Next Gen Microsoft Windows Vulnerabilities (beta) is not shown in the Patch Manager > Download updates > Windows > Vulnerabilities
To resolve the issue, click on and select "Microsoft Windows Vulnerabilites", click on button "Apply" and click on the button "Download now".
Once the download completes, go back to "Download updates" and the definition type "Next Gen Microsoft Windows Vulnerabilities ( beta ) will be shown.
EPM version 2017.3 Verification - Verify definition signatures/hashes before downloading option is enabled by default and it cannot be disabled.
EPM version 2017.3 Management Console > Tools > Security and Compliance > Patch and compliance > Download updates > tab Content > Verification
Verify definition signatures/hashes before downloading
NOTE: When checked, any definitions that do not have a valid SHA256 hash will not be downloaded. Also, any lists of definitions that do not have a valid signature will not be processed. The download progress form will show any download failures due to invalid/missing signatures or hashes.
LANDESK support program for Windows XP and Server 2003 patch content
This article describes how to use Ivanti Patch and Compliance to upgrade to Windows 10 Anniversary Edition
For information about upgrading to Windows 10 Creators Edition (1703) see How to upgrade to Windows 10 Creators Edition using Ivanti Patch Manager
Windows 10 Anniversary Edition is also known as Windows 10 RS1 or Windows 10 1607.
Upgrade the clients to Windows 10 version 1607.
These steps use the Ivanti Patch and Compliance Manager definition called "W10V1607". A prerequisite for installing this version to a client computer is that the target computer must have 2GB of memory or higher. If the client computer does not have 2GB of memory or higher it will be detected but it will not attempt to install the update.
* MediaCreationTool.exe from http://go.microsoft.com/fwlink/?LinkId=691209 can create only two editions: Windows 10 Professional or Windows 10 Home. There is no option to download and create editions Windows 10 Enterprise or Windows 10 Education. Also within a Windows 10 ISO file created using the MediaCreationTool.exe there is no ..\sources\install.wim file and the verification of what edition Windows 10 is, cannot be performed using dism.exe -- "dism.exe /get-wiminfo /wimfile:F:\sources\install.wim"
Please note that the MediaCreationTool will download the latest Windows 10 version, which is at this point 1709 (Fall Creator Update)
If using a copy from MSDN this is likely an all-in-one image, only the product key changes the version.
You will notice that there is a list of rules in the definition. You need to select the correct rule that matches the version of Windows you are trying to upgrade.
Further information about the Patch Manager definition release can be seen here.
In order to block Windows 10 systems from automatically installing Operating System Upgrades, the following methods may be used:
Group Policy
Computer Configuration / Administrative Templates / Windows Components / Windows Update Policy
Setting: Turn off the upgrade to the latest version of Windows through Windows Update
Registry
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DWORD value: DisableOSUpgrade = 1
Ivanti Patch and Compliance Manager Definition
The DISABLEWIN10UPGRADE can be sent as a repair job to turn off the Windows 10 auto-updates to newer OS versions.
This definition sets the Registry key listed above.
Overview:
Ivanti Patch and Compliance now provides support for Office 365 versions 2013 and 2016. Patch and Compliance administrators can now scan, detect, and remediate client devices that have Office 365 installed. For Office 365 version 2013, Ivanti leverages the Microsoft Office Deployment Tool to perform the remediation tasks for updating Office 2013 installations. For Office 365 version 2016, Ivanti has developed an Office Com API to perform remediation tasks for updating Office 2016 installations. Ivanti provides a utility (Office365Util.exe) for you to use to download the Office installation data and to check the hash for Office 2016 installation data. When the Office patches are downloaded, Ivanti Endpoint Manager will check the hash on the pertinent files to ensure validity.
Customers download the Office 365 vulnerability definitions, the O365Util.dll, and the Office365Util.exe from the Ivanti Global Host Content Server by downloading the latest Microsoft Windows Vulnerabilities.
| Download Updates (Microsoft Windows Vulnerabilities) | Updating Definitions (Office365Util.exe/O365Util.dll) |
|---|---|
 |  |
| Updating Definitions (MSO365)MSOFFICE 365 (Vul_Defs) | MSO365 (Vul_Defs) |
|---|---|
 |  |
Upon successful content download, an Office365Utility folder is created under the LDLogon share and will contain the Office365Util.exe file provided by Ivanti.
\\Core_Server\LDLogon\Office365Utility
This utility will allow you to select the specifics regarding the Office 365 product you are patching. Launch this utility directly from C:\Program Files\LANDesk\ManagementSuite\ldlogon\Office365Utility\ by double-clicking on Office365Utility.exe
(do not try to run it via the network share \\Core_Server\LDLogon\Office365Utility or \\localhost\LDlogon\Office365Utility as you will get an error).
The view provided below displays the available options inside of the Office365Util application (Ivanti Office 365 Utility for Patch and Compliance):
| Platforms | Deployment Tools |
|---|---|
 |  |
| Channels | Office 365 (2013) Product List View |
|---|---|
 |  |
In order to successfully patch Office 365, select which Office 365 patch product updates to download in order to support client remediation. After selecting the desired product updates from the Ivanti Office 365 Utility for Patch and Compliance application, click START.
The START action will do (2) things:
\\Core_Server\LDLogon\Office365Tool
The contents of this folder will contain the Deployment Tool Type (2016 or 2013) selected during the download and all relative installation data applicable to the options selected in the Ivanti Office 365 Utility for Patch and Compliance
application. The display below will outline the contents of both Deployments Tools (2016 and 2013).
If you have both 2016 and 2013 products in need of patching, the download has to be completed separately.
| Office365Tool | Deployment Tool Options |
|---|---|
 |  |
| 2016 Content | 2013 Content |
|---|---|
 |  |
2. Create an Office365 folder under the LDLogon\Patch share that contains the patch files(s):
\\Core_Server\LDLogon\Patch\Office365
Updated Office 365 patching is not designed to take advantage of our download technology. The client device will NOT download o365 patch files from a preferred server or peer device. The files will be retrieved from the default or non-default patch location.
This section is only applicable to those who have changed the default download location for patches. After downloading the Office 365 patch updates and installation data with the Ivanti Office 365 tool, the following SOURCE will be in the vulnerability definition:
Office 365 (2016)
httpSourcesURL="Core_Server/LDLogon/Patch/Office365/DeploymentToolType/Channel/Architecture"
Ex: httpSourcesURL=http://2016E/ldlogon/patch/office365/2016/current/x64
Office 365 (2013)
httpSourcesURL=http://Core_Server/LDLogon/Patch/Office365/DeploymentToolType
Ex: httpSourcesURL= http://2016E/ldlogon/patch/office365/2013
In order for the Patch Install Commands in the vulnerability definition to interpret the correct patch location, the Custom Variable will have to be set in every MSO365 vulnerability definition.
To do this open the properties on the definition and select the Custom Variables tab. By default the value specified will resolve to the default patch location.
You will need to explicitly set the value to reflect the location your patches reside.
The Patch Install Commands section of the definition utilizes a script that resolves the Custom Variable.
How to change the default Patch Location for Security and Patch Manager
Security and Patch option is missing when right-clicking computers in the Scheduled Tasks tool in the Console.
Install SU2 or newer for 2017.3.
Starting with the April 11th 2017 Patch Tuesday, Microsoft no longer uses a traditional naming format for Security Bulletins. To help our customer's, we created our own naming format as follows:
The new Security Bulletin mappings our products will be using: MS[YY]-[MM]-[PP(P)]
Here are examples from Patch Tuesday December 12, 2017:
.NET Patches will follow a slightly different naming scheme:
Non-security .NET Patches also have a slightly different naming scheme:
Additional Naming Conventions
Microsoft released the following article for FAQ on the changes made: Security Updates Guide dashboard and API:
Q: Why is the security bulletin ID number (e.g. MS16-XXX) not included in the new Security Update Guide?
A: The way Microsoft documents security updates is changing. The previous model used security bulletin webpages and included security bulletin ID numbers (e.g. MS16-XXX) as a pivot point. This form of security update documentation, including bulletin ID numbers, is being retired and replaced with the Security Update Guide. Instead of bulletin IDs, the new guide pivots on vulnerability ID numbers and KB Article ID numbers.
Microsoft released KB4058702 late the night of 1/3/18 (out of band) to address an Intel CPU firmware vulnerability. The patches released will be added to our patch definition update to be released later today, 1/4/18.
List of patches from Microsoft:
https://www.catalog.update.microsoft.com/Search.aspx?q=2018-01
Additional Information
Important information on detection logic for the Intel 'Meltdown' security vulnerability
Microsoft has identified a severe compatibility issue with a small number of anti-virus software products.
We highly suggest all customers review these issues here: https://support.microsoft.com/en-us/help/4072699
Due to to possible BSOD issues that may occur when installing this update on system with out of date AV software, we will be adding a detection prerequisite as Windows Update does:
Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat"
Value="cadca5fe-87d3-4b96-b7fb-a231484277cc"
Type="REG_DWORD”
If key does not exist you will be offered the detection only version of this patch.
This means that the associated patch for a system will not be remediated unless the Registry key is present. This mirrors how the patches are handled by Microsoft. Full details regarding the offering of the patch, and options if the Registry key is missing, are located in the Microsoft article here: https://support.microsoft.com/en-us/help/4072699/important-information-regarding-the-windows-security-updates-released
The patches will be offered for deployment if the key exists.
Affected patches:
Affected CVEs:
Link to Security bulletin advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002
The Global Autofix and Reboot settings can be set up in the Agent configuration> Standard LANDesk Agent page, but once configured it seems there is no way to update it by a Change Setting task, or by simply updating on the Agent configuration and save the setting. Some believe that the Agent will need to be redeployed in order to overwrite the existing Global Autofix and Reboot settings. This document provides a way to update those settings without having to redeploy the Agents.
1. First it will be useful to get an idea of which Agents have used the Global Autofix and Reboot settings. Follow this article: Displaying the Settings "Never Reboot" and "Never Autofix" in Your Inventory
2. After the above step, an inventory scan will have to be run successfully in order for the inventory information to be synced back to the core server. Then you should be able to see an entry like the following in the Agent's inventory:
NOTE: If the Agent doesn't have the Global Settings configured, the inventory will simply look like this.
3. Locate the Agent configuration that your Agent has been using, modify the Global Autofix and Reboot settings as needed, save the configuration.
4. Right click on the Agent configuration, and select Schedule Update to Agent Setting to create a scheduled task.
5. Drag and drop the Agents you need the setting to be modified and start the task.
6. When this is done, start an inventory scan on the Agent machines and you can see that the above entry in the inventory value has changed.
