Quantcast
Channel: Ivanti User Community : All Content - Agent Deployment
Viewing all 652 articles
Browse latest View live

How to update Ivanti Agent via Patch Manager

$
0
0

 

Purpose

The purpose of this document is to show you how to update an Ivanti Agent via Patch Manager.

 

Instructions

1. Please create a new agent settings model and ensure that "Ivanti Updates" & "Enable auto fix" boxes at the level of Patch-Only settings > Scan options are both checked within.

 

majagentpatch4.JPG

 

2. Download the latest Ivanti Software Updates definition

 

majagentviapatchmanager.JPG

 

3. Download the latest Patch: Patch and Compliance > Vulnerability > Ivanti Update > Scan > latest SU > double click > latest SU for client > right click > Download Path

 

majagentviapatch2.JPG

 

4. Drag and drop the latest SU downloaded to Autofix (global)

 

majagent3.JPG


Best Practices For Updating Agents With New Settings Or Configurations

$
0
0

 

Purpose

 

This article covers the different ways to update an agents settings. Explanations of the differences between an agent setting and an agent configuration, and best practices for managing agent settings in your environment. This article assumes that you already have agents deployed to your endpoints and that you are looking to update or change configurations on those already deployed agents. This article does NOT cover best practices for updating configurations after installing a new SU. Please see the following document for best practices on updating agents after upgrading to a new SU: How to download and install Service Updates (SU).

 

What is the difference between an Agent Configuration and an Agent Setting?

 

An easy way to think about the difference between those 2 modules is to think of the Agent Configuration as a bucket and the Agent Settings as the contents or items you put into that bucket. When you schedule a change to a machines agent configuration, you are replacing the configuration with a new bucket and contents. When you change a devices agent setting, it is only changing some contents of the bucket. Use agent configurations to initially deploy or change installed Endpoint Manager components and use agent settings to modify how installed Endpoint Manager components operate.

 

What Are Agent Configurations?

Additional information on Agent Configuration can be found at the following link: Working with agent configurations

Endpoint Manager uses agent configurations that you create to deploy agents and agent preferences to managed devices. Once devices have the Endpoint Manager agents on them, you can use agent settings to easily update your agent configuration preferences without reinstalling the agent. However, there are some settings that cannot be updated with an agent settings update. Instead, you need to run an agent configuration update. I will go over what is modified with an agent configuration update and the steps to push that update to the client.

 

To view your current list of all of the agent configurations in your environment Select Tools > Configuration > Agent Configuration:

 

To view what agent configuration is currently assigned to a machine, open the devices inventory and navigate to the following section in the devices inventory:

 

 

There are some settings such as "Never Autofix" and "Never Reboot" that can only be updated with an agent configuration update:

 

Unfortunately there is not an easy out of the box way to view what a devices global autofix and global reboot settings are. This information is in the devices registry and is set to whatever the global settings of the agent configuration was when the agent was installed, or what the global settings were the last time an update to the devices agent configuration was done.

 

We can add a registry entry to be scanned when the machine does a scheduled inventory scan using the following document:

 

How to Verify and Update the Global Autofix and Reboot Settings to Existing Agents

 

I would highly recommend adding that custom data to your devices inventory so you can keep track of the global settings on the clients easily through queries.

 

What Are Agent Settings?

 

Agent Settings control how Ivanti Endpoint Manager services and other components operate on managed devices. These components and their associated settings are deployed to your managed devices as part of the initial agent configuration. These settings can be changed/modified by a separate install or update tasks, and change settings tasks.

 

If a component is installed on a managed device, changes to that component's settings don't require redeployment of the whole agent. Settings are stored as XML files and the managed device only needs an updated XML file to reconfigure how an installed component operates. Changes to a component setting are propagated to all devices with that setting installed automatically.

 

To view your current list of all of the agent settings in your environment Select Tools > Configuration > Agent Settings:

 

 

To view what agent settings are currently assigned to a machine, open the devices inventory and navigate to the following section in the devices inventory:

 

Different Ways To Update An Agent To Use A Different Configuration:

 

Open the Agent Configuration tool in to the console. Right click on the Agent Configuration that you would like to push to a client and select "Schedule update to agent settings". Don't let the name "Agent Settings" fool you, that menu option really means, "Schedule Update To Agent Configuration".

