Why don't the updates in the SCUPdates catalogs have any supersedence information filled in? If I deploy an update to a client, then deploy a supserseding update, a client without either update installed will be offered both, instead of just the most recent one.

Overview

Shavlik Patch 2.1 for SCCM 2012 2.1 has added some features around handling patch revisions and supersedence.  Specifically, patch revisions for patches you have already published to make it easier to accept these revisions.  On 11/12/2014 we will begin including supersedence information with our Shavlik Patch for SCCM 2012 patch content.  By including supersedence content customer will more easily see which patches they need to apply to be up to date.  Customers will not need to keep track of supersedence themselves and have a separate process for expiring old patches.

Shavlik Patch 2.1 includes new a filter in that can be used to filter out patches that have been superseded so customers can easily identify the latest patches.  We have also added information about the details of supersedence in new columns and the new details view so customers have visibility into the supersedence content. 

There are some important things to understand regarding supersedence and SCCM 2012.  When a patch is published that supersedes an older patch the publishing process triggers an expiration process of the older superseded patch.  How that older patch is expired is controlled by settings in the Software Update Point (SUP). Below is a screenshot of the supersedence tab in the SUP that shows your options.

You have the option of triggering the expiration immediately or dealing it by a specified number of months.  When an update is expired it will not be evaluated and installed on client machines.

Product

Shavlik Patch 2.1 for Microsoft System Center (SCUPdates)

I've been testing Shavlik for a few weeks with no issues installing and configuring it.  I've run into a cert error recently trying to push the updates to systems and was working to get this resolved.  However, I just tried to open Shavlik Patch (SCCM 20012) and got the following error:

I've never had issues opening Shavlik and getting the latest catalogs.  Any ideas what this message means?  Logs to look at to investigate?  Thanks for any help.

Jeff

Installed and setup Shavlik Patch.  Getting this error:

Manifest synchronization error. Code=1, message=File 'C:\Users\username\Shavlik\Shavlik Patch\engines.manifest.xml' failed signature check: http://xml.shavlik.com/data/patch/v2/21/manifest/engines.manifest.xml

I can download the file manually.  There doesn't seem to be any signature on it though.

Hello

We seem to have a problem with the latest flash update we are deploying with Shavlik.

The Firefox plugin version works fine, however the IE update is failing on a number of machines. I cannot see any information regarding the failure in the log files, however I can see the following in Windows Updates

My concern is, now that the update has failed and it has removed the old version of Flash for IE off the machine - will it retry the update again, or as I suspect is happening, skip it because it is no longer needed because the old version has been removed?

This is a real concern for us - especially seen as an out of date version of Flash would have been better than the situation we have here of no working Flash for Internet Explorer.

Any suggestions would be gratefully received.

Thanks

Sarah

Hello,

I'm still new when it comes SCCM and Shavlik Patch so please bear with me. Currently we are running SCCM 2012 on a Windows Server 2012 R2. Currently I'm trying to deploy Adobe Flash 15.0.0.189 for IE, Google Chrome 38.0.2125.111, and Java 7u72. I am able to publish these updates, and they come up in Software Updates. But after putting them into a Software Update Group and trying to deploy the group it gives me: "Failed to download content id 16811656. Error: There was an error downloading the software update. (404)", Now I know typically 404 is not found, so does this mean that it cannot reach whatever servers it pulls these updates from? Or maybe that it cannot find the software in the Deployment Package (Which shouldn't it download if it cannot find)?

Any help or guidance is greatly appreciated!

Thank you.

Is there a planned support time for Java 8 through Patch for SCCM?

Purpose

This document is intended to show how to set proxy information for the Shavlik Patch plugin.

If your internet connection goes through a proxy, this may be required for Shavlik Patch to be able to successfully publish updates.

Description

1) In SCCM, navigate to Software Library > Software Updates > Shavlik Patch.

2) Right click on Shavlik Patch, then choose 'Settings'.

3) Navigate to the 'Proxy' tab within the Shavlik Patch Settings.

