Description

During setup of a patch deployment within Protect you will eventually get to the "Deployment Configuration" screen (Figure 1). The deployment templates that you already have configured can be modified while you are at this screen. However, it is important to know the difference between using the "Edit" button vs. the "Change" button.

• The "Edit" button on the upper right will make permanent changes to the chosen template. You will not be able to modify built-in templates from this option.
• The "Change" button on the lower right will make temporary changes to the chosen template. The temporary template will only be used for this deployment. You will also see "(Temporary)" in the name of the chose template.

Figure 1: Deployment Configuration Screen showing a Temporary template currently chosen.

Affected Product(s)

Shavlik Protect 9.x

Purpose

The purpose of this document is to explain what causes deployments to stay at the status of 'Files Copied' but never install any patches after all files are copied to the target machines.

Symptoms

Deployment tracker will show both the machine status and the patch status as Files Copied.

Cause

The deployment was configured to be a copy only operation. When configuring the deployment, the 'Execute deployment package' option was selected as 'Do not schedule execution'.

This is further validated by looking at the View Deploy Rules in the deployment tracker. This will show the deployment type as 'Copy files only and do no execute deployment'.

Resolution

To ensure that the deployment installs the patches, make sure to select the Install the patch(es) option and configure the deployment to either install the patches 'Immediately after staging' or scheduled for a later time or next reboot.

Additional Information

How To: Schedule and Configure a Deployment in Patch for Windows Servers 9.3

Affected Product

Ivanti Patch for Windows Servers 9.3

Symptoms

Protect is detecting a Patch that should not be detected as missing.

Resolution

NOTE: Before performing the following, please update to the latest XML data by going to Help > Refresh Files, close and reopen Shavlik Protect and then perform another scan against the machine(s) using a Security Patch or WUScan Template. The root cause of the issue may stem from custom filtering in a Scan Template or could already be fixed in a later XML release.

From The Protect Console:

1. Click on Results tab.

2. Choose the most recent scan containing the specific patch.

3. Click on the machine containing the specific patch.

4. Click on the specific patch.

5. View why Protect detects the patch as missing (Patch Information Tab).

6. Click on the linked Qnumber to be taking to documentation regarding this patch. Most of the time this will include the detection logic.

7. Browse to the location referenced in step 5 to verify the information found in step 5 and 6.

See below for more information:

Also note the Downloaded File name.

On the Target:

Browse to C:\Windows\ProPatches\Patches and find the specific patch. If you have previously deployed this patch and it failed, manually try to run the patch.

Take any screenshots of any errors such as the one below.

Information to Send to Support

If you experience these errors, please create a support case at support.shavlik.com or by calling into support.

NOTE: If you choose to call into support, please gather this information before calling in: Obtaining Support

Gather the following information:

1. Before doing the following, please download the latest XML data by going to Help > Refresh Files.
2. The Bulletin ID & Qnumber of the patch in question. This information can be found in Step 4 above.
3. Clear your logs, and do a rescan and/or deployment.then gather the log. Please do this by following this guide for console logs: How To: Collect Shavlik Protect - Ivanti Patch for Windows Servers console, patch deployment and agent logs
   
4. A DPDTrace gives more information on how Protect detects certain patches. Please gather a DPD trace on the target machine by following this guide: DPDTrace command line logging tool used for patch detection issues
5. Screenshots from Step 5 from the console, Step 7 from the target and if applicable, the error when the patch is manually installed.

Include the following registry exports from the same target machine that ran the DPDTrace.  This will not only save time, it will also greatly increase our chances of determining the root cause of the detection issue and correcting it:

NOTE: This document has a batch file that retrieves the needed registry keys: Batch File for Obtaining Registry Exports for Detection Related Issues

• HKLM\SOFTWARE\WOW6432\Microsoft\Windows\CurrentVersion\Uninstall

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

• HKLM\SOFTWARE\Classes\Installer\Products

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages

• HKLM\SOFTWARE\Classes\Installer\Patches

Please zip all files into one archive file before emailing or attaching them to the case.

NOTE: You will not be able to email the registry keys to the case as .reg files. They must be either uploaded to the case through the support portal or changed into .txt files.

Affected Product(s)

Shavlik Protect 9.x

Purpose

This document will help you identify and correct WSUS connection issues caused by an expire self-signed SSL certificate.

Symptoms

1.  You see the following popup message when you navigate to Software Library > Software Updates >  Shavlik Patch.

"Failed to retrieve updates from specified WSUS server. The server could not be contacted. Please confirm the server name and port number."

2. You see the following popup message when you navigate to Shavlik Patch > Setting.

"Failed to connect to the WSUS server. Please verify the server name, port number and SSL setting."

3.  You see the following popup message when clicking on the Test Connection button in the Shavlik Patch > Settings > WSUS Server tab.

