This article is an exerpt from the Protect 9 Admin Guide

Shavlik Protect is, at its roots, an agentless solution. With a few simple configuration steps, however, Shavlik Protect can also provide agent-based services. This section explains when to implement each solution.

Start with the Agentless Features of Shavlik Protect

For large enterprises containing thousands of machines, the ease of use provided by the agentless technology of Shavlik Protect can be used to address the patch management and asset management needs of the vast majority of the machines in your enterprise. Shavlik Protect can be used to discover which target machines are missing patches and automatically deploy the missing patches. It can also scan your target machines and report on the software, hardware, and virtual assets contained on the machines. Using Shavlik Protect you can scan and fix, from one central location, the vast majority of the machines in your network within minutes.

Polish Things Off with the Agent-based Features of Shavlik Protect

Most large enterprises have machines in hard-to-reach places: machines in remote locations, laptops that roam to different locations or that park and dock outside the office, machines in protected zones (DMZs), etc. For these devices you can use the agent-based features provided by Shavlik Protect, which are implemented using Shavlik Protect Agent. With Shavlik Protect Agent you can be sure that these machines are scanned regularly, even if they are disconnected from your enterprise network. Note: There is one exception; agents can be used to perform software asset scans and hardware asset scans, but they cannot perform virtual asset scans.

The threat management capabilities within Shavlik Protect must be implemented using agents. With the threat management capabilities you can configure an agent to scan for and remediate threats such as spyware, worms, viruses, trojans, rootkits, and more. You can also configure it to provide real-time monitoring and protection on your target machine against known and unknown threats.

A number of the power management tasks apply only to agentless situations. This includes the Shutdown now, Restart now, and Wake-On-LAN tasks that are initiated from Machne View or Scan View. These tasks require the target machines to be accessible from the console and are therefore not implemented within an agent policy.

Power management tasks that use a power state template, however, can be implemented in either an agentless or agent-based manner. You may consider using an agent-based power state task under the following conditions:

• If you want to apply your power management policy consistently across all machines within your organization (connected and disconnected).
• If you have machines that may not always be reachable from the console (for example, machines in a DMZ).
• If you are concerned with network bandwidth issues.

An agentless power state task will push a small number of files from the console to each
target machine -- if a large number of machines are involved it may affect the
performance of your network.

Shavlik Protect Version: All

Direct Link to Document Here

" "

Direct Link to Document Here

" "

How to configure an Agent Policy to run a patch task on boot if the schedule is missed

Create or Modify existing agent policy

To create an Agent Policy go in New > Agent Policy

To modify an existing Agent Policy click on the button just under Home and Agent Policies

Configure Patch Task Schedule to "Run on boot if scheduler missed"

You configure agent patch tasks on the Patch tab. You can edit an existing patch task, or you can create a new task by clicking Add a Patch Task.

Select the check box labeled "Run on boot if scheduler missed"

If a scheduled task is missed while a target machine is powered off, this option enables you to force the task to automatically run whenever the machine is restarted. The task will run immediately unless you enable the Delay after boot (minutes) check box, in which case the execution will be delayed by the specified number of minutes.

Assign the policy to agent machines using Install/Reinstall with Policy or Assign Policy in  Machine View or Scan View

See "How to update a policy on the Protect Agent" http://community.shavlik.com/docs/DOC-23337

Shavlik Protect 9.x

VMWare VCenter Protect 8.x

When trying to access a machines Scheduler under Manage > Scheduled Tasks the following error occurs:

[Window Title]
Refresh Machine

[Main Instruction]
The scheduler on machine 'MACHINE-NAME' is not available. (Error: -2080374779)
The list of jobs currently scheduled on the remote machine is unreadable.

[Content]
Upgrading the scheduler will allow you to view scheduled jobs.

An associated error from the ST.TaskScheduler.Managed log file is:

This issue is caused by the Scheduler of the Protect Console being a newer version than the Scheduler files on the target machine. This often occurs when an upgrade of the console has occured.

Choose to 'Upgrade scheduler now' to upgrade the necessary files on the target machine and re-establish a connection to the target machines scheduler and scheduled tasks.
After selecting to Upgrade the Scheduler, assign credentials with local admin rights to the target machine to perform the action.

In some situations the automated upgrade may fail. An associated error from the ST.TaskScheduler.Managed log file is:

In this situation a manual uninstall/re-install of the scheduler on the target will be necessary.

Uninstalling/reinstalling the Shavlik (ST) Remote Scheduler service on a single machine

http://community.shavlik.com/docs/DOC-2222

Note: If the issue exists on multiple machines, the following document can be followed to use a Custom Action to remove the Shavlik Remote Scheduler from all affected machines.

