Patch Management Upgrade Validator

This tool examines the Notification Server database to determine if are any issues that require addressing before an upgrade can occur. In "Analyze" mode, the tool makes no attempt to remediate issues and makes no modifications to the database.

The tool restricts its reporting to the internal state of the Notification Server and Patch Management solution. The results do not contain any information identifying vulnerabilities in individual machines or groups of machines.

Download the latest Validator tool HERE.

It's safe for PM 6.1 and 6.2 to be used and fix any reported errors

How to view codebases returned to the Altiris Agent through getpackageinfo.aspx request

Answer

When the Altiris Agent is required to download a package it will request the appropriate codebases from the Notification Server through getpackageinfo.aspx. The information returned from getpackageinfo.aspx is ultimately stored as the package.xml on the client computer under 'Program Files\Altiris\Altiris Agent\Software Delivery\<package GUID>'.

For example, a client computer will show the following in the logs during the getpackageinfo.aspx request (when trace logging is enabled on the client computer):

Date: Nov 08 14:23:41:011
Source: AeXNetworkTransport
Description: GET:
url=http://ns-03/Altiris/NS/Agent/GetPackageInfo.aspx?xml=<request resource="{89782D60-FFA1-487A-B4BA-38E909ABB6DF}" version="1" type="codebases" compress="1" totalTime="0">
<packages>
<package guid="{8661D7F2-039B-4418-9A0A-70A9C7445F9C}"/>
</packages>
<addresses>
<address ip="192.168.0.104"/>
</addresses>
</request>

The IIS logs on the server record the following:

2005-11-08 21:23:41 192.168.0.104 GET /Altiris/NS/Agent/GetPackageInfo.aspx xml=%3Crequest%20resource=%22%7B89782D60-FFA1-487A-B4BA-38E909ABB6DF%7D%22%20version=%221%22%20type=%22codebases%22%20compress=%221%22%20totalTime=%220%22%3E%0A%3Cpackages%3E%0A%09%3Cpackage%20guid=%22%7B8661D7F2-039B-4418-9A0A-70A9C7445F9C%7D%22%2F%3E%0A%3C%2Fpackages%3E%0A%3Caddresses%3E%0A%09%3Caddress%20ip=%22192.168.0.104%22%2F%3E%0A%3C%2Faddresses%3E%0A%3C%2Frequest%3E%0A 80 - 192.168.0.104 - 200 0 0

To view the codebases in your browser, take the IIS log entry and make the following changes:

1. Replace the space between getpackageinfo.aspx and XML with a question mark.
2. Remove the section referring to compress=%221%22 (highlighted in red below).
3. Complete the URL by adding 'http://server_name' at the beginning of the line.

Before:

/Altiris/NS/Agent/GetPackageInfo.aspx xml=%3Crequest%20resource=%22%7B89782D60-FFA1-487A-B4BA-38E909ABB6DF%7D%22%20version=%221%22%20type=%22codebases%22%20compress=%221%22%20totalTime=%220%22%3E%0A%3Cpackages%3E%0A%09%3Cpackage%20guid=%22%7B8661D7F2-039B-4418-9A0A-70A9C7445F9C%7D%22%2F%3E%0A%3C%2Fpackages%3E%0A%3Caddresses%3E%0A%09%3Caddress%20ip=%22192.168.0.104%22%2F%3E%0A%3C%2Faddresses%3E%0A%3C%2Frequest%3E%0A

After:

http://server_name/Altiris/NS/Agent/GetPackageInfo.aspx?xml=%3Crequest%20resource=%22%7B89782D60-FFA1-487A-B4BA-38E909ABB6DF%7D%22%20version=%221%22%20type=%22codebases%22%20%20totalTime=%220%22%3E%0A%3Cpackages%3E%0A%09%3Cpackage%20guid=%22%7B8661D7F2-039B-4418-9A0A-70A9C7445F9C%7D%22%2F%3E%0A%3C%2Fpackages%3E%0A%3Caddresses%3E%0A%09%3Caddress%20ip=%22192.168.0.104%22%2F%3E%0A%3C%2Faddresses%3E%0A%3C%2Frequest%3E%0A

Another solution from AKB#1070 (modify IP address and Package Guid as needed):

http://<notification server>/ALTIRIS/NS/Agent/GetPackageInfo.aspx?xml=<request resource="{1675E076-73CA-4CDD-BAD8-7130435F447E}" version="1" type="codebases"><packages><package guid="{01B54EB5-3679-4C73-9E10-E169D5A5EC59}"/></packages><addresses><address ip="10.50.104.82"/></addresses></request>

DAgent synchronizes the system clock when the option is not enabled

Problem/Symptoms

Even when the option to synchronize time with the Deployment Server is not checked, the DAgent will still synchronize time with the Deployment Server.

