Introduction

Very often customers open a support ticket claiming that their software distribution, patch management etc. tasks fails or even hang stuck on the active status.

Following a remote session, we usually identify that one of the causes of this behaviour is due to the Common Base agent which is not loaded or missing.

This article explains how solve some of the scenarios when the CBA status shown as not loaded within the agent properties of a device.

Environment

LANDesk Management Suite all versions.

Review Date

30/10/2015

Assumptions

It is assumed that the agent has been already installed once on the affected machines.

Why this component is so important?

The CBA is installed by default when you deploy your agent configuration across your unmanaged devices. Whether this is done through push, advance agent or GPO, the CBA MUST be installed in order to provide (among other functionalities) device discovery and to manage core server/device communication.

How to:

There are many reasons why the CBA is not loaded. One of the most common is related to the fact that the agent has been corrupted or may be not upgraded after the installation of a service pack\component patch.

In order to resolve this scenario, we usually recommend to reinstall the agent (possibly removing it with a force clean switch). This solution is most likely to solve also other issues CBA related. How to uninstall the LANDESK Agent

Another possible approach, which can be tested before removing and reinstalling the agent, is to reinstall only the CBA . This can be simply done running : \\[IP core server] \ldlogon\cba8inst.msi

In other situations when the client machine cannot reach the url : http://[client IP address]:9595/ , the issue migh be related to the device resolution and it can be solved with : Configure > Agent Status Options > Use DNS .

Also look at these documents::

Agent Status Icons Suddenly Not Appearing in Console

Testing console to client communication and connectivity

One of my techs just informed me of this issue. Seems that yesterday he reimaged of some of his laptops. Version 8.8 got installed but now when any of us try to force a inventory scan of those machines from the console it errors out with  "Agent Refused Access. Unathorized" I found an old document in th KB about verifying that the .0 cert is on the client machine and it is. Any ideas?

Problems/Symptoms:

How to upgrade LANDesk Agents

How to patch LANDesk Agents with Service Packs

Fix:

-Upgrade

Perform a full Agent Push to upgrade an existing Agent to the latest Core version. This can be accomplished by right-clicking on the Agent Configuration name from the Console and selecting 'Schedule'

-Patch

To apply a patch or Service Pack to an Agent, either perform the full Agent install as described above, or install the patch.

To apply a service pack or patch to clients, follow these steps:

1. Update the Core to the latest Service Pack (if deploying a Service Pack).
2. Download updates in Security and Patch Manager to update content.
   1. Click on Download Updates.
   2. Make sure the LANDESK Updates check box is selected.
   3. Click the Update Now button.
   4. Wait for this to finish.
3. Click on the All Items Folder.
   1. Locate the Service pack or patch that you want to upgrade.
   2. Right Click on the Definition and Choose Download now.
   3. Click on all selected Items.
   4. Right click on the "Client" patch and choose download.
   5. Let this Finish.
4. Make sure that the Definition is in the Scan folder.
   1. If the definition has a X or a ? on it it is not in the scan folder and you will need to move it to the Scan folder.
5. Run a Security Scan against client machines.
   1. Click on Create a Task.
   2. Choose Security Scan.
   3. Check the Box that says Scheduled Task.
   4. Click ok.
   5. Drag all the computers into the Scheduled task that was created.
   6. Start the Scheduled Task.
6. Wait for all the computers to Scan.
7. Repair the Service Pack using Patch Manager.
   1. Right click on the Definitions Choose Repair.
   2. Check box that says Scheduled Task.
   3. Click OK.
   4. Drag all the computers into the Scheduled Task.
   5. Start the Scheduled Task.

Alternately, you can apply the Agent Service Pack or patch manually.

• Note: Do not use the Schedule Update feature to upgrade or patch an Agent. Schedule Update only updates settings on an existing Agent. Updating the agent settings performs the following actions:

1) Uninstalls the LANDesk Remote Control Service, LANDesk Targeted Multicast, and LANDesk(R) Software Monitoring Service services.

2) Runs the agent configuration MSI for the specific agent configuration (this is not the full agent install).

