[doug]

Hi spiff-21 – Thank you for the feedback. Can you please describe in more detail what you mean when you say “the program starts to get extremely slow.” Are you saying that the check for pending reboot takes time to complete on many computers? Or are you saying that after the check has completed, if the column is visible, then when you scroll in grid or select rows etc that it doesn’t scroll quickly or select quickly? Something else? The more descriptive you can be, the better.

Thanks!

-Doug

[doug]

Scott posted a tutorial here that might help:

Remotely Deploy Chrome to Numerous Computers

Thanks,

Doug

[doug]

Magnus – It’s unclear to me what might be happening here. Let’s please start by removing the scheduler from the equation and starting with the basics. What happens if you highlight a computer (or computers) in BatchPatch and then select ‘Actions > Windows Updates > Check for available updates’ in BatchPatch?

Thanks,

Doug

[doug]

Joseph – Thanks for your feedback. There is not currently a wiki, but we will consider something like that for the future. In the meantime, in addition to this web forum and the administrator’s guide available from ‘Help > BatchPatch Admin Guide’ (inside the application), we also have lots of tutorials and helpful information on the main website at BatchPatch Tutorials.

-Doug

[doug]

William – Thanks for reporting back. I’m glad you got things working with remote process 1. As for the alternate credentials issue that I mentioned, I was wrong/confused, so what I said was not accurate. The issue that I was concerned about is sometimes referred to as a “double-hop” network authentication issue. It wouldn’t affect you in the alternate credentials scenario as I had stated. However, I believe it *could* affect you in the integrated security scenario (when NOT using alternate credentials) under certain circumstances. Essentially the issue is that when you use integrated security in BatchPatch to execute a script on a remote computer, the remote computer has to impersonate the logon account that BatchPatch is running under (first hop), but from there due to how impersonation works, the remote computer cannot access network resources (second hop). Essentially, windows will allow you to use impersonated credentials to access local resources (during the first hop), but it won’t allow you to delegate the impersonated credentials to another remote resource (second hop). This clearly is not always a problem because you are not encountering it (I believe it depends on the type of authentication that is being used), but if one does encounter the problem, the solution can actually be to use alternate credentials instead of integrated security because in that case impersonation is not used. Instead, the alternate credentials are actually copied to the remote system, and then when the task is executed there is no double-hop issue if the remote computer then needs to access a central/shared third server because the connection to the central/shared third server would actually only be the first hop, not the second. The double-hop issue is complicated, and I’m not an expert. However, I believe what I have stated above is a reasonably accurate description of how it works.

-Doug

[doug]

Thanks, Glenn. Unfortunately you’re correct– there isn’t much info to go on in the logs. It’s essentially just pointing to a timeout, which we already knew. The real question, of course, is *why* is it timing out. Let me know what you come up with when you test the other suggestion.

Thanks,

Doug

[doug]

Hi Glenn – I’m sorry to hear that you are encountering the same issue. Coincidentally I happened to build a brand new 2012R2 machine a few days ago with nothing installed except for WSUS. So, I went ahead and installed the BatchPatch service on it a few minutes ago. However, I didn’t encounter any problems with installation or running it. That said, I do think there is something specific to your environment that is causing the problem. But as you pointed out, it’s hard to pin down what it might be. You are only the second person who has ever reported a problem running the service.

You mentioned A/V, which I do think is a possible culprit. Rather than just trying to start the service with A/V disabled, I’d actually like you to uninstall the service altogether, then disable A/V, and then with A/V disabled re-install the service. Then with it still disabled, start the BP service. Does this have any impact?

Additionally, could you please look in the BatchPatch service installation directory. You should find a couple of .log files there. I’d like to know if those .log files contain any additional information that references service startup errors.

Thanks,

Doug

[doug]

Hello William –

1. If you are using ‘Alternate Credentials’ in BatchPatch, then you will definitely have a problem with the .xml file being on a central server. It would have to be on the target computer that is running the setup.exe. And even if you are not using ‘Alternate Credentials’ this could still be an issue (though I’m not certain if it’s the issue you are encountering).

2. Remote Process 1/2 are executed differently from Remote Process 3/4. In some cases 1/2 will work when 3/4 fail.

My suggestions are as follows:

1. Try the same command with Remote Process 1/2. See if that works or not.

2. Put the .xml on the target computer instead of on a shared server. See if that works (again you might need to use Remote Process 1/2 instead of 3/4). You can use BatchPatch to copy the .xml to target computers using the ‘Actions > Copy file/folder’ menu option.

I hope this helps.

-Doug

[doug]

Strange… If the time/date values are synchronized, then I wonder if the problem has nothing to do with the “Update Date Filtering” setting and instead is a completely different problem. Could you post the log where you determined that the “Update Date Filtering” setting is causing the update to be skipped?