In WinPE 2.1 automation, the DAgent sets the hardware clock to a time that is not synchronized with the Deployment Server.

---

Cause

The cause is currently being investigated by Symantec

---

Resolution

A resolution is currently being investigated.  A possible workaround until this is resolved is to use AClient instead of DAgent.

How to preform a hard disk wipe using the Ghost utility called GDisk.

When reallocating hardware from one person to another, it is often important to ensure that none of the old data from the hard disk can be retrieved, even after deploying a new imaging to the computer.

The GDisk utility (one of the Ghost tools shipped with Deployment Solution 6.9 SP1) is a multipurpose disk management utility that includes a secure disk wiping feature. GDisk’s secure disk wiping feature wipes data according to the U.S. Department of Defense (DoD) 5220.22-M standard. According to this standard, the following group of operations is performed six times:

• All addressable locations on the hard disk are overwritten with 0x35.

• All addressable locations on the hard disk are overwritten with 0xCA.

• All addressable locations on the hard disk are overwritten with a pseudorandom character.

• All addressable locations on the hard disk are verified in hardware using the Verify Sectors command to the disk.

Running GDisk to Securely Wipe a Disk

GDisk can be run from a DOS (GDisk.exe), WinPE (GDisk32.exe or GDisk64.exe), or Linux (Gdisk) pre-boot operating system using the following syntax:

gdisk disk /diskwipe /dodwipe

The following table explains the GDisk command-line elements.

Element	Description
gdisk	The Gdisk executable used, such as GDisk.exe (for DOS) or GDisk32.exe (for WinPE).
disk	The physical disk to be wiped. Replace disk with a number between 1 and 128.
/diskwipe	Instructs GDisk to perform a disk wipe.
/dodwipe	Instructs GDisk to perform the required wipes meeting the DoD standards.

Example: gdisk.exe 1 /diskwipe /dodwipe

This command runs the DOS version of GDisk and wipes the first drive using the DoD standards.

Sample Symantec wipe disk jobs ships with Deployment Solution and can be found in the Samples job folder.

How to discover missing drivers for DeployAnywhere.

To determine if your DeployAnywhere database has the drivers needed for a particular computer, start the computer in question using WinPE and run the following DeployAnywhere command:

ghdplyAw32.exe /target=c:\Windows /ddb=DriversDB /eval

If a mass storage or NIC driver is missing, a list of the missing drivers is displayed on the screen and are also stored in a text file named ghDplyAw.txt.

This discovery process can be automated using a Deployment Run Script task (configured for WinPE) using the following in a Deployment Run Script task:

cd \Ghost

ghdplyAw32.exe /target=c:\Windows /ddb=\DriversDB /eval

Important: The previous task only works if the SmeUtil.sys driver is in the \Windows\System32\Drivers folder of WinPE. This driver is found in the Ghost folder in your Deployment Share. It can be added to the WinPE automation during the creation or editing process by right-clicking the Drivers folder and selecting

Add File.

As an alternative, the SmeUtil.sys driver can be copied by adding the following command to your run script task:

Copy %ALTIRIS_SHARE%\Ghost\SmeUtil.sys %SystemRoot%\

System32\Drivers

Download Snapshot failed: HTTP error: 404 Not Found (-2147209951) when attempting to download packages

Problem/Symptoms

When attempting to download a package through an IIS-enabled Package server, the following error messages are seen in the Altiris Logs:
Priority: 1
Date: 9/18/2008 2:03:18 PM
Tick Count: 26759250
Host Name: ------
Process: AeXNSAgent.exe (4744)
Thread ID: 1648
Module: AexPackageDelivery.dll
Source: PackageDownload
Description: Download Snapshot failed: HTTP error: 404 Not Found (-2147209951)

and

Priority: 1
Date: 9/18/2008 2:03:18 PM
Tick Count: 26759250
Host Name: ------
Process: AeXNSAgent.exe (4744)
Thread ID: 1648
Module: AexPackageDelivery.dll
Source: PackageDelivery
Description: Error while downloading package: HTTP error: 404 Not Found (-2147209951)

---

Environment

Notification Server 6.0 SP3 R7

IIS-enabled Package Server

---

Cause

In This case, the client computers were unable to generate their package snapshots becuase Active Server Pages were not enabled in IIS on the package server.