Displaying the Settings "Never Reboot" and "Never Autofix" in Your Inventory
Affected patches:
Vulnerability | KB | Product | Type |
MS18-01-2K8_INTL | KB4056615 | Windows Server 2008 | Security Updates |
MS18-01-IE_INTL | KB4056568 | Internet Explorer | Security Update |
| MS18-01-MR7_INTL | KB4056894 | Windows 7, Server 2008 R2 | Monthly Rollup |
| MS18-01-MR8_INTL | KB4056896 | Windows Server 2012 | Monthly Rollup |
MS18-01-SO7_INTL | KB4056897 | Windows 7, Server 2008 R2 | Security Only |
MS18-01-SO8_INTL | KB4056899 | Windows Server 2012 | Security Only |
MS18-01-SO81_INTL | KB4056898 | Windows 8.1, Server 2012 R2 | Security Only |
MS18-01-SQL_INTL | KB4052987 | SQL Server 2016, 2017 | Security Updates |
MS18-01-W10_INTL | KB4056888 | Windows 10 | Cumulative Update and Delta Update |
How to Scan and/or Repair against a custom group
Additional Information
Due to to possible BSOD issues that may occur when installing this update on system with out of date AV software, we will be adding a detection prerequisite as Windows Update does:
Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat"
Value="cadca5fe-87d3-4b96-b7fb-a231484277cc"
Type="REG_DWORD”
If key does not exist you will be offered the detection only version of this patch.
This means that the associated patch for a system will not be remediated unless the Registry key is present. This mirrors how the patches are handled by Microsoft. Full details regarding the offering of the patch, and options if the Registry key is missing, are located in the Microsoft article here: https://support.microsoft.com/en-us/help/4072699/important-information-regarding-the-windows-security-updates-released
An Example of the detection only definition being returned will contain "DETECT" in the definition name and under Patch Required it will say: No repair action specified There is also no patch information provided
An Example of the definition where the regkey is detected and you will be able to remediate
Support for the Intel 'Meltdown' security vulnerability KB4058702
Important information on detection logic for the Intel 'Meltdown' security vulnerability
Purpose
This article explains how our detection the Delta or Cumulative version of the patch is offered.
Description
Our detection logic will verify the 'UBR' value from the registry to determine if the Delta or the Cumulative update will be offered.
HKLM" Key="SOFTWARE\Microsoft\Windows NT\CurrentVersion" Value="UBR" (Update Build Revision)
You will only be offered one or the other and never both.
Related Documentation
Getting messages like the following in the Security and Patch Information for clients on the History page:
String not found Patch Action 46
String not found Patch Action 47
The messages are cosmetic and can be ignored. They will go away if you upgrade to 2016.3 with the latest update or 2017.3.
If you are like me living a country that does not have a localized version of LANDESK, you might run into this issue.
You start the Vulnerability Scan and when the message should appear that the vulscan detects a vulnerability, you only get the message: Unable to find string with ID...
This happens because LANDESK doesn't support the language of your OS but builds a XXXvulscan.dll with your language code. In the case of The Netherlands, we would see a NLDvulscan.dll. This 'localized' dll unfortunately doesn't contain the all of the strings the vulscan UI asks for.
To remedy this, go to the LDLogon share on the Core Server. Copy the ENUvulscan.dll and rename the copy to XXXvulscan.dll, XXX being your country ID. If the localized DLL exists already, delete it before you rename the copy.
That's it. Your vulscan running on the workstation will detect a newer DLL on the server and automatically download it. And you will have all the strings available from the English languange DLL, showing you exactly what is detected and more.
In addition this can occur if not all Vulscan related files are up to date and there is a mismatch.
As the Enterprise Ivanti Endpoint Manager Administrator of a large company that has had over 15 Core Servers with over 12,000 systems and over 20 other Ivanti tech's to support I have found "how should I patch" to come up often at my location as well as on this forum.
Like Windows, there are 3 or more ways to do most anything in Ivanti Endpoint Manager patching being one of those, and I have re-written the way I advocate our techs patch in Ivanti from the way I recommended a few years back and thought I would post it here for other to use as needed. It is not the only way, nor am I saying it is the best way.
Please keep in mind that this is a basic method, simple and effective. I did not go into Auto-Fix, some of our advanced tech's use it, others don't. I wanted something a newbie could pick up, read and begin patching in a very short amount of time.
Picking what patches to patch can be a political nightmare depending on your companies policies. Ours went from 12 groups doing it all differently, some patching critical's only, some not patching, others patching everything possible to a reduced number of groups that all now have a "baseline" that is set from up above that is pretty in-depth and aggressive deadlines to have them patched by.
In short, we patch all security related items with few exceptions that are patchable via Ivanti and we do it aggressively as you must nowadays in this world of exploits.
If you are not patching, I strongly suggest you start.
Attached is the method I recommend, it uses two tasks, one a "Push" the other a straight "Policy". Why not a "Policy Support Push" you ask? We were doing that but are finding that some systems will stick in the "active" bin of the scheduled tasks for some reason (being researched) and thus the task will not become a policy. If you restart the task, some of those systems will clear, but then others will stick... and so on.
It goes over creating a group of patches, creating the tasks, targeting the systems and scheduling the deployment.
I look forward to your feedback and I hope this helps some of you.
This document details the procedure for copying definitions from a "light core" (A core that is connected to outside networks) and a "Dark Core" (a core that is not connected to outside networks) This is often done for security purposes or lack of connectivity.
In order to download a complete set of data to transfer from the light core to the dark core, the database tables related to Patch Manager must be reset. This must occur on any core server that has previously downloaded patch data, otherwise a complete set of data will not be downloaded.
This can be done on both core servers by doing the following:
On the Dark Network Core Server, you will need to have a location for the vulnerability XML files and a location for the actual patches themselves to be stored in. For ease of use, we recommend using the already created patch folder structure that is set up when you install Ivanti EPM. By default, patches are stored in the \Program files\LANDESK\ManagementSuite\LDLogon\patch folder. If a different location is desired this article can be used to set up the alternative location.
If patches have not been downloaded on the dark core previously the patch folder may not have been created and should be manually created.
To verify further that this process has completed correctly, in \Program Files\LANDESK\Managementsuite\ldlogon\patch and it's subdirectories you should have .XML files that were generated by the Ivanti Content download to represent your vulnerability definitions. Do not change the folder structure or files.
Copy ENU_PatchSourcesXXX*.xml (Where XXX equals the current LDMS version) from \Program Files\LANDESK\ManagementSuite\LDMAIN to \Program Files\LANDESK\ManagementSuite\LDLOGON\PATCH on the source core. This step is necessary because Vaminer.exe (the program that is downloading the Patch Content) expects that file to be in that location. Again, this needs to match the version you are running: 9.5 (ENU_PatchSources95.xml), 9.6 (ENU_PatchSource96.xml, 2016.3 (ENU_PatchSources101.xml) and so on. Modification of the file is not necessary, it just needs to exist in that location.
In the \Program Files\LANDESK\ManagementSuite\LDMAIN folder there will be several files called ENU_PatchSources and then a numerical ending. These stand for the current and prior versions of LDMS. Choose the one that is the latest and matches your version on your core server.
For example: On a 2016.3 Core server you will likely see three ENU_PATCHSOURCESXXX files:
We would select ENU_PatchSources101.xml as this corresponds to LDMS 10.1 (2016.3) and begin editing it.
If your core is not running in the English language you will want to select the XML file that matches your language prefix (ESP, JPN, etc)
Modify the Enu_PatchSourcesXXX.xml as modeled below:
Line #2 in the .XML will contain ‘/LDPM8/ldvul.php?%Credentials%KEYWORD=filename&FILENAME=’. Replace it with /ldlogon/Patch (or whatever directory you have defined as your patch storage directory).
Before:
PatchesSrcRelativePath>/LDPM8/ldvul.php?%Credentials%KEYWORD=filename&FILENAME=patches</PatchesSrcRelativePath>
<LDAVRelativePath>/kvirus-8.0/mirror</LDAVRelativePath>
<CVEMoreInfo>http://cve.mitre.org/cgi-bin/cvename.cgi?name=%CVE_ID%</CVEMoreInfo>
After:
<PatchesSrcRelativePath>\LDLOGON\PATCH</PatchesSrcRelativePath>
<LDAVRelativePath>/kvirus-8.0/mirror</LDAVRelativePath>
<CVEMoreInfo>http://cve.mitre.org/cgi-bin/cvename.cgi?name=%CVE_ID%</CVEMoreInfo>
If you are using content that will be manually copied to the core server, put the name of your Dark Core server. If there will be constant or periodic network connection between your light core and dark core, put the name of your light core here.
In the following section you will select the definition download category that you want to download to the dark core and you will edit that entry in the .XML. We will replace the string that normally works with the LANDESK Patch server and replace it with a local path.
The following example is for the vulnerability definition category Windows Vulnerabilities Again, you will modify the path from the patch server location to a local directory. You also will add the tag <Enabled>true</enabled>. This is the same as ticking the checkbox next to the vulnerabilities category when bringing up the Download Updates tool.
Search for /LDPM8/ldvul.php?%Credentials%KEYWORD=filename&FILENAME=Windows2 the correct section by searching for "Windows2". Modify the section within the <URL> tags
The resulting line will be<URL>/LDLOGON/PATCH/Windows2</URL>.
You also will add the tag <Enabled>true</Enabled>. This is the same as ticking the checkbox next to the vulnerabilities category when bringing up the Download Updates tool. Without adding the <Enabled> tag you will need to select the categories every time Download Updates is opened.
When renaming these sections per component you wish to download, FILENAME=Windows2 will use the subdirectory name of "Windows2" under the Patch directory after you modify it. For example, if I wanted to change the source for Ivanti Data Analytics updates, you would search for that category by searching for just that - "LANDESK Data Analytics Updates".
You would then modify the <URL>/LDPM8/ldvul.php?%Credentials%KEYWORD=filename&FILENAME=LDDA</URL> to <URL>/LDLOGON/PATCH/LDDA</URL>.
Before:
<Source><URL>/LDPM8/ldvul.php?%Credentials%KEYWORD=filename&FILENAME=LDDA</URL>
<Description>LANDESK Data Analytics Updates</Description>
<ShowInLDSM>true</ShowInLDSM>
<ShowInLSM>true</ShowInLSM>
</Source>
After:
<Source><URL>/LDLOGON/PATCH/LDDA</URL>
<Description>LANDESK Data Analytics Updates</Description>
<ShowInLDSM>true</ShowInLDSM>
<ShowInLSM>true</ShowInLSM>
<Enabled>true</Enabled>
</Source>
Once all of the edits have been made do a "Save as" and save it as "Patchsourcestemp.xml" and mark it as a read-only file. (Right-click, go to properties and check the box "Read Only")
After you have marked it as read-only, rename it to "patchsources.xml". Remember, all of this is taking place in the LDMAIN folder.