3) Reinstalls the LANDesk Remote Control Service, LANDesk Targeted Multicast, and LANDesk(R) Software Monitoring Service services.

4) Runs an inventory scan to ensure changes are reported to the core server.

How To:

This article will guide you through how to change agent settings on devices that already have an agent configuration installed. For instance, you'd like to change the reboot agent setting on several devices without creating an entirely separate agent configuration for that group of devices.

Step by Step:

In this example, we will be creating a Change Agent Settings task to change Reboot settings.

1. In Agent Settings, click on the calendar icon and choose Change settings

2. A Patch and Compliance - change settings task window will appear. Scroll down to Reboot settings.

3. Click on Keep agent's current settings. This will bring up a drop down menu.

4. Choose desired Reboot agent setting, then click Save

5. This creates a Scheduled task

6. Drag and drop the desired device(s) into the Change settings task

7. Right click the task and choose Start now

If you would like to verify the change, you can do the following:

1. After the Change settings task has finished, run an inventory scan on the device

2. After the inventory scan has finished, right click on the device and choose Inventory, or double click on the device to bring up Inventory

3. Expand LANDESK Management then expand Agent settings

4. Click on Reboot settings. In the right hand pane you will see the settings that were just applied with the Change settings task

ENVIRONMENT

LANDESK Management Suite 9.6

DESCRIPTION

Agent Health is a new feature in LANDESK Management 9.6 and will allow you to do the following:

• Add or Remove one of the Agent's component without having to re deploy an agent or an update to the agent
• Ensure that your agent is properly installed and no files are missing or corrupted
• Repair your agent if a file is missing or corrupted
• Modify your components settings to meet the configuration you set in Agent Health
• Update your Agent files, components and settings if it is outdated

HOW IT WORKS

Agent Health is using the vulnerability scanner (vulscan) to check the following on a machine:

• Which components are installed
• How these components are configured
• Are they missing one or more file(s)
• Are the services running properly as required
• Are the files up to date

It will then compare this to the configuration you set in your agent health on the Core and adjust the settings accordingly on the clients.

VIDEO

    Youtube version: LANDESK Agent Health - How to use

BASIC SETUP OF AGENT HEALTH

I. Download the latest updates for Agent Health

Go to Agent Settings and click on the update icon:

Then go to: Updates - Windows - Software Updates - Check LANDESK 9.6 Agent Health and click Download now

You should then see the following in your Patch and Compliance window:

(You can find the Agent Health definitions in View by Vendor - LANDesk Software)

These are the definitions for Agent Health, they contain scripts to either install or uninstall a component like Remote Control or XDD.

II. Create a Query and Scope in order to enable AutoFix on it

In our example, we will create a Query, then a Scope based on this Query.

We will only target our Windows 7 machines for this lab.

In your Network View - Queries - My Queries, New Query

Once your Scope is created, go to Patch and Compliance, into View by vendor, and look for LANDESK Software to find your definitions. You will have to set the AutoFix enabled on the Scope you created earlier for each of the definitions you will be using (see How To Use Autofix in Patch and Compliance Manager)

Once done, you will only have to create and deploy your Agent Health Settings, then launch a Security Scan to have it applied to the machine.

SCENARIO: Install and/or Repair a component via Agent Health

In our example, we will install Remote Control to a machine that doesn't have it.

Go to Agent Settings - All Agent Settings - Agent Health - Right click and New

You will now set the configuration you want for this Agent Health Settings. In our case, we will add the Remote Control component.

I. Deploy your Agent Health settings

Once you have saved your Agent Health settings, you will have to deploy it. To do so, in Agent Settings - Create a task - Change settings

You will have to choose the Agent Health settings you created earlier, in our case: Agent Health - Install Remote Control

After your scheduled task is generated, apply it to the devices / groups / queries you would like, then start the task.

II. Apply your Agent Health settings using Vulscan

Once the task has completed successfully, you will have to run vulscan.exe through a Patch and Compliance Scan or a Security Scan from the machine for example.