"The WSUS server could not be contacted. Please confirm the server name and port number.  Verify that your account is a member of the WSUS Administrator group on the WSUS server."

Cause

Your self-signed SSL certificate has expired.

Resolution

The resolution to this issue will vary depending who you originally created your SSL certificate.  We will be covering one possible fix in this document.

1.  Open IIS on the SCCM/WSUS server and click on your server name under Connections.

2.  Answer the popup.  Choosing 'No' is a viable answer.

3.  Double-click on Server Certificates in the middle pane.

4.  Click on Create Self-Signed Certificate.

5.  Enter a friendly name for the new certificate.

6.  Choose Web Hosting in the drop down menu then click OK.

7.  Under the Connections pane, expand the tree under your server name then expand Sites.

8.  Click on WSUS Administration and then Bindings... in the far right pane.

9.  Click on the HTTPS binding and then click Edit.

10.  Choose the new SSL certificate under the SSL certificate drop down menu.

11.  Click OK and then Close on the next screen.

12.  Open SCCM and monitor for any issues described in the Symptoms section.

Affected Products

Shavlik Patch

Purpose

This document explains how to transfer data and patch files manually from a Shavlik Protect Console on a Internet facing network, to a Protect Console on a Secure network with no internet connection using Write Once/Read Only Media .  This procedure is used when data from re-writable media is not allowed to be copied to machines in a secure zone.

Procedure

Setup a separate Distribution Share for Internet Connected and Offline Protect Consoles as a data file and patch repository

• Setup a separate shared folder for each security zone for the Internet Connected and offline facing consoles that is accessible from the console to be used as the path for Distribution Server configuration.
• Make sure that patch definitions downloads are scheduled so that current patch definitions are synced to the Distribution Server share
• Configure a Distribution Server on each console using the document, Configuring Authenticated SMB Distribution Servers
  
• Configure the Distribution Server on the Connected Protect Console to Sync All engines, definitions, and patch downloads.
• Under Tools > Operations > Downloads on the Secure Network Protect Console, select the Specific Distribution Server for the "Definition download source" and the "Patch and Service Pack" download source.

Copy files to a DVD to be delivered to the Protect Console on the Secure Network 

• Sync data files and patches to the Distribution Server share manually using information the document How To: Manually Synchronize Distribution Servers
• Burn contents of the Distribution Server Share from the Internet Connected Console to a write one DVD-R
• Walk the DVD-R to the Secure non-internet facing network and copy the contents to the Distribution Share on the Secure Network Protect Console

Using the copied files

After the data files and patches have been downloaded to the Secure Network Protect Console Distribution share, data files will be transferred to the correct folder when files are refreshed automatically during a scan or manually using Help > Refresh files.  Patch downloads will go to the Downloads folder when the console requests a patch download during deployment.

Additional Information

This Procedure is simplified by using the existing Download folder as specified under Tools > Operations > Downloads as the Distribution Share for the internet console.  This eliminates the need to sync the Patch downloads.  You would only need to sync the Core engines/definitions and Threat engines/definitions if you are using agents.

Affected Product(s)

Protect 9.X

Purpose

This article provides a list of URLs that may be required to download catalog content and patches when using Shavlik Patch for Microsoft System Center and Ivanti Patch for SCCM.

Description

The following URLs may be used to download updates and must allowed through firewalls, proxies and web filters.

Additional Information

• license.shavlik.com is required for activation the license on the product.
• If using the Shavlik Patch plugin with SCCM or Ivanti Patch for SCCM, you may also want to review the following for certificate site requirements:  Certificate verification sites to allow for Shavlik Patch
• To obtain the IP for vendor sites you can ping the vendor site or contact the vendor to obtain this information. It may be easier to create an exception for an entire domain rather than entering all specific URLs, you can usually do so by entering the exception in this format: *.domain.com.

Affected Product(s)

Ivanti Patch for SCCM

Shavlik Patch for Microsoft System Center

Overview

This document provides a list of required URL addresses for Shavlik Protect and Ivanti Patch for Windows Servers to allow:

• Patch executable download.
• Patch content definition download.
• Online license activation or license refresh.
  
• Home page RSS feed.
  
• Product check for update.
  

URL List

The following URLs may be used to download updates and must allowed through firewalls, proxies and web filters:

Additional Information

• To obtain the IP for vendor sites you can ping the vendor site or contact the vendor to obtain this information. We are unable to provide a list of IP addresses due to the varied dynamic IP addresses being used by the vendors. It may be easier to create an exception for an entire domain rather than entering all specific URLs, you can usually do so by entering the exception in this format:
  • *.domain.com.

Affected Product(s)

Shavlik Protect

Ivanti Patch for Windows Servers

Overview

You receive this error when scanning Error 106 when scanning a Windows 10 machine after upgrading to 1709 or newer version.  Microsoft changed the way Windows 1709+ handles SPN's for CIFS.