Setting up the Custom Action to Remove the Remote Scheduler for Protect version 9

http://community.shavlik.com/docs/DOC-23009

• Patch Scans stalls or freezes between step '4. Scan for Patches' and step '5. Wait for Results.'
• Scans go from '1 of 1 machine complete. 0 machines not scanned' to '0 of 0 machine complete. 0 machines not scanned'.
• Protect's ST.ServiceHost.Managed.Log contains an error such as:
  • Failed to determine service pack name for product 'xxx'
  • The required attribute 'Ordinal' was not found

Example of error found in the ST.ServiceHost.Managed.Log:

2013-09-20T16:52:08.7528184Z 0011 W PatchResultXmlSerializer.cs:225|Failed to determine service pack name for product 'Microsoft Report Viewer Redistributable 2008'.

This issue is caused because Protect's product detection is finding a version of an application that needs a repair/reinstall or is not supported, such as a beta or RC version of a product. The scan failing out due to this is a known defect that should be fixed in a future version of Protect.

First, ensure that you have the latest patch definitions by going to Help > About. Outdated patch definitions can cause this issue to occur. Running Help > Refresh Files should update your patch definitions.

If you continue to have the issue, it will be best to open a case directly with support. You can open a case at, http://support.shavlik.com/

If you can provide the following information at the time you open a case it will help to expedite support's ability to provide a resolution:

• Protect Console side Logs as noted in this document:
  • http://community.shavlik.com/docs/DOC-22921
• A copy of the 'Arrivals' folder, which can be found in the following location:
  • Version 9 -
    • Vista & Later: C:\ProgramData\LANDesk\Shavlik Protect\Console\Arrivals
    • Earlier OS's: C:\Documents and Settings\All Users\Application Data\LANDesk\Shavlik Protect\Console\Arrivals
  • Version 8 -
    • Vista & Later: C:\ProgramData\Shavlik Technologies\Console\Arrivals
    • Earlier OS's: C:\Documents and Settings\All Users\Application Data\Shavlik Technologies\Console\Arrivals

If you are aware of which system may be causing the scan to fail out, it can also be helpful to obtain the following information:

• A DPD Trace of target system found to have this problem. Refer to the following document:
  • http://community.shavlik.com/docs/DOC-22997
• An Export of the following registry keys from the target system:
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432\Microsoft\Windows\CurrentVersion\Uninstall
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products

Shavlik Protect 9.x

.NET Framework will fail to install/deploy when scheduled by Shavlik Protect.  The same patch can be installed manually.

.NET Framework components are in use and cannot be modified.

Before proceeding with scheduled .NET Framework patch deployment troubleshooting, verify that the failed deployment of the patch is not caused by a corrupted .NET Framework installation and that the patch executable can be deployed manually from the worksation.  Also verify that scheduled patch deployment is working for non .NET Framework patches.

After these possible causes for patch installation failure have eliminated, Follow these two recommendations to release .NET Framework from its associated applications before patch deployment.

Recommendation 1.  - Deploy .NET Framework Patches with the Pre-deploy Reboot option selected in your Deployment Template

This will eliminate the problem with programs in use during your .NET Framework patch deployment.

Verify this by viewing your existing Deployment Templates by clicking Templates-My Deployment Templates.

If you do not have a previous Deployment Template with the Pre-deploy Reboot option selected, you may create a new Deployment Template by clicking on New-Deployment template. By doing a Pre-deployment Reboot, this will ensure that no programs will be in use during the deployment.

For extremet cases 2.  - Disable the auto startup of any programs that utilize .NET Framework. (Advanced Users only)

There are 2 ways to do this. Through Group Policy and on each machine.

*NOTE changes to Group Policy or System Configuration can cause problems to your machines. This guide is for informational purposes only. Shavlik Protect Support won't support any problems caused from changes to the Group Policy or System Configuration.

There are multiple places that startup applications are listed. See here for more information. http://technet.microsoft.com/en-us/magazine/ee851671.aspx

Through Group Policy - See this document http://support.microsoft.com/kb/314488

On Each Machine - You can Verify what programs are set to start on boot by using the System Configuration.

Please read this article for more information. http://windows.microsoft.com/en-us/windows7/using-system-configuration

Open the System Configuration by typing msconfig in a run command and clicking OK.

Next click on the startup tab. Uncheck any Programs that use Java. Click OK.

The next screen will Prompt for a reboot. Please reboot before .NET Framework deployment.

Failed deployment of the .NET Framework patches can also be caused by a corrupted .NET Framework installation.  If you are unable to perform a manual installation of the .NET Framework patch from the target workstation, the issue is most likely related to the .NET Framework installation.  To troubleshoot this and other non Shavlik related .NET Framework issues, please contact support.microsoft.com

Shavlik Protect 8.x
Shavlik Protect 9.x

This document outlines how to manually execute a scheduled task

In Protect choose Manage> Scheduled Tasks.