 

This will create a scheduled task that you can add devices to. The task properties should look like the screenshot below:

 

You should not see any "Change Settings" options in this window. If you do, you scheduled a change settings task and that task will not change the agent configuration on the clients. Make sure you are right clicking an Agent Configuration (and not an agent setting!) when you create the update task.

Once you have the devices added to the task, start the task to have the agent update its configuration. Once it reports back a successful return code, you will need to run Vulscan for the machine to pull down the settings for that new agent configuration. This change will occur when the machine does its regular Vulscan scan. You can expedite this change by scheduling/running a Vulscan on that machine.

 

How To Change A Devices Agent Settings:

 

Open the Agent Setting tool in to the console. Click on the "Create a Task" icon and select "Change Settings...".

 

 

Once the scheduled task is created, right click the task and select properties. Here you can change what settings are applied to an agent's configuration. Click on "Keep Agent's Current Settings" to select a different configuration to push to that machine. You can use the Edit/Configure buttons in this window to modify and edit agent settings as well.

 

 

Once your task is configured how you would like, add the devices that you would like to change the settings on and start the task. The machines will run a vulscan /changesettings and pull down those new settings.

 

Recommendations For Agent Configurations/Settings

 

Here are some recommendations that can be followed to help keep your agent settings and configurations organized.

The suggestions below are based off of issues seen in customers environments and are not hardline requirements from Ivanti. Implement these standards at your own discretion.

  • Rename your Agent Configurations when you update to a new SU so that you can easily keep track of what machines have updated and which have not updated to that SU level.
    • For example, my default workstation agent is called "Windows Workstations 2018_1".
    • After I update to SU1, I will rebuild my agent configurations and update the configuration name to "Windows Workstation 2018_1 SU1" to show that the configuration is on SU1.
    • If using this method, you will need to push a configuration update after installing the SU1 update on the client to update the configuration name. If you are reinstalling the agent instead of running the update, it will have the updated name after the install is complete.

  • Add the date to your Agent Configuration Name and change the date in the name when you make major changes to the configuration.
    • In the inventory of the machine, you can only see when the agent was installed, and what the configuration name was when the agent was installed.
    • By adding the date to the configuration name, you can see exactly what agent configuration that was installed on that machine and what date that configuration was finalized.

  • Create a separate PXE Agent in addition to the PXE Enabled Client Connectivity Setting.
    • Sometimes users will only create a PXE Client Connectivity Setting and push that agent setting to the devices they want to be PXE reps.
      • While this does work, it is best to create a separate PXE Agent Configuration so that the PXE Enabled setting does not get overwritten when the agent in reinstalled or if someone pushes an agent configuration update to that PXE representative.

 

  • Create detailed names for your agent settings so that the settings are easy to distinguish at a glance.
    • You can add identifiers like Server, Workstation, Executive, End User, Location, and dates to the name to help identify the settings easily.

 

  • Create backups of your agent executable (and advanced agent MSI's) by periodically creating self contained exes in a backup folder. This is especially important if you are implementing a limited release SU in your environment.
    • if any issues occur with the SU and you need to rollback to an older agent (from before the SU) you can use the backup agent exes and

Self-contained agent installer fails on servers after updating to 2018.1

$
0
0

My team is currently in the middle of upgrading to EPM 2018.1 from LDMS 2016.  We are unable to get the self-contained agent installer to run on our servers.  We had a problem with our workstations where deploying the updated agent would uninstall the previous version but wouldn't install the new version  On the servers it looks like the Agent Configuration Utility starts to try to run but it will inevitably stop responding.  Has anyone else had this issue after updating?  We tested the upgrade in a test environment and didn't have any issues with installing the updated agent on the machines in our test environment.  Although our test environment didn't include any servers.

Change default icon for Portal Manager

$
0
0

I have just upgraded the core server to 2017.3 and will be pushing out the updated agent.  I am planning on including Portal Manager with the agent, but want to do a bit of customization. 

 

I have been through the Portal Manager agent settings and testing this out on my development server.  Changing the "Taskbar icon" shows what I want it to look like on the taskbar when I preview it.  But, when I save the changes and push it out to a client, the original icon will appear on the taskbar when the Portal Manager is launched.  Also, the icon for the desktop shortcut remains the original one.

TaskbarIcon1.png

Default Icon1.png

PM-Preview.png

PM-Default icon.png

 

I have done an agent uninstall with /forceclean and reinstalled the agent from the core with wscfg32.exe, but no joy.

 

How can I get this to push out the agent settings the way I want them?  Also, does changing the taskbar icon also change the icon of the shortcut that gets put on the desktop?

