only offered by request.

Example of Microsoft Hotfix Request Form

These patches/hotfixes do not offer a publicly available download url, and therefor are unable to be added to Protect.

Here are some known hotfixes that this article applies to:

• KB2406705
• KB2522766
• KB968287
• KB2597051
• KB2935092

Protect Version: All

The Protect Console does not show in the list of machines under the Scheduled Task Manager.

Note: This issue is most commonly seen after an upgrade to version 9 build 1182.

With the release of Version 9 Patch 1 (Version 9 build 1182), the Protect Console will not be listed in the Scheduled Task Manager.

Run a successful patch scan against the Console. (Any patch scan will work).

The scheduled jobs should then re-appear in the Scheduled Task Manager.

Shavlik Protect 9.0.0.1182

This document is meant to describe the best practices for the order in which to apply updates with Protect when using agentless patch scanning and deployment.

When preparing to deploy updates to your systems with Shavlik Protect, it is best to follow the order listed below:

1. If you wish to deploy software using the software distribution feature of Protect, do so first.
   See the following document for more information on software distribution: http://community.shavlik.com/docs/DOC-23116
2. Run a patch scan for Security Patches and/or (optional) Non-Security Patches and Security Tools.
   More info about creating a patch scan template can be found here:
   http://www.shavlik.com/onlinehelp/Protect90HTMLHelp/Creating_or_editing_a_patch_scan_template.htm
3. View scan results. How many service packs show missing? These should be applied prior to patches/hotfixes.
4. Deploy operating system level service packs first.
5. Run your patch scan again after applying OS level SPs.
6. Deploy any remaining service packs. Take into account that each service pack must be deployed separately, and each service pack will require a reboot.
   This can seem tedious, however, it's important that you do service packs first. Service packs may update the base code for the application as well as apply currently missing updates during the process. New updates may be required once the service pack is applied as well.
7. After all service packs have been applied, run a patch scan on the systems once more, and then deploy missing patches.

More information about agentless deployment of service packs and patches can be found in Protect's online Help under "Agentless Patch Management Tasks".

Protect Online Help:

http://www.shavlik.com/onlinehelp/Protect90HTMLHelp/HFN.htm

Additional Information from Microsoft about best practices for applying updates can be found here:

http://technet.microsoft.com/en-us/library/cc750077.aspx

http://technet.microsoft.com/en-us/library/cc512589.aspx

Shavlik Protect 9.x

vCenter Protect 8.x

The purpose of this document is to help to prepare a current Protect console and database for upgrade to a newer version of Protect, and also to provide some information about how to resolve common upgrade issues.

Preparing for Upgrade of Protect

Most issues with upgrading Protect can be avoided by ensuring that you are meeting system requirements and that proper database maintenance has been performed prior to upgrade. The list below can be used as a guide to ensure you have a successful upgrade:

• Review the System Requirements for the version of Protect you plan to install.
  Refer to the document - Shavlik Protect Requirements Guide
• Review the Shavlik Protect Upgrade Guide.
• Prior to upgrade, it is recommended that you clean out as much old results as possible and perform database maintenance.
  This document covers the full steps for database maintenance: DOC-23430
• The user who will perform the upgrade of the database should either be the SA for the database in SQL, or the user should at least have the following privileges for the Protect database:
  Privileges required for upgrade purposes: db_securityadmin, db_ddladmin
  Privileges required for all Protect users: STExec, DB_DataReader, DB_DataWriter
• If your Protect database is hosted on SQL 2005, review the document; Authentication Limitation with Protect 9.0+ and SQL 2005.
• If you plan to move/migrate your console to a different system, review the document; Migrate Shavlik Protect Console.

