Forum Replies Created
-
Posts
-
Very peculiar. At the moment I don’t have any great thoughts, though it might be interesting to see if the old WsusScn2.cab is still able to scan successfully without producing this error. Are you able to test with the old .cab file that you used successfully back in May?
In the way that you describe, the list could not be auto-imported into BP. You would have to manually pull the list into BP and execute the desired Windows Update action.
However, let me propose two alternate ways that you could accomplish what you are trying to do:
1. The BP job queue has an option ‘Wait for host to have zero logged-on users’ in the “Special” list. You could create a job queue that looks something like this:
Wait for host to have zero logged-on users
Download and install updates + reboot if requiredThen create a scheduled task to execute that job queue. The only issue I see here is that if you choose to have the scheduled task repeat daily, and if the computer has logged on users each time the task runs, I’m not 100% certain how things will go if the previous day’s task is still waiting for the host to have zero logged-on users when the next day’s task executes. I think this will cause multiple ‘wait…’ actions to start (one ‘wait…’ action for each day). When the computer finally has zero logged on users, one of those ‘wait…’ threads will probably execute just fine with all of the other ‘wait…’ threads then failing to execute. This might end up working just fine despite the fact that you would see a bunch of failures/errors, but I’m not positive. Also, I believe it would create a thread leak because BP would create a new thread each day for each host that is doing nothing but waiting for there to be no logged on users. The leak would be cleaned up only when those threads are returned to the pool when the target host finally has no logged on users.
2. To avoid the potential issue that I described in method number 1 you could write your own script to check for logged-on users and return 0 if no logged-on users are found but return any non-0 integer if logged-on users are found. Then you could add that custom script to a BP job queue that looks something like this:
Execute custom script
Terminate queue if previous action fails/errors
Download and install updates + reboot if requiredIn this way your custom script would execute first. If it returns 0 then BP will execute ‘Download and install updates + reboot if required’, but if it returns a non-0 value then BP will terminate the queue. If you have this queue set to execute daily via scheduled task, it should give you exactly what you want. There is an example of integrating a custom script into BP posted here. If your script simply returns the number of logged-on users, that would be sufficient for this to work because when 0 logged on users are found your script would return 0, which is what would be needed for this to function as I described.
-Doug
Error -198 indicates that there was a problem when BatchPatch tried to add the scan package service for the WsusScn2.cab file. The HRESULT value is the reason code.
HRESULT -2147024894 translates to:
0x80070002 -2147024894 ERROR_FILE_NOT_FOUND
The System cannot find the file specifiedThis would only happen if the file itself did not exist on the target computer when the scan was initiated. It sounds like you got this resolved.
HRESULT -2146762487 translates to:
0x800B0109 -2146762487 CERT_E_UNTRUSTEDROOT
A certificate chain processed, but terminated in a root certificate which is not trusted by the trust providerThis indicates that the certificate on the WsusScn2.cab was signed by an untrusted CA. This is not the same problem that you read about in other forum postings that described some cases where the WsusScn2.cab file contains no digital certificate. In this case the .cab file is signed, but the issue is that the certificate is not trusted by the target computer(s). I suspect that you have not used Windows Update on these target computers for a very long time, and now the certificate authority that Microsoft is using to the sign the cab file is not in the trusted root store of the target computers. This does not mean that there is a problem with the WsusScn2.cab file. Probably the file itself is fine and legitimately signed. However, since your target computers are probably either an old OS (you didn’t mention which OS they are) and/or they have not been updated in a very long time, the trusted root store simply does not contain the CA that Microsoft used to sign the .cab file.
I think you just need to get the CA to be included in the trusted root store on the target computers in question. I’m not sure the exact path to make this happen. You might be able to simply view the details of the certificate (right click on the WsusScn2.cab file and then select the ‘digital certificate’ tab, and dig in to ‘view certificate’), and then once viewing the certificate you might be able to simply click a button to import that cert. I think this might depend on which OS you are running on the targets, and I’m not 100% certain that this is the exact correct method. When I look at the cert for the most recent .cab file that I just downloaded, the CA is ‘Microsoft Code Signing PCA.’ I believe historically the way that Microsoft has modified the trusted root store on Windows computers is by publishing a Windows Update with the desired/needed updates. In your case since the computers do not have internet access it seems like you would need another way to get the trusted root store updated. If the method that I described above does not work, then I wonder if maybe you can export the cert from a computer that has it to then import on the computers that do not have it. I’m not sure, but hopefully I’ve given you enough information to go on so that you can get it worked out. If/when you get it worked out it would be great if you could post here with the exact steps you took to get the trusted root store updated.