4) (Optional) You can click on 'Do I need proxy information?' to run a quick test to see if Shavlik Patch can successfully connect to the internet.

5) Put a check in the box next to 'Use Proxy'.

6) Enter the username and password required for proxy authentication. If your proxy does not require authentication you most likely do not need to enter these settings.

7) Click 'Verify Proxy'.

8) You will be prompted with a Settings window stating if Shavlik Patch is able to connect to the internet or not.

9) Click Yes.

10) Click 'OK' in the main Shavlik Patch Settings window.

Additional Information

If you are having problems connecting with Shavlik Patch you may also need to consider making exceptions in your proxy or firewall. Refer to this document:

URL Exception list for Shavlik Patch for Microsoft System Center

Affected Product(s)

Shavlik Patch for Microsoft System Center (Plugin) 2.1.801.0 and newer

Purpose

Configuration Checker is used to determine if you meet all the requirements for using Shavlik Patch.

Procedure

You can access the Shavlik Patch Settings screen using one of two methods.

Method 1.  Select Software Library in the SCCM Console Screen.  Right-click on Shavlik Patch Plugin and select Settings.

Method 2.  Click the Settings button in the top left hand corner of the Software Library Home screen in the SCCM Console.

Click on Verify Setup and click on the Launch Configuration Checker button.

Please note: You can also run it from the command line: C:\Program Files (x86)\Microsoft Configuration

Manager\AdminConsole\bin\ST.SCCM.ConfigurationChecker.exe. You must run

Configuration Checker with full Administrator privileges, but you can use it to evaluate

accounts that do not have full Administrator privileges.

Fill out the required fields and click the Start button.

Most of the information on this dialog will be pre-populated for you but it can be modified as necessary.

• WSUS Server FQDN: Type the fully qualified domain name of your WSUS server.
• Port: Select the port used to access the WSUS server.
• Cloud account: Type your Protect Cloud user name.
• Cloud Password: Type your Protect Cloud password.
• User account (domain/user): Type the domain and user name of the account that you want to evaluate.
• Account password: Type the password associated with the user account. This field can be left blank if you are evaluating the account that you are using to run this tool.
• Use proxy: If enabled, indicates that proxy server credentials are required in order to run the Configuration Checker test. If you clear the check box after specifying credentials, the credentials will be saved but not used. This box will initially mirror what is configured on the Proxy tab but can be temporarily overridden here.
• Proxy user name: Type the user name for an account on the proxy server. This box will be automatically populated with the user name provided on the Proxy tab but it can be overridden. It may be necessary to specify a domain as part of your user name (for example: mydomain\my.name).
• Proxy password: Type the password for the proxy server account.

The utility checks for the following:

• Ability to connect to the WSUS server using a fully qualified domain name and port number
• Ability to connect to Protect Cloud using a user name and password
• Ability to retrieve the Shavlik Patch catalog
• User account has Log on as a batch job privileges
• User account is a member of the Administrators group and the WSUS Administrators group on the WSUS server
• WSUS signing certificate is contained in the Trusted Root and Trusted Publisher stores and is current (not expired)

If any of the tests fail, you should correct the issue before using Shavlik Patch.

Affected Product(s)

Shavlik Patch 2.1

Purpose

Some administrators may question why the Shavlik Patch plug-in for Microsoft System Center is installed as an instance on a specific user account rather than all user accounts. Understanding how the product works can help explain why this is, and the purpose of this document is to offer clarification on this subject.

Description

Shavlik Patch helps to streamline the patching process in SCCM by providing a way to publish third party patches. Shavlik Patch offers patch definitions that will publish those patches selected to be published by the administrator to the WSUS server. One of the prerequisites to the proper function of Shavlik Patch is that the user belongs to the WSUS Administrators group, as such the proper function of the Shavlik Patch plug-in is closely tied to the user account and the rights granted.

Because of the rights-related requirements inherent to the process, Shavlik Patch is tied closely to user accounts and relies on the user account having the proper rights.