---

Resolution

To resolve this, we:

1) Checked the snapshot file in the GUID Folder on the Client and found that it was unable to generate a snapshot.

2) We checked the IIS logs on the Package Server, and found that the client was receiving 404 errors when it was attempting to generate its snapshot.

3) We Enabled Active Server Pages in the IIS Manager on the Package Server, and the client was then able to generate its snapshots. This is found in the IIS Manager under 'Web Service Extensions' in the main menu tree.

Altiris licensing technical FAQ

Applies To

• Inventory for Windows 6.0, 6.1
• Notification Server 6.0
• Patch Management 6.1, 6.2
• Software Delivery

---

Question

How does Altiris licensing work for Notification Server based products?

---

Answer

Overview

This article discusses licensing for each of the Altiris Notification Server based solutions:

• How a license is consumed.
• What happens when the license count is exceeded.
• What happens when a time limited (demo/install) license expires.
• What happens when the Automatic Upgrade Protection (AUP) expires.
• How to recover a solution license (retirement vs. deletion).
• Anomalies in expected functionality.

Inventory Solution for Windows

• License consumption—A license is consumed after the Notification Server has received the first posted software inventory data from a managed computer. A license is not consumed from the existence of the inventory solution agent on a managed computer. A license is not consumed by the "basic inventory" function of the Altiris Agent.
• License count exceeded—Inventory from licensed nodes will continue to be processed. Incoming inventory data from unlicensed nodes is discarded.
• License expiration (only applicable to Trial or otherwise temporary licenses)—Agent rollouts will still occur without a problem. All new incoming inventory data is discarded. Inventory reports will throw a license error.
• AUP expiration—All functions will continue normally. However, if newer versions of the solution are installed, they will not function.
• License recovery—As of Inventory Solution 6.1 SP2, setting the status of the computer to anything but Active will release a license.  In prior versions, only Retired, Return to Lessor, and Disposed computers will free up a license. Deletion of the computer resource record will also release a license.
  NOTE:  Inventory Solution specific data on Retired, Return to Lessor and Disposed computers will be purged as part of a background process that runs each night.

Software Delivery Solution for Windows

• License consumption—A license is consumed the first time a managed computer requests a software delivery task. The prerequisites for this event would be the assignment (via the Notification Server console) of a software delivery task to a managed node that has the Software Delivery Solution agent installed. A license is not consumed from the existence of the Software Delivery Solution agent and/or the Task Synchronization agent on a managed computer.
• License count exceeded—All agents that attempt to obtain Software Delivery Tasks beyond the allowed node count will stop receiving the task details in their client policy files.
• License expiration (only applicable to Trial or otherwise temporary licenses)—Agent rollouts will still occur without a problem. Software Delivery jobs will be no longer be advertised to clients, including newer schedules for existing tasks.
• AUP expiration—All functions will continue normally. However, if newer versions of the solution are installed, they will not function.
• License recovery—Retired computers will not release a license.
  • Computers can be deleted to release a license
  • For unmanaged computers, the event deletion in Data Purging for Software Delivery can be used to clear out old records and free up licenses. This will not work for systems actively using Software Delivery Solution.

Patch Management Solution for Windows

• License consumption—A license is reserved the first time a managed node posts the results of an inventory rule scan to the Notification Server or requests a software update package. A license is not consumed from the existence of the Software Update, Inventory Rule, and/or the Package agent on a managed computer.
• License count exceeded—All agents will stop receiving new software update policies. The Notification Server will refuse to download new (the pmimport.cab file) patch management data from the Altiris Web site. Newly posted Inventory Rule scanning data will be silently discarded by the Notification Server.
• License expiration (only applicable to Trial or otherwise temporary licenses)—Software Update Agent rollouts will still occur without a problem. Inventory Rule scanning and Software update tasks will be no longer be advertised to clients, including newer schedules for existing tasks. The Notification Server will refuse to download new (the pmimport.cab file) Patch Management data from the Altiris Web site.
• AUP expiration—Pre-existing software bulletins will be available for enablement and deployment of their related software updates. The Notification Server will no longer be able to download updated versions of the PMImport.cab file. Software update policies and inventory rule scans will continue to function. However, it will not be possible to obtain updates for new bulletins and their corresponding inventory rules due to the inability to update the pmimport.cab. If a newer version of the solution is installed, it will not function.
• License recovery—Retired computers will not release a license. Computers must be deleted to release a license.