-Doug
Hi Stephen – I’m sorry to say that I don’t fully understand what you are asking. What kind of list do you want BatchPatch to read? And what would reading such a list accomplish? In the way that your current question is phrased it’s unclear what you are trying to accomplish. What does reading a list have to do with using the task scheduler to install updates? What is in the list? What should BatchPatch do with the information that it reads from the list? Please clarify with as much detail as possible in describing exactly what you are trying to accomplish.
Thanks,
Doug
This is peculiar. I don’t recall ever seeing something like this happen before. I would suggest that for the sake of troubleshooting it would be best to not use the service instance, and instead to just manually test running actions. This way we can first make sure that things work when BP is used manually. Then once things are working manually, then we can try the service to see what happens. For things to simply stop at “Initiating…” every day is very odd. There is no error message and no further action. My best first guess is that this is being caused by a problem with WMI on the target computer. It seems as if the WMI connection is being received but is just hanging, indefinitely.
My first suggestion is to reboot the target computer and reboot the BatchPatch computer. Then after rebooting both computers you should test by manually executing ‘Actions > Windows Update > Download and install updates.’ If it still gets stuck at ‘Initiating…’, then go ahead and follow the steps for troubleshooting Windows Update actions in the BatchPatch troubleshooting guide. Let me know what happens.
Thanks,
Doug
BP doesn’t currently have the built-in If/Else that you are looking for, but you can still use BP to execute the deployment as desired. To do that you would just need to create a simple script that checks the OS of the local computer, and then if it’s the desired OS the script then executes your .exe with the appropriate parameters. Then you would put the script file and the .exe together in a folder on the BP computer, and then create a deployment in BP to deploy the script to target computers. The key here is that you would be deploying the script, not the .exe. And in the deployment configuration you would check the box to “copy entire directory” so that both the script file and the .exe get copied to target computers for execution. When you execute the deployment the directory containing the two files will be copied to target computers, and then the script will be executed on target computers. Target computers that pass the OS check, per the code in your script, will then have the .exe run. Target computers that fail the OS check, per the code in your script, will not run the .exe.
-Doug
In BatchPatch you can schedule or manually execute the download/install/reboot at any time that you want. Also, you can schedule or manually execute the download/install/reboot to all happen together at the same time or to happen separately at different times. It’s your choice.
-Doug
Yes, in the ‘Alternate credentials’ field if you uncheck the box that says ‘Domain’ you’ll notice that ‘$computer’ is automatically populated in the ‘domain’ field. So if you had a local account on each computer with the same username, that would be one way you could handle it.
-Doug
EM – It is not possible to use %logonserver% in the alternate credentials form.
-Doug
PsExec.exe only needs to be on the computer that is running BatchPatch. It does not need to be on the target computers.
In 99.9% of cases PsExec.exe can simply be placed into C:Windows on the BatchPatch computer. In rare cases this might not be sufficient. If you have already tried putting PsExec.exe into C:Windows with no luck, then the next step is to put PsExec.exe into the same folder/directory as BatchPatch.exe. Then when you launch BatchPatch.exe it should always find PsExec.exe without problems.
Another option is to modify where BatchPatch looks for PsExec.exe by going to ‘Tools > Settings > Remote Execution > Use psexec.exe custom filepath’
Thanks,
DougExcellent.
As noted in my previous posting from 3 days ago, the psexec -r switch is already included in BatchPatch under ‘Tools > Settings > Remote Execution > ‘Use PsExec -r switch to specify remote service name’
Thanks. Keep me posted.
-Doug
One other option to try is in BatchPatch ‘Tools > Settings > Remote Execution > ‘Use PsExec -r switch to specify remote service name’ and then you can specify a custom name, which might cause your anti-virus software to not block it, but I don’t know whether or not it would be likely to work, so you’d have to test it and see.
-Doug
On the BatchPatch computer psexec.exe needs to be able to run. On the target computers psexesvc.exe is what needs to be able to run. To confirm that the antivirus software is the cause of the problem you should disable or uninstall the antivirus software and then test the application. If that appears to resolve the issue then the next step would be to whitelist those applications in the antivirus software. If you have trouble whitelisting those, you should reach out to your antivirus vendor for instructions.