Step six: Import the vulnerability definitions into the "Dark Core"
If you are automating the copying of the vulnerability data from the light core to the dark core, ensure the following steps are taking place:
This should be done on an automated schedule so that these steps take place in sequence and that there is enough time for each step to complete before the next one starts.
Overview
Microsoft has released an out of band Critical Update KB4078130 to disable mitigation against CVE-2017-5715.
Note: We highly recommend reading this Microsoft article:Update to disable mitigation against Spectre, Variant 2
MSNS18-01-4078130 / KB4078130 is a Critical Non-Security Patch that will disable the fix for variant 2 for stability issues. The machine must reboot after installing the patch for it to apply on the system.
To enable the fix again you may reinstall the patch for your OS that remediates CVE-2017-5715
Note: Clicking on a photo will enlarge it.
This document will go over what to look for and do if you think you have a patch that is detecting incorrectly on your devices. Incorrect detections can happen if the detection logic is incorrect and still reports as needed but the patch has already been installed, is not applicable to the system or other issues. In this document, you’ll learn what to look for in the vulscan logs which are required to submit the incorrect patch detection for review.
This document assumes you know how to find individual patches, create a patch group and move patches to it in the console and create a repair task on a specific patch or group of patches in the console. It also assumes you have an understanding of repair tasks and how to add target devices to them and run the task.
Prep the Client
As of January 2018 all new content created uses the new patching engine. Additional logs are needed as well as the vulscan log to troubleshoot the false detection.
Updated The "Get debug logs and zip (patch)" feature is only available in 2017.3 and newer product versions.
To retrieve logging remotely access the Diagnostic tool and select the Logs | Client option to view client-side logs. An additional option "Get debug logs and zip (patch)" is present for debug logging for all Next Gen definitions. This will only function if the Distribution and Patch agent setting has Enable security scan debug trace logselected.
To enable debug trace logs for versions 9.6 - 2017.1 run the following cmd locally on the endpoint or distribute a script to the desired device:
vulscan /enableDpdTrace=true /showui
The showui switch is optional.
This will generate additional logging in the Programdata\Landesk\DebugLog folder consisting of the following (2) files:
PatchManifestSyncSDK.log
PatchScanSDKDpdTrace.log
When the repair job finishes you will need the following files to give to support in a zip file:
C:\Programdata\landesk\log\Vulscan.log (Make sure it is the correct one, see below)
C:\Programdata\landesk\log\stdeploy.log
C:\Programdata\landesk\log\stdeployercore.log
C:\Programdata\Landesk\DebugLog\PatchManifestSyncSDK.log
C:\Programdata\Landesk\DebugLog\PatchScanSDKDpdTrace.log
Run a Repair Task
Running a repair task for the specific patch(es) gives supports the best information. The vulscan logs only showing one patch or two processing will show them detecting and installing and are more concise and easier to look over to find details. General vulscan logs are not Ideal as many only show the patch detecting but not installing and have a lot of unneeded information. Running a specific repair task with patches having the issue will provide the best logs.
You can create a repair task by going to Tools > Security and Compliance > Patch and Compliance. Click the Scan folder and find your patch. When you find the patch having the issue right click it and from the menu that appears click Repair. If you have a patch group or several patches you can do the same and create a repair task for several patches at the same time.
The Repair task dialog will open. Most settings you can leave as a defaults. You can add a target device at this time as well. If you have a maintenance window on your clients, be sure to check Ignore Maintenance Window if specified so the patch tries to install as well as scan in this repair task.
Once you have a target in your task run it and wait for it to complete.
Vulscan Log
The full vulscan log, created as a result of running the task, is needed for us to determine the issue of the false detection. This log is located on the target devices in the C:\programdata\Landesk\Log folder. They are named vulscan.log. Older logs have a number in the name. The correct log file will have a line at the top with the task ID in the name as shown in the example. This information changes with each task.
Thu, 26 Oct 2017 14:59:37 Command line: /policyfile="C:\ProgramData\LANDesk\Policies\CP.2353.RunNow._iOiXj4cedTDGǚFOGYMztt+mWNQ=.xml" Thu, 26 Oct 2017 14:59:37 client policy file: C:\ProgramData\LANDesk\Policies\CP.2353.RunNow._iOiXj4cedTDGǚFOGYMztt+mWNQ=.xml Thu, 26 Oct 2017 14:59:37 Reading policy parameters Thu, 26 Oct 2017 14:59:37 scan=0 Thu, 26 Oct 2017 14:59:37 scanFilter=INTL_4049179_MSU;INTL_3089023_MSU Thu, 26 Oct 2017 14:59:37 fixnow=True Thu, 26 Oct 2017 14:59:37 maintEnable=False
Once you have found the correct vulscan log. Doing a search in the log file for the all capitals case sensitive “DETECTED” will yield the detection of the patch and the reason. In our example case it show the file version is out dated and that is the reason the patch is needed.
Thu, 26 Oct 2017 14:59:45 VUL: '3089023_MSU' (windows8.1-kb3089023-x64.msu) DETECTED. Reason 'File C:\Windows\System32\flashplayerapp.exe version is less than the minimum version specified.'. Expected '18.0.0.232'. Found '11.3.300.265'. Patch required 'windows8.1-kb3089023-x64.msu'. Thu, 26 Oct 2017 14:59:45 Patch is NOT installed
You can see in the example the patch was detected as needed due to a file being at a lower version than in the patch. Now scroll down to the bottom of the log file. You’ll see a “Patch Installation” header and below that you will find details of what happened when the device attempted to install the patch. In our example the patch returned the error code 2149842967 converted to a hex value that gives a result of 0x80240017 Looking on the list of WUSA codes the patch returned a “Not Applicable”.
Thu, 26 Oct 2017 15:03:21 Command Interpreter running Thu, 26 Oct 2017 15:03:21 Setting current directory: C:\Program Files (x86)\LANDesk\LDClient\ Thu, 26 Oct 2017 15:03:21 Executing C:\Windows\system32\wusa.exe "C:\Program Files (x86)\LANDesk\LDClient\sdmcache\windows8.1-kb3089023-x64.msu" /quiet /norestart Thu, 26 Oct 2017 15:03:23 Exit Code: -2145124329 (0x80240017) Thu, 26 Oct 2017 15:03:23 Error: "C:\Windows\system32\wusa.exe" returned failure exit code (2149842967) Thu, 26 Oct 2017 15:03:23 ERROR(EXECUTEFILE) Failed to run command - 80004005 Thu, 26 Oct 2017 15:03:23 DownloadPatch ERROR: Failed to run commands (80004005). Thu, 26 Oct 2017 15:03:23 Last status: Failed Thu, 26 Oct 2017 15:03:23 Stopping wuauserv service. Thu, 26 Oct 2017 15:03:23 Stop service wuauserv Thu, 26 Oct 2017 15:03:25 Successfully controlled the service. Thu, 26 Oct 2017 15:03:25 DeferredReportAction: name 'windows8.1-kb3089023-x64.msu', code '1', type '-1', status 'Error: "C:\Windows\system32\wusa.exe" returned failure exit code (2149842967)' Thu, 26 Oct 2017 15:03:25 Running post-install/uninstall script Thu, 26 Oct 2017 15:03:25 RunPatches completed. 1 processed. 0 installed. 1 failures. Thu, 26 Oct 2017 15:03:25 Sending previous action history to core
STdeployercore.log
In addition the STdeployercore.log will also show the patch being installed and the error code for the Next Gen definitions:
2018-01-26T21:15:53.2279239Z 134c I DeploymentPackageReader.cpp:783 Deploy package 'C:\ProgramData\LANDesk\timber\sandboxes\InstallationSandbox#2018-01-26-T-21-15-15\0001c460-0000-0000-0000-000000000000.zip' successfully opened unsigned for package IO 2018-01-26T21:15:53.2279239Z 134c I Authenticode.cpp:134 Verifying signature of C:\Program Files (x86)\LANDesk\LDClient\sdmcache\windows6.1-kb4056894-x64_tw1158080.msu with CWinTrustVerifier 2018-01-26T21:15:54.2534266Z 134c V UnScriptedInstallation.cpp:30 Executing (C:\Program Files (x86)\LANDesk\LDClient\sdmcache\windows6.1-kb4056894-x64_tw1158080.msu /quiet /norestart), nShow: true. 2018-01-26T21:19:19.4406288Z 134c V ChildProcess.cpp:140 Process handle 00000408 returned '3010'.