 

Thanks.

Ivanti Endpoint Security by Heat Agent Linux error

$
0
0

Hello community,

Unable to install the Linux Agent on a CentOS 7.5.

Have you ever encountered this kind of problem?

Here is the error log.

 

 

./install -silent -d /opt/cheops -p http://XXXXX -sno XXXXXXXX -g "XXXXXXXX"

 

 

Installing HEAT PatchLink Agent 8.3051

Copyright (c) 2015 HEAT Software USA Inc.

 

Performing tests for Silent install...

Checking Group List

Silent installation tests successfully completed.

Expanding archive...

Exception in thread "main" java.lang.ExceptionInInitializerError

        at com.patchlink.deployment.Register.registerMain(Register.java:108)

        at com.patchlink.deployment.Register.main(Register.java:46)

        at register.main(register.java:7)

Caused by: java.util.MissingResourceException: Can't find bundle for base name patchagent, locale en_US

        at java.util.ResourceBundle.throwMissingResourceException(ResourceBundle.java:1507)

        at java.util.ResourceBundle.getBundleImpl(ResourceBundle.java:1330)

        at java.util.ResourceBundle.getBundle(ResourceBundle.java:804)

        at com.patchlink.deployment.InstallLib.<clinit>(InstallLib.java:16)

        ... 3 more

cp: cannot stat '/opt/cheops/patchagent/update.conf': No such file or directory

grep: /opt/cheops/patchagent/update.conf: No such file or directory

 

ERROR: The HEAT PatchLink Agent files were properly installed to /opt/cheops but did not register successfully.

Please check the serial number and hostname for errors.

 

 

Thank you for your feedback.

Real time inv and mon in a workgroup

$
0
0

I have an issue with some workgroup machines - Agent is down, I can remote control deploy etc all is well except the real time inventory and monitoring.

 

If i launch this from the core by right clicking a machine i am asked for credentials... we already have the local admin account listed in the scheduler service along with other accounts.. I am at a loss though as to where to add an account to stop real time Inv prompting for creds?? Any ideas anyone?

2018.1版本的LANDesk,MAC USB禁用管控策略不起作用,请问怎么解决

$
0
0

2018.1版本的LANDesk,MAC USB禁用管控策略不起作用,请问怎么解决

Real time inv and mon in a workgroup

$
0
0

I have an issue with some workgroup machines - Agent is down, I can remote control deploy etc all is well except the real time inventory and monitoring.

 

If i launch this from the core by right clicking a machine i am asked for credentials... we already have the local admin account listed in the scheduler service along with other accounts.. I am at a loss though as to where to add an account to stop real time Inv prompting for creds?? Any ideas anyone?


agent installation always in Pending status

$
0
0

Hi guys,

 

I'm new to Ivanti (ver. 11.0.0.164) and I need assistance understanding why an agent deployment is stuck on Pending state for some computers I added after the device discovery.

I've already been able to install the same agent to other devices, and I didn't do any change in the configuration.

Here are the steps I did:

 

1- cleared every device in the UDD and "Pending unmanaged client deployments"

2- launche a new scan for the subnet, found several devices

3- dragged the 3 devices I need to install the agent on to the scheduled task for the Agent installation (default windows agent)

4- started the task

 

The installation doesn't work at all, it's just stuck on Pending with no error or messages of any type.

I tried to ping, inventory, check the services (Agent Pending Install state ) and they are all running.

I can't check the Network Discovery on the client because I'm working remotely, but I think this is not the issue.

 

Can you give me a hint please?

Deploying EPM Agent via existing Software Distribution

$
0
0

Hello fellows,

 

First I will describe our Background:

we are starting to integrate the EPM 2018.1 for our company.

90% our Devices are Macintosh and this will be our crucial Clients.
Core Server + Console are fully set up and the first Client is in it via manually deploying our costum Agent.
We got the .pkg from the storage location \Program Files\LANDesk\ManagementSuite\ldlogon\mac.

With this .pkg we are going to create a Software Package and we are about to deploy the Agent via ivanti LANrev (our current Device Management Software) to our second test Device.

 

Now the Problem:
The ivanti EPM Agent is installed fully, but it will not take connection to the Console.

The Testdevice is still on "Unmanaged Devices".

 

Is there anywhere a mistake I´ve made?

 

 

Thanks for any help.

 

Kind Regards,
Mathias

Active Working Jobs which process?