When the scan is finished, and the autofix has been applied, you might then be able to see the changes:

You can then test that Remote Control is working on this client:

SCENARIO: Repair a component via Agent Health

If a third party software or a user deleted / modified the Agent files and/or folders, you would have had to troubleshoot until you realize that a file is missing and which one it is, uninstall then reinstall the agent.

This whole process might take at least 1 hour if everything is going perfectly, and could go up to many days if not.

With Agent Health, you will be able to check that your Agent is properly installed and functional. If not, then Vulscan will scan, detect, download and reinstall the missing files.

In our example, we cannot use the Inventory Scanner as the LDISCN32.EXE has been deleted:

I. Deploy your Agent Health settings

We set our Agent Health Settings to check our Base Agent and be sure that our Settings are the right ones (you can modify them as well with Agent Health), then we schedule it to push it to the device:

II. Apply your Agent Health settings using Vulscan

Once you have deployed your settings, and ensured that your Base Agent definition is configured to be AutoFix on a Scope that contains your targeted device, you can then launch a Security Scan on the machine:

After your Security Scan is done and you saw the Base Agent being fixed, you can try again to launch an Inventory Scan:

EPM 2017.3

Hello I think I know the answer to this but just to make sure here it is:

The "schedule update to agent settings" task created using the Agent Configuration section or right click the agent setting, is only PUSH supported, meaning that any devices connecting via the CSA will not get this task correct?

If I want to send it to all I have to send it via a Software Distribution task as POLICY, correct?

Best. 

Hello

I would like to push a new agent ou update the old (v 10 from landesk 2016) from an old consol landesk 9.5.

Because i don' t see some computer on the new landesk.

thanks

Hello,

at the moment I'am investigating a alarming situation on all of our 2016 Clients and Servers.

We have very high CPU usage on all of our systems for the tmcsvc.exe (Multicast Services). The Clients work halfway okay with that load - but on our servers I see real performance issues.

We did not even activated Multicast in our Distribution and Patch Settings - so I have no glue where the high cpu comes from.

Perfmon shows me high read/write Operations accompanied by the high CPU peaks.

I would be happy about any advice what is happening here, and what options I have to stop it.

Best Regards, Marco

So as far as i know this is not in our agent config.

Can someone confirm that - even though we are still seeing the selfelectcontroller.exe process on our agents?

Self Elect is not enabled in our Agents - should the process still be visible ?

How to Build a Self Contained Executable for Installing LANDESK Management Suite on a Legacy Operating System

Description

To maintain compatibility with legacy operating systems, a special agent must be created from older code sources.

A LANDESK agent compiled from the older LDMS code branches is what must be used to continue using LANDesk on these legacy Operating Systems. The Whitepaper attached to this article describes how to build/configure the "Legacy Agent".

The LDMS 2016.3 release no longer supports the installation of the agent on Windows XP and Server 2003 systems. Existing agents on Windows XP/2003 will continue to function, but new features will not be available. If you have a large number of Windows XP devices and need to continue installing agents, it is recommended that you use LDMS 2016.0 with SU5. An agent installation can be created and preserved from the previous version, or Windows XP machines can be managed by a previous version of LDMS until they are updated to operating systems supported by Microsoft®.

REFERENCE: https://community.ivanti.com/downloads/Readme/Pages/LD2016.3.html

To create the LANDESK Agent 2016.0 for LDMS 2016.3 that is compatible with Windows XP and/or Windows Server 2003, please perform the following.

1. Set up a Windows Server 2012 R2 server with the same computer name as the new LDMS 2016.3 core server and with the same IP address as the new LDMS 2016.3 core server in an isolated environment.
2. Install LDMS 2016.0* on the Windows Server 2012 R2* created in step 1 above.
3. Install Software Update 5 (SU5)** for LDMS 2016.0 on the Windows Server 2012 R2 created in step 1 above.
4. Create a new LANDESK Agent Configuration agent configuration with a unique name.
5. Create the self-contained LANDESK Agent executable(s).
6. Copy the executable(s) to the new LDMS 2016.3 core server.
7. Run %ldms_home%legacyagent.exe on the new LDMS 2016.3 core server.
   
