Symptoms

Deployment fails with the following error:  "Deployment machine name match failed, expected 'Machine Name', actual ''

You can also see this error you the ST.Protect.Native.log located at

C:\ProgramData\LANDesk\Shavlik Protect\Logs

Deploy.cpp:1837 DeployMachine exception - class STCore::CInvalidOperationException at Deploy.cpp:1305: Deployment machine name match failed, expected 'MachineName', actual ''.

Deploy.cpp:1869 Error Deployment machine name match failed, expected 'MachineName', actual ''

Cause

The credentials in the Machine Properties are incorrect for this machine.

Solution

In Machine view highlight the machine, right click and navigate to Machine Properties. Then assign the correct credentials.

Affected Products

Protect 9.1

Symptoms

You may see a pop-up error:

Protect Setup:

Error 1603: A fatal error occurred during installation

Error 1605: This action is only valid for products that are currently installed.

Error 1612: The installation source for this product is not available. Verify that the source exists and that you can access it.

You may see a message that says "protectinstaller.msi was not found".

Purpose

This article provides information on manually un-installing Shavlik Protect. This document is generally meant for the purpose of cleaning up a bad or broken installation of the Protect application.

Cause

Occasionally, the application may not be removed completely due corruption to the Windows Installer, Installer folder or other corruption to the automated uninstall process. When this occurs a manual un-install of the application is necessary.

Resolution

You may need to use the steps below to perform a manual uninstall of the application, and then re-install as necessary.

Microsoft provides assistance with the manual uninstall process by providing a Fix it tool.  The link to the tool is:  http://support.microsoft.com/mats/Program_Install_and_Uninstall

Here are instructions on how to use the Fix it tool

1. Use the link above to navigate to the Fix it main page.
2. Click on ‘Run Now’ and choose ‘Save File’.
3. Run the EXE that is downloaded and choose ‘Accept’ on the first page.
4. Choose the second option ‘Detect problems and let me select the fixes to apply’.
5. Choose the ‘Uninstalling’ option
6. You will see a list of the installed products on the server.  Choose the product if you see it on the list for instance. ‘Shavlik Protect’.  If you do not see the product on the list then select ‘Not listed’.

If Shavlik Protect, vCenter Protect, or Netchk Protect is listed:

1. Choose the corresponding name and click ‘Next’.
2. Choose ‘Yes, try uninstall’
3. Verify both options are check-marked and click ‘Next’.
4. You should see a screen that indicates whether Protect was uninstalled or not.
5. Click ‘Next’ and the close out of the screen.

If Shavlik Protect, vCenter Protect, or Netchk Protect is Not Listed:

1. Choose ‘Not Listed’ and click ‘Next’.
2. Enter the product code for the version of the Product installed and click ‘Next’. (Include the brackets)

     Product codes for Protect are listed below.

1. Verify both options are check-marked and click ‘Next’.
2. You should see a screen where it indicates whether the product was uninstalled or not.
3. Click ‘Next’ and the close out of the screen.

Product GUID codes:

Make sure to use the corresponding GUID for the version of Protect you are attempting to uninstall.

Protect 7.0.832.0: {C6D1AE7C-DE93-4E93-A916-C4144525C82C}

Protect 7.0.841.0: {C6D1AE7C-DE93-4E93-A916-C4144525C82C}

Protect 7.1.410.0: {90047C28-0B1B-4B30-8177-50729907EBF2}

Protect 7.2.155.0: {9B7F1E45-4C47-4E25-9EAB-098923E4171C}

Protect 7.5.2716.0: {CEA2D643-08C0-422E-9B27-B58ED9D38D07}

Protect 7.6.1482.0: {661A3308-5BE2-4E0F-A752-BDDB247DD2DB}

Protect 7.8.1340.0: {0A4D8D5E-7177-4A45-8A7F-0A5757403F97}

Protect 7.8.1388.0: {0A4D8D5E-7177-4A45-8A7F-0A5757403F97}

Protect 7.8.1392.0: {0A4D8D5E-7177-4A45-8A7F-0A5757403F97}

Protect 8.0.3756.0: {F77AFB04-D13F-48DA-BB99-A5B31B6AAE0B}

Protect 8.0.3965.1: {5A696B05-9F06-4B3D-83A0-69E848EFAC4A}

Protect 8.0.4027.2: {5A696B05-9F06-4B3D-83A0-69E848EFAC4A}

Protect 9.0.1106.0: {8045AD29-C6A4-43F5-9F1F-9560EB09F99A}

Protect 9.0.1182.0: {070964CB-00B0-4E36-A3F6-A09F76FBD197}

Protect 9.0.1182.0  {B7F5FF6F-382B-8834-3B85-B6390F7F4DA1}

Protect 9.1.4334.0: {83593D3F-ADD7-491B-82EC-1A2E6D08C385}

ScriptLogic Patch Authority Ultimate 8.0.3756: {A8210996-CD25-4C8C-A2D7-207635DEDC28}

ScriptLogic Patch Authority Ultimate 8.0.4027: {86DE6110-3F1C-40EE-98D9-05CD7A4B212F}

ScriptLogic Patch Authority Ultimate 9.0.1182: {0EAD1B8A-6F58-2304-A817-34C1724CE04C}

At this point, install the latest version of Protect.