Windows Update(WUSA) Error Codes
| Result Code | Result String | Description |
|---|---|---|
| 0x80240001 | WU_E_NO_SERVICE | Windows Update Agent was unable to provide the service. |
| 0x80240002 | WU_E_MAX_CAPACITY_REACHED | The maximum capacity of the service was exceeded. |
| 0x80240003 | WU_E_UNKNOWN_ID | An ID cannot be found. |
| 0x80240004 | WU_E_NOT_INITIALIZED | The object could not be initialized. |
| 0x80240005 | WU_E_RANGEOVERLAP | The update handler requested a byte range that overlaps a previously requested range. |
| 0x80240006 | WU_E_TOOMANYRANGES | The requested number of byte ranges exceeds the maximum number (2^31 - 1). |
| 0x80240007 | WU_E_INVALIDINDEX | The index to a collection was invalid. |
| 0x80240008 | WU_E_ITEMNOTFOUND | The key for the item queried could not be found. |
| 0x80240009 | WU_E_OPERATIONINPROGRESS | A conflicting operation was in progress. Some operations (such as installation) cannot be performed simultaneously. |
| 0x8024000A | WU_E_COULDNOTCANCEL | Cancellation of the operation was not allowed. |
| 0x8024000B | WU_E_CALL_CANCELLED | Operation was cancelled. |
| 0x8024000C | WU_E_NOOP | No operation was required. |
| 0x8024000D | WU_E_XML_MISSINGDATA | Windows Update Agent could not find the required information in the update's XML data. |
| 0x8024000E | WU_E_XML_INVALID | Windows Update Agent found invalid information in the update's XML data. |
| 0x8024000F | WU_E_CYCLE_DETECTED | Circular update relationships were detected in the metadata. |
| 0x80240010 | WU_E_TOO_DEEP_RELATION | Update relationships that are too deep were evaluated. |
| 0x80240011 | WU_E_INVALID_RELATIONSHIP | An invalid update relationship was detected. |
| 0x80240012 | WU_E_REG_VALUE_INVALID | An invalid registry value was read. |
| 0x80240013 | WU_E_DUPLICATE_ITEM | Operation tried to add a duplicate item to a list. |
| 0x80240016 | WU_E_INSTALL_NOT_ALLOWED | Operation tried to install while another installation was in progress or the system was pending a mandatory restart. |
| 0x80240017 | WU_E_NOT_APPLICABLE | Operation was not performed because there are no applicable updates. |
| 0x80240018 | WU_E_NO_USERTOKEN | Operation failed because a required user token is missing. |
| 0x80240019 | WU_E_EXCLUSIVE_INSTALL_CONFLICT | An exclusive update cannot be installed with other updates at the same time. |
| 0x8024001A | WU_E_POLICY_NOT_SET | A policy value was not set. |
| 0x8024001B | WU_E_SELFUPDATE_IN_PROGRESS | The operation could not be performed because the Windows Update Agent is self-updating. |
| 0x8024001D | WU_E_INVALID_UPDATE | An update contains invalid metadata. |
| 0x8024001E | WU_E_SERVICE_STOP | Operation did not complete because the service or system was being shut down. |
| 0x8024001F | WU_E_NO_CONNECTION | Operation did not complete because the network connection was unavailable. |
| 0x80240020 | WU_E_NO_INTERACTIVE_USER | Operation did not complete because there is no logged-on interactive user. |
| 0x80240021 | WU_E_TIME_OUT | Operation did not complete because it timed out. |
| 0x80240022 | WU_E_ALL_UPDATES_FAILED | Operation failed for all the updates. |
| 0x80240023 | WU_E_EULAS_DECLINED | The license terms for all updates were declined. |
| 0x80240024 | WU_E_NO_UPDATE | There are no updates. |
| 0x80240025 | WU_E_USER_ACCESS_DISABLED | Group Policy settings prevented access to Windows Update. |
| 0x80240026 | WU_E_INVALID_UPDATE_TYPE | The type of update is invalid. |
| 0x80240027 | WU_E_URL_TOO_LONG | The URL exceeded the maximum length. |
| 0x80240028 | WU_E_UNINSTALL_NOT_ALLOWED | The update could not be uninstalled because the request did not originate from a WSUS server. |
| 0x80240029 | WU_E_INVALID_PRODUCT_LICENSE | Search may have missed some updates before there is an unlicensed application on the system. |
| 0x8024002A | WU_E_MISSING_HANDLER | A component that is required to detect applicable updates was missing. |
| 0x8024002B | WU_E_LEGACYSERVER | An operation did not complete because it requires a newer version of server software. |
| 0x8024002C | WU_E_BIN_SOURCE_ABSENT | A delta-compressed update could not be installed because it required the source. |
| 0x8024002D | WU_E_SOURCE_ABSENT | A full-file update could not be installed because it required the source. |
| 0x8024002E | WU_E_WU_DISABLED | Access to an unmanaged server is not allowed. |
| 0x8024002F | WU_E_CALL_CANCELLED_BY_POLICY | Operation did not complete because the DisableWindowsUpdateAccess policy was set. |
| 0x80240030 | WU_E_INVALID_PROXY_SERVER | The format of the proxy list was invalid. |
| 0x80240031 | WU_E_INVALID_FILE | The file is in the wrong format. |
| 0x80240032 | WU_E_INVALID_CRITERIA | The search criteria string was invalid. |
| 0x80240033 | WU_E_EULA_UNAVAILABLE | License terms could not be downloaded. |
| 0x80240034 | WU_E_DOWNLOAD_FAILED | Update failed to download. |
| 0x80240035 | WU_E_UPDATE_NOT_PROCESSED | The update was not processed. |
| 0x80240036 | WU_E_INVALID_OPERATION | The object's current state did not allow the operation. |
| 0x80240037 | WU_E_NOT_SUPPORTED | The functionality for the operation is not supported. |
| 0x80240038 | WU_E_WINHTTP_INVALID_FILE | The downloaded file has an unexpected content type. |
| 0x80240039 | WU_E_TOO_MANY_RESYNC | The agent was asked by server to synchronize too many times. |
| 0x80240040 | WU_E_NO_SERVER_CORE_SUPPORT | WUA API method does not run on a Server Core installation option of the Windows 2008 R2 operating system. |
| 0x80240041 | WU_E_SYSPREP_IN_PROGRESS | Service is not available when sysprep is running. |
| 0x80240042 | WU_E_UNKNOWN_SERVICE | The update service is no longer registered with Automatic Updates. |
| 0x80240FFF | WU_E_UNEXPECTED | An operation failed due to reasons not covered by another error code. |
| 0x80241001 | WU_E_MSI_WRONG_VERSION | Search may have missed some updates because Windows Installer is less than version 3.1. |
| 0x80241002 | WU_E_MSI_NOT_CONFIGURED | Search may have missed some updates because Windows Installer is not configured. |
| 0x80241003 | WU_E_MSP_DISABLED | Search may have missed some updates because a policy setting disabled Windows Installer patching. |
| 0x80241004 | WU_E_MSI_WRONG_APP_CONTEXT | An update could not be applied because the application is installed per-user. |
| 0x80241FFF | WU_E_MSP_UNEXPECTED | Search may have missed some updates because there was a failure of Windows Installer. |
| 0x80242000 | WU_E_UH_REMOTEUNAVAILABLE | A request for a remote update handler could not be completed because no remote process is available. |
| 0x80242001 | WU_E_UH_LOCALONLY | A request for a remote update handler could not be completed because the handler is local only. |
| 0x80242002 | WU_E_UH_UNKNOWNHANDLER | A request for an update handler could not be completed because the handler could not be recognized. |
| 0x80242003 | WU_E_UH_REMOTEALREADYACTIVE | A remote update handler could not be created because one already exists. |
| 0x80242004 | WU_E_UH_DOESNOTSUPPORTACTION | A request for the handler to install (uninstall) an update could not be completed because the update does not support install (uninstall). |
| 0x80242005 | WU_E_UH_WRONGHANDLER | An operation did not complete because the wrong handler was specified. |
| 0x80242006 | WU_E_UH_INVALIDMETADATA | A handler operation could not be completed because the update contains invalid metadata. |
| 0x80242007 | WU_E_UH_INSTALLERHUNG | An operation could not be completed because the installer exceeded the time limit. |
| 0x80242008 | WU_E_UH_OPERATIONCANCELLED | An operation being done by the update handler was cancelled. |
| 0x80242009 | WU_E_UH_BADHANDLERXML | An operation could not be completed because the handler-specific metadata is invalid. |
| 0x8024200A | WU_E_UH_CANREQUIREINPUT | A request to the handler to install an update could not be completed because the update requires user input. |
| 0x8024200B | WU_E_UH_INSTALLERFAILURE | The installer failed to install (uninstall) one or more updates. |
| 0x8024200C | WU_E_UH_FALLBACKTOSELFCONTAINED | The update handler should download self-contained content rather than delta-compressed content for the update. |
| 0x8024200D | WU_E_UH_NEEDANOTHERDOWNLOAD | The update handler did not install the update because the update needs to be downloaded again. |
| 0x8024200E | WU_E_UH_NOTIFYFAILURE | The update handler failed to send notification of the status of the install (uninstall) operation. |
| 0x8024200F | WU_E_UH_INCONSISTENT_FILE_NAMES | The file names in the update metadata are inconsistent with the file names in the update package. |
| 0x80242010 | WU_E_UH_FALLBACKERROR | The update handler failed to fall back to the self-contained content. |
| 0x80242011 | WU_E_UH_TOOMANYDOWNLOADREQUESTS | The update handler has exceeded the maximum number of download requests. |
| 0x80242012 | WU_E_UH_UNEXPECTEDCBSRESPONSE | The update handler has received an unexpected response from CBS. |
| 0x80242013 | WU_E_UH_BADCBSPACKAGEID | The update metadata contains an invalid CBS package identifier. |
| 0x80242014 | WU_E_UH_POSTREBOOTSTILLPENDING | The post-reboot operation for the update is still in progress. |
| 0x80242015 | WU_E_UH_POSTREBOOTRESULTUNKNOWN | The result of the post-reboot operation for the update could not be determined. |
| 0x80242016 | WU_E_UH_POSTREBOOTUNEXPECTEDSTATE | The state of the update after its post-reboot operation has completed is unexpectedly. |
| 0x80242017 | WU_E_UH_NEW_SERVICING_STACK_REQUIRED | The operating system servicing stack must be updated before this update is downloaded or installed. |
| 0x80242FFF | WU_E_UH_UNEXPECTED | This update handler error is not covered by another WU_E_UH_* code. |
| 0x80243001 | WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSION | The results of the download and installation could not be read in the registry due to an unrecognized data format version. |
| 0x80243002 | WU_E_INSTALLATION_RESULTS_INVALID_DATA | The results of download and installation could not be read in the registry due to an invalid data format. |
| 0x80243003 | WU_E_INSTALLATION_RESULTS_NOT_FOUND | The results of download and installation are not available; the operation may have failed to start. |
| 0x80243004 | WU_E_TRAYICON_FAILURE | A failure occurred when trying to create an icon in the notification area. |
| 0x80243FFD | WU_E_NON_UI_MODE | Unable to show the user interface (UI) when in a non-UI mode; Windows Update (WU) client UI modules may not be installed. |
| 0x80243FFE | WU_E_WUCLTUI_UNSUPPORTED_VERSION | Unsupported version of WU client UI exported functions. |
| 0x80243FFF | WU_E_AUCLIENT_UNEXPECTED | There was a user interface error not covered by another WU_E_AUCLIENT_* error code. |
| 0x80244000 | WU_E_PT_SOAPCLIENT_BASE | WU_E_PT_SOAPCLIENT_* error codes map to the SOAPCLIENT_ERROR enum of the ATL Server Library. |