Microsoft network server: Server SPN target name validation level

Cause

Starting in Windows 10 build 1709, how Windows handles SPN's for CIFS: Microsoft network server: Server SPN target name validation level

By default this is set to Off in Windows, however customers that have configurations for higher security such as CIS they will experience this issue.

Resolution

Microsoft has released an update addressing that issue: KB4343909An alternate fix would be to change the Microsoft network server: Server SPN target name validation level security policy setting to Off.

Affected Product

Shavlik Protect 9.2.x

Ivanti Patch for Windows Server 9.x

Symptoms

When your deployment options are set to take a pre-deploy snapshot of a hosted VM, the deployment fails with error "Pre-deploy snapshot failed":

Deployment logs show the following error:

HostedVirtualDeployment.cs:555|VMware.Vim.VimException: Current license or ESXi version prohibits execution of the requested operation. ---> System.Web.Services.Protocols.SoapException: Current license or ESXi version prohibits execution of the requested operation.

Cause

All versions of ESXi licensing allow you to take manual snapshots.  However, the free version of ESXi has locked APIs, so with that free version you are unable to initiate that task remotely even though you can take snapshots manually.

Resolution

The only way to unlock the ESXi APIs is to purchase licensing for it.  As of the publication of this doc, any level of paid licensing will unlock the APIs, so any license tier will suffice for this operation.

Affected Products

Shavlik Protect 9.2.x

Ivanti Patch for Windows Servers 9.3.x

Symptoms

• Agents attempting to patch machines fail.
• The agents are unable to find and download the .MSU patch files from HTTP-configured distribution servers.
• On the UI of the target machine in the Patch tab, you see the error:
  
  Cannot download patch

Cause

This issue caused by the IIS MIME type extension for MSU not being configured correctly.

Resolution

To resolve this issue, configure the MIME Type extension for MSU on the IIS Server.

Note: If you are not using the vCenter vProtect Console patch repository, support for configuration of the the HTTP/HTTPS distribution server is not provided by VMware.

• On Windows 2003 server:
  1. On the core server, launch Internet Information Services Manager.
  2. Navigate to the Default Web Site.
  3. Right-click the Default Web Site and select Properties.
  4. Click the HTTP Headers tab, then click MIME Types.
  5. Click New.
  6. Enter MSU for the file extension, and application/octet-stream for the MIME Type.
  7. Restart IIS by clicking Start> Run and entering iisreset.
     
     
• On Windows 2008 Server:
  1. On the core server, Launch Internet Information Services Manager.
  2. Navigate to the Default Web Site and select it.
  3. Double-click MIME Types in the middle panel.
  4. Click Add.
  5. Enter MSU for the file extension, and application/octet-stream for the MIME Type.
  6. Restart IIS by clicking Start> Run and entering iisreset.

Products

Shavlik NetChk Protect

Shavlik NetChk vProtect

Product Versions

Shavlik NetChk Protect 7.8.1340

Shavlik NetChk Protect 7.8.1388

Shavlik NetChk Protect 7.8.1392

Shavlik NetChk vProtect 7.8.1340

Shavlik NetChk vProtect 7.8.1388

Shavlik NetChk vProtect 7.8.1392

Symptoms

When installing the latest version of 7-Zip, vulnerability scans still report that older versions are installed and vulnerable.

Cause

The 7-Zip installer does not actively remove registry keys from older versions.  The vulnerability is a false positive since the executable has been upgraded, but the registry keys from those previous versions trigger the detection.

Resolution

We currently have a request posted on the 7-Zip support forum for the vendor to address this in future installers.  That thread is located here:

https://sourceforge.net/p/sevenzip/discussion/45797/thread/c6f74111/

This doc will be updated as that request reaches a resolution.

Description

Microsoft patches fail to deploy on the following operating systems:

• Windows Vista
• Windows Server 2008
• Windows 7
• Windows Server 2008 R2
• Windows 8
• Windows Server 2012
• Windows 8.1
• Windows Server 2012 R2
• Windows 10 (all builds)
• Windows Server 2016 (all builds)

When attempting to manually run a patch file copied to a target machine in C:\Windows\ProPatches\Patches you receive an error that the Windows Update service was not able to start or is not started.

Resolution

Windows Vista/2008 changed patching behavior. Windows Vista and later patches are of a file type .MSU and this file type requires the Windows Update Service to be enabled to execute. The Windows update application is not required, but the standalone service handles extraction and execution of MSU patches and must remain enabled. For more details: KB934307 

Affected Products

Shavlik Protect 9.x

Ivanti Patch for Windows Servers 9.3.x

Purpose

This document provides information to troubleshoot slow patch scans when using Ivanti Patch for Windows Servers (PWS).