If you continue to encounter any install errors, contact Shavlik support. (http://www.shavlik.com/support/contact/)

If the Fixit tool fails to correct the error, you may need to manually delete an upgrade key located under HKEY_CLASSES_ROOT\Installer\UpgradeCodes in the registry. Then try reinstalling Protect with the latest installer.

Latest versions of Protect can be downloaded from: http://www.shavlik.com/downloads/

It is highly recommended to perform a backup of the registry before performing any modifications.

How to backup Windows Registry:  http://windows.microsoft.com/en-US/windows-vista/Back-up-the-registry

Impact / Risks

The Fixit utility is provided by Microsoft. Make sure you read any known issues or guidelines for this tool on Microsoft's site prior to use.

Affected Product(s)

Shavlik Protect 9.x

Purpose

The attached .bat file is designed to collect information that may assist the support team in diagnosing and resolving issues with the Protect application.

This batch file will collect trace log files, event logs, registry entries, config files, and other information that can provide great information to support for diagnosing problems.

This .bat can prove useful on any system where you are currently having issues with the Protect console or a Protect agent.

This file is intended only to obtain information for support purposes. It is not an officially supported tool and has not gone through QA/Testing. The user assumes any risks of running the attached file(s).

Instructions

1) Download the attached Get_Protect_Info.bat.zip.

2) Extract the Get_Protect_Info.bat to the desktop of the Protect console system or agent system where you wish to obtain files for support.

3) Right click the Get_Protect_Info.bat, choose 'Run as Administrator'. For older operating systems such as XP or 2003 this will not be necessary - just run the file.

Note: If you do not run as administrator the batch file may not be able to obtain all information.

4) Allow the .bat to run through everything. It may take some time.

When the operation is complete you will see the text of commandline turn green and the following text displayed:
Complete
Press any key to continue...

Note: If you do not see this you need to either run as administrator or wait until the operations are complete.

5) A folder titled 'ProtectLogs' will be created at the root of C:\, containing all the files collected by the .bat.

6) Please create a compressed file of this folder. It is suggested to use 7zip for compression. 7zip will compress to a smaller file size than the built in Windows compression, and it allows for creation of an encrypted 7z or zip file. You can download 7zip here: http://7-zip.org/download.html

7) Send the 7z or zip file of the ProtectLogs folder to support.

8) The folder C:\ProtectLogs can be deleted after this.

Risks

This .bat file may retrieve some files containing sensitive system or network information. Make sure you review the files that are collected prior to sending if you believe this poses any security risk for you. This is why it is also highly recommended to place the files within an encrypted or password protected zip or 7z file before sending.

Purpose

When running the Shavlik Protect in a secure environment without Internet access, it is necessary to download the latest data files on a system that has internet access and then transfer them to the console machine.

This article applies only to patch data.

Description

This article discusses both methods:

• PowerShell (Highly Recommended)
• Individual file download (All Files Are Required)

PowerShell

To use the PowerShell script:

• Download and install PowerShell 1.0 from Microsoft, if it is not already installed. For more information, see Microsoft KB article 926140.
• Shavlik NetChk Protect and VMware vCenter Protect patch files are released twice per week. To download the patch files, you can use a PowerShell script to automate the process or you can download each file individually.
• If you need a compression utility, download and install the 7-Zip extraction utility from http://www.7-zip.org/download.html.

          Shavlik does not endorse or recommend any particular third_party utility.

• Create an output directory.
• Download and extract the PowerShell script attached to this article: DownloadProtectData90.zip

  This script works for all versions of these products.

• Open a command prompt.
• Enter PowerShell by typing powershell.
• Navigate to the location where you extracted the PowerShell script.
• At the PowerShell command prompt, launch the script with this command:
  
  .\DownloadProtectData90.ps1 "<outputdirectory>" <major or minor version> "<7-zip directory>"
  
    The command begins with the characters . before the script name. These characters are required if the script is in the current working directory. If you are in a different directory, enter the full path to the script.
  
  The major/minor version argument has a two-digit value. Use the value corresponding to your version:

• Protect 9.0: 90
• Protect 9.1: 91

Example:

The command you run looks like this: .DownloadProtectData90.ps1 "C:\Data" 90 "C\:program Files\7-Zip"

The command has these elements:

• .\DownloadProtectData.ps1: This is the script itself.
• c:\Data: This is the folder to which you are downloading the data files.
• 90: This is the version of vCenter Protect or Shavlik Protect files you are downloading.

1. You may see this error:
   
   execution of scripts is disabled on this system
   
   If this occurs, enable the execution of scripts by entering this command:
   
   set-executionpolicy RemoteSigned

  This command is case-sensitive.
   
   Alternatively, you can sign the script instead of changing the execution policy. For more information, see http://www.hanselman.com/blog/SigningPowerShellScripts.aspx.    The preceding link was correct and last checked as of June 11, 2013.