Installing an agent on a full custom built PC returns information such as 'Manufacturer' = System Manufacturer & 'Model' = System Product Name.

$
0
0

Installing an agent on a full custom built PC returns information such as 'Manufacturer' = System Manufacturer & 'Model' = System Product Name. I understand with it being a custom build that this information is not available, but is there any way to standardize this so that it comes up with a custom value that we set? The problem with it coming up with this information means it is not importing into our HEAT Service Manager CI location which we also use to manage devices. Any help would be appreciated.

Erreur lors de la création d'une requête

$
0
0

Bonjour,

 

Lors de la créa@tion d'une requête je n'ai que l'onglet "ordinateurs" dans l'onglet des composants.

 

Cordialement.

Issue: Windows 10 Upgrade Leaves OS in Non-Functional State

$
0
0

Problem

 

After upgrading Windows 10 to the latest version, the Windows Defender Firewall is corrupt and unable to be configured. You may see the service starting and stopping.

When in this state, the Microsoft store applications (MSstore, calendar, mail, etc.) are unusable. The start menu is also unusable until after a reboot.

 

Cause

 

This is caused by softmon.exe and its' spyware blocking functionality configured while Windows is trying to upgrade.

 

Solution

 

After Upgrade

 

  1. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters\AppCs
  2. Open Security properties of that key and add "NT Service\MpsSvc" with Full Control.
  3. Reboot.

 

The firewall should be running and manageable at that point, which should restore most other functionality.

 

Before Upgrade

 

Disable/uncheck the box for Real-Time Spyware Blocking: Tools>Configuration>Agent Settings>All Agent Settings>Security>Other Security Settings>Properties of settings used>Spyware>"Enable real-time spyware blocking"

 

spywareblocking.png

 

Push out Change Settings task to update the Other Security Settings: Tools>Configuration>Agent Settings>Create a Task>Change Settings...

 

changesettings.png

 

After the clients get this update, they should be ready to upgrade Windows 10.

 

Troubleshooting Agent Installs

$
0
0

Scope

This document is intended to help you to narrow down or resolve agent installation problems in general.

 

Assumptions

You should have a basic understanding of how to create and push out LANDESK agents, and how to use the LDMS core.

 

Here are some basic troubleshooting questions and steps that will help you to narrow down the error(s) that you are seeing

 

Does the problem you are seeing happen on all systems across the board or just a few of them? Have you tried to run the same task on a fresh VM or PC to see if the issue still exists? If the problem happens on all devices and or fresh VM's or PC's then it is most likely an issue with the agent installation files on the core, and you should look at them more closely. Specifically, you should look at the following files on the core in the \ldlogon folder;

 

"Put your Agent Name Here".msi

"Put your Agent Name Here".ini

 

You can open, view, and edit the agent.ini file with your favorite text editor, I like notepad++. The agent.ini file will show you all of the configuration options that this agent will install with, so open it and make sure that it has the correct options. You could compare it to another agent.ini if you have one that is working and one that isn't.

 

You can open the agent.msi to see if everything looks good. When you are having problems, it is good to compare the agent.msi with the problems to one that is known to have succeeded. To view the agent MSI you will need an MSI editing tool, I like to use Orca from Microsoft.

 

Typical size for an agent.msi is about 310KB and anything smaller could indicate a problem. Most of the important actions will be stored in the CustomAction section of the MSI.

Orca.JPG

 

If you suspect problems with any of these core side files you could do a "Rebuild All" task from the core. This should rebuild all agent configurations including the agent.msi and agent.ini files so you should see the date and timestamp change for these files in the ldlogon folder.

 

RebuildAll.JPG

 

If a rebuild all task is still not doing the trick you may want to try a rebuild all from a CMD prompt. In some rare cases we have seen issues with "Rebuild All" from the console so running this from a command prompt might help you.

To rebuild all from a command prompt, go to the \LANDesk\ManagementSuite folder, and run this command: CreateClientConfiguration.exe /rebuild

 

rebuild.JPG

 

Note -- Check to see that the ldlogon directory on the core has updated time stamps for these files after doing the rebuild. If you see files that are NOT updating then rename the originals to *.OLD and then run the task again, new ones should be created.