Note, the LastDeploymentChangedTime (WSUS approval time) is displayed in the batchpatch.log file next to each update title in parentheses. Then also we will see in the ‘filtering’ section of the log “Reason: UpdateDateFiltering” if the “Update Date Filtering” setting is the reason that an update is getting filtered. So in the log example below the COMPUTER1 search began on Feb 1 2016. The ‘Definition Update for Windows Defender’ has a LastDeploymentChangedTime of 2016-02-01. So if the “Update Date Filtering” setting is set to 0, then 2016-02-01 is compared to 2016-02-01, and the update is downloaded/installed. However, if the “Update Date Filtering” setting is set to 1, then 2016-02-01 is compared to 2016-01-31 (this is the same as 2016-02-01 MINUS 1 day), and the update is not downloaded/installed.

Example:

COMPUTER1 02/01/2016 15:02:28



::Begin online search - Server Selection: Default



The search query "ImportantAndRecommended" returned 2 update(s):



1> Cumulative Update for Windows 10 Version 1511 for x64-based Systems (KB3124262) (471 MB) (2016-01-27) - Critical Updates

(Type-SoftwareUpdate | Downloaded-TRUE | RebootRequired-MAYBE)

http://support.microsoft.com/kb/3124262



2> Definition Update for Windows Defender - KB2267602 (Definition 1.213.5118.0) (429 MB) (2016-02-01) - Definition Updates

(Type-SoftwareUpdate | Downloaded-TRUE | RebootRequired-FALSE)

http://support.microsoft.com/kb/2267602



::End search



::Begin filtering collection



adding> Cumulative Update for Windows 10 Version 1511 for x64-based Systems (KB3124262)

skipped> Definition Update for Windows Defender - KB2267602 (Definition 1.213.5118.0) - Reason: UpdateDateFiltering



::End filtering collection



::Begin adding non-downloaded items to downloader collection



skipped> Cumulative Update for Windows 10 Version 1511 for x64-based Systems (KB3124262) - Reason: Update already downloaded/cached



::End adding non-downloaded items to downloader collection



There are no updates to download



COMPUTER1 02/01/2016 15:02:31

If the times are already synched, I suspect that maybe there is a different underlying cause to your issue. If you are approving the update in WSUS, I wonder if maybe before you do the new “check for available updates” in BP, you simply need to run some combination of the following commands first on the target server (these commands are available in BP under ‘Actions > Windows Updates’:

wuauclt.exe /detectnow

wuauclt.exe /resetauthorization /detectnow

wuauclt.exe /reportnow

Thanks,

Doug

[doug]

Thank you for reporting this issue.

After reviewing the code, here is what we found:

1. The update date filtering appears to be working properly by comparing the LastDeploymentChangeTime (which is equivalent to the time the update is approved in WSUS)

2. When the “Update Date Filtering” in BatchPatch is set to 0, instead of skipping/disabling the filter altogether, BatchPatch is still running the update through the filter. Normally this is fine because if you set the “Update Date Filtering” value to 0, all updates would/should be included. *However, if you have a time discrepancy (or *possibly* even just a time-zone discrepancy) between your WSUS server and the target computer that is downloading/installing updates, then this could cause the update to get filtered out erroneously.

3. We have updated the code in BatchPatch so that starting with the next release of the app, if the “Update Date Filtering” value is set to 0, the filter will get skipped/disabled altogether, rather than still doing the datetime comparison, so this problem will not exist anymore for you.

For the time being since the above-mentioned code improvement is not included in the current version of BP that you are using (it will be in the next published release of BP coming some time likely in the next 4 to 8 weeks), I believe the only possible explanation is due to a time/date discrepancy or possibly a timezone discrepancy between your WSUS server and the target computer that you are seeing this behavior on. Please make sure all computers in question have their dates/times set accurately. Let me know what you find/determine.

Thanks,

Doug

[doug]

Hi J – If you used BP to install the updates, I would generally expect that you could determine the particular problematic update by looking at the bp log under ‘Actions > Windows Updates > View BatchPatch.log” Normally it should show which update is failing. Also consider looking at the Windows Update log file for more info. However, if for some reason you’re not able to determine from the logs, then you can use the following instructions to install one update at a time:

Installing specific updates

-Doug

[doug]

Thanks for explaining, Mats. I understand now what you mean. We’ll consider this for a future build. Thank you for your suggestion!

In the meantime, probably the best way for you to get all the computers would be to put them into a single security group. Then in the BP ‘Add hosts from directory’ form you can simply highlight that single security group to display all of the desired computers.

-Doug

[doug]

J – Sorry to say that I don’t have answers to either question right now.