Individual file download

You can manually download the necessary data files. To download the files:

1. Right-click each link and select Save Link As.
2. Save the files to the console, in the DataFiles folder. This is the default location:
   • 8.x on Vista, 2008, & Windows 7: C:ProgramData\Shavlik Technologies\NetChk\DataFiles
   • 8.x on Windows XP or 2003: C:\Documents and Settings\All Users\Application Data\Shavlik Technologies\NetChk\DataFiles
   • 9.x on Vista, 2008, & Windows 7: C:\ProgramData\LANDesk\Shavlik Protect\Console\DataFiles
   • 9.x on Windows XP or 2003: C:Documents and SettingsAll UsersApplication Data\LANDesk\Shavlik Protect\Console\DataFiles

  The Protect console requires both the .CAB and the files archived within the .CAB files for Protect to function correctly. The PowerShell script downloads the .CAB files, places the files in the output directory, and extract the files to the output directory. You need to manually extract the .CAB files using an archiving tool like 7-Zip if you choose to manually download the .CAB files.

Update files for Shavlik Protect 9.0:

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STPlatformUpdater.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/AssetInstaller.msi

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/PatchInstaller.msi

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/ThreatInstaller.msi

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/cl5.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/ST.Licensing.Data.dll

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/DplyEvts.dll

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/7z.dll

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/SafeReboot.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/SafeReboot64.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STSchedEx.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STRemoteCommand.exe

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STScheduleView.exe

http://xml.shavlik.com/data/hf7b.xml

http://xml.shavlik.com/data/pd5.xml

http://xml.shavlik.com/data/iadata.xml

http://xml.shavlik.com/data/ai_dpd.xml

http://xml.shavlik.com/data/scriptcatalog.zip

http://xml.shavlik.com/data/assetinventory.xml

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STPlatformUpdater.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/cl5.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/ST.Licensing.Data.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/DplyEvts.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/7z.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/SafeReboot.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/SafeReboot64.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STSchedEx.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STRemoteCommand.cab

http://xml.shavlik.com/data/Protect/v9/90/Protect/1182/STScheduleView.cab

http://xml.shavlik.com/data/hf7b.cab

http://xml.shavlik.com/data/pd5.cab

http://xml.shavlik.com/data/iadata.cab

http://xml.shavlik.com/data/ai_dpd.cab

http://xml.shavlik.com/data/hypervisors.cab

http://xml.shavlik.com/data/assetinventory.cab

http://xml.shavlik.com/data/Protect/v9/90/manifest/protect.manifest.cab

Update files for Shavlik Protect 9.1:

http://xml.shavlik.com/data/protect/v9/91/protect/4334/7z.dll

http://xml.shavlik.com/data/hf7b.xml

http://xml.shavlik.com/data/protect/v9/91/protect/4334/cl5.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/safereboot.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/safereboot64.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stschedex.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stremotecommand.exe

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stscheduleview.exe

http://xml.shavlik.com/data/pd5.xml

http://xml.shavlik.com/data/ai_dpd.xml

http://xml.shavlik.com/data/protect/v9/91/protect/4334/assetinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4334/patchinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4334/threatinstaller.msi

http://xml.shavlik.com/data/protect/v9/91/protect/4334/st.licensing.data.dll

http://xml.shavlik.com/data/protect/v9/91/protect/4334/dplyevts.dll

http://xml.shavlik.com/data/iadata.xml

http://xml.shavlik.com/data/scriptcatalog.zip

http://xml.shavlik.com/data/supportedHypervisors.obf

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stplatformupdater.exe

http://xml.shavlik.com/data/assetCatalog2.obf

http://xml.shavlik.com/data/assetCatalogMetadata2.obf

http://xml.shavlik.com/data/protect/v9/91/protect/4334/7z.cab

http://xml.shavlik.com/data/hf7b.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/cl5.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/safereboot.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/safereboot64.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stschedex.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stremotecommand.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stscheduleview.cab

http://xml.shavlik.com/data/pd5.cab

http://xml.shavlik.com/data/ai_dpd.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/st.licensing.data.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/dplyevts.cab

http://xml.shavlik.com/data/iadata.cab

http://xml.shavlik.com/data/supportedHypervisors.cab

http://xml.shavlik.com/data/protect/v9/91/protect/4334/stplatformupdater.cab

http://xml.shavlik.com/data/assetCatalog2.cab

http://xml.shavlik.com/data/assetCatalogMetadata2.cab

http://xml.shavlik.com/data/Protect/v9/91/manifest/protect.manifest.cab

Additional Information

Shavlik Protect and VMware vCenter Protect consoles that have no internet connectivity, but that still try to download updates automatically can experience other issues. Shavlik recommends setting consoles with no internet connectivity to Disconnected Mode. To enable Disconnected Mode from the console application:

Version 8.x: Go to Tools and select Run Disconnected.

Version 9.x: Go to Tools and deselect Auto-Update Definitions.