   
8. Browse to the executable created on the 2016.0 core server.
9. Browse to the location you wish to save the updated self-contained executable.
10. Browse to the most recent file in "C:\Program Files (x86)\LANDesk\Shared Files\cbaroot\certs\*.0" and click "Add".
11. Check the box labeled 'Edit configuration file manually.'
12. After clicking "Update" the following message will appear:
    
13. Browse to the directory stated in this dialog, and locate the agent ini file. In this example you would locate the file called 'Default Windows Configuration.ini'.
14. Edit the file, and locate the line ServerName='core name', and replace 'core name' with your new core's hostname.
15. Next, search for the  "REG45" and add the following line below that.
    

    REG46=HKEY_LOCAL_MACHINE, SOFTWARE\LANDesk\ManagementSuite\WinClient\Vulscan\CommandLine, /NoSelfUpdate, , REG_SZ

16. Click "OK" and the files will be processed and the Legacy Agent will be built in your desired target location.
17. Repeat steps 7-14 for any further Agent Configurations you wish to process.
18. After your legacy agent has been deployed, you will need to create a Change Settings task, and push the correct settings to your legacy agents.
    1. Do not use the option 'Schedule update to agent settings', found in agent configuration, as this will break the legacy agent.
    2. For more information on creating a change settings task, please view the following document:How To: Change Agent Settings

* Download LDMS 2016.0 from here .

** Download Software Update 5 ( SU5 ) for LDMS 2016.0 from here.

Description

During agent installation the client device is presented with a prompt for credentials as seen below:

Cause

The prompt is due to Location Reporting being enabled within the Agent's Inventory Settings. With the release of EPM 2017.3 location reporting can be used on all laptops/tablets, hardware permitting. This requires opt-in on both the Console as well as an opt-in of at least one enrolled user on the client devices themselves in order for GPS coordinates to be sent to the core. The prompt is displayed to fulfill the opt-in requirement on the client side.

Additional

Location Information can be found within the device's inventory record under Mobile Broadband > GPS Location.

现在报个故障都报不了。   每次报个故障    都要处理大半个月  甚至处理不了。

Any document or guide on the log-in script for bulk agent deployment.

I saw the e-learning link but the video/file might have been removed, had its name changed, or is temporarily unavailable.

Thanks in advance.

E-Learning - Agent Deployment - Login Script

Pushing out the full exe agent from the old core, seems to install ok (using the advance agent would say successful, but never actually install the payload) which is currently causing BSOD on about 10-20% of machines due to faulting softmon process.  It doesn't happen straight away, might go a week or so, then BSOD with a 7f error.

I do have a ticket logged for this but the only answer from the tech so far is to upgrade the core to 2017.3 as this one has a newer version of softmon.  Although we'd like to gain some of the new features from 2017.3 anyway I wanted to see if anyone else has seen this and come up with a quicker fix.

At the moment we have to uninstallwinclient, run the Kaspersky cleaner, we update some drivers/BIOS while we're at it, then reinstall the agent manually.  This is a big headache for us and has halted our plans to migrate our base from 9.6sp3.

Hello,

after upgrading agents to 2017.3, when running inventory scan, many computers experience error  MBBScanner has stopped working.

Event viewer shows the following:

It has not happened on my test machines. So far I have disabled the Scheduled scan, but this is not a solution.

Thank you for any input or suggestion how to resolve this.

Just upgraded to the latest 2017.3 for IEM and there was a new option in SESS for "Enable Agent State Service". I cannot find anything on the community or release notes to detail what this does, but it is enabled by default.

I can tell it added a new item in Inventory, but outside of that nothing. Anyone have any information on this?

So we have tasks that will stay active or working on machines indefinitely.

An example is this machine which is saying working in console but this the process list.. there is no vulscan or sdclient so which process is causing the core to show working or is this another problem? we have many random machines doing this and its not accurate.