Symptoms

There can be a number of causes of slow patch scans. The first thing you should look into is if there have been any recent changes - either to the console system or the network you are on.

Some of the most common causes of slow scans addressed in this article are:

- Insufficient system resources (RAM, CPU, etc.)

- Antivirus scanning- particularly those that perform on-access scans.

- Network/Latency issues (poor latency, scanning over WAN, etc.)

- Database issues - (lack of database maintenance, insufficient SQL server system resources, etc.)

Resolution

Possible issues that may need to be addressed:

Affected Product(s)

Ivanti Patch for Windows Servers 9.3.x

Shavlik Protect 9.x

Available Reports

The following reports are available in Shavlik Protect. The reports you have access to is dependent upon your current license level.

To choose a report, select Tools > Create report from the main menu and then select a report from the drop-down list at the top of the Report Gallery dialog. The list is divided by the different types of security programs available within Shavlik Protect.

Purpose

Administrators may find that the default reports may provide information that is less important to their patch process. There may be a need for information only regarding specific machines, patches, patch statuses, or other criteria.

Description

In Protect, choose Tools > Create Report.
In the Reports window choose your desired report in step 1.
In the Pick Filter Options, check the 'Use Advanced Filter' checkbox, and click Generate Report.

The advanced filter options will load.

In the Advanced Report Settings select the filtering type on the left, and then select the type's options on the right. When ready to generate the report, click Ok.

Example: The below screenshot will show the Condensed Patch Listing report filtered to only show patches that are found as Missing.

Example: The following shows the difference between a non filtered report, and the same report when filtering for only missing patches.

Available Reports and filters:

Here is a list of the various Advanced Filter types and options available for each report.

• Seat License Status -  No Filters

Patch Reports

• Condensed Patch Listing
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Patches
    • Bulletin IDs
    • QNumbers
    • Severity
      • Critcial
      • Important
      • Moderate
      • Low
      • Not Set
    • Patch Properties
      • Found
      • Missing
      • Warning
      • Effectively Installed
      • Informational
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
    • Machine Properties
  • Products
    • Product Names
    • Service Pack Names
• Deployment Detail
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Patches
    • Bulletin IDs
    • QNumbers
    • Severity
      • Critcial
      • Important
      • Moderate
      • Low
      • Not Set
    • Patch Properties
      • Found
      • Missing
      • Warning
      • Effectively Installed
      • Informational
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
    • Machine Properties
  • Products
    • Product Names
    • Service Pack Names
• Deployment Percentage by Patch
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Consoles
    • Console Names
  • Patches
    • Bulletin IDs
    • QNumbers
    • Severity
      • Critcial
      • Important
      • Moderate
      • Low
      • Not Set
    • Patch Properties
      • Found
      • Missing
      • Warning
      • Effectively Installed
      • Informational
  • Products
    • Product Names
    • Service Pack Names
• Deployment Status by Deployment
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
• Deployment Status by Machine
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Patches
    • Bulletin IDs
    • QNumbers
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
    • Machine Properties
• Detailed Summary
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Consoles
    • Console Names
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
• Executive Summary
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Consoles
    • Console Names
• Machine Inventory
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Consoles
    • Console Names
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
  • Products
    • Product Names
• Machine Status by Patch Count
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Consoles
    • Console Names
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
• Machine Status by Summary
  • Scan & Deployments
    • Scan Names
  • Consoles
    • Console Names
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
• Machine/OS Listing
  • Scan & Deployments
    • Scan Names
    • Creation Dates
  • Machines
    • Machine Names
• Machines by Patch
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Patches
    • Bulletin IDs
    • QNumbers
    • Severity
      • Critcial
      • Important
      • Moderate
      • Low
      • Not Set
    • Patch Properties
      • Found
      • Missing
      • Warning
      • Effectively Installed
      • Informational
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
    • Machine Properties
  • Products
    • Product Names
    • Service Pack Names
• Machines Not Scanned
  • Scans & Deployments
    • Creation Dates
• Missing SP
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
    • Machine Properties
  • Products
    • Product Names
    • Service Pack Names
• Patch Annotation Information
  • Patches
    • Severity
      • Critcial
      • Important
      • Moderate
      • Low
      • Not Set
    • Patch Properties
      • Found
      • Missing
      • Warning
      • Effectively Installed
      • Informational
  • Products
    • Product Names
    • Service Pack Names
• Patch Criticality Information
  • Patches
    • Severity
      • Critcial
      • Important
      • Moderate
      • Low
      • Not Set
    • Patch Properties
      • Found
      • Missing
      • Warning
      • Effectively Installed
      • Informational
  • Products
    • Product Names
    • Service Pack Names
• Patch Listing
  • Scan & Deployments
    • Scan Names
  • Patches
    • Bulletin IDs
    • QNumbers
    • Severity
      • Critcial
      • Important
      • Moderate
      • Low
      • Not Set
    • Patch Properties
      • Found
      • Missing
      • Warning
      • Effectively Installed
      • Informational
  • Machines
    • Domains
  • Products
    • Product Names
    • Service Pack Names
• Patch Status Detail
  • Scan & Deployments
    • Scan Names
  • Patches
    • Bulletin IDs
    • QNumbers
    • Severity
      • Critcial
      • Important
      • Moderate
      • Low
      • Not Set
    • Patch Properties
      • Found
      • Missing
      • Warning
      • Effectively Installed
      • Informational
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
    • Machine Properties
  • Products
    • Product Names
    • Service Pack Names
• Patch Status Summary
  • Scan & Deployments
    • Scan Names
  • Patches
    • Bulletin IDs
    • QNumbers
• Patches by Machine
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Patches
    • Bulletin IDs
    • QNumbers
    • Severity
      • Critcial
      • Important
      • Moderate
      • Low
      • Not Set
    • Patch Properties
      • Found
      • Missing
      • Warning
      • Effectively Installed
      • Informational
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
    • Machine Properties
  • Products
    • Product Names
    • Service Pack Names
• Patches by Machine Detail
  • Scan & Deployments
    • Scan Names
  • Patches
    • Bulletin IDs
    • QNumbers
    • Severity
      • Critcial
      • Important
      • Moderate
      • Low
      • Not Set
    • Patch Properties
      • Found
      • Missing
      • Warning
      • Effectively Installed
      • Informational
  • Machines
    • Domains
  • Products
    • Product Names
    • Service Pack Names
• Top Ten Missing Patches - No Filters
• Top Ten Vulnerable Machines - No Filters
• Deployment Percentage by Patch (IAVA)
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Consoles
    • Console Names
  • Patches
    • Severity
      • Critcial
      • Important
      • Moderate
      • Low
      • Not Set
  • Products
    • Product Names
    • Service Pack Names
• Detailed Summary (IAVA)
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Consoles
    • Console Names
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
• Machine Status by Patch Count (IAVA)
  • Scan & Deployments
    • Scan Names
    • Creator Names
    • Creation Dates
  • Consoles
    • Console Names
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
• Patch Status Detail (IAVA)
  • Scan & Deployments
    • Scan Names
  • Patches
    • Severity
      • Critcial
      • Important
      • Moderate
      • Low
      • Not Set
    • Patch Properties
      • Found
      • Missing
      • Warning
      • Effectively Installed
      • Informational
  • Machines
    • Domains
    • IP Addresses
    • Machine Names
    • Machine Properties
  • Products
    • Product Names