Document Content Update History

11/1/2011 - Updated article for VMware vCenter Protect 8.0.x 

07/16/2013 - Updated article for Shavlik Protect 9.0.x

05/21/2014 - Updated article for Shavlik Protect 9.1.x

Products

Shavlik Protect 9.x

Overview

There have been an incredibly large number of vulnerabilities this year, which unfortunately is going to cause asyntax change in MITRE CVE-ID.   The current syntax will max out at 9,999 vulnerabilities, so the change is to start adding additional digits.  When the CVE count breaks 10,000, MITRE will be adding an extra digit onto the end of their CVE-IDs.  The resulting CVE change will drive a change in how we import content for Shavlik Protect 9.1 and 9.0.

The deadline for the change is January 15, 2015, but due to the high volume of vulnerabilities releasing this year the change in format may be forced upon us early.  We have released an update for Protect 9.1 and are working on the Protect 9.0 update to prevent the format change from causing issues.  The patch will prevent import of new content from failing, avoiding an inconvenience to our customers.  Protect 9.1 Patch 2 is available now and the Protect 9.0 Patch 2 will be coming in the next couple of weeks. Although the updates do not include a security fix, this is a critical bug fix to avoid a customer outage. 

To upgrade you can follow the instructions below based on version of Protect. 

Upgrade Protect 9.1 to Patch 2:

• Download Protect v9.1 Patch 2 fromhttp://www.shavlik.com/downloads/protect/. Patch 2 includes fixes from Patch 1 as well, so customers on Protect 9.1.4446 or 9.1.4334 can upgrade with the same patch. 

Upgrade Protect 9.0 to 9.1 Patch 2 or 9.0 Patch 2:

• (Recommended) For 9.0 customers you will now see that auto update to 9.1 Patch 2 is enabled in product.  You can click the auto update link in the bottom right corner of Protect when you open it and it will download the full installer upgrading you to Protect 9.1 Patch 2.

  You must be on a Windows 7 or 2008 r2 x64 or later OS to upgrade to Protect 9.1. 

• If you are unable to upgrade to Protect 9.1 Patch 2 at this time we are in the process of releasing a similar fix for Protect 9.0.  This update will be coming in a couple of weeks and can be applied very easily to Protect 9.0.  The change is entirely database schema related so no binaries are updated on Protect 9.0 console. 

  If you have not applied Patch 2 for either version, there will be a point in the not too distant future where you may not be able to import new content.  We would like to avoid this as much as you would, so plan for this patch update as soon as possible. 

Additional Information

Release notes for Patch 2 for Protect 9.1: Shavlik Protect Standard/Advanced 9.1 Patch 2 Release Notes

Release notes for Patch 2 for Protect 9.0: Coming soon.

Products

Protect 9.x

Symptoms

The Protect patch installer fails with the error  "There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor."

Or

"Another version of this product is already installed. Installation of this version cannot continue"

In the ST.DatabaseConfiguration.log you can see the following errors

2014-10-28T20:43:25.5457040Z 0004 E DatabaseState.cs:77|System.Data.SqlClient.SqlException (0x80131904): Database state cannot be changed while other users are using the database 'ShavlikScans'
ALTER DATABASE statement failed.

2014-10-28T20:43:25.5525745Z 0004 E UnattendedInstaller.cs:95|Database installation failed: Unable to lock the database because there are existing connections.
2014-10-28T20:43:25.5535560Z 0004 E DatabaseInstallerController.cs:378|Database 'Update' error: Unable to lock the database because there are existing connections..
2014-10-28T20:43:25.5535560Z 0004 S DatabaseInstallerController.cs:238|ExecuteInstall|Leaving.
2014-10-28T20:43:25.5918345Z 0004 E UnattendedInstaller.cs:149|ST.Data.SchemaInstaller.DbLockFailedException: Unable to lock the database because there are existing connections. ---> System.Data.SqlClient.SqlException: Database state cannot be changed while other users are using the database 'ShavlikScans'
ALTER DATABASE statement failed.

Cause

The database is locked and cannot be altered.

Solution

Using Studio Management express you can detach and reattach the Protect Database.

Run the patch again to attempt the upgrade.

Related Article

Database Connection Error Caused by Missing SQL Server

Database Connection Error Caused by Missing SQL Server

Symptoms

The agent returns the following error when attempting to Update agent binaries:

Update failed: Engine updates were required but none could be applied

Cause

The agent detects that it needs an updated engine and cannot reach the binaries through the method configured in the policy.  This typically happens if the agent can't connect directly through to the console machine or the distribution server.

The agent is pointed to a Distribution server but it does not have the updated content data.  Synchronize core data files are missing from Distribution Server Scheduled automatic synchronization list.

Resolution

If agent is using a distribution server this error make sure the agent can connect with the distribution server and that the distribution server has been synced with the console.

If agent is accessing the binaries from Protectcloud.shavlik.com this error occurs because of a failure in web access, usually from a problem with a proxy configuration or malfunction.

If Synchronize core data files are missing from Distribution Server Scheduled automatic synchronization list, add "Synchronize core data files" to the Distribution Server Scheduled automatic synchronization list using "Tools>Operations>Distribution Servers> Add scheduled sync Core engines/definitions"

Affected Product(s)

Shavlik Protect 9.x

Purpose

This document provides information about End Of Life dates (EOL) for Shavlik Patch.