| 0x80244001 | WU_E_PT_SOAPCLIENT_INITIALIZE | Initialization of the SOAP client failed, possibly because of an MSXML installation failure. |
| 0x80244002 | WU_E_PT_SOAPCLIENT_OUTOFMEMORY | SOAP client failed because it ran out of memory. |
| 0x80244003 | WU_E_PT_SOAPCLIENT_GENERATE | SOAP client failed to generate the request. |
| 0x80244004 | WU_E_PT_SOAPCLIENT_CONNECT | SOAP client failed to connect to the server. |
| 0x80244005 | WU_E_PT_SOAPCLIENT_SEND | SOAP client failed to send a message due to WU_E_WINHTTP_* error codes. |
| 0x80244006 | WU_E_PT_SOAPCLIENT_SERVER | SOAP client failed because there was a server error. |
| 0x80244007 | WU_E_PT_SOAPCLIENT_SOAPFAULT | SOAP client failed because there was a SOAP fault due to WU_E_PT_SOAP_* error codes. |
| 0x80244008 | WU_E_PT_SOAPCLIENT_PARSEFAULT | SOAP client failed to parse a SOAP fault. |
| 0x80244009 | WU_E_PT_SOAPCLIENT_READ | SOAP client failed while reading the response from the server. |
| 0x8024400A | WU_E_PT_SOAPCLIENT_PARSE | SOAP client failed to parse the response from the server. |
| 0x8024400B | WU_E_PT_SOAP_VERSION | SOAP client found an unrecognizable namespace for the SOAP envelope. |
| 0x8024400C | WU_E_PT_SOAP_MUST_UNDERSTAND | SOAP client was unable to understand a header. |
| 0x8024400D | WU_E_PT_SOAP_CLIENT | SOAP client found the message was malformed (fix before resending). |
| 0x8024400E | WU_E_PT_SOAP_SERVER | The SOAP message could not be processed due to a server error (resend later). |
| 0x8024400F | WU_E_PT_WMI_ERROR | There was an unspecified Windows Management Instrumentation (WMI) error. |
| 0x80244010 | WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS | The number of round trips to the server exceeded the maximum limit. |
| 0x80244011 | WU_E_PT_SUS_SERVER_NOT_SET | WUServer policy value is missing in the registry. |
| 0x80244012 | WU_E_PT_DOUBLE_INITIALIZATION | Initialization failed because the object was already initialized. |
| 0x80244013 | WU_E_PT_INVALID_COMPUTER_NAME | The computer name could not be determined. |
| 0x80244015 | WU_E_PT_REFRESH_CACHE_REQUIRED | The reply from the server indicates that the server was changed or the cookie was invalid; refresh the state of the internal cache and retry. |
| 0x80244016 | WU_E_PT_HTTP_STATUS_BAD_REQUEST | HTTP 400 - the server could not process the request due to invalid syntax. |
| 0x80244017 | WU_E_PT_HTTP_STATUS_DENIED | HTTP 401 - the requested resource requires user authentication. |
| 0x80244018 | WU_E_PT_HTTP_STATUS_FORBIDDEN | HTTP 403 - server understood the request, but declined to fulfill it. |
| 0x80244019 | WU_E_PT_HTTP_STATUS_NOT_FOUND | HTTP 404 - the server cannot find the requested Uniform Resource Identifier (URI). |
| 0x8024401A | WU_E_PT_HTTP_STATUS_BAD_METHOD | HTTP 405 - the HTTP method is not allowed. |
| 0x8024401B | WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ | HTTP 407 - proxy authentication is required. |
| 0x8024401C | WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT | HTTP 408 - the server timed out waiting for the request. |
| 0x8024401D | WU_E_PT_HTTP_STATUS_CONFLICT | HTTP 409 - the request was not completed due to a conflict with the current state of the resource. |
| 0x8024401E | WU_E_PT_HTTP_STATUS_GONE | HTTP 410 - the requested resource is no longer available at the server. |
| 0x8024401F | WU_E_PT_HTTP_STATUS_SERVER_ERROR | HTTP 500 - an error internal to the server prevented fulfilling the request. |
| 0x80244020 | WU_E_PT_HTTP_STATUS_NOT_SUPPORTED | HTTP 501 - server does not support the functionality that is required to fulfill the request. |
| 0x80244021 | WU_E_PT_HTTP_STATUS_BAD_GATEWAY | HTTP 502 - the server, while acting as a gateway or proxy, received an invalid response from the upstream server it accessed when attempting to fulfill the request. |
| 0x80244022 | WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL | HTTP 503 - the service is temporarily overloaded. |
| 0x80244023 | WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUT | HTTP 504 - the request was timed out waiting for a gateway. |
| 0x80244024 | WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP | HTTP 505 - the server does not support the HTTP protocol version used for the request. |
| 0x80244025 | WU_E_PT_FILE_LOCATIONS_CHANGED | Operation failed due to a changed file location; refresh internal state and resend. |
| 0x80244026 | WU_E_PT_REGISTRATION_NOT_SUPPORTED | Operation failed because Windows Update Agent does not support registration with a non-WSUS server. |
| 0x80244027 | WU_E_PT_NO_AUTH_PLUGINS_REQUESTED | The server returned an empty authentication information list. |
| 0x80244028 | WU_E_PT_NO_AUTH_COOKIES_CREATED | Windows Update Agent was unable to create any valid authentication cookies. |
| 0x80244029 | WU_E_PT_INVALID_CONFIG_PROP | A configuration property value was wrong. |
| 0x8024402A | WU_E_PT_CONFIG_PROP_MISSING | A configuration property value was missing. |
| 0x8024402B | WU_E_PT_HTTP_STATUS_NOT_MAPPED | The HTTP request could not be completed and the reason did not correspond to any of the WU_E_PT_HTTP_* error codes. |
| 0x8024402C | WU_E_PT_WINHTTP_NAME_NOT_RESOLVED | The proxy server or target server name cannot be resolved. |
| 0x8024402F | WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS | External .cab file processing completed with some errors. |
| 0x80244030 | WU_E_PT_ECP_INIT_FAILED | The external .cab file processor initialization did not complete. |
| 0x80244031 | WU_E_PT_ECP_INVALID_FILE_FORMAT | The format of a metadata file was invalid. |
| 0x80244032 | WU_E_PT_ECP_INVALID_METADATA | External .cab file processor found invalid metadata. |
| 0x80244033 | WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST | The file digest could not be extracted from an external .cab file. |
| 0x80244034 | WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILE | An external .cab file could not be decompressed. |
| 0x80244035 | WU_E_PT_ECP_FILE_LOCATION_ERROR | External .cab processor was unable to get file locations. |
| 0x80244FFF | WU_E_PT_UNEXPECTED | There was a communication error not covered by another WU_E_PT_* error code |
| 0x80245001 | WU_E_REDIRECTOR_LOAD_XML | The redirector XML document could not be loaded into the Document Object Model (DOM) class. |
| 0x80245002 | WU_E_REDIRECTOR_S_FALSE | The redirector XML document is missing some required information. |
| 0x80245003 | WU_E_REDIRECTOR_ID_SMALLER | The redirector ID in the downloaded redirector .cab file is less than in the cached .cab file. |
| 0x8024502D | WU_E_PT_SAME_REDIR_ID | Windows Update Agent failed to download a redirector .cab file with a new redirector ID value from the server during the recovery. |
| 0x8024502E | WU_E_PT_NO_MANAGED_RECOVER | A redirector recovery action did not complete because the server is managed. |
| 0x80245FFF | WU_E_REDIRECTOR_UNEXPECTED | The redirector failed for reasons not covered by another WU_E_REDIRECTOR_* error code. |
| 0x80246001 | WU_E_DM_URLNOTAVAILABLE | A download manager operation could not be completed because the requested file does not have a URL. |
| 0x80246002 | WU_E_DM_INCORRECTFILEHASH | A download manager operation could not be completed because the file digest was not recognized. |
| 0x80246003 | WU_E_DM_UNKNOWNALGORITHM | A download manager operation could not be completed because the file metadata requested an unrecognized hash algorithm. |
| 0x80246004 | WU_E_DM_NEEDDOWNLOADREQUEST | An operation could not be completed because a download request is required from the download handler. |
| 0x80246005 | WU_E_DM_NONETWORK | A download manager operation could not be completed because the network connection was unavailable. |
| 0x80246006 | WU_E_DM_WRONGBITSVERSION | A download manager operation could not be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible. |
| 0x80246007 | WU_E_DM_NOTDOWNLOADED | The update has not been downloaded. |
| 0x80246008 | WU_E_DM_FAILTOCONNECTTOBITS | A download manager operation failed because the download manager was unable to connect the Background Intelligent Transfer Service (BITS). |
| 0x80246009 | WU_E_DM_BITSTRANSFERERROR | A download manager operation failed because there was an unspecified Background Intelligent Transfer Service (BITS) transfer error. |
| 0x8024600a | WU_E_DM_DOWNLOADLOCATIONCHANGED | A download must be restarted because the location of the source of the download has changed. |
| 0x8024600B | WU_E_DM_CONTENTCHANGED | A download must be restarted because the update content changed in a new revision. |
| 0x80246FFF | WU_E_DM_UNEXPECTED | There was a download manager error not covered by another WU_E_DM_* error code. |
| 0x80247001 | WU_E_OL_INVALID_SCANFILE | An operation could not be completed because the scan package was invalid. |
| 0x80247002 | WU_E_OL_NEWCLIENT_REQUIRED | An operation could not be completed because the scan package requires a greater version of the Windows Update Agent. |
| 0x80247FFF | WU_E_OL_UNEXPECTED | Search using the scan package failed. |
| 0x80248000 | WU_E_DS_SHUTDOWN | An operation failed because Windows Update Agent is shutting down. |
| 0x80248001 | WU_E_DS_INUSE | An operation failed because the data store was in use. |
| 0x80248002 | WU_E_DS_INVALID | The current and expected states of the data store do not match. |
| 0x80248003 | WU_E_DS_TABLEMISSING | The data store is missing a table. |
| 0x80248004 | WU_E_DS_TABLEINCORRECT | The data store contains a table with unexpected columns. |
| 0x80248005 | WU_E_DS_INVALIDTABLENAME | A table could not be opened because the table is not in the data store. |
| 0x80248006 | WU_E_DS_BADVERSION | The current and expected versions of the data store do not match. |
| 0x80248007 | WU_E_DS_NODATA | The information requested is not in the data store. |
| 0x80248008 | WU_E_DS_MISSINGDATA | The data store is missing required information or has a null value in a table column that requires a non-null value. |
| 0x80248009 | WU_E_DS_MISSINGREF | The data store is missing required information or has a reference to missing license terms, a file, a localized property, or a linked row. |
| 0x8024800A | WU_E_DS_UNKNOWNHANDLER | The update was not processed because its update handler could not be recognized. |
| 0x8024800B | WU_E_DS_CANTDELETE | The update was not deleted because it is still referenced by one or more services. |
| 0x8024800C | WU_E_DS_LOCKTIMEOUTEXPIRED | The data store section could not be locked within the allotted time. |
| 0x8024800D | WU_E_DS_NOCATEGORIES | The category was not added because it contains no parent categories, and it is not a top-level category. |
| 0x8024800E | WU_E_DS_ROWEXISTS | The row was not added because an existing row has the same primary key. |