 

If you are pretty confident the files on the core look good then let's move on to the client:

 

Right after you start the task on the core go to client and look for a $lddir$ or $ldcfg$ folder that gets created on the root of the C drive. If you don't ever see this share get created then most likely you have a communication or sharing problem. If this is the case verify the following;

 

a. Can you ping from the core to the client and the client to the core?

b. Does the hostname resolve to the correct ip address?

c. Does the scheduler user that is configured in the core have rights to that box? Remember an agent push task is ran by the scheduler service in the core. If this is on a domain it is usually best to make this account a domain admin.

e. Check that "Simple File Sharing" is enabled on the client.

 

As a test you could login to the core with the same user that the scheduler service is using, and try to map a drive to \\clienthostname\C$.

 

Moving on, if the core files look good, and you see the shares being created, then you will need to look at the agent install logs to see where it is failing.

 

The agent install logs would be in any of the following locations depending on how the task is being run;

 

Windows\Temp folder

%temp% folder

LDClient folder

 

Below are the key logs to look at. Note that these are NOT all of the logs, and in some cases you may need to look at others, but these are most likely to have problems.

 

agentmsi.log (the log file for the agent.msi)

wscfg32.xlg (the log file for the agent installer wscfg32.exe)

 

If the agent.msi has a problem, double check your agent.msi looks good on the core. You could also copy the agent.msi manually from the core and launch it manually from the client with the showui switch to see if the Windows installer is broken on your client. If your xlg log has errors then you may need to involve support for further help, or search the community for your specific error.

 

Additional quick troubleshooting tips:

 

Build a self-contained agent on your core and copy it to the client and manually run it. Does it work? If so then that will at least prove that the files in THAT exe are good. Be sure that the self contained EXE that you are using is current, if you are using a 2 year old exe then it will not have the same files that you are trying to push the agent with.

 

Does the client you are trying to install the agent on already have a LANDesk agent? If it does, as a test you may want to run the UninstallWinClient task on it, followed by another install attempt to see if the issue only occurs during the agent upgrade.

Follow this article for more on UninstallWinClient: How to uninstall the LANDesk Agent

 

Prior to running the agent install task, verify the Device Name is correct for the device(s) you are attempting to install to: Agent install fails because UDD didn't discover host name correctly

 

Verify UAC is turned off

 

Try installing the agent on a different OS? Maybe your issue is only related to a certain OS. Note that you need to build a separate agent configuration for Windows Server OS's, Windows OS's, and Windows Embedded OS's (WES).

 

Use Process Explorer and Process Monitor tools available from microsoft to diagnose problems. These should run on the client when the install is happening and could be monitored to watch the progress.

 


Issue: Unable to delete agent configuration because it is currently scheduled.

$
0
0

Environment

 

This should work in LDMS 9.5 and 9.6. It is assumed you are running MS SQL and have something like SQL Server Management Studio to run queries.

 

 

Problem

 

When trying to delete an Agent Configuration, a warning occurs indicating it is currently scheduled. The Agent Configuration is unable to be deleted.

 

1-error.png

Old LDMS Agent can't be deleted because it is currently scheduled.   

 

 

Cause

 

The Agent Configuration exists as part of a scheduled task. While it is associated with a scheduled task, it will be locked and unable to be deleted.

 

 

Solution / Workaround

 

Locate the Scheduled Task and delete it.

 

If you are unable to locate the Scheduled Task that is associated with the Agent Configuration, the following SQL Query can be ran to get a list of Scheduled Tasks that are utilizing the Agent Configuration. Once the Scheduled Tasks are identified, they can be deleted to release the lock on the Agent Configuration.

 

Query to show all Scheduled Tasks that correspond with an Agent Configuration

 

select t.ld_task_idn, t.task_name,tc.ld_Task_config_idn,tc.cfg_name, cc.Name
from LD_TASK t    join LD_TASK_CONFIG tc        on t.LD_TASK_CONFIG_IDN = tc.LD_TASK_CONFIG_IDN    join ClientConfig cc        on tc.CFG_NAME = 'AgentConfig ' + CAST(ClientConfig_idn as nvarchar)   

 

 

Query to find Scheduled Tasks for a specific Agent Configuration. In this query replace <INSERT AGENT CONFIG NAME HERE> with the name of the Agent Configuration in desired.