  Direct link to the Legacy Product Lifecycle Policy

Products

Shavlik Patch for Microsoft System Center 2.x

Description

• After deploying patches, one or more patches still show as missing.
• While deploying, the deployment tracker lists an error.

Cause

The cause of a failed deployment can vary greatly. This document will serve as a way to troubleshoot and identify common issues that can cause a failed deployment.

• Do Patches Download?
• Did Patches Copy to Target?
• Did Batch File Run?
• Errors in the CL5.Log?
• Error Running Patch Manually?

Do Patches Download?

When initiating a deployment, Shavlik Protect will initiate the deployment process by downloading the Patches from the vendor to a local repository.

To identify if the patch was downloaded, examine the Patch Download column within the scan results.

• If the icon is a Green Arrow that says 'Yes', it indicates it is currently downloaded and saved in your patch repository.
• If the icon is a Gray Arrow and says 'No', this indicates the patch is not downloaded.
• If there is no icon, this indicates the patch is not available to be downloaded through Protect and is only available for reporting purposes.
  • Related Document - Patch Download Status and Corresponding Icons

If you are in an offline environment (i.e. the Protect console has no internet connectivity), and your patch is in the Patch Repository, but the download icon is Gray and says 'No', it may need to be renamed to the Shavlik Name.

Related Document: Patches' Shavlik Name

YES - Patches Did Download

NO - Patches Did Not Download / Patch is not in repository

Troubleshooting Possible Download Issues

• Firewall, proxy, or anti-virus settings prohibiting downloads

• No Internet connectivity

• Downloads are set to a Distribution Server/Share that does not have the file available

When viewing the download entry in the ST.Protect.Managed...Log it lists the source as a local/network share. If your download source is set to a Distribution Server, the patch must exist on the specified Distribution Server to be able to download from it. If it does not exist on that share, there will be nothing to download, and it will fail.

Example:
2013-12-18T22:08:56.5798742Z 0001 V SingleFileDownload.cs:563|Download Error 'file://nevans-pc/DistributionServer/7z920.msi'.
2013-12-18T22:08:56.5803742Z 0001 V DownloadItem.DownloadFileCompleted|7z920.msi not downloaded: Connection lost: Could not find file '\\nevans-pc\DistributionServer\7z920.msi'.

To correct this, download the patch to the share, or change the download source to the vendor.
You can switch the download source by going to Tools> Operations> Downloads> Patch and Service Pack download source> select Vendor web sites to download the patches directly from the vendor.

• Vendor removed the patch from the specific url

Did Patches Copy To The Target?

After the patches are downloaded, they are copied to the target machine to the directory C:\Windows\ProPatches\Patches\

YES - Patches Did Copy to C:\Windows\ProPatches\Patches\

NO - Patches Did Not Copy to C:\Windows\ProPatches\Patches\

Troubleshooting Possible Copy Issues

• Does the Target have Anti Virus Software?
  • Anti Virus software may delete patches that get copied to the target based on their settings. Try disabling any Anti Virus on the target to see if the patches will copy to the target machine for installation.
• Is the Deployment Template using a Distribution Server?
  • This can be verified by opening the Deployment Template and going into the Distribution Server tab. If 'Use Distribution Server by IP Range' is selected, verify the patch exists on the appropriate DS.
  • Alternatively, choose to use 'Console Push'. This will cause Protect to copy the patch from the Console itself, as opposed to having the target initiate a copy form the Distribution Server.

Did The Batch File Run?

After the patches are Copied to the Target machine, a batch file that contains the necessary installation switches is also copied to the target. This file is located under C:\Windows\ProPatches\Install\. The last thing the Batch file will do after it runs, is rename itself from a .BAT extension to a .HIS extension. If the extension has changed, that indicates the patches should have all been executed (thought not necessarily successfully).

YES - Batch File Ran and Has .HIS Extension

NO - Batch File Did Not Run and Has .BAT Extension

• One of the patches is still running.
  • If a patch is still in the process of running, the batch file will not have received the return information to rename itself. This can be caused by a patch taking a long time to install (which is may not actually be a failed install, but may still be in progress). It is also possible for a patch to get hung up if the machines resources are being heavily utilized, or if the patch has received incorrect silent switches. To troubleshoot these:
    • Patch is still installing- Look for the patch in the list of active processes. End the process if found to continue to the next patch in the deployment.
      • Alternatively reboot the target, and re-deploy.
    • Patch is frozen while installing - Look for the patch in the list of active processes. End the process if found to continue to the next patch in the deployment. If the patch continues to have this behavior it may have an incorrect switch being passed to it. Ensure you are on the latest xml data by performing a Help > Refresh Files, and try deploying again. If the issue persists, contact Technical Support with the Q# of the patch, your Assessment Version and Deployment Version (located under Help > About > Version Info) and the OS of the target machine.

Are There Errors In The CL5.log?