For Deployments

Select the target machine in the tree on the left. Deployments are scheduled on the target machine.

For Scans

Select the Console machine in the tree on the left. All agent-less scans are stored in the Console's scheduler. This means that even if you are scanning a different target machine, you still select the Console machine from the tree.

When the intended machine has been selected, the Scheduled Jobs should automatically populate in the list on the right.

Right click the desired job, and choose Run now

When prompted to confirm, choose Run.

Shavlik Protect 9.x
vCenter Prtoect 8.x

The purpose of this document is to review support for Hypervisor Bulletin scans using Protect version 9.0.x and lower.

Unable to add/scan ESXi/VCenter version 5.5.

When attempting a Bulletin scan on an ESX/VCenter server that has been recently upgraded to version 5.5 you receive the following message.

• Patching is not supported  for embeddedEsx 5.5.0

When trying to add a 5.5 ESX/VCenter server you receive the following error.

• The underlying connection was closed: An unexpected error occurred on a send. The server could not be added.

ESXi/VCenter 5.5 is not supported in Protect 9.0.x or earlier versions.

Upgrade to Protect Version 9.1, coming soon. Final release expected April 29, 2014.

Shavlik Protect 9.0.x

Shavlik Protect 8.x.x

The attached .bat file is designed to collect information that may assist the support team in diagnosing and resolving issues with Shavlik Patch for Microsoft System Center.

This batch file will collect trace log files, event logs, registry entries, config files, and other information that can provide great information to support for diagnosing problems.

This .bat can prove useful on any system where you are currently having issues with the Shavlik Patch plugin or publishing via SCUP.

This file is intended only to obtain information for support purposes. It is not an officially supported tool and has not gone through QA/Testing. The user assumes any risks of running the attached file(s).

1) Download the attached Get_ShavPatch_Info.zip.

2) Extract the Get_ShavPatch_Info.bat to the desktop of the SCCM console system, WSUS system, or SCUP system where you wish to obtain files for support.

3) Right click the Get_ShavPatch_Info.bat, choose 'Run as Administrator'. For older operating systems such as XP or 2003 this will not be necessary - just run the file.

Note: If you do not run as administrator the batch file may not be able to obtain all information.

4) Allow the .bat to run through everything. It may take some time.

When the operation is complete you will see the text of commandline turn green and the following text displayed:
Complete
Press any key to continue...

Note: If you do not see this you need to either run as administrator or wait until the operations are complete.

5) A folder titled 'ShavPatchLogs' will be created at the root of C:\, containing all the files collected by the .bat.

6) Please create a compressed file of this folder. It is suggested to use 7zip for compression. 7zip will compress to a smaller file size than the built in Windows compression, and it allows for creation of an encrypted 7z or zip file. You can download 7zip here: http://7-zip.org/download.html

7) Send the 7z or zip file of the ShavPatchLogs folder to support.

8) The folder C:\ShavPatchLogs can be deleted after this.

This .bat file may retreive some files containing sensitive system or network information. Make sure you review the files that are collected prior to sending if you believe this poses any security risk for you. This is why it is also highly recommended to place the files within an encrypted or password protected zip or 7z file before sending.

Direct Link to Document Here

" "

The purpose of this document is to assist in locating the Agent Manager within Shavlik Protect version 9.

The Agent Manager has been removed. All functionality is available from within Machine View.

From: Shavlik Protect Release Notes

Within Machine View you can install an agent onto machines, you can assign a different policy to machines that already contain an agent, and you can uninstall agents from machines. It also provides a convenient place to determine which machines have Protect Agents installed. You can access Machine View by selecting View>Machines.

How to View Only Agents

In Machine View (View> Machines) set the Smart Filters to 'Has an Agent Policy'. This will filter the Machine View to only show those machines that have an Agent.

Shavlik Protect 9.x

This document outlines how to schedule scans to occur on specific occurances of a specific day or a specific date.
Example: The First Sunday of the Month.
Example: The 20th of the Month.

Scans for specific occurance's of a day are handled in similar manners, but different locations depending on if they are used Agentlessly or with Agents.

Agentless

On the Home Screen, select the machine group(s) to be scanned.
Under Step 3. Select schedule choose Recurring:
Select Monthly

Specific Date

Select Day, and designate what day to have it run.
Example: Day 20 will run the scan on the next occurrence of the 20th day of the month. (If creating the scheduled scan on the 21st, it will wait to run on the next occurrence which would be in a month).

 

Specific Day Occurrence

Select The and set the occurrence value (First, Second, Third, Fourth, Last) and the day of the week to run.
Example: The First Sundaywill run the scan on the first Sunday of the month. If scheduling the scan after the First Sunday has occurred for the current month, it will run at the next occurrence.