 

select t.ld_task_idn, t.task_name,tc.ld_Task_config_idn,tc.cfg_name, cc.Name
from LD_TASK t    join LD_TASK_CONFIG tc        on t.LD_TASK_CONFIG_IDN = tc.LD_TASK_CONFIG_IDN    join ClientConfig cc        on tc.CFG_NAME = 'AgentConfig ' + CAST(ClientConfig_idn as nvarchar)
where tc.cfg_name like
(    select '%' + CAST(ClientConfig_idn as varchar) + '%'    from ClientConfig    where name like '%<INSERT AGENT CONFIG NAME HERE>%'
)   

 

Example: This example shows the query looking for any Scheduled Tasks for our 'Old LDMS Agent' configuration, and shows it is in use by the Scheduled Task called 'Deploy the 2007 Agent'.

 

2-results.png

Local Scheduler and being aware of time creep

$
0
0

 

I – Introduction

 

The LANDesk Local Scheduler is a very powerful client-side component that is very popular and sees wide usage.

 

Yet at the same time, it is one of the most easily misunderstood components of the LANDesk Management Suite. The effects of such misunderstanding can range from being a negligible matter to being of serious impact indeed. Not to make too fine a point out of it - it is theoretically possible to configure your tasks in such a way as to ensure that they will never – EVER – run. Or, respectively, run without end.

 

With the Local Scheduler being such a powerful tool, informed caution is well advised. However, the focus here is not in cautioning, rather it is to inform, to educate.

 

This article aims to clarify one of the most commonly misunderstood processes of the Local Scheduler, and bring to attention the importance of using time-filter constraints – particularly in bandwidth/timing-sensitive environments.

 

That frequently misunderstood process is the timing and repetition of tasks.

 

II – Local Scheduler basics – how to read local scheduler tasks:

 

There are primarily two ways to read data concerning Local Scheduler tasks.

 

The first (covered in II.A) is centrally – on the Core, as part of a clients’ inventory. The second (covered in II.B) is to generate an output-file locally on the client itself which can then be read in your text-editor of choice.

Both are quite viable. Both are demonstrated here, as certain situations may call for one (or the other) to be more convenient or more effective when querying a client directly.

 

II.A – How to find/list Local Scheduler tasks on a Core:

For several versions now, LANDesk has been reporting all Local Scheduler tasks into inventory, and this information (individual to each locally scheduled task) can be found in any devices’ inventory as shown in the screenshot below.

 

In the screenshot below, the *RED* section serves to guide where in inventory this information can be found, whilst the *BLUE* square indicates the properties/details of that particular local scheduler task.

 

Core_Local_Sched_Tasks_Modded.JPG

The meaning of the various task details will be discussed and clarified further below (in section II.C - HERE ).

 

II.B – How to find/list Local Scheduler tasks on a Client:

 

NOTE: To get an output of local scheduler tasks into a text file run the following from the LDCLIENT-directory (By default – "C:\Program Files\LANDesk\LDClient\" or - for 64-bit systems - "C:\Program Files(x86)\LANDesk\LDClient\" ).

 

Localsch.exe /tasks >mytasks.txt

 

 

Client_LocalSched_Tasks_Modded.jpg

 

II.C – What do those terms (handler, filter, frequency, etc.) mean exactly?

Some parts of a Local Scheduler task may be more intuitive than others – as a result, I will go through the various sections, and have highlighted the crucial bits of information in colour-code so as to match the screenshot presented in II.B.

 

II.C.1 – A complete Local Scheduler task

This is simply a “complete” Local Scheduler task entry from beginning to end. In the output-file, the separation can be simply done by the listed number in the first space of an entry.

 

II.C.2 – The task handle

This is a unique identifier for a task, which is used when a particular task needs to be deleted or modified, for example.

Certain task ID’s are treated as reserved (and task ID below 1,500 should be regarded as reserved), with “normal” user-generated tasks usually having six digit handles (so as to better separate them from “reserved” tasks).

One of the reasons we start with such high, six-digit numbers is to prevent any problems with legacy clients, where smaller numbers were used.

 

II.C.3 – The task frequency

The task Frequency is based on the number of seconds between repetitions of a task. Most tasks have a value of either 3600 (1 hour) or 86400 (1 day) as a frequency, but any sensible positive value is acceptable.

 

IMPORTANT NOTE– don’t panic when you see a frequency of “1” in the screenshot above. That particular task has got an additional filter (see below) that activates the task only when the IP-address changes.

 

II.C.4 – Task Filters

Task Filters are additional conditional clauses you can attach to a task to give you more control under which conditions a task is run. Most commonly this is a filter based on the time of day (i.e.: “only run between the hours of 01:00 – 04:00).

 

It is important to point out here that filters are purely based on the CLIENT’S perception of things – i.e. its own local system clock, and so on.