When patches are executed on the target machine, they log their exit codes in the file: C:\Windows\ProPatches\Cl5.log

Open the Cl5.log file and search for the patches name. There should be an entry that looks similar to this:
2013-12-19T17:20:57.4472656Z 0e88 I CommandLine.cpp:2157 Patch Install returned 0: Patchname.exe

If the patch is installed successfully, it returns '0'.
If the patch requires a reboot, it returns '3010'.
If the patch returns any other code, it is an error and the code needs to be troubleshot. The error will typically be searchable online for what it corresponds with. Alternatively, trying to run the patch manually should give you a prompt indicating the error.

Example:
This is a successful install of the patch 7z920-x64.msi
2013-12-19T17:20:57.4472656Z 0e88 I CommandLine.cpp:2157 Patch Install returned 0: 7z920-x64.msi

NO - CL5.Log Has No Errors

Yes - CL5.Log Has Errors

Do You See Errors When Installing The Patches Manually?

When a patch finishes executing it will return an 'exit code' that is logged into the file C:\Windows\ProPatches\Cl5.log (covered in previous section).

If the Cl5.log shows an exit code other than 0 or 3010, this typically indicates an error occurred. If searching online does not yield an answer to what the exit code means, running the patch manually will usually provide an error message to troubleshoot from.
To run the patch manually, on the target machine navigate to C:\Windows\ProPatches\Patches\ and find the patch to be tested. Double click the file to run it. Often times the error will be immediate upon running, where some patches require clicking through several steps before the error occurs.

Note:If the patch does not return an error, the may install successfully. If this occurs, in order to troubleshoot why it failed to install from Protect, the patch must first be uninstalled so a reinstall of the patch via Protect can occur for testing purposes.

YES - Running the Patch Manually Returns Error/Fails

NO - Running the Patch Manually Installs Without Issue

Most patch install failures will meet one of the listed criteria. If you are not finding this to be true in your situation, it is recommended to open a ticket with Technical Support. When opening the ticket please provide the Q# of the affected patch, the Operating System of the target machine, the Patch Assessment and Patch Deployment versions located under help > about > version info, the logs from the console, and the logs from the target machine.

Related Document: Gathering Console, Client Side (agentless), and Agent logs for Protect

Products

Shavlik Protect 9.x

Overview

These release notes support the current GA version of Shavlik Patch 2.1.

For Use as an Add-on to System Center Configuration Manager 2012

Shavlik Patch 2.1 can downloaded from: http://www.shavlik.com/downloads/patch/

The build information is 2.1.801.0.

For Use with SCUP 2011 or SCUP 4.5

The Shavlik Patch CAB file can be downloaded from this link:  Shavlik Protect Cloud Portal

Documentation

http://www.shavlik.com/support/online-documentation/patch/

http://www.shavlik.com/support/training-videos/patch/

Symptoms

You encounter download timeout failures when performing a Help - Refresh Files, Patch Download from vendor, Distribution Server or customer URL location.

You would see this in the GUI:

"Error reason: The request was aborted: The request was canceled.:"

You would see this in the ST.Protect.Managed*.log:

"Download did not complete. No activity took place in 25 seconds. Number of retries available is 0."

Cause

The inactivity timeout of 1 minute has been reached due to a slow connection.

Resolution

Increase the download inactivity by following these instructions.

1.  Navigate to the install folder for Protect.  The default location is: C:\Program Files\LANDesk\Shavlik Protect

2.  Make a backup the STEnvironment.config files.  Creating a zip of the file in the same folder is usually the easiest method.

3.  Edit the STEnvironment.config file using NotePad.

You will be inserting downloadInactivityTimeout="00:01:00" into the config file.  We suggest inserting it after the 'dataFilesDirectory' information and before 'helpRUIFormat' as depicted below:

dataFilesDirectory="C:\ProgramData\LANDESK\Shavlik Protect\Console\DataFiles"downloadInactivityTimeout="00:01:00"helpUriFormat="http://help.shavlik.com/Protect/91/{0}/{1}"

4.  Increase the inactivity timeout by modifying "00:01:00" (HH:MM:SS format)

5.  Save the STEnvironment.config file and restart the Shavlik Protect Console service.

You can test again once these steps are complete.  Revert back to your backup STEnvironment.config if you wish to undo these settings.

Affected Products

Shavlik Protect 9.1.4446

Purpose

This document outlines how to Link Files to a Machine Group. Shavlik Protect provides a dynamic mechanism to keep a machine group current. This is especially useful if your machine list changes from time to time and you want an easy way to update it. If you add machines to, and delete machines from a linked file between scans, any new machines added to the file will be scanned. While any machines removed from the list will not be scanned. When defining a machine group you can link to files containing machine names, domains, IP addresses , and virtual machines.  The following table describes how to create each particular link file..

Steps

Step 1

Use a text editor to create a text file using the following instructions for each type of file

Step 2

Select "Link to file" under to the appropriate Tab for the type of file that you created.

The path to the linked file will show in the Machines List

Save the machine group.

Affected Product(s)

Shavlik Protect 9.x

Overview

Shavlik Patch 2.1 for SCCM 2012 2.1 has added some features around handling patch revisions and supersedence.  Specifically, patch revisions for patches you have already published to make it easier to accept these revisions.  On 11/12/2014 we will begin including supersedence information with our Shavlik Patch for SCCM 2012 patch content.  By including supersedence content customer will more easily see which patches they need to apply to be up to date.  Customers will not need to keep track of supersedence themselves and have a separate process for expiring old patches.