 

Note: Scans can only be scheduled with a single occurrence. Create additional scans if multiple occurance's are desired.
Example: To have a scan occur on The First and Third Sunday, create the first scan using the First Sunday parameters, then create a second scan for the Third Sunday.

Agent Based

Open the Agent Policyto edit.
Select the Patchtab.
Create a new Patch Task, or expand an existing Patch Task to Edit.
Under the Schedule, select Once per month:

Specific Date

Select Day, and designate what day to have it run.
Example: Day 20 will run the scan on the next occurrence of the 20th day of the month. (If creating the scheduled scan on the 21st, it will wait to run on the next occurrence which would be in a month).

 

Specific Day Occurrence

Select The and set the occurrence value(First, Second, Third, Fourth, Last) and the day of the week to run.
Example: The First Sundaywill run the scan on the first Sunday of the month. If scheduling the scan after the First Sunday has occurred for the current month, it will run at the next occurrence.

 

Note: Scans can only be scheduled with a single occurrence. Create additional Patch Tasks if multiple occurance's are desired.
Example: To have a scan occur on The First and Third Sunday, create the first Patch task using the First Sunday parameters, then create a second Patch Task for the Third Sunday.

Shavlik Protect 9.x

This document is meant to help find if an update was previously published as Metadata Only rather than the correct method of Full Content.

Is there a way to tell if an update was published as Metadata Only via SCUP?

Yes it is possible to see if an update was published as Metadata Only.

Note: Shavlik only supports publishing updates as Full Content. If you have accidentally published an udpate as Metadata Only you can attempt to re-publish, however, additional steps may be required.

• Go into the Configuration Manager Console.
• View the Update Lists (SCCM 2007) or All Software Updates (SCCM 2012)
• Highlight the update you want to check
• In the information displayed for the update there is a ‘Metadata Only’ column to display if the update was published as Metadata Only.
  • Note: You may need to add the column into the view - this can usually be done via a rightclick menu.

Screenshots for reference:

SCCM 2012R2:

SCCM 2007:

See this Technet Discussion for some additional detail about updates published as metadata only.

Shavlik Patch for Microsoft System Center

(Formerly SCUPdates)

The attached .bat file is designed to help test connectivity to the addresses listed in the document:

URL Exception list for Shavlik Patch for Microsoft System Center.

This batch file will run an nslookup and ping of each of the sites listed in the above document and output to a single file.

This .bat can prove useful on any system where you are currently having issues downloading updates with the Shavlik Patch plugin or publishing via SCUP.

This file is intended only to obtain information for support purposes. It is not an officially supported tool and has not gone through QA/Testing. The user assumes any risks of running the attached file(s).

1) Download the attached TestConnections_ShavlikPatch.zip.

2) Extract the TestConnections_ShavlikPatch.bat to the desktop of the system where you wish to obtain files for support.

3) Right click the TestConnections_ShavlikPatch.bat, choose 'Run as Administrator'. For older operating systems such as XP or 2003 this will not be necessary - just run the file.

If you do not run as administrator the batch file may not be able to obtain all information.

4) Allow the .bat to run through everything. This will take some time. When the operation is complete you will see the text of commandline turn green and the following text displayed:

Complete

Press any key to continue...

If you do not see this you need to either run as administrator or wait until the operations are complete.

5) A file titled TestConnections.txt should be created on the Desktop.

6) Please zip and send this file to support.

Note: The file TestConnections.txt can be deleted after this.

Shavlik Patch for Microsoft System Center

(Formerly SCUPdates)

Direct Link to Document Here

" "

Direct Link to Document Here

" "

When performing a custom action that includes a 'Push File' action, an error occurs: ...: Error 3: The system cannot find the path specified.

Error in ST.Protect.Native:

DeployMachine exception - class STWin32::CWin32Exception at ComputerTools.cpp:632: Y:\this.bat: Error 3: The system cannot find the path specified..
Error Y:\this.bat: Error 3: The system cannot find the path specified.

• The file does not exist at the path indicated.
  • Example:       C:\Temp\test.batvs C:\Temp2\test.bat
• The file is hosted on a network mapped drive.
  • Example:       Y:\test.bat

File Does Not Exist

Ensure that the path to the file is correct. Use the Browse button to navigate to the file and select it. This will automatically populate the path and filename into the field.

File is on Mapped Drive

Files must reside on the local hard drive for Protect to push them. If the file is on a network mapped drive, copy it to a local directory and modify the path to the new location of the file on the local drive.
Example: Copy file from Y:\test.bat to C:\test.bat

Shavlik Protect 9.x

The Attached documents below contain the error codes from the vendor and possilble solutions to the error.

You attempted to install a patch but it failed with a return code in your deployment tracker.

As an example return code 0 is success, return code 3010 is reboot required

Direct Link to Document Here

" "