 

Additional filters such as “on IP change” or “when no user is logged on” are also popular, and for a full list, I would recommend that you go through the Local Scheduler task UI (In “Manage Scripts”, you can create Local Scheduler tasks) to get a taste for what is possible. The screenshot below should hopefully help with any remaining confusion on where this is.

 

LocalSched_CreateTask_Modded.JPG

 

Note:ALL filters must be true for a task to run. There’s a distinct AND logic here, and a task will not run until ALL filters’ conditions are satisfied.

Therefore, be thoughtful when applying filters. Ask yourself if this is what you truly want, what you truly need – it’s a simple enough thing to misconfigure oneself and end up in an undesired state.

Local Scheduler will do EXACLY as it is configured to by you, not necessarily as you intended!

 

II.C.5 - A “bad” example of using filters:

 

Since a task will ONLY trigger when ALL of its filters are true, let’s demonstrate how one can use filters badly, so as to never have a task running.

 

If you were to configure a task to run between 02:00 and 04:00 in the morning, and have an additional filter that REQUIRES a user to be logged in but this ends up being a condition that is never met (as people may not work in such late/early hours), you would end up with a task that never runs.

 

 

III – Task reruns and “the time creep”:

The most common misconception in relation to Local Scheduler is that the frequency of a task is based upon its START-time. In other words. – if a task is set to start at 10:00 on day 1, the expectation is that it will always start at 10:00, assuming a frequency of 1 day (86,400 seconds) is used.

 

Little could be further from the truth!

 

In fact, the frequency kicks in based on when a task has last FINISHED! So - if a task starts at 10:00, then has a 15 minute long random delay (10:00 => 10:15) and a 10 minute long runtime (10:15 => 10:25), the 1-day delay will apply to the end-time of 10:25.

 

This “time creep” is something of which you should be aware, as this will inevitably send tasks spiralling throughout all possible times. This is particularly likely if you’re combining long-running tasks with large, random time windows.

 

The best way to counter-act this is by confining tasks to run in a certain time-window. This shouldn’t be used too narrowly, as a long-running task with a narrow time window will cause loss of days very quickly.

 

As an example, the following table shows what can happen to a task with the following settings:

• Task must run between 10:00 and 11:00

• Task has a random delay of 0-60 minutes

• Task has a runtime average of 10 minutes

 

Running Day #Start TimeRandom DelayDurationEnd TimeNext Effective Start
Day 1 (Start of the task)10:0015 mins (Runs at 10:15)10 mins10:25Day 2 - 10:25
Day 210:2527 mins (Runs at 10:52)10 mins11:02Day 4 - 10:00
Day 311:02  ** N/A---------Day 4 - 10:00
Day 410:0040 mins (Runs at 10:40)10 mins10:50Day 5 - 10:50
Day 510:5035 mins (Runs at 11:25)10 mins11:35Day 7 - 10:00
Day 611:25 ** N/A---------Day 7 - 10:00

 

** Notice that we do NOT run the task on day 3, nor on day 6.

 

This is because 11:02 (Day 3) // 11:25 (Day 6) is ‘outside’ the TOD (Time Of Day) filter set to run the task between 10:00 and 11:00. What happens now is that whilst the task is “active”, we check every 20 seconds (default) to see if the filters are all OK. In other words, we wait until 10:00 am the next day to run/start it again.

 

IV - An Important clarification on START TIME:

 

* A task is deemed to have started as soon as its random delay kicks in. It doesn’t matter if the random delay pushes the task outside the time-constraint boundary (such as 11:25 for instance, in the above example, on day # 5). The task STARTED in the acceptable time-boundary, and the random delay is not deemed a factor here.

 

* A task that will END outside of the acceptable time-frame (such as 11:02, as on day # 2 in the above example), will still be checked on the next day for running conditions. However, since – in the above examples – there’s a constraint for a task to run from 10:00 to 11:00, the task will idle with the Local Scheduler continuously checking whether all filters can be satisfied.

 

* In this example, this is true on day # 4 at 10:00, since the task “started” (but was not LAUNCHED) on day 3 at 11:02 as the 10:00 – 11:00 filter was not satisfied … so the task was continuously active for just under 23:00 hours for all filters to be satisfied and finally being successfully launched.

 

* It is for this reason that one should be mindful not to use too many filters for a single task. The more filters that are used, the more conditions need to be simultaneously met, thus increasing the chances that one ends up with a task that will never run because all of the filter conditions CANNOT ever be all true at the same time.