Additional Information

Shavlik Patch for Microsoft System Center Requirements

Installation checklist for Shavlik Patch for Microsoft System Center

Product

Shavlik Patch 2.x

Purpose

This document provides documentation to our clients on how Java deployments in Shavlik Patch have changed recently with Java 7 Update 71 and why these changes had to be made, as well as providing best practices to ensure proper deployment of Java patches.

Symptoms

Shavlik Patch users may have experienced issues deploying recently released Java patch (Java 7 Update 71), or noticed changes in the deployment mechanism. In some cases Java patch deployments that previously worked without a reboot may not be successfully installed until a reboot is completed. Understanding the changes made to Java deployment in Shavlik Patch and how to respond to them can help administrators keep Java fully patched in their environment.

Description

Due to changes made by the vendor with Java 7 Update 71 that caused silent patch installations to fail - changes had to be made to the way Shavlik deploys these and future Java patches. These changes had to be made to ensure continued support of Java patches in Shavlik Patch.

Java update installs will now be scheduled to run at system reboot.

Resolution

To ensure successful patching, deployments of Java 7 Update 71+ updates will now require a system reboot.

If you have any difficulty publishing these patches and getting the newer Java patches to deploy successfully- please contact Shavlik Support.

http://www.shavlik.com/support/contact/

Affected Product(s)

Shavlik Patch 2.x

Symptoms

Despite fulfilling all the prerequisites in the Shavlik Patch documentation, some users may still find themselves to be unable to connect the plug-in to their WSUS server.

Cause

This issue appears to be related by a User Account Control (UAC) issue. In some environments, despite all prerequisites having been met, Shavlik Patch does not receive the elevated adminstrative privileges necessary to connect to the WSUS server.

Resolution

In order to solve this issue, users must right-click the SCCM shortcut/executable and select "Run as administrator".

This will allow some users to resolve the connection problem and connect to the WSUS server successfully. If you find you are still unable to connect to your WSUS server, please contact Shavlik Support.

Affected Product(s)

Shavlik Patch

Hi

I am very new to Shavlik and SCCM 2012.

I've recently had to deploy software updates from Shavlik to SCCM for Google Chrome (v39) and would like to know if there is any way I could track the progress of the deployment? .i.e. since its deployment, how many machines has the software been installed on.

Regards

Ivan

Purpose

This document is meant to provide information about where to obtain logging related to Shavlik Patch for Microsoft System Center.

Description

Starting with Microsoft System Center 2012 there is a new log reading tool available called CMTrace.

You can locate this on your Configuration Manager server under:

C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe

We recommend creating a shortcut to this or setting this as the default log reader.

Locations of log files and useful information:

• System Center Configuration Manager (SCCM) Server:
  • C:\Program Files\Microsoft Configuration Manager\logs
    • Contains all logs related to operations of Configuration Manager
    • Most useful log(s) when troubleshooting issues with Shavlik Patch:
      • wsyncmgr.log - WSUS synchronization operations
  • C:\Users\*SCCM-Admin*\Shavlik\Shavlik Patch
    • Contains both logs and datafiles/binaries used by Shavlik Patch plugin.
      • Logs found here:
        • AutoPublish.log - Contains logging of publishing process.
        • Shavlik Patch.log - Contains logging of Shavlik Patch plugin operations.
• Client
  • For trouble with deployment of dependent action patches (Java or Apple) it can be beneficial to obtain the following:
    • C:\Windows
      • WindowsUpdate.log
    • C:\ProgramData\Shavlik\Installation
      • Contains files related to deployment of dependent action patches (Java, Apple). Collect and zip everything in this folder.
      • Note: This folder is automatically cleaned out after 30 days

The below table will help in understanding what log(s) may be most helpful during certain workflows:

(Click to Enlarge)

Product(s)

Shavlik Patch for Microsoft System Center

(Formerly SCUPdates)

Hello,

In order to further extend our use of Shavlik, we are looking to see if we can report based on the which machines have patches outstanding and what was the date those machines in question were last patched.  This would enable us to confirm automatic patching is taking place within a given number of days and also

I can see the database which holds information when a basic report is run, but i do not know how I would find the last patched date for a machine and how to connect with this whether its in our automatic patched group or our manual patched group. We would therefore want to get a list of servers from the manual group where the patches had not been applied in the last 30-60 days for example.