| 0x8024800F | WU_E_DS_STOREFILELOCKED | The data store could not be initialized because it was locked by another process. |
| 0x80248010 | WU_E_DS_CANNOTREGISTER | The data store is not allowed to be registered with COM in the current process. |
| 0x80248011 | WU_E_DS_UNABLETOSTART | Could not create a data store object in another process. |
| 0x80248013 | WU_E_DS_DUPLICATEUPDATEID | The server sent the same update to the client computer, with two different revision IDs. |
| 0x80248014 | WU_E_DS_UNKNOWNSERVICE | An operation did not complete because the service is not in the data store. |
| 0x80248015 | WU_E_DS_SERVICEEXPIRED | An operation did not complete because the registration of the service has expired. |
| 0x80248016 | WU_E_DS_DECLINENOTALLOWED | A request to hide an update was declined because it is a mandatory update or because it was deployed with a deadline. |
| 0x80248017 | WU_E_DS_TABLESESSIONMISMATCH | A table was not closed because it is not associated with the session. |
| 0x80248018 | WU_E_DS_SESSIONLOCKMISMATCH | A table was not closed because it is not associated with the session. |
| 0x80248019 | WU_E_DS_NEEDWINDOWSSERVICE | A request to remove the Windows Update service or to unregister it with Automatic Updates was declined because it is a built-in service and Automatic Updates cannot fall back to another service. |
| 0x8024801A | WU_E_DS_INVALIDOPERATION | A request was declined because the operation is not allowed. |
| 0x8024801B | WU_E_DS_SCHEMAMISMATCH | The schema of the current data store and the schema of a table in a backup XML document do not match. |
| 0x8024801C | WU_E_DS_RESETREQUIRED | The data store requires a session reset; release the session and retry with a new session. |
| 0x8024801D | WU_E_DS_IMPERSONATED | A data store operation did not complete because it was requested with an impersonated identity. |
| 0x80248FFF | WU_E_DS_UNEXPECTED | There was a data store error not covered by another WU_E_DS_* code. |
| 0x80249001 | WU_E_INVENTORY_PARSEFAILED | Parsing of the rule file failed. |
| 0x80249002 | WU_E_INVENTORY_GET_INVENTORY_TYPE_FAILED | Failed to get the requested inventory type from the server. |
| 0x80249003 | WU_E_INVENTORY_RESULT_UPLOAD_FAILED | Failed to upload inventory result to the server. |
| 0x80249004 | WU_E_INVENTORY_UNEXPECTED | There was an inventory error not covered by another error code. |
| 0x80249005 | WU_E_INVENTORY_WMI_ERROR | A WMI error occurred when enumerating the instances for a particular class. |
| 0x8024A000 | WU_E_AU_NOSERVICE | Automatic Updates was unable to service incoming requests. |
| 0x8024A002 | WU_E_AU_NONLEGACYSERVER | The old version of Automatic Updates has stopped because the WSUS server has been upgraded. |
| 0x8024A003 | WU_E_AU_LEGACYCLIENTDISABLED | The old version of Automatic Updates was disabled. |
| 0x8024A004 | WU_E_AU_PAUSED | Automatic Updates was unable to process incoming requests because it was paused. |
| 0x8024A005 | WU_E_AU_NO_REGISTERED_SERVICE | No unmanaged service is registered with AU. |
| 0x8024AFFF | WU_E_AU_UNEXPECTED | There was an Automatic Updates error not covered by another WU_E_AU * code. |
| 0x8024C001 | WU_E_DRV_PRUNED | A driver was skipped. |
| 0x8024C002 | WU_E_DRV_NOPROP_OR_LEGACY | A property for the driver could not be found. It may not conform with required specifications. |
| 0x8024C003 | WU_E_DRV_REG_MISMATCH | The registry type read for the driver does not match the expected type. |
| 0x8024C004 | WU_E_DRV_NO_METADATA | The driver update is missing metadata. |
| 0x8024C005 | WU_E_DRV_MISSING_ATTRIBUTE | The driver update is missing a required attribute. |
| 0x8024C006 | WU_E_DRV_SYNC_FAILED | Driver synchronization failed. |
| 0x8024C007 | WU_E_DRV_NO_PRINTER_CONTENT | Information required for the synchronization of applicable printers is missing. |
| 0x8024CFFF | WU_E_DRV_UNEXPECTED | There was a driver error not covered by another WU_E_DRV_* code. |
| 0x8024D001 | WU_E_SETUP_INVALID_INFDATA | Windows Update Agent could not be updated because an .inf file contains invalid information. |
| 0x8024D002 | WU_E_SETUP_INVALID_IDENTDATA | Windows Update Agent could not be updated because the wuident.cab file contains invalid information. |
| 0x8024D003 | WU_E_SETUP_ALREADY_INITIALIZED | Windows Update Agent could not be updated because of an internal error that caused setup initialization to be performed twice. |
| 0x8024D004 | WU_E_SETUP_NOT_INITIALIZED | Windows Update Agent could not be updated because setup initialization never completed successfully. |
| 0x8024D005 | WU_E_SETUP_SOURCE_VERSION_MISMATCH | Windows Update Agent could not be updated because the versions specified in the .inf file do not match the actual source file versions. |
| 0x8024D006 | WU_E_SETUP_TARGET_VERSION_GREATER | Windows Update Agent could not be updated because a Windows Update Agent file on the target system is newer than the corresponding source file. |
| 0x8024D007 | WU_E_SETUP_REGISTRATION_FAILED | Windows Update Agent could not be updated because regsvr32.exe returned an error. |
| 0x8024D008 | WU_E_SELFUPDATE_SKIP_ON_FAILURE | An update to the Windows Update Agent was skipped because previous attempts to update failed. |
| 0x8024D009 | WU_E_SETUP_SKIP_UPDATE | An update to the Windows Update Agent was skipped due to a directive in the wuident.cab file. |
| 0x8024D00A | WU_E_SETUP_UNSUPPORTED_CONFIGURATION | Windows Update Agent could not be updated because the current system configuration is not supported. |
| 0x8024D00B | WU_E_SETUP_BLOCKED_CONFIGURATION | Windows Update Agent could not be updated because the system is configured to block the update. |
| 0x8024D00C | WU_E_SETUP_REBOOT_TO_FIX | Windows Update Agent could not be updated because a restart of the system is required. |
| 0x8024D00D | WU_E_SETUP_ALREADYRUNNING | Windows Update Agent setup is already running. |
| 0x8024D00E | WU_E_SETUP_REBOOTREQUIRED | Windows Update Agent setup package requires a reboot to complete installation. |
| 0x8024D00F | WU_E_SETUP_HANDLER_EXEC_FAILURE | Windows Update Agent could not be updated because the setup handler failed when it was run. |
| 0x8024D010 | WU_E_SETUP_INVALID_REGISTRY_DATA | Windows Update Agent could not be updated because the registry contains invalid information. |
| 0x8024D011 | WU_E_SELFUPDATE_REQUIRED | Windows Update Agent must be updated before search can continue. |
| 0x8024D012 | WU_E_SELFUPDATE_REQUIRED_ADMIN | Windows Update Agent must be updated before search can continue. An administrator is required to perform the operation. |
| 0x8024D013 | WU_E_SETUP_WRONG_SERVER_VERSION | Windows Update Agent could not be updated because the server does not contain update information for this version. |
| 0x8024DFFF | WU_E_SETUP_UNEXPECTED | Windows Update Agent could not be updated because of an error not covered by another WU_E_SETUP_* error code. |
| 0x8024E001 | WU_E_EE_UNKNOWN_EXPRESSION | An expression evaluator operation could not be completed because an expression was unrecognized. |
| 0x8024E002 | WU_E_EE_INVALID_EXPRESSION | An expression evaluator operation could not be completed because an expression was invalid. |
| 0x8024E003 | WU_E_EE_MISSING_METADATA | An expression evaluator operation could not be completed because an expression contains an incorrect number of metadata nodes. |
| 0x8024E004 | WU_E_EE_INVALID_VERSION | An expression evaluator operation could not be completed because the version of the serialized expression data is invalid. |
| 0x8024E005 | WU_E_EE_NOT_INITIALIZED | The expression evaluator could not be initialized. |
| 0x8024E006 | WU_E_EE_INVALID_ATTRIBUTEDATA | An expression evaluator operation could not be completed because there was an invalid attribute. |
| 0x8024E007 | WU_E_EE_CLUSTER_ERROR | An expression evaluator operation could not be completed because the cluster state of the computer could not be determined. |
| 0x8024EFFF | WU_E_EE_UNEXPECTED | There was an expression evaluator error not covered by another WU_E_EE_* error code. |
| 0x8024F001 | WU_E_REPORTER_EVENTCACHECORRUPT | The event cache file was defective. |
| 0x8024F002 | WU_E_REPORTER_ EVENTNAMESPACEPARSEFAILED | The XML in the event namespace descriptor could not be parsed. |
| 0x8024F003 | WU_E_INVALID_EVENT | The XML in the event namespace descriptor could not be parsed. |
| 0x8024F004 | WU_E_SERVER_BUSY | The server rejected an event because the server was too busy. |
| 0x8024FFFF | WU_E_REPORTER_UNEXPECTED | There was a reporter error not covered by another error code. |
Windows Update Agent Result Codes
Manually Testing the Patch
It is best practice that you download the patch to the device and manually run in in the GUI. The patch should display a message giving the same reason for not installing in a dialog. Once you have verified why the patch will not install manually, contact support and be sure to upload the vulscan log from the repair task to the case.
Detection Issues That Support Likely Will Not be able to Resolve
Certain false detection issues can occur that support will likely be unable to troubleshoot or resolve. The most likely of these is with our powershell scripts running on Windows 7 devices. The example from another vulscan log below shows a script error when trying to run on a device.
Mon, 23 Oct 2017 14:58:48 File OSVERSION version within specified Mon, 23 Oct 2017 14:58:48 Prod Windows 7 Service Pack 1 (ID:WIN7SP1) verified OSVERSION, found: 6.1.7601.1 Mon, 23 Oct 2017 14:58:48 Prod Windows 7 Service Pack 1 (ID:WIN7SP1) verified C:\Windows\explorer.exe, found: C:\Windows\explorer.exe Mon, 23 Oct 2017 14:58:48 Running detection script Mon, 23 Oct 2017 14:58:48 Content filename: 'RollupFixB201710.ps1' Mon, 23 Oct 2017 14:58:48 Writing script content to file 'C:\Windows\TEMP\RollupFixB201710.ps1' starting at line 5 Mon, 23 Oct 2017 14:58:48 Launching external script processor: <powershell.exe> Mon, 23 Oct 2017 14:58:48 args: <-executionpolicy bypass C:\Windows\TEMP\RollupFixB201710.ps1> Mon, 23 Oct 2017 14:58:48 External timeout: 60 Mon, 23 Oct 2017 14:58:48 Called CreateProcess: "powershell.exe" Mon, 23 Oct 2017 14:58:48 Error 2 launching application <powershell.exe> Mon, 23 Oct 2017 14:58:48 4041681_MSU detected Mon, 23 Oct 2017 14:58:48 VUL: '4041681_MSU' (windows6.1-kb4041681-x86.msu) DETECTED. Reason 'Unexpected error in custom script source. See agent log for details'. Expected ''. Found ''. Patch required 'windows6.1-kb4041681-x86.msu'. Mon, 23 Oct 2017 14:58:48 Patch is NOT installed Mon, 23 Oct 2017 14:58:48 Last status: Done
You can see from the log that the script attempted to run but got a 'Unexpected error in custom script source. See agent log for details' error. In all cases where we cannot get a proper detection from our scripts Ivanti errs on the side of caution and will throw a DETECTED and will try and install the patch just to be safe.