 

IV – Conclusion:

With the information provided in this article, the reader should be more informed about some key points when using the Local Scheduler. It should be clear why task filters should be used with care, and why particularly the “Time Of Day”-filter is an important utility in overcoming the time-creep issue.

Agent Return Codes

$
0
0
Return CodeStatusResultMeaningRelated Articles

0

Not Specified
2Failed

The system cannot find the file specified.

401FailedFailed: Another instance of the agent is running.
424Agent cancelled by user.This is a confirmed defect for LDMS 9.0 SP2Re: 'Agent Cancelled by User' - Return code 424
457DoneRemoving LANDESK HIPS succeeded.
458FailedRemoving LANDESK HIPS failed.
1026

Problem remotely executing the agent

For Mac verify credentials. Check raxfer.log for errors ssh to the machine

1074ActiveDistributing package…Deployment in progress.
1076selected delivery method and /or packages require features that are not provided by the agent installed on this target
1081FailedAn error occurred while copying the agent software.

Drive full/lack of space on client

IPCheck Fails (nslookup, if IP's do not match, ipconfig /registerdns on client)

1082ActiveThe agent software was copied.Deployment in progress.
1083FailedThe agent setup program returned an error.Failure during the install, search wscfg32.xlg for FAILED
1084The agent setup program ran successfully.Deployment in progress.
1086The agent setup succeeded and is now rebooting.Deployment in progress.
1087FailedUnable to contact the specified machine.  The machine may be off or unreachable.The user account for the LANDESK Scheduler service does not have administrator rights on the client computersAgent Deployment Results in error: "Unable to contact the specified machine" 1087
1110Off/FailedCannot find agent. Task should still be activeDevice offline or is not accessible via the network. No agent currently installed. Task should still be active
1165FailedThe agent setup program started but communication is lost.
1166DoneSuccess, reboot required.Deployment in progress.
1205FailedCould not copy to/from clientNo admin rights to copy/install
1208FailedAn internal error occurredLANDESK Scheduler Service login does not have admin rights on the destination device
1352ActiveMachine was successfully discovered.Deployment in progress.
1895FailedCBA 8, the connection was not authorized.refusing authorization to store unknown host-keyAgent Return Code 1895, CBA 8 The connection was not authorized.
18946Failedunable to create tmp file

To resolve the issue, deleted the files in the following temporary directories:

1. \Windows\temp

2. \Users\<user account for scheduler service>\AppData\Local\Temp

18945FailedFailed to build the agent installation package.Failure opening file to be stored in cabinet

Advance Agent installation via GPO fails with 80004005

$
0
0

Description

While deploying the Advance Agent MSI file via a GPO, the LANDesk Agent does not install. However, if the EXE file is started manually the installation succeeds.

Within the AdvanceAgent.log in the windows\temp directory, there are lines with “Attempting to download file” and “returned 80004005”.

Cause

Installing the AdvanceAgent via the MSI file is a two phase process. First the MSI installs an AdvanceAgent Service which then tries to pull the full installation (aka the EXE) and the starts the EXE do fulfil the installation.

The 80004005 means  “Access Denied” to the share where the EXE file is located. But checking the permissions on the share shows that “everyone” does have read access.

Solution

The AdvanceAgent Service is running as “local system account”.  So the Access to the server share is denied.

To solve this, “domain computers” have to be added to the permissions of the share to have read access. Now the AdvanceAgent Service should be able to pull the EXE and finish the installation of the agent.

LANDesk agent installation fails due to error caused by ClientSideEnableWOL.vbs

$
0
0

Problem

While installing the LANDesk agent, the installation process fails while installing the LANDesk Power Management component. The installation halts while executing the ClientSideEnableWOL.vbs script.

 

DOC-24090.png

 

 

 

Cause

Corrupted Windows Management Instrumentation (WMI) engine on the target machine.

 

 

 

Resolution

The script in question (ClientSideEnableWOL.vbs) leverages the WMI technology to enable necessary settings on the target machine. Follow these steps in order to repair WMI:

 

1) Download Microsoft's WMIDiag utility from this location: http://www.microsoft.com/download/en/details.aspx?id=7684

2) Execute the WMIDiag utility on the affected machine

3) Attempt to install the LANDesk Agent once again.

 

 

 

Applies To

LANDesk Management Suite 8.8

LANDesk Management Suite 9.0

Viewing all 652 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>