I was wondering if anyone has any experience in reporting on this? The excel exports from Shavlik do not not include last patched date, only number of patches outstanding on a machine.

Thanks in advance for your trouble taken to look at this.

Regards,

Aaron

Hello

We seem to have a problem with the latest flash update we are deploying with Shavlik.

The Firefox plugin version works fine, however the IE update is failing on a number of machines. I cannot see any information regarding the failure in the log files, however I can see the following in Windows Updates

My concern is, now that the update has failed and it has removed the old version of Flash for IE off the machine - will it retry the update again, or as I suspect is happening, skip it because it is no longer needed because the old version has been removed?

This is a real concern for us - especially seen as an out of date version of Flash would have been better than the situation we have here of no working Flash for Internet Explorer.

Any suggestions would be gratefully received.

Thanks

Sarah

Purpose

This document is intended to provide information about support for Google Chrome within Shavlik Patch for Microsoft System Center.

Symptoms

Generally you can tell if there's an issue going on because of this if you see only a small number of machines being patched for Google Chrome, when you know from another method that Chrome is installed on many more machines.

Cause

In short, the issue is because the Shavlik Patch content will not detect installations of Chrome that are on a per-user basis which means Chrome was installed on machines using the EXE installer (per-user), and currently the Shavlik products only support patching of Chrome installed with the MSI installer (system level).

-Shavlik Patch only detects Chrome installed via MSI.

-Shavlik Patch only offers the MSI installer for Chrome.

Additional Information behind this:

Per User vs System-Level:

Google Chrome can be installed in two ways.  The first way to install Chrome (and probably the most popular) is to install it on a per-user basis.  If Chrome is installed in this manner, the browser will be available only to the user that has installed it on the machine.  Other users on the machine will not have Chrome installed.  To patch Chrome, it will require the user that installed Chrome to update it.  To do this, Google has written an auto-updater that will automatically patch Chrome for the user.

The second way to install Chrome is to install it on a system-level (aka per-machine in Windows terms) basis. This is also known as the enterprise version of Chrome.  This means that Chrome will be installed for all users, and can be updated for all users at once.  In these system-level installs, there is no auto-update mechanism.

.exe vs .msi:

Google Chrome has multiple installers that will install on a system-level basis.  They have a .exe and a .msi.  Installing from the .exe will install Chrome on a system-level basis (given the proper switches), unless there is a per-user install already on the machine.  In this instance, the .exe will fail to install Chrome.  Installing the .msi on a system will install Chrome on a system-level basis, even if a per-user install already exists.  The problem with the .msi install, is that if you want to upgrade (patch) Chrome, you need to uninstall the previous version first.  You cannot install a newer .msi install on top of an older .msi install.

Registry detection process

Shavlik Patch content only uses registry key detection. When Google Chrome is installed, one of the following registry keys is placed on the system:

• If installed per-user (EXE) - Not Supported
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
  • Check under Wow6432Node on x64 systems
  • This is NOT SUPPORTED by Shavlik Patch content. Systems with the above registry key will not have Chrome detected by Shavlik Patch.
• If installed as system-level (MSI) - Supported
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{GUID}
    • The GUID may differ, but an example value = {C3FF5ACB-174A-3E07-AE2A-62063FBCC9B1}
  • Detection of this type of registry entry for Chrome install indicates system-level installation, which is supported by Shavlik Patch.
  • Shavlik Patch will detect these installations of Chrome and provide the proper update information to be deployed.

Resolution

If you have not yet installed Chrome in your environment, please consider the above information if you plan to patch using Shavlik Patch for Microsoft System Center. It will be beneficial to deploy the MSI version from the very beginning if you intend to have more control and reporting of Chrome installations via Software Updates in SCCM.