Notification Server 6.0 SP3 R9 Release Notes

Release Notes for Altiris® Notification Server™ 6.0 SP3 R9

Installation and Configuration

Fixes in this Release

Known Issues

Additional Documentation

Installation and Configuration

Rollup 9 (R9) for Notification Server 6.0 is a rollup of fixes to the core product since the release of Service Pack 3. It includes R1 (KB22690), R2 (KB23784), R3 (KB25133), R4 (KB27859), R5 (KB31946), R6 (KB34317), R7(KB35803), and R8(KB39159)

Note: We do not recommend uninstalling R9 as it contains essential fixes. If you experience problems after the installation, please contact Altiris Support Services at www.altiris.com/Support.

Prerequisite Software

Notification Server 6.0 SP3 (build 6.0.6074)

Installing Rollup 9 (R9) for Notification Server 6.0 SP3

Download Altiris_NS_6_0_SP3_KB39160.exe from the following location:

http://www.solutionsam.com/solutions/6_0/Altiris_NS_6_0_SP3_KB39160.exe

Run Altiris_NS_6_0_SP3_39160.exe on the Notification Server.

Note: R9 includes an updated version of the Altiris Agent. After installing R9 onto the Notification Server, the Altiris Agent package will be updated. The upgrade policy is located in the Configuration tab of the Altiris Console under Configuration > Altiris Agent > Altiris Agent Rollout.

Fixes in this Release

The following issues were resolved in this release. For additional information regarding a fixed issue, click on the Article ID link.

Fixed Issues

https://kb.altiris.com/article.asp?article=39160&p=1

Known Issues

• If Helpdesk Solution is installed on the Notification Server, install R9, then go to KB43862 and follow the additional steps in the resolution section of that article.
• If IT Analytics is installed on the same computer as the Notification Server, wait to install R9 until after a new release of IT Analytics. R9 causes the current version of IT Analytics to stop working correctly. See article 40366.
• "PackageDownload Download Snapshot failed: Failed to create NS Client component. Error number: 46. Error description: Permission denied". See article 1751 for the workaround.

If a Package is deleted on the server and clients still have the packages, the events generated from the packages will cause ItemNotFoundException errors.

Question

If a Package is deleted on the Notification Server and clients still have the packages, the events generated from the packages will cause ItemNotFoundException errors.

Answer

The default setting for deletion for all SWD packages on the local client machine is 7 days.  If the Package is deleted on the server and clients still have the packages, the events generated from the packages will cause ItemNotFoundException errors.

The 7 days begins from the time the client no longer sees the package in the Client Configuration XML sent from the server.

As such, this is the best practices for retiring/deleting packages:
1. Disable all tasks associated with the package (if a task is enabled, and a client has that task, the 7 days will not start until that task is gone or removed).
2. Tasks can be deleted very quickly since an updated Client policy XML will stop any events for that task from being generated.
3. 7 days after the tasks were disabled/deleted, delete the package.

How to use Ghost 'Hot Imaging' to create images while the computer is running

Question

How do you use Ghost "Hot Imaging" to create an image while the computer is running?

Hot imaging is the ability to create an image of a computer while the computer is running the production operating system. For example, with Ghost hot imaging, you can create an image of Windows XP while you are logged on and using Windows XP.

While the image is being created, you can continue to work in the production operating system, but any file changes made after the imaging process is started, will not be captured in the image.

---

Answer

Hot images are created by running Ghost in the production operating system. This can be accomplished from a command prompt or from a Deployment Server Run Script task.

(Important: When using the hot imaging feature of Ghost, you cannot save the image being created to the same partition that is being captured in the image. Hot Imaging has been disabled for all Server operating systems.)

Sample Deployment Run Script Task:

REM Map a drive

net use z: \\Provo\express

REM Run Ghost to capture image

Z:\Ghost\Ghost32.exe -clone,MODE=create,SRC=1,DST=Z:%COMPNAME%.gho -sure

Important: The only spaces in the preceding script are located before a dash. Do not put spaces after the commas.

The following information explains the command-line switches used in the sample script:

Command or Switch	Description
Z:\Ghost\Ghost32.exe	The path and name of the Ghost program being used.
-clone, MODE=create,SRC=1,	Create an image of drive 1.
DST=Z: COMPNAME%.gho	Create the image on the Z: drive. The variable of %COMPNAME% will be replaced with the name of the computer being imaged. The path used to store the image cannot be the same partition that is being captured.
-sure	Eliminates the need to manually confirm the creation of the image.

(Important: Configure the task to run in the production environment using the Security Context of either Specific user or Run script in console user session. The account used, must have rights to create the image on the destination server.)