Issues that arise from script errors are difficult to impossible for us to troubleshoot. The likely cause is a security setting or Antivirus/Malware program that prevents the script from running. GPOs and powershell policies can also interfere if they are enabled in the customers environment. Since issues like this are impossible to replicate in our teat labs and are unique to the customers environment, the customer is advised to do some troubleshooting and see if security settings and restrictions can be lowered on a test device to try and get the script to run properly before contacting support.
This document illustrates the files, registry, settings and other information necessary to effectively troubleshoot a vulnerability scan.
In addition, this document walks through the steps that a basic Patch and Compliance scan (otherwise known as a vulnerability scan) takes.
This article will not describe every single step that the Vulnerability Scanner takes, but those steps where a failure can occur.
For the purposes of this document a simple scan is performed by running the following at the client command line:
vulscan /scan=0 /showui
This command tells the vulnerability scanner to scan Windows vulnerabilities (type 0) and to show a user interface.
More information about vulscan command line switches.
The name "LDMS2016" and "LDMS2016_v###" will be seen throughout this document. This refers to the Core Server name of "LDMS2016" which is the name of the core server that the author had when creating the document.
The settings that control how the vulnerability scanner will behave are stored in the Distribution and Patch Settings within the Agent Settings tool.
These settings control behaviors such as user input options, Cloud Services Appliances patch options, scanner CPU utilization, etc.
These settings are stored in the Ivanti EPM Database in the AgentSettings table and physically on the core server in the
\Program Files\LANDESK\ManagementSuite\ldlogon\AgentBehaviors folder. The Distribution and Patch Settings are stored in the AgentBehavior_(Corename)_v###.xml file within this folder.
Example
The categories available to scan and repair are controlled by the Product license that has been purchased and activated on the core server.
The following graphic shows the categories available within the Download Updates function within the Patch and Compliance tool for those with a license for all categories.
Click for full size
For Product Licensing support Contact Ivanti supportand select the Product Licensing option.
HLKM\Software\LANDESK\ManagementSuite\PatchManagement\WebServiceMaxThreads
This key does not exist by default and should only be created with an understanding of how this key works and the full ramifications of creating this key and changing the default value. This changes the number of default threads
This key is documented here: https://community.landesk.com/docs/DOC-36027#jive_content_id_Increasing_the_Number_of_Web_Process_to_Database_Threads
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\landesk\managementsuite\WinClient\Vulscan
This registry key contains the following information:
| Name | Type | Data | Description |
|---|---|---|---|
| AgentBehavior | REG_SZ | LDMS2016_v495 | The agent behavior that vulscan will use when operating |
| AlternateRebootBehavior | /rebootIfNeeded is called from 3 possible locations during a client configuration. It is hard for the task-handler version of the caller to know that a one-time-only (client-config-only) reboot override has been specified. So all installers just call vulscan with the /UseAlternateRebootBehavior. If vulscan can find the string value of "AlternateRebootBehavior" in the vulscanreg key, it'll act as if the behavior was passed by the command line. | ||
| CommandLine | REG_SZ | The command line that was used to launch vulscan | |
| ComputerIdn.LDMS2016 | REG_DWORD | 0x00000006 | When running in a /showui mode the ComputerIDN is accessed locally from the registry rather than needing a separate GetSystemIDN for the UI through a second web service call to the core. This value matches the ComputerIDN identifier in the Ivanti Endpoint Manager database. |
| KLBehavior | REG_SZ | LDMS2016_v517 | This refers to the Ivanti Antivirus behavior. This will exist even if Ivanti Antivirus is not installed on the client. |
| LastReportedReboot.LDMS2016 | REG_DWORD | 0x00000001 | |
| trustedfilelist | REG_SZ | LDMS2016_v861 | Trusted file list used for Ivanti Endpoint Security. This will be present even if EPS is not installed or trusted file lists are not configured for this client. |
Note: The populated "Data' entries are provided as an example. Yours will differ.
The VulscanReboot key should NOT be modified, deleted or created. This is a volatile registry key used by the vulnerability scanner. Creating this key manually will create a persistent registry key that does not go away and will cause reboot loops and/or other undesirable behavior.
The vulnerability scan log files are located in the C:\ProgramData\LANDESK\log folder.
When in doubt just .ZIP up the entire folder and send it.
Otherwise, the following logs should be gathered:
It is very useful to turn on Xtrace with the following enabled from the registry key prior to duplicating the problem and gathering logs:
From HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\landesk\managementsuite\LogOptions:
How To: Enable XTrace Diagnostic Logging for the Ivanti Core and Clients
Vulscan can be used as a shortcut to open various folders. The following should be run on the client command line:
Vulscan e - Open the folder where Vulscan resides
Vulscan c - Open the LDClient folder,
Vulscan log - Open the ProgramData\LANDESK\Log folder
Issue: Cannot open vulscan logs folder from the command line using "vulscan e"
It is important to note that the following must all be able to take place: Client contact to core through IIS and several web services. Core contact to Database Server Core Contact to client Correct permissions on core ManagementSuite\Incoming directory and \ManagementSuite\LDLOGON\VulnerabilityData and VulscanResults folders.
Note that issues can come and go during a vulscan. This would indicate intermittent issues. Most of the time this occurs when the server or database has connectivity issues or are too overwhelmed to respond to requests.
Step 1 - Contact the Ivanti Core Server |
|---|
The vulscan engine attempts to contact the core server by checking the HKLM\SOFTWARE\Intel\LANDESK\LDWM registry key. The client tries to contact vulcore.asmx through the WSVulnerabilityCore web service. Thus the client needs to be able to contact the core, IIS needs to be available, the app pool needs to be running, and the database needs to be able to contact the core.
Good Vulscan.log entry
|
What could go wrong? Certificate-Based Authentication - New Secure Client information
Ivanti Endpoint Manager Enhanced Security Mode
If core has been upgraded and you have copied the .CRT, .KEY and Client unable to connect to the core server
Error: "Host not found. Retrying" Bad vulscan.log entry:
The client makes a SOAP request to the core server webservice and gets HTTP error 503 - Service Unavailable
Note: The default timeout for Vulscan to connect to the core is 10 minutes. Connection will fail after this time.
Useful ArticlesIIS Troubleshooting and Ivanti Endpoint Manager: 101 How to troubleshoot IIS using Log Parser Studio from Microsoft
Core server unable to talk to the database
This error shows that something is wrong with the core to database communication or web service to database communication. This can be a simple connectivity issue, database too busy, IIS/ASP.NET, etc.
Error: "Server busy"
Bad Vulscan.log entry:
The client does a SOAP request to the core web service to resolve it's device ID and gets HTTP Error 500 - Internal Server Error
|
Step 2 - Core downloads and applies various agent settings |
|---|
At this step the core server downloads and applies various agent settings. If a setting does not apply to the computer the file will be downloaded anyway. (For example, if you have Endpoint Security in your
Good Vulscan.log entry
The client checks it's file hash for the behavior file and compares it through a SOAP request to the core web service function "GetHashForFile". It then applies the behavior to the client. |
What could go wrong? Client cannot access the AgentBehaviors folder on the core server
The client needs to be able to access the \LDLOGON\Agentbehaviors folder on the core server. It then downloads the agent behavior .XML files and applies them if they pertain to the computer, otherwise the settings come down, but they are not applied.
Error: " 'Applying XXX settings failed" Bad vulscan entry:
Useful ArticlesIssue: Vulscan is not applying agent setting changes or is using an incorrect agent setting Error "Unable to get the setting from core" when running security scan (Vulscan.exe) Error: "Core could not find a file" when running vulscan on clients Error: "Failed to apply compliance settings" during vulnerability scan return code 451 |
Step 3 - Vulscan loads and caches local MSI information | ||
|---|---|---|
In order for the vulnerability scanner to scan MSI information, the vulnerability scanner reads and caches the MSI information from the local computer's registry. This calls the MsiEnumProducts and MsiEnumPatches functions. This depends on the existence of MSI.DLL in the C:\Windows\System32 directory.
Vulscan.log entry:
| ||
|
Step 5 - Vulnerability scanning results are sent to the core server |
|---|
After scanning the results are sent to the core server through http://<corename>:443/WSVulnerabilityCore/vulcore.asmx. At this point the Web services processes the results and creates a scan result file (in this case ScanResults_{A25894AD-E7E7-C042-86AB-5F8BBD866601}_0.vrz) that goes into the \Program Files\LANDESK\ManagementSuite\VulscanResults folder on the core. This gets processed into the database and will show up in the Security and Compliance information for the client in the inventory.
Good vulscan.log entry
What can go wrong? Failures to send the results can come from some of the following issues:
Failure in vulscan.log
In this case the postcgi.exe was missing in the incomingdata folder. The service responded with an HTTP 404 error "File or directory not found".
Additional articles: |
Step 6 - Vulnerability scanner checks for autofix patches |
|---|
The vulnerability scanner then checks with the core server to see if there are any patches that should be auto fixed at this time. This is done through the http://localhost/wsvulnerabilitycore/vulcore.asmx web service using the GetAllPatches function. If patches are found that need to be auto fixed one of the following methods is called:
The core then builds a list of the repair logic that vulscan will follow and it gets sent to the client through the web service, the client then writes an .XML file to follow as it repairs patches. This information is all of the repair logic from the definition. |
| This article is regularly updated with information regarding these vulnerabilities |
This document serves to be a reference to assist with the following:
For a further overview of both the Meltdown and Spectre vulnerabilities please see the following Ivanti Blog Post: https://www.ivanti.com/blog/meltdown-spectre-need-know/
Meltdown - CVE Notice # CVE-2017-5754 More information from the National Vulnerability Database: NVD - CVE-2017-5754
Spectre Variant 1 - CVE Notice # CVE-2017-5753 More information from the National Vulnerability Database: NVD - CVE-2017-5753
Spectre Variant 1 - CVE Notice # CVE-2017-5715 More information from the National Vulnerability Database: NVD - CVE-2017-5715
These CVE and NVD entries contain lists of advisories, solutions, and tools regarding these vulnerabilities. CVE is a reference method for publicly known IT vulnerabilities and exposures.