For users addressing symptoms noted above -

The first thing to consider is that just because the Shavlik products are not detecting these does not mean there is necessarily a security vulnerability. The per-user installation will use Google's auto-update feature. However, you will have less control and reporting of the versions existing in your environment.

If you want to switch to the system level install of Chrome so you can patch using Shavlik Patch/SCCM, remove the existing per-user Chrome installation (that was installed with EXE) and re-install using the latest MSI installer for system level installation. From that point on, the Shavlik products will be able to properly detect and update Chrome across all your systems. Unfortunately there is currently no software distribution content offered via Shavlik Patch so you will need to find a method for deploying the MSI version of Chrome to your environment.

Additional Information

Other Considerations when switching to Chrome via MSI (system level install)

The first is what happens to bookmarks and user data when we install the .msi on top of a per-user install.  During our testing, all user data is retained, so that the system-level install will use all of the user data that existed in the per-user installation.  The second possible problem is that the .msi installation requires that a previous .msi Chrome installation be uninstalled before installing the newer version. During our tests, all user-data is retained on the machine and is used by the new version of Chrome.

Additionally, it is important to note that there will be no auto-updating of Chrome once you switch to a system-level install.  You will, however, have an honest assessment of the use of Chrome on your network, as well as an accurate assessment of the patch level of Chrome on your network.

Feature Requests/Changes:

If you would like to see changes to how Shavlik supports Chrome please feel free to submit a feature/change request.

Affected Product(s)

Shavlik Patch for Microsoft System Center, All Versions

Symptoms

In the SCUP.log or updatepublisher.log you find the following error:

Error Scup2011.10 Publisher.VerifyPackageRulesAndState VerifyPackageRulesAndState(): Too many locally published categories. Existing: 100, Adding: 1 at Microsoft.UpdateServices.Internal.BaseApi.Publisher.VerifyPackageRulesAndState()

Cause          

Microsoft SCUP Publisher has a limit of 100 unique categories.

Solution

Microsoft has released a KB addressing the issue with a resolution: http://support.microsoft.com/kb/945536.

Affected Product(s)

Shavlik Patch for Microsoft System Center

(Shavlik SCUPdates)

Purpose

This document is intended to act as a basic guide on how you can use Smart Filters and Composite Filters in Shavlik Patch for Microsoft System Center.

Creating and Using a Smart Filter

The default Filter that is set to be used when veiwing Shavlik Patch items is "*All", which is intended to display all products and updates. However, it can make it easier to set up some filters that you can use to access certain information more quickly. There are a few default filters already set up, but for creating your own the simplest filtering to set up is a "Smart Filter". Here's how:

1) Click the 'New Smart Filter' button.

2) Create the filter with the rules you'd like to use. In this example, we're creating a basic filter to only show Mozilla Firefox updates by using the rule;

     Product > contains > Firefox

3) You can click 'Add Rule' if you want your smart filter to contain multiple rules. Click Save when you're done.

3) Click the 'Filter' drop-down and choosing the filter you want to use.

     You can see in the example below the filter Mozilla Firefox now only shows updates where the product contains "Firefox".

Creating and Using Composite Filters

Sometimes you may want a little more complicated filtering or need to combine multiple Smart Filters that you've set up. Composite Filters are the method to complete this.

1) For this example we're showing how you can use a Composite Filter to combine multiple Smart Filters, so let's set up another Smart Filter first. This one is intended as a filter to show only updates that are marked as superseded, using the rules; Is Superseded > contains > Yes.

2) Now click 'New Composite Filter'.

3) We are creating a filter that will combine the use of the other two previously created Smart Filters so we can display all Firefox updates that are superseded, using the rules;

     Start with updates selected by SmartFilter: 'Mozilla Firefox' then Filter again using SmartFilter: 'Superseded Updates'

4) Click Save when done.

5) Check the results of your new Composite Filter by choosing it from the Filter drop-down.

     In the example, you can see this filter successfully shows all the Firefox updates that are currently superseded.