Resolving Common Upgrade or Post-Upgrade Issues

If you do have an issue during the upgrade process, it's possible the issue can be resolved based on some common issues listed below:

Upgrade/Install Failure

• Error: "Installation Failed.  A data conversion error has been detected during the database upgrade process."
• Resolving database upgrade timeout failures for Shavlik Protect
• Upgrading Protect fails with the error: Cannot create a new Service Broker in a mirrored database
• Upgrade to v9.x fails with error "Protect bootstrapper has stopped working"
• Upgrade\Installation Error, Background Intelligent Transfer Service (BITS) is disabled
• Failed to commit or save the database installation. Invalid License
• Install- Error 1612: The installation source for this product is not available
• Upgrade - Error - Data Conversion Error - EventSubscription
• Shavlik Protect Install/Uninstall Issues
• Upgrade to version 9 Fails with error 'This installation package could not be opened.'
• How to clean up broken installs of Shavlik Protect with the Microsoft Fixit Tool
  • Applies when seeing: Error 1605: This action is only valid for products that are currently installed.

  Post-Upgrade 

• Scheduled Jobs Missing from Scheduled Task Manager in Protect Console
• Scheduled Task Manager pops Error: -2080374779 - Upgrade scheduler now
• It is worth noting that the Agent Manager has been removed in version 9. All functionality is available from within Machine View.
  • You can see the full list of changes in each build, here.

What to do if you face an upgrade failure you cannot resolve

If you receive an upgrade or installation failure, and you are not able to use the above resources to resolve the issue it's time to open a support case.

• Contact Support with one of the following methods:
  • Support Portal: https://support.shavlik.com/
  • Other contact methods: http://www.shavlik.com/support/contact/
• If possible please provide the following information:
  • Console Logs
  • Installation Logs
  • Any applicable screenshots
  • Operating system of the console system and version of SQL used to host Protect database

Shavlik Protect 9.x

vCenter Protect 8.x

Upgrading to version 9 fails with errors.

• This installation package could not be opened.  Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package.

Errors located in the Protect Installer log files (ProtectInstall_20130903_204512.log) in the TEMP directory (%TEMP%)

• 2013-09-03T20:45:12.7989609Z 0b0c E BitsNotification.cpp:156 Error from BITS: The server does not support the necessary HTTP protocol. Background Intelligent Transfer Service (BITS) requires that the server support the Range protocol header.

Clicking the prompt from Protect to upgrade will download a no longer supported web installer.

The web installer is 1.15mb where the full installation file is 154mb.

*Note the Name and Size difference between the 2 files.

Download the full installation file from http://www.shavlik.com/downloads/

*Note: Always read upgrade documenation prior to running the upgrade. Failure to do so increases likelihood of upgrade issues.

• When upgrading Protect, you experience a database upgrade failure. 
• In the ST.databaseconfigurationlog file, you see an error similar to:
  
  Cannot create a new Service Broker in a mirrored database "Protect".
  ALTER DATABASE statement failed.

This issue occurs because database mirroring is enabled for the Protect database.

To resolve this issue, turn off the mirroring on the database.

If you are unsure how to turn off database mirroring, contact your DBA. For more information, see these Microsoft articles:

• Remove Database Mirroring (SQL Server)
• How to: Remove Database Mirroring (SQL Server Management Studio)

Shavlik Protect 9.x

vCenter Protect 8.x

• When downloading a patch in Protect, the console crashes.

Note: Other actions may also cause this. Downloading patches is the most common cause.

 

[Window Title]
Shavlik Protect Advanced

 

[Main Instruction]
Sorry, an unexpected error has occurred and Shavlik Protect Advanced must close to recover.

 

Depending on the configuration of your operating system, a second dialog may be displayed that gives you the option to report this error and check online for a solution. We really want to fix this problem (to help you and other customers) and hope you will select the “Check online” or "Send Error Report" option. Thanks!

• An error is present in the ST.Protect.Managed log:

This is a Windows based error typically caused when the operating system has run out of available working memory (RAM), though Microsoft indicates other potential causes such as:

• Active Anti Virus
• IRPStackSize registry entry on the server is set too low.

Microsoft Article: Error message: "Not enough server storage is available to process this command"

Because the issue can occur from different causes, there is not an explicit fix-all solution. Where this issue stems from system resource limitations (Hardware or Operating System Based), the following 'solutions' are provided as potential workarounds.