-Doug

[doug]

Hello Thomas – network scanning is not currently a feature. However, you can easily just input a list of IP addresses and then use BP to ping them or some other action to see which ones respond. So for example if you created a list from Excel or similar such as:

192.168.1.2

192.168.1.3

192.168.1.4

192.168.1.5

Then you could just paste the list into BatchPatch and immediately determine which IPs are responding.

Thanks,

Doug

[doug]

Hi Mats – I’m a bit confused because already in BP you can specify an OU to import objects from. Also, you the built-in filter enables you to easily select all machines in the ComputersServers OU without selecting any of the machines in ComputersServersVirtual. I’m not sure what more you are asking for. Am I misunderstanding your request? Or perhaps you can experiment more with the “Add hosts from directory” form and then let me know what you experience?

Thanks,

Doug

[doug]

More on BatchPatch port requirements here: BatchPatch Port Requirements

[doug]

I would suggest that you download the .msi installer from https://www.google.com/work/chrome/browser/

Then do a normal deployment. I just tested it and had no issues.

-Doug

[doug]

J – The instructions on the page you linked above are sufficient for getting BP to work with Win7 or Win2008, so I’m not quite sure what else you are looking for. The Remote Administration exception normally includes ICMP, among other ports that are opened when you enable it. It sounds like maybe you want to allow ICMP traffic through without allowing “Remote Administration” ?

If that’s the case then with regard to ICMP, I can confirm that BatchPatch pings are sent via standard ICMP, so if you are trying to allow ICMP traffic through Windows Firewall without allowing “Remote Administration” then I’d suggest you follow the instructions outlined here: https://technet.microsoft.com/en-us/library/cc972926%28v=ws.10%29.aspx

Note, if you choose not to enable “Remote Administration” and “File and printer sharing” then you’re going to have problems with pretty much every other BatchPatch task, even if you allow ICMP just for BatchPatch pings to reply successfully.

I hope this helps. Let me know if you get stuck with anything.

-Doug

[doug]

Hi Jay – Thanks for the feedback. I’m really glad to hear that you like the tool! Yes, we are considering this for a future build. In the meantime I would suggest that you simply save a .bps or .bpt file to use as a template for future runs. So, basically you just add a list of hosts to the grid with credentials, then save the grid to .bps or .bpt before you do anything else. Then when you’re ready to do a new run at a later date, you can simply load the .bps/.bpt file and it will be all ready to go with your credentials already entered. I hope this helps.

-Doug

[doug]

Got it. Thanks.

[doug]

I’m not quite sure what to make of this. If you are a customer with an active support contract, please contact us through our contact page for troubleshooting assistance.

-Doug

[doug]

Hi Mats – Unfortunately there is not currently a way to filter this output. It’s simply returning the entire output of the REG QUERY command.

-Doug

[doug]

Hi Giles – Are you saying that you want to clear the host, mac, and logon account columns? Or are you saying you want to clear all columns *except* for the host, mac, and logon account columns? Let me know. We can hard-code this in the next release. There is not currently a way for the user to hard-code a custom option.

Thanks,

Doug

[doug]

That sounds like a solid plan. I’m really glad to hear that you’re loving the app and that you find the evaluation version so useful! Thanks for the feedback. We really appreciate it.

-Doug

[doug]

REN is an internal MS-DS command, as opposed to a stand-alone executable. It can only be run inside of a cmd shell. When you execute ‘Remote Process/Command’ in BatchPatch, under the hood we actually do not load the cmd shell, so REN fails because there is no REN.exe to be found. However, in the case of ‘Remote Process/Command (Logged Output)’ we do load the cmd shell. This is why REN is successful in that case.

I hope this helps.

-Doug

[doug]

Yes, Windows 10 support was added later. You’ll need to update.

-Doug

[doug]

Thanks for confirming. The next would be to examine your WindowsUpdate.log on that machine to see what it reveals. We should see an error in the log. Also, have a look at this posting, which explains the resolution that a couple of people used for this issue.

Windows Update: Error: -1073741819. HRESULT: -2147024894.

-Doug

[doug]

Andreas – first we need to confirm please what is the complete error message that you are seeing? The topic of this post is “Error: -1073741819. HRESULT: -2147024894.”

You mentioned -2147024894, but that is only one piece of the error message, and it’s the least important part. We need the entire error message please. There should be two different error numbers, with the first number being the most important.

Thanks,

Doug

[doug]

Unfortunately those settings are global, and so they will affect every computer. There is not currently a way to change those two values for just a specific subset of computers. However, we’ll consider this for a future build.

-Doug

[doug]

There is not currently a way to do this aside from changing the values to “D:whateverwhatever” in the settings.

-Doug

[Author]

Posts