Shavlik Patch 2.1 includes new a filter in that can be used to filter out patches that have been superseded so customers can easily identify the latest patches.  We have also added information about the details of supersedence in new columns and the new details view so customers have visibility into the supersedence content. 

There are some important things to understand regarding supersedence and SCCM 2012.  When a patch is published that supersedes an older patch the publishing process triggers an expiration process of the older superseded patch.  How that older patch is expired is controlled by settings in the Software Update Point (SUP). Below is a screenshot of the supersedence tab in the SUP that shows your options.

You have the option of triggering the expiration immediately or dealing it by a specified number of months.  When an update is expired it will not be evaluated and installed on client machines.

Product

Shavlik Patch 2.1 for Microsoft System Center (SCUPdates)

Symptoms

After logging in on a Windows 8 or 8.1 system and removing Windows "Metro" or Store Apps you notice Shavlik Protect detecting missing updates for the Windows Apps (such as MSWU-1006 or MSWU-1007).

Cause

Windows Metro/Store Apps are installed along with the OS. If you are still seeing updates listed missing when scanning with Protect it's because the Apps have only been removed for a certain user or users on the system, but the apps technically still exist on the system.

Resolution

If you want to exclude these updates from coming up within scans, you can do so using the steps in this document:

How to Include or Exclude Specific Patches in Scan Results

We're not currently aware of a definite way to completely remove Windows Store Apps, however, it may be possible to completely disable Windows Store Apps via additional configuration. The following documentation from Microsoft provides more information about the Windows Store and Apps:

Manage Client Access to the Windows Store

Win8: App: Store related group policy settings

Affected Product(s)

Shavlik Protect 9.x

Purpose

How to schedule the automatic sychronization of Patch Defintions, Patch install files, and Threat engines and defintions to a Distribution Server

Steps for Completion

Highlight the target Distribution Server in the Distribution Server pane.  In the drop down box above the pane select what kind of files that need to be synced  and click  "Add scheduled sync:" A dialog box with scheduling information should appear.  After selecting Save, the scheduled sync should appear in the scheduler automatic synchronization pane with the type of files being synchronized.   If you select "All engines, definitions, and patch downloads", there will be a separate entry created in the middle "Scheduled automatic synchronization" pane for each relevant component.

If you want to force a synchronization  select one or more scheduled synchronization entries in the Scheduled automatic synchronization pane and click Run now

       Note: To synchronize all data, all three synchronization tasks must be selcted. This will immediately copy all appropriate files from the console to the specified distribution server(s).

The scheduled Synchronization process runs in the background of Protect. You may check the status by viewing the event history atView > Event History.

Affected Product(s)

Shavlik Protect 9.X

Purpose

This document provides steps on how to obtain a verbose logging output from any .msi package which may assist in troubleshooting installation failures.

Symptoms

This may be useful when patches failing to install throw a generic 1603 return code.

Description

To obtain verbose logging from the .msi package:

On the system where the update is failing to install:

1) Open command prompt.

2) Change directories to the location of the .msi file.

3) Use the following command (replacing Example.msi with your msi file name):

msiexec /i Example.msi /L*vx "C:\folder\ExampleLogFilename.txt"

Or to run this without user interaction:

msiexec /i Example.msi /quiet /L*vx "C:\folder\ExampleLogFilename.txt"

The log file will be generated with the name specified within the folder specified. Review this log or send to support.

Note: This command will also run with .EXE and .MSU packages, however, it will not provide the same level of output.

Additional Information

For more information about MSIEXEC command line options, see the following Microsoft KB article:

Msiexec (command-line options)

Affected Product(s)

Shavlik Protect 9.x

Purpose

The purpose of this document is to provide configuration steps to enable data rollup within your environment. In a data rollup console configuration, one console acts as the central console. In addition to receiving scan and deployment data from the machines it manages, the central console also receives data about machines managed by other consoles. The central console is therefore also known as the rollup console because the data from all the other consoles is rolled up to it. This enables you to track what is happening throughout your organization from one central site.

The following figure illustrates a data rollup console configuration.

The purpose of this document is to provide instructions on implementing a data rollup configuration within your environment.

Configuration Steps

On the Central Console navigate to Tools>Operations

Within the Operations window select the 'Data Rollup' tab on the left hand side of the screen.

In the Configure Data Rollup settings file area, select the IP address of the central console. Once this has been completed select the 'Export Settings' button to create an export file that the remote consoles will need to import the data rollup configuration settings.

On each remote Console machine navigate to Tools>Operations> and select the 'Data Rollup' tab. Select the 'Import Settings' button and navigate to export file that was created on the Central Console. Once this file has been selected the data rollup configuration will populate within the 'Data Rollup Options' as depicted below:

Tip: Importing the file will also automatically generate an entry in the Edit Console Description dialog on the central console. You can use this dialog to track how many remote consoles are configured to roll up their results to the central console. See Editing the Console Description for more details.