Threat Reports

• 7 Day Executive Threat Summary - No Filters
• 30 Day Executive Threat Summary - No Filters
• Machine Threat Status
  • Scans & Remediations
    • Creation Dates
  • Consoles
    • Console Names
  • Machines
    • Domains
    • Machine Names
• Threat Action Report
  • Scans & Remediations
    • Creation Dates
  • Consoles
    • Console Names
  • Machines
    • Domains
    • Machine Names
• Threat Protection Status Report
  • Consoles
    • Console Names
  • Machines
    • Domains
    • Machine Names

Asset Reports

• Software Catalog Report
  • Consoles
    • Console Names
  • Machines
    • Domains
• Machine Hardware Detail Report
  • Scans
    • Scan Names
    • Creation Dates
  • Consoles
    • Console Names
  • Machines
    • Domains
    • Machine Names
• Machine Software Detail Report
  • Scans
    • Scan Names
    • Creation Dates
  • Consoles
    • Console Names
  • Machines
    • Domains
    • Machine Names
• Virtual Machine Hardware Detail
  • Scans
    • Scan Names
    • Creation Dates
  • Consoles
    • Console Names
  • Machines
    • Domains
    • Machine Names
• Virtual Machine Memory Usage Report
  • Scans
    • Scan Names
    • Creation Dates
  • Consoles
    • Console Names
  • Machines
    • Domains
    • Machine Names
• Virtual Machine Disk Usage Report
  • Scans
  • Scan Names
  • Creation Dates
  • Consoles
    • Console Names
  • Machines
    • Domains
    • Machine Names

Power Status Reports

• Power Status Report
  • Scans
    • Scan Names
    • Creator Names
    • Creation Dates
  • Consoles
    • Console Names
  • Machines
    • Domains
    • Machine Names

Affected Product(s)

Shavlik Protect 9.x

Purpose

The following is a sample integration script for the Ivanti Patch for Windows Servers API integration with the Qualys vulnerability scanner.