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName

-------  ------    -----      -----     ------     --  -- -----------

     63       3     1196       3988              1412   0 armsvc

   1480      32    18528      16604              1080   0 ccSvcHst

     43       4     1432       4412              1732   0 collector

     33       3      940       3272              1760   0 conhost

     33       3      920       3312              2844   0 conhost

     33       3     1196       3308              3732   0 conhost

    823       7     1628       3432               364   0 csrss

     88       7     7216       2308               416   0 csrss

    191       8     3324       7620              3268   0 dllhost

      0       0        0         24                 0   0 Idle

    170       9     2888       8992              2148   0 issuser

     52       4     1208       4200              2044   0 LDRegWatch

    191       7     4308       7624              1548   0 LocalSch

    197      17     9036      17580               824   0 LogonUI

    661      12     3096       8064               524   0 lsass

    196       5     1980       5092               532   0 lsm

    146       9     2852       5492              2504   0 msdtc

    113       6     1716       4412              1636   0 pds

    104       5     2144       6592               360   0 rcgui

    166       9     2372        448              1464   0 residentAgent

    707      16    17316       8976              5380   0 SearchIndexer

    122       7     3896       9280              2836   0 SelfElectController

    260       8     5640       8632               508   0 services

    686      25    16696       9648              2696   0 Smc

     29       1      248        680               260   0 smss

    188       8     7348       8024              1212   0 SoftMon

    305      11     5276       7532              1280   0 spoolsv

    157       3     2096       5016               316   0 svchost

    363       7     3600       7944               644   0 svchost

    265       9     3296       6916               712   0 svchost

    373      10     8108      10452               764   0 svchost

    373      11    43716      48056               852   0 svchost

    575      14     5176       9152               928   0 svchost

    963      22    16660      22840               972   0 svchost

    210      10     9428       9500              1032   0 svchost

    574      18     9756      12668              1160   0 svchost

    319      25     8780       9872              1316   0 svchost

    141       6     3316       5536              1508   0 svchost

    101       7     1644       5120              3136   0 svchost

    111       7     1556       5364              5444   0 svchost

    469       0       52        240                 4   0 System

    152      10     5408       7440              1900   0 tmcsvc

     68       4     1284       4728              3360   0 unsecapp

    293      11     7252      11508              2268   0 vmtoolsd

     77       5      880       2920               408   0 wininit

     96       4     1952       5156               448   0 winlogon

    223       9    11656      13344              2984   0 WmiPrvSE

    189       5     1544       4224              3292   0 WUDFHost

I found that the .exe files in the C: \ Program Files \ LANDesk \ LDClient folder have administrators, guests and everyone permissions.
In my company rules do not allow everyone to be in the permissions files or folders only if the app needs them.
Can everyone be deleted in the permissions. especially on LANDeskAgentBootStrap.exe file?

I am unable to remove an old agent configuration.

I received the following error:

(Agent Name) can't be deleted because it is currently scheduled

I am sure that I have deleted all tasks and packages related to this configuration.

I am using LDMS 9.5 SP1  9.50.1.6159B

Any suggestions would be welcomed.

Thanks in advance

How To:

This article will guide you through how to change agent settings on devices that already have an agent configuration installed. For instance, you'd like to change the reboot agent setting on several devices without creating an entirely separate agent configuration for that group of devices.

Step by Step:

In this example, we will be creating a Change Agent Settings task to change Reboot settings.

1. In Agent Settings, click on the calendar icon and choose Change settings

2. A Patch and Compliance - change settings task window will appear. Scroll down to Reboot settings.

3. Click on Keep agent's current settings. This will bring up a drop down menu.

4. Choose desired Reboot agent setting, then click Save

5. This creates a Scheduled task

6. Drag and drop the desired device(s) into the Change settings task

7. Right click the task and choose Start now

If you would like to verify the change, you can do the following:

1. After the Change settings task has finished, run an inventory scan on the device

2. After the inventory scan has finished, right click on the device and choose Inventory, or double click on the device to bring up Inventory

3. Expand LANDESK Management then expand Agent settings

4. Click on Reboot settings. In the right hand pane you will see the settings that were just applied with the Change settings task