Editing a Filter

1) Ensure the filter you want to edit is chosen in the drop-down, then click the 'Edit Filter' button.

     For the example we are editing our Composite Filter "All Superseded Firefox Updates".

2) You can edit existing rules/settings in the filter, but for this example we are going to add a filter into the mix so that the filter shows all the superseded Firefox updates from only the last 30 days.

3) Click the 'Add filter' button.

4) Set up the rules for the additional filter. In the example we use; Filter again using SmartFilter: 'Last 30 days'.

5) Change the name of the filter if you wish, then click Save.

6) If you changed the name of the filter, you will be prompted by the 'Save Filter' window stating the name of the filter was changed. It will provide you the old and new name.

7) Click 'Rename the existing filter' if you want to overwrite the old filter with the new one, or choose 'Save a copy with the new name' to save it separately.

8) You can see that the edited filter now displays only the Firefox updates that are superseded from the last 30 days.

9) As an alternate example showing how you can use some of the logic rules, we are editing the filter once more so that it shows any Firefox updates from within the last 30 days except those updates that are superseded. Rules in the example below;

Start with the updates selected by SmartFilter 'Mozilla Firefox' then 'Remove' updates slected by SmartFilter 'Superseded Updates then Filter again using SmartFilter: 'Last 30 days'

10) We renamed the filter again so the prompt comes up. We are saving this as a copy with a new name.

11) You can see now the list shows only the Firefox updates from the last 30 days that are NOT superseded.

That should be enough to get you started using the filters available in Shavlik Patch. Try playing around with the logic rules and fields available to come up with your own Smart or Composite filters you like using best.

If there's anything you feel is missing from this feature, please feel free to submit a feature request at our Shavlik Feature Request Form.

Affected Product(s)

Shavlik Patch Plugin for Microsoft System Center

Purpose

This document is intended to provide a basic walk-through of setting up and using automatic scheduling to publish and synchronize software updates via the Shavlik Patch plugin for SCCM, and to describe how some of this process works.

Setting Up an Automatic Schedule

1) Right click on the Shavlik Patch section, then choose Settings.

2) Go to the Schedule tab.

3) Check the box 'Schedule Download and/or Publication'.

4) Set up the schedule for the time(s) when you prefer this to take place.

5) Set up the 'At the scheduled time' section.

• Publish the updates selected by this filter
  • Default filter is '*Latest not-published'
  • You can click the drop-down to choose any filters you've created to be used.
• Checking 'Accept all metadata updates in the catalog' will allow the automatic publication to accept all revisions on updates previously published.
• Checking 'Synchronize updates' will initiate a synchronization of software updates after publishing is complete.

• 'Schedule the task to run as' will allow you to choose the account that the scheduled task will be run as.
  • If you set the 'Logged on user', you just need to type in the password. It will pull any required proxy authentication from the settings on the Proxy tab.
    • Example above
  • If you set a 'Different user' you'll need to set both User and password, and you will also be given the option to set proxy authentication for that user if needed.
    • Example below

Information Worth Noting

• You can view the scheduled task(s) set up from Shavlik Patch within the Task Scheduler (taskschd.msc) on the system where Shavlik Patch is installed.
  • Expand Task Scheduler Library > click Shavlik Patch to see scheduled tasks set up for Shavlik Patch.

• Only one automatic schedule can be set up at a time per logged on user.
• If you want to stop or delete the automatic schedule that is set up, you can either;
  • Within Shavlik Patch Settings > Schedule tab, uncheck the 'Schedule Download and/or Publication' box.
    • The scheduled task should be deleted by doing the above.
  • Or, you can just go into Task Scheduler and delete the scheduled task.
• There may be other scheduled tasks displayed because every time you run a publish, even 'publish now', Shavlik Patch uses a scheduled task to run the operation.
• If you are checking for tasks or history of tasks that were run within Task Scheduler, you may need to 'Enable All Tasks History'.

Additional Information

Additional Information for Shavlik Patch use and requirements can be found in the online documentation.

Affected Product(s)

Shavlik Patch for Microsoft System Center