If you use a vulnerability scanner to identify weaknesses in your network, the scanner may detect hundreds or even thousands of issues on your machines. At first this might seem a bit overwhelming, but what’s likely happening is that the vulnerability scanner is simply producing a lot of noise. The scanner is assessing for CVEs (Common Vulnerabilities and Exposures) explicitly.  In reality a software update will often include many CVEs.  A patch can also be superseded or replaced by a newer update.  What this tends to cause is the Vulnerability Assessment reflecting hundreds of vulnerabilities that can be resolved by updating just a few software titles on a system.

To address this, you can use the API to::

• Make calls to the vulnerability scanner
• Extract the vulnerability list (consisting of CVEs)
• Import those CVEs into a Ivanti Patch for Windows Servers patch group via the Patch Group API
• Perform patch scans and deployments using that patch group
• The patch engine will take into account any superseded patches and will identify the handful of patches that are required to bring the target system into compliance. If you rerun the vulnerability scanner after deploying the patches, the vulnerability count should be greatly reduced.

Overview

• The script and supporting files can be downloaded from here: QualysToPatch_API.zip (attached to this document)
  • Extract the contents to it's own folder on C:\. For example C:\QualysToPatch_API
• The copy tool curl is required for this to work. You can download this tool from here: curl 7.56.1
  • Extract the contents of the CAB files to it's own folder on C:\. For example: C:\curl

1. Edit the variables in the UpdateLocalQualysFiles.bat. This batch file is used to download data files directly from the Qualys content servers.

a. SET CURLPATH=C:\curl\curl.exe - Set the location of your curl.exe.

b. SET LOCALDATA="C:\QualysToPatch_API\Qualys" - Set the location of your Qualys scripts.

c. SET PLATFORM=qualysapi.qg3.apps.qualys.com - Specify host you were assigned when you setup your Qualys account.

d. SET USER="user:pass" - Set a username and password for your Qualys account.

2. Run UpdateLocalQualysFiles.bat to get the latest data from Qualys.  This will download the data files directly from the Qualys content servers and place them in the location specified in the batch file.

3. Run the script: (Scan)

    > . .\QualysToIvanti.ps1

    > QualysToIvanti -machinesXmlFile C:\QualysToPatch_API\hosts.xml -qualysKbXmlFile C:\QualysToPatch_API\qualyskb.xml -ScanTemplate 'Demo' -DeployTemplate 'Agent Standard' -PatchGroupName 'Demo' -MachineGroupName 'Demo' -ScanName 'Qualys-Ivanti demo' -DeployMissingPatches $False

4. You can choose not to perform a scan and update a Patch Group in Patch for Windows Servers.

    > . .\QualysToIvantiPatchGroup.ps1

    > QualysToIvantiPatchGroup -machinesXmlFile "C:\QualysToPatch_API\hosts.xml" -qualysKbXmlFile "C:\QualysToPatch_API\qualyskb.xml" -PatchGroupName 'Demo'

Purpose

The purpose of this document is to highlight a Microsoft Windows Task Scheduler bug that can cause your monthly scheduled console tasks to run a week early or not at all.

Symptoms

The Ivanti Patch for Windows Servers console is installed on Windows Server 2016 or Windows 10, and you have a monthly console task that is set to run on a specific occurrence of a day of the week (4th Wednesday, 2nd Saturday, etc.).  Occasionally, this task executes exactly one week early or not at all.

Cause

Microsoft has confirmed a bug in the Windows Server 2016/Windows 10 Task Scheduler that will execute scheduled tasks one week early or not at all when specific conditions are met:

• The monthly task is set to execute on a specific occurrence of a day of the week (4th Wednesday, 2nd Saturday, etc.)
• The date the task is scheduled to execute is a multiple of 7 (7th, 14th, 21st, or 28th)

If these conditions exist and the task is scheduled to execute on the 7th, the task will not run.

If these conditions exist and the task is scheduled to execute on the 14th, 21st, or 28th, the task will execute one week early.

NOTE: This bug does not affect one-time tasks scheduled for an explicit time and date or monthly tasks set for a specific day of the month.  This will only affect monthly tasks scheduled for a certain occurrence of a day of the week.

This calendar from Microsoft's TechNet post regarding the issue illustrates the affected days of 2018.  Tasks scheduled days circled in red will execute one week early, while tasks scheduled on the days circled in grey will not execute.

• NOTE: Microsoft originally stated this issue would not affect April and October as illustrated on the calendar below, but they have updated the TechNet post linked above to indicate the issue is occurring in April.  We recommend operating under the assumption this bug will surface in any month until Microsoft has released a fix for it.

Resolution

Q4343884 has been released by Microsoft to resolve this issue in Windows 10/Server 2016 build 1607

https://support.microsoft.com/en-us/help/4343884/windows-10-update-kb4343884https://support.microsoft.com/en-us/help/4343884/windows-10-update-kb4343884

Additional Information

Microsoft has acknowledged this issue and describes it further on their TechNet AskCore Japan blog:

https://blogs.technet.microsoft.com/askcorejp/2017/12/11/mouthly_tasks_issue/

Affected Product(s)

Shavlik Protect 9.2.x

Ivanti Patch for Windows Servers 9.3.x

Symptoms

Protect is detecting a Patch that should not be detected as missing.