Crash Occurs Downloading Multiple Patches at Once

Try downloading a smaller subset of patches, or even downloading them individually. The goal is to not overtax the OS's available memory.

Crash Occurs Downloading A Single Patch

If a single patch is being downloaded, and crashes (typically at around 99%) this can be caused by the patch occupying memory in the download, and then occupying additional memory from being copied from the Temp directory into the working Patch Repository. To correct this, download the patch manually from the vendor.
If you are able to download the patch manually from the vendor, copy it manually into the Patch Repository, and provide it with the Shavlik Name.

Related Document: Protect doesn't recognize a patch that was manually downloaded

Crash Occurs During Other

Because the crash stems from Hardware or Operating System based limitations, there are a variety of things that can attribute to the crash. Microsoft has many threads online regarding the error, with fixes ranging form increasing the IRPStackSize Registry entry, to adding more RAM to the machine.

Note:This issue seems to occur on x86 Operating Systems specifically (though unverified). Beginning with Protect 9.1, x86 systems will no longer be supported. To prepare for new versions of Protect, consider upgrading your Protect Console to a newer x64 based Operating System.

Shavlik Protect 9.x
vCenter Prtoect 8.x

This document explains the various icons displayed for Patch Downloads.

No Icon:

The patch is not available to be downloaded by Protect, and will only show as missing for reporting purposes.

Greyed Out Icon:

The patch has not yet been downloaded.

Green Icon:

The patch has already been downloaded.

Protect Version: All

This documentation trying to explain why some patches do not have a "Download" indicator next to it.

You find a patch in Patch View and there is now Download button in the patch information.

Not all patches are available to be deployed with protect but the scan information is still available to detect if the patch is missing. We refer to these as ‘scan only’ items.

In some cases the patch requires user intervention and the patch cannot be deployed silently, a good example of this would be with some service packs or rollups so we are not able to download the patch with Protect.

Other times the vendor has changed the url or the patch is no longer publically available. In those cases we leave the scan detection there but are unable to download the patch.

Additionally, the lack of download icon could be caused by out of date data files.  You should run a Help -> Refresh Files to ensure you have the latest files.

The purpose of this document is to provide a resolution to an issue where the Protect 9 installer is unable to complete the attempted installation.

You are unable to install Shavlik Protect and within the ProtectSetup.log in the %temp% directory you see the following:

ExecuteInstallConsoleCerts: Error 0x80090016: class STWin32::CWin32Exception at CryptoServiceProvider.cpp:58: Error 2148073494: Keyset does not exist.

The cause of this issue is the user attempting to install Protect does not have full control rights to the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys folder on the system.

The user account will need to have explicit access to the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys folder on the system. You may provide these explicit rights by following the process outlined below.

1. Navigate to the C:\ProgramData\Microsoft\Crypto\RSA\ directory on the machine you are attempting to install Protect on.

2. Right-click on the 'MachineKeys' folder and select 'Properties'.

3. Within the 'MachineKey Properties' select the 'Security' tab. Ensure the user has 'Full control' rights to this folder.

Note: If these permissions need to be altered, you may do so by selecting the 'Edit' button.

Please note we have had an instance of this issue being associated with malware. If you are still receiving this error message after providing the install user with full control rights to the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys folder on the system we suggest scanning for possible malware.

Shavlik Protect 9.x

When attempting to scan a Hosted Virtual Machine or virtual machine Template, You get the error "802: Unable to open Virtual Disk (4000).

The status code (4000) translates to 4000 – VIX_E_VM_NOT_FOUND and as a result Protect is unable to reach the Hosted Virtual Machine or Virtual Machine Template.

The most common cause for the status code (4000) is due to a special character within the datastore path. These special characters may be one of the following:

%, &, *, $, #, @, !, \, /, :, *, ?, ", <, >, |, ;, '

Please remove any of these characters from the datastore path.

For additional information concerning the scan Error 802: "Unable to open Virtual Disk" please visit the link below:

http://community.shavlik.com/docs/DOC-23104

Shavlik Protect 9.x