I hope this helps.
-Doug
Add an exception in your antivirus configuration that allows the service to install/run. The antivirus product should have whitelist capability.
I should also point out that you can put a range of IP addresses into BatchPatch instead of host names, and then you can use ‘Actions > Get info > Get host name’ to to essentially a reverse lookup. You’ll end up connecting by IP to the target computer, and then the target computer itself (rather than DNS) will tell you what its host name is. This should help, I think.
-Doug
Glad you figured it out.
-Doug
First I would recommend testing psexec at the command prompt (start > run > cmd). You can try a command such as:
psexec \targetComputer IPCONFIGIf you determine that this command does not work, then you should look at making sure you can access the target computer’s admin$ share. Go to ‘start > run’ and then type:
\targetComputeradmin$If you are not able to connect, that would indicate the source of your problem is due to this share being disabled on target computers.
Another place to look would be at any security policies that might have been enacted in your environment, which includes Anti-Virus applications or Host Intrusion Prevention/Protection applications that might be blocking psexec.
I would also suggest that you review the steps outlined in the BatchPatch Troubleshooting Guide to help further narrow down the source of your problem. You posted in this forum posting that you were receiving the same error that’s described in that posting (Windows Update: Error 1611: 5. Failure). As noted in that same posting, this would indicate a permissions issue on target computers. If it’s stopped working all of a sudden on all of your target computers, it would imply that a security policy was applied to your environment that is blocking the psexesvc from running on target computers.
-Doug
Excellent. I’m glad you made some progress.
-Doug
Chris – It still sounds like there is something weird happening with permmissions. From the computer that is running BatchPatch are you able to reach the target computer by going to “start > run” and then typing:
\targetComputerNameGoesHereC$Program FilesBatchPatch
What happens when you do that? Also please go through all of the steps in the troubleshooting guide to see which other steps you can or cannot complete successfully.
-Doug
This appears to be a permissions problem. Windows System Error code 5 means ERROR_ACCESS_DENIED. What is peculiar in this particular example is that normally if there is a permissions problem BatchPatch will spit out an ‘Access Denied’ error before ‘Executing BatchPatchRemoteAgent.exe.’ However, what you are seeing indicates that the failure occurs later, at an unexpected place, which would seem to indicate that there are partial permissions but not complete permissions. If you are not seeing a C:Program FilesBatchPatch folder on the target computer, then it would indicate that BatchPatch was not able to create folder, though again that seems slightly odd only because normally BP would try to create that folder and then say ‘Access Denied’ if it couldn’t. Whereas based on what you are reporting the failure occurs later AND the folder still does not exist. Please start by going through the steps in the troubleshooting guide. This should help reveal where exactly the problem is occurring. Report back with your results.
Thanks,
Doug
The way that BatchPatch ‘deployment’ works is to first copy the setup file(s) to the target computer. Then BP executes the installer locally on the target computer. This is by design, so it’s expected behavior to see it execute from the local drive and not directly from the network share.
-Doug
Hi Jason –
For the message size quote issue… first try restarting the service. This might resolve it. If not, then it would seem that the amount of data in the grid that you have running in the service is too large. This seems odd/unlikely, but it’s possible. Based on our testing the 2000000 max should be more than enough for the very large majority of situations. The number of rows itself shouldn’t be a problem. 450 rows isn’t all that many. It really comes down to how much data is in each row. If you have been using the same .bps file running in the service for a long time, then it’s possible over time that it eventually became too large. We have not seen this ever happen before in practice, and in our testing the 2000000 always seemed like a *very* large amount of overhead. This is why I wonder if you might just need to restart the service to solve the problem. Let me know, however, if restarting it isn’t enough in this case. And if that’s the case then I would suggest you either start a new grid (instead of using the old grid that contains lots of historical data) or delete all the column data from your existing grid except for the columns that you need like host name, scheduled task, job queue etc.
With regard to the email reports… I’m not sure what to make of this. Was there an error of some kind? It should not matter how many rows are in the grid or how much data is in the grid. This kind of implies that something is/was going on with the system. I wonder if after a reboot or a re-launch of BP with the .bps files everything would be back to normal. In general, there is no limitation to the number of rows that you can send email to.
-Doug