Meltdown and Spectre are vulnerabilities that affect various computer processors including Intel x86 processors and some ARM-based processors. Due to this, we will cover how to mitigate this through the features of Ivanti EPM. Meltdown affects a very large range of computers, cell phones, tablets, etc. Thus this touches some of the systems that you manage with Ivanti EPM. (Examples are servers, desktops, cell phones and other mobile devices) In January of 2018, it was disclosed along with another exploit called "Spectre" with which it shares some but not all characteristics. Meltdown patches may introduce some amount of performance loss, however, it is not as high as initially reported. On January 18th, 2018 unwanted reboots and other stability issues were reported due to patches applied for the mitigation of these vulnerabilities. Due to this newer updates have been released. All updates will be addressed later in the document underneath the OS Updates section.
This section describes available Patch and Compliance definitions that can be delivered through the EPM Patch and Compliance tool.
If your patches are not installing and you expect them to be, it may be due to a registry key that Microsoft requires to be present prior to installing the patches. This protects against potential incompatibility with Anti-malware software that may cause blue screen crashes.
For more information see About Antivirus products and the Meltdown and Spectre security vulnerabilities
01/29/2018
Microsoft has released an emergency out of band update that disables the mitigation for Spectre variant 2. This was due to the fact that Intel's new microcode can cause higher than expected reboots that can result in data loss or corruption.
Microsoft news about this patch release: https://support.microsoft.com/en-us/help/4078130/update-to-disable-mitigation-against-spectre-variant-2
This update adds two registry settings that “manually disable mitigation against Spectre Variant 2”:
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 1 /f
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 1 /f
The installation of this latest patch is optional, however, caution should be taken. If the prior Spectre mitigation patches caused instability, you will want to install this patch (within definition MSNS18-01-4078130_INTL) in order to return to better system stability.
Note: If you choose to install the following patch for KB4078130, the previously fixed patches will again detect as being installed. You need to choose one or the other to put in your scan group. Meaning MSNS18-01-4078130_INTL or the patches further below
| Ivanti ID | Microsoft KB # | Ivanti Publish Date | Other Notes |
|---|---|---|---|
| MSNS18-01-4078130_INTL | KB4078130 | 01/29/2018 |
| Ivanti ID | Microsoft KB # | Ivanti Publish Date | Other Notes |
|---|---|---|---|
| MS18-01-W10_INTL | Version 1507 - KB4056893 | 01/03/2018 | Cumulative Update and Delta Update |
| " | Version 1511 - KB4056888 | 01/03/2018 | Cumulative Update and Delta Update |
| " | Version 1607 - KB4056890 | 01/03/2018 | Cumulative Update and Delta Update |
| " | Version 1703 - KB4056891 | 01/03/2018 | Cumulative Update and Delta Update |
| " | Version 1709 - KB4056892 | 01/03/2018 | Cumulative Update and Delta Update |
| Ivanti Patch and Compliance Manager ID | Microsoft KB # | Ivanti Publish Date | Other Notes |
|---|---|---|---|
| MS18-01-SO81_INTL (Windows 8.1) * | KB4056898 | 01/04/2018 | Security Only |
| MS18-01-SO9_INTL (Server 2012) * | KB4056899 | 01/04/2018 | Security Only |
| MS18-01-MR7_INTL | KB4056894 | 01/04/2018 | Monthly Rollup |
* 01/24/2018 - Windows has issued a further update to mitigate stop errors caused by a spurious interrupt on systems with PIC and APIC controllers on systems that have previously been patched with the patches for KB4056898 amongst other patches.
(This is Ivanti Definition ID MSNS18-01-4077561_INTL)
| Ivanti ID | Microsoft KB # | Ivanti Publish Date | Other Notes |
|---|---|---|---|
| MS18-01-S07_INTL | KB4056897 | 01/04/2018 | Security Only |
| MS18-01-MR7-INTL | KB4056894 | 01/04/2018 | Monthly Rollup |
For important information regarding the installation of these patches, go here Current definitions in Patch and Compliance referencing Support for the Intel 'Meltdown' Security Vulnerability and see the "Additional Information" section.
Patches are often superceded by another newer patch that contains additional fixes or migitates problems with prior patches. It is expected that most if not all of these patches will be superceded, likely in the near future as Intel and Microsoft acquire more information about the issue.
It is important to keep your definitions cleaned up so you are only scanning and repairing the latest patches.
To manage your Patch Content effectively seeHow To: Manage Superceded Patches in Patch and Compliance Manager
Note: As of 01/17/2018 for all OS Versions all Windows patches for 32-bit systems do not provide Meltdown mitigations. This is a Windows Patch issue, not an Ivanti Patch issue.
Apple included mitigations for macOS 10.13.2 and iOS 11.2 released in December. It has since followed up with additional mitigations with the just-released Apple macOS Supplemental Update: About speculative execution vulnerabilities in ARM-based and Intel CPUs - Apple Support
| Ivanti ID | Type of update | More Info URL | Date Published |
|---|---|---|---|
| CESA-2018-0093 | microcode_ctl | https://access.redhat.com/errata/RHSA-2018:0093 | 01/17/2018 |
| CESA-2018:0013 | microcode_ctl | https://access.redhat.com/errata/RHSA-2018:0013 | 01/04/2018 |
| CESA-2018-0061 | libvert | https://access.redhat.com/errata/RHSA-2018:0030 | 01/04/2018 |
| CESA-2018:0008 | kernel | https://access.redhat.com/errata/RHSA-2018:0013 | 01/04/2018 |
| CESA-RHSA-2018:0024 | qemu-kvm | https://access.redhat.com/errata/RHSA-2018:0024 | 01/04/2018 |
| Ivanti ID | Type of update | More Info URL | Date Published |
|---|---|---|---|
| CESA-2018:0094 | linux-firmware | https://access.redhat.com/errata/RHSA-2018:0094 | 01/17/2018 |
| CESA-2018:0007 | kernel | https://access.redhat.com/errata/RHSA-2018:0007 | 01/04/2018 |
| CESA-2018:0014 | linux-firmware | https://access.redhat.com/errata/RHSA-2018:0014 | 01/04/2018 |
| CESA-2018:0012 | microcode_ctl | https://access.redhat.com/errata/RHSA-2018:0012 | 01/04/2018 |
| CESA-2018:0029 | libvirt | https://access.redhat.com/errata/RHSA-2018:0029 | 01/04/2018 |
| CESA-2018:0023 | qemu-kvm | https://access.redhat.com/errata/RHSA-2018:0023 | 01/04/2018 |
| Ivanti ID | Type of update | More Info URL | Date Published |
|---|---|---|---|
| RHSA-2018-0093 | microcode_ctl | https://access.redhat.com/errata/RHSA-2018:0093 | 01/17/2018 |
| RHSA-2018-0094 | linux-firmware | https://access.redhat.com/errata/RHSA-2018:0094 | 01/17/2018 |
| RHSA-2018-0030 | libvert | https://access.redhat.com/errata/RHSA-2018:0030 | 01/05/2018 |
| RHSA-2018-0024 | qemu-kvm | https://access.redhat.com/errata/RHSA-2018:0024 | 01/04/2018 |
| RHSA-2018-0023 | qemu-kvm | https://access.redhat.com/errata/RHSA-2018:0023 | 01/04/2018 |
| RHSA-2018-0012 | microcode_ctl | https://access.redhat.com/errata/RHSA-2018:0012 | 01/04/2018 |
| RHSA-2018-0014 | linux-firmware | https://access.redhat.com/errata/RHSA-2018:0014 | 01/04/2018 |
| RHSA-2018-0007 | kernel | https://access.redhat.com/errata/RHSA-2018:0007 | 01/04/2018 |
| RHSA-2018-0008 | kernel | https://access.redhat.com/errata/RHSA-2018:0008 | 01/04/2018 |
| RHSA-2018-0013 | microcode_ctl | https://access.redhat.com/errata/RHSA-2018:0013 | 01/04/2018 |
| Ivanti ID | Type of update | More Info URL | Date Published |
|---|---|---|---|
| USN-3530-1 | WebKitGTK | USN-3530-1: WebKitGTK+ vulnerabilities | Ubuntu | 01/11/2018 |
| USN-3531-1 | intel-microcode | USN-3531-1: Intel Microcode update | Ubuntu | 01/11/2018 |
| USN-3522-4 | linux-lts-xenia | USN-3522-4: Linux kernel (Xenial HWE) regression | Ubuntu | 01/10/2018 |
| USN-3523-2 | linux-hwe, linux-azure, linux-gcp, linux-oem | USN-3523-2: Linux kernel (HWE) vulnerabilities | Ubuntu | 01/10/2018 |
| USN-3522-3 | linux regression | USN-3522-3: Linux kernel regression | Ubuntu | 01/10/2018 |
| USN-3522-2 | linux-lts-xenial, linux-aws | USN-3522-2: Linux (Xenial HWE) vulnerability | Ubuntu | 01/09/2018 |
| USN-3522-1 | linux, linux-aws, linux-euclid, linux-kvm | USN-3522-1: Linux kernel vulnerability | Ubuntu | 01/09/2018 |
| Edge | Internet Explorer | Google Chrome | Firefox | Opera | |
|---|---|---|---|---|---|
| Earliest Recommended Version | Varies per build number | Varies per OS | 64.0.3282.140 | 57.0.4 | 50.0.2762.67 |
| Ivanti Patch Definition ID | MS18-01-W10_INTL | MS18-01-IE_INTL | Chrome-215_INTL | FF18-001_INTL or newer | OPERA-154_INTL |
Ivanti EPM Patch and Compliance provides content for several vendor's BIOS and driver updates. It is recommended to follow the advice of the vendor and to update your systems accordingly.
As a convenience we offer some links to vendor websites relating to this issue:
Dell: Meltdown and Spectre Vulnerabilities | Dell US
HP: HPSBHF03573 rev. 7 - Side-Channel Analysis Method | HP® Customer Support
Lenovo: Reading Privileged Memory with a Side Channel
Most vendors have pulled their BIOS updates pending new changes from the CPU vendors.
Further Information: Root Cause of Reboot Issue Identified; Updated Guidance for Customers and Partners
These vendor links are provided for convenience. They may quickly become outdated and there may be better links provided by the vendor.
See the following article for information specific regarding antivirus compatibility including Ivanti Antivirus: About Antivirus products and the Meltdown and Spectre security vulnerabilities