Please note you can alter the port data rollup communication is initiated over as well as the minutes between the rollup occurrences. These values are set to port 3121 and '240' minutes by default.

Affected Product(s)

Shavlik Protect 9.x

Purpose

This document is intended to provide information about some changes around detection and installation of Java patches starting in October 2014.

Description

Starting in October 2014 Java started releasing updates in a new manner. The basic concept is that main critical bulletins are released with an odd number such as Java SE 7 Update 71 (CPU release), and then there is an additional bulletin that contains other bug fixes with an even numbered bulletin such as Java 7-72 (PSU release).

The full explanation for the changes can be found on Java's site, here:

Java CPU and PSU Releases Explained

Shavlik will be offering both the CPU and PSU releases. The CPU releases will be offered with a Security patch type whereas the PSU releases will be offered with a non-security patch type.

If you were to run a Security Patch scan in Protect you will only be offered the CPU release. (main security bulletin) However, if you run a WUscan (both security & non-security) you will be offered both the CPU & PSU release as missing patches. Per Java - only one version is required to be installed. If you do not use a patch group to filter out the PSU release, this version will end up being installed because it has a higher version number than the CPU release. Keep this in mind before you set up scan and deployment when using both security and non-security patch types.

Additional Information

Additionally, we have noticed that most often when the latest Java updates are installed they provide a return code that a reboot is required. Keep in mind that a reboot will often be required.

We suggest to refer to this document to help alleviate some pain points with updating Java:

Best Practices for Deploying Java in your Environment

Affected Product(s)

Shavlik Protect 9.x

Symptoms

Within the Event History (View > Event History) you see the following event logged:

Event Type: Distribution Server Sync: core engines/definitions

Status: Complete with details

Summary: One or more files may have failed

Within the event details or ST.ServiceHost.native.log you see the following error:

Error Setting File Security on "\\DistributionServerName\PowerShellModules": class STWin32::CWin32Exception at SecureableObject.cpp:27: Error 5: Access is denied.

Cause

The reason this may happen is because the 'PowerShellModules' folder is being created with default permissions of the local system account - "SYSTEM" or "SystemName\Administrators", and this folder then denies access to any other account that may be set for the distribution server with in Tools > Operations > Distribution Servers > Edit Distribution Server > Credential used by the console to synchronize.

Resolution

Our engineering team currently has this marked as a defect, and it should be resolved in a future release.

This folder currently does not actually have anything synchronized so the error can be ignored as long as your other files (patches & definitions) are synchronizing correctly.

Alternately, you could manually add read/write permissions for the account needed to this folder.

Affected Product(s)

Shavlik Protect 9.0.x

Shavlik Protect 9.1.x

Overview

There have been an incredibly large number of vulnerabilities this year, which unfortunately is going to cause asyntax change in MITRE CVE-ID.   The current syntax will max out at 9,999 vulnerabilities, so the change is to start adding additional digits.  When the CVE count breaks 10,000, MITRE will be adding an extra digit onto the end of their CVE-IDs.  The resulting CVE change will drive a change in how we import content for Shavlik Protect 9.1 and 9.0.

The deadline for the change is January 15, 2015, but due to the high volume of vulnerabilities releasing this year the change in format may be forced upon us early.  We have released an update for Protect 9.1 and are working on the Protect 9.0 update to prevent the format change from causing issues.  The patch will prevent import of new content from failing, avoiding an inconvenience to our customers.  Protect 9.1 Patch 2 is available now and the Protect 9.0 Patch 2 will be coming in the next couple of weeks. Although the updates do not include a security fix, this is a critical bug fix to avoid a customer outage. 

To upgrade you can follow the instructions below based on version of Protect. 

Upgrade Protect 9.1 to Patch 2:

• Download Protect v9.1 Patch 2 fromhttp://www.shavlik.com/downloads/protect/. Patch 2 includes fixes from Patch 1 as well, so customers on Protect 9.1.4446 or 9.1.4334 can upgrade with the same patch. 

Upgrade Protect 9.0 to 9.1 Patch 2 or 9.0 Patch 2:

• (Recommended) For 9.0 customers you will now see that auto update to 9.1 Patch 2 is enabled in product.  You can click the auto update link in the bottom right corner of Protect when you open it and it will download the full installer upgrading you to Protect 9.1 Patch 2.

  You must be on a Windows 7 or 2008 r2 x64 or later OS to upgrade to Protect 9.1. 

• If you are unable to upgrade to Protect 9.1 Patch 2 at this time we are in the process of releasing a similar fix for Protect 9.0.  This update will be coming in a few of months and can be applied very easily to Protect 9.0.  The change is entirely database schema related so no binaries are updated on Protect 9.0 console. 

  If you have not applied Patch 2 for either version, there will be a point in the not too distant future where you may not be able to import new content.  We would like to avoid this as much as you would, so plan for this patch update as soon as possible. 

Additional Information

Release notes for Patch 2 for Protect 9.1: Shavlik Protect Standard/Advanced 9.1 Patch 2 Release Notes

Release notes for Patch 2 for Protect 9.0: This will be update once the patch is released.

Products

Protect 9.x