Purpose
This document will help explain why some Agentless scan results differ from an Agent scan results even though they are using the same Scan Template.
Description
Here are a couple of possible scenarios where the scan results may differ:
- In cases where you use a custom Scan Template filtering by User Criticality, agentless and agent based scan results may differ. The User Criticality filter is ignored by agent scans, this may account for the difference in scan results between the agent and the agentless scans.
- Another possible reason is the scan definitions used in the agentless scan are different from the from the definitions used in the agent scan. This will occur if the agent doesn't have access to the updated definitions, usually because the Distribution Server has not synced with the Protect console before the Agent runs its scan.
- You can verify this by looking at the Patch Definition on the Agent in View > Machines.
- You can verify the Protect console definitions by going to Help > About Shavlik Protect and looking at the Patch Assessment version.
Resolution
- When creating custom Scan Templates for use in both agent and agentless scans, do not filter by User Criticality.
- Verify the definitions are the same between the Protect Console and the Agent.
Affected Products
Shavlik Protect 9.x