Resolution

NOTE: Before performing the following, please update to the latest XML data by going to Help > Refresh Files, close and reopen Shavlik Protect and then perform another scan against the machine(s) using a Security Patch or WUScan Template. The root cause of the issue may stem from custom filtering in a Scan Template or could already be fixed in a later XML release.

From The Protect Console:

1. Click on Results tab.

2. Choose the most recent scan containing the specific patch.

3. Click on the machine containing the specific patch.

4. Click on the specific patch.

5. View why Protect detects the patch as missing (Patch Information Tab).

6. Click on the linked Qnumber to be taking to documentation regarding this patch. Most of the time this will include the detection logic.

7. Browse to the location referenced in step 5 to verify the information found in step 5 and 6.

See below for more information:

Also note the Downloaded File name.

On the Target:

Browse to C:\Windows\ProPatches\Patches and find the specific patch. If you have previously deployed this patch and it failed, manually try to run the patch.

Take any screenshots of any errors such as the one below.

Information to Send to Support

If you experience these errors, please create a support case at https://success.ivanti.com/  or by calling into support.

NOTE: If you choose to call into support, please gather this information before calling in.

Gather the following information:

1. Before doing the following, please download the latest XML data by going to Help > Refresh Files.
2. The Bulletin ID & Qnumber of the patch in question. This information can be found in Step 4 above.
3. Clear your logs, and do a rescan and/or deployment.then gather the log. Please do this by following this guide for console logs: How To: Collect Shavlik Protect - Ivanti Patch for Windows Servers console, patch deployment and agent logs
   
4. A DPDTrace gives more information on how Protect detects certain patches. Please gather a DPD trace on the target machine by following this guide: DPDTrace command line logging tool used for patch detection issues
5. Screenshots from Step 5 from the console, Step 7 from the target and if applicable, the error when the patch is manually installed.

Include the following registry exports from the same target machine that ran the DPDTrace.  This will not only save time, it will also greatly increase our chances of determining the root cause of the detection issue and correcting it:

NOTE: This document has a batch file that retrieves the needed registry keys: Batch File for Obtaining Registry Exports for Detection Related Issues

• HKLM\SOFTWARE\WOW6432\Microsoft\Windows\CurrentVersion\Uninstall

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

• HKLM\SOFTWARE\Classes\Installer\Products

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages

• HKLM\SOFTWARE\Classes\Installer\Patches

Please zip all files into one archive file before emailing or attaching them to the case.

NOTE: You will not be able to email the registry keys to the case as .reg files. They must be either uploaded to the case through the support portal or changed into .txt files.

Affected Product(s)

Shavlik Protect 9.x

Purpose

This document outlines how to locate the Shavlik Protect license activation key in the console and transfer this key to a new or additional Protect console.

Description

When migrating to a new Shavlik Protect server or setting up an additional Protect console machine- understanding where to find the license key and how to input it in to the new console is vital to maintaining Shavlik Protect functionality through this transition. As this process may not frequently performed by administrators, a reference/guide for this process may prove to be helpful.

Locating the License Key on Existing Protect Console

Follow the process below to obtain your license key from your console machine. After locating the key in order to prepare to transfer the key to the new console machine, copy this 25-digit license key and make it readily available.

In Shavlik Protect 9.x:

    Help>About Shavlik Protect Advanced

In the About Shavlik Protect window, the license key can be found in the main text display under

    License Key:

          Activation Key: xxxxxxxxxxxxxxxxxxxxxxxxxx

In vCenter Protect 8:

This process is nearly identical to the process in Shavlik Protect 9.x. Refer to the images above.

To locate the license key follow this path:

          Help>About VMware vCenter Protect

In the About VMware vCenter Protect window, the license key can be found in the main text display under:

          License Key:

              Activation Key: xxxxxxxxxxxxxxxxxxxxxxxxx

Note: In the event the Protect Console is no longer installed, it may still be possible to obtain the license key from the following registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\LANDesk\Shavlik Protect\Console\Activation

The AK Value will contain the Activation Key/License key.

Activating the License Key in New Console

Activation is the process by which the Protect software is validated as having been purchased.  In order for the new Protect console to fully function activation is required. Users are prompted after installing and opening Shavlik Protect to input their activation key, through the Shavlik Protect Activation window.

To transfer the license key from your previous console machine follow the directions in the window as ordered by number:

    1. Select an activation mode (on left portion of window)

          Select "Product or bundle license"

    2. Enter your activation key(s) (in center of window)

          In the text field below, paste or manually input your 25-digit Protect license key

          Click the "Add" button right of the text field.

    3. Select activation method (lower-center of window)

          Choose "Online activation" if you have an internet connection.

          Click "Activate online now"(at the lower-right corner)

If you require "Offline activation" see the following article- How to Process a Manual (Offline) Activation for Ivanti Patch for Windows 9.3 or Patch for SCCM 2.3+

If the software was previously launched and activated by selecting Trial mode, this window can be accessed through Protect by navigating to:

    Help>Enter/refresh license key...

Additional Information

• Protect 9 Installation Guide
• Protect 9 Upgrade Guide
• How to Activate Shavlik Protect
• Managing License Seat Usage
• Sales/Licensing Contact Information

Affected Product(s)

Shavlik Protect 9.x
vCenter Protect 8.x

Symptoms

• Attempting to launch Shavlik Protect fails and returns with the following error:

"The database connection could not be made. This may be caused by a temporary interruption in the database server, or the machine hosting the database could have been renamed."

• Selecting "Launch the database configuration utility" and attempting to reconnect to SQL Server and Protect database fails, returning with error:

              "Failed to connect to SQL Server '(sql server path)'. Please verify the SQL name and credentials>"

• After verifying SQL server credentials user receives same error message.

Cause

This issue will occur if the SQL Server previously on the machine has been removed. Without the SQL Server installed on the console machine, despite retaining the Protect database, Protect will be unable to function. Some users may inadvertently uninstall the server software without being aware that doing so will not permit Shavlik Protect to run. Doing so will not delete the Protect database and Protect should be able to function again after reinstalling and configuring the SQL Server.

Resolution

To resolve this issue you must:

1. Reinstall Microsoft® SQL Server Management Studio® software (the Protect installer installs SQL Server 2012 Express by default)

  2.  Reattach the Protect SQL database to the SQL server.

The remainder of this document will provide in-depth instructions on how to perform these tasks to resolve the database connection error.

Installing the SQL Server

If you will be using an Express Edition of Microsoft SQL Server, you should consider downloading and installing Microsoft SQL Server Management Studio. This free software can be used to perform backups and to manage your database. Additionally, it will make the process of reattaching the Protect database to the SQL server much simpler.

If you would like to follow the resolution outlined in this document, SQL Server Management Studio is required.

The Microsoft® SQL Server® 2012 Express installer can obtained for free at the following link:

http://www.microsoft.com/en-us/download/details.aspx?id=29062

To install both the SQL Server and the Server Management Studio Express, install the package containing the SQL Express Server and SQL Server Management Studio.

After installation, Protect will still not launch, attempts to reconnect to the SQL server will return with this error:

    "The database 'Protect' does not exist on the SQL Server  Please verify your configuration"

This error indicates that the protect database must be reattached to the SQL Express server, the easiest way to do this is through Microsoft SQL Server Management Studio. This process will be outlined in the next section of this article.

Reattaching the Protect Database to the SQL Express Server

To reattach the Protect database to the SQL Express Server, open SQL Server Management Studio.

SQL Server Management Studio can be opened by following this path:

    Start->Micrsoft SQL Server 2012->SQL Server Management Studio

The "Connect to server" window will appear at launch.

For most users- including all who originally installed SQL Express through the Protect install package- none of the fields need to be modified.

Simply click connect to proceed to the next step in the process. Doing so will close the dialog box.

The SQL server should now be visible on the left in the Object Explorer pane. If the Databases subfolder is not visible, click the plus sign to the left of the entry containing the server path to display the server contents.

Right click this Databases directory and click "Attach..."

An "Attach Databases" dialog box will open.

Click Add in the right-center of the window to proceed. Doing so will open the Locate Database Files window.

Left-click the Protect.mdf file, which is located under DATA, then click OK.

This will attach the database file and close the window.

Click OK again to exit the Attach Databases window.

In the Object Explorer pane, the Protect database should now be visible, demonstrating that the Protect database has successfully been attached to the SQL Express server.

After completing these steps, the SQL Server should be configured properly to allow the Protect console to function as before. Opening Protect should launch the program without any of the previous errors. Protect should require no more additional configuration to resume functional operation.

Note: After the completion of these steps, if any further difficulty is encountered in attempting to connect to the database by Protect, use the Database Setup Tool to make sure that Protect database is configured properly. This can be located by going to:

Start->Shavlik Protect->Database Setup Tool

Related Articles

If you receive the same error message as above and verify that the SQL Server is installed, your SQL Server service may not be running.

Launch Interface - Error - a Network-Related or Instance-Specific Error Occurred While Establishing a Connection to SQL Server.

Restore Shavlik Database from backup using SQL Server Management Studion:

http://community.shavlik.com/docs/DOC-22956

Affected Product(s)

Shavlik Protect 9.x