Understanding Deployment Method Differences

Transcription

1 Troubleshooting Landesk Software Distribution Jobs When a Software Distribution job fails you need to narrow down the cause of a failed job. Knowing the causes of a failed job will help you avoid the same issues in future job distributions. This handout assumes that the Software Distribution job has actually attempted to run on a system. Understanding Deployment Method Differences When you deploy a task as a scheduled task, the task can run as either Microsoft s Local System account or as the Logged on user. If the user is an Administrator, the task runs as the Logged on user. For any other user, it runs as the Local System account. So if you are an administrator & test the package, it runs as you the Administrator. But, it will probably not run that way for your users, unless they are administrators on that computer. Deploying Using a Push Delivery Method Using this type of deployment, the task runs as the account under which the client machine s LANDesk Management Agent service runs. By default, this is Microsoft s Local System account. Deploying Using a Policy Using this type of deployment, Landesk determines if the logged on user is an administrator on the client machine and if so, the task runs as the logged on user. If the user is not an administrator, the task runs as Microsoft s Local System account. Deploying Using a Policy-Supported Push A policy supported push is combination of a push and a policy. The task starts out as a push and runs under the Local System account. If a machine is off or doesn t complete the initial push, Landesk determines if the logged on user is an administrator on the client machine and if so, the task runs as the logged on user. If the user is not an administrator, the task runs as Microsoft s Local System account. Tip#1: Check the Log File of the computer where the software was being installed from the Landesk console Right-mouse click on the machine you deployed software to. Choose Log File Tip#2: Check the Provisioning History (if you use templates to deploy software) from the Landesk console Right-mouse click on the machine you deployed software to. Choose Provisioning History Remember: Templates are deployed as pushes Tip#3: Reset the hash on a package in the Distribution Packages console in Landesk If you ve modified a software package that you ve created, you MUST reset the hash on the package before deploying it. Right-mouse click on the package & choose reset hash Deploy the package again

2 Tip#4: Use the WINS name (not IP address) of the server where the Software Package is located \\5011x-Beach-GIS\Images\Software works. \\ \Images\Software doesn t often work. Tip#5: DON T assume that since you can install a software package manually that it is a Landesk issue when a package fails:. When you install software manually, you are doing so as the logged in user, or if you choose "Run as" it runs as a specific user. By default LANDesk runs its tasks using "LOCAL SYSTEM". SO.. The only way that a Software distribution job should ever be tested is trying the run them as "LOCAL SYSTEM" (See below for more) Tip#6: Check to see if there are log files on the computer where the software was being installed Client log files are located in the C:\Program Files\LANDesk\LDClient\data, the C:\Program Files\LANDesk\LDClient\SdmCache, or the C:\Program Files\LANDesk\LDClient folders Some files to look for: sdclient_task<taskid>.log, taskmanifest.<coreserver>.<taskid>.#.ini (See below for more) Testing an application as LOCAL SYSTEM: 1. Open up a Local System command prompt: Use the Landesk localsch.exe command o "c:\program files\landesk\ldclient\localsch.exe" /exe=cmd.exe OR use the Windows Scheduler service o at 14:24 /interactive cmd.exe (replace the time in the example below with the current time on your system plus 1 or 2 minutes) (Won t work on Windows 7) OR when remote controlling a LANDesk agent, in the top of the screen there is a Run: field. Simply type "cmd.exe" in the Run: field and click the green arrow. OR for Windows 7 download PSExec. Unzip it an run a command similar to this: c:\pstools\psexec.exe -accepteula -i -s "%windir%\system32\cmd.exe" -accepteula yes 2. Test access to the share where the distribution package is located: Map a drive to the share using the net use command o C:\> net use * \\server\share (replace server & share with your server & share) o The * will assign the next available drive letter so you may need to know what it is Change to the mapped drive: o G: (for example) Change directory where the application is located: o CD name of folder o For example: cd adobe or cd software\adobe Now try to copy one of more of the files from the share to the local computer o G:\adobe> copy adobe.msi c:\ IF all of these steps work, then the Local System account has access to the share, folder, and file. If you get errors such as Access Denied or Network path not found or something similar, then the Local System account does not have access to the share.

3 Make sure if you get a network path error that you are typing in a valid path. Make sure you run the application with the switches that may have been added when creating the task are used. Try this on multiple systems as the first system could have problems If using environmental variables, make sure you are only using environmental variables that a Local System Account uses Make sure the Domain Computers group has access to the software share 1. Make sure that the group Domain Computers or a group such as 5011 All Computers access to the share where the distribution package is located: In order for the Local System account to have access to a share where your distribution packages are located the Domain Computers group needs access to the Share and Security (NTFS) permissions of the share. Be careful with Environmental Variables in Batch Files 1. Be careful using Environmental Variables Not all environmental variables are available under the Local System account so only use the Local System Account variables. Check the Log Files (if there are any) IMPORTANT: No matter what the error message you see in the Landesk console, it is always a good idea to review the sdclient_taskxxx.log on the computer where the software was being installed You can access this file from your Landesk administrator computer by going to Start/Run and typing in \\ComputerName\c$ and browsing to the location of the file. The sdclient_taskxxx.log is located in the C:\Program Files\Landesk\ldclient\data folder on any computer where the distribution task failed. Scroll to the bottom.. o If you see something referring to /ldlogon/filelists/taskmanifest, it means that the taskmanifest file is not being downloaded to the C:\Program Files\Landesk\ldclient\sdmcache folder on the client. o If there is an error code something like or 0x8dac4026, you could go to the Website and search for the error code o If there is an error referring to a file that did not match the hash such as JE1ajAlxHFHUTV11Hs73fQ== and a message indicating that it Failed to download and has hash all additional files.

4 Common Error "Failed to download all additional files for a package" (The files are in the same folder) Make sure you have added any additional files in the Additional Files Section of the Package Distbribution If there is still a problem: o Go to the client machine and delete all files in the \Program Files\LANDesc\LDClient\sdmcache folder o Re-run the task o See if there is a file like taskmanifest.<coreserver>.<taskid>.#.ini. It will list all the files that should be downloaded, where they are to be downloaded from, and the hash for each file o See if there is a file like sdclient_task<taskid>.log. It will give some indication of why the job failed o Another log to look in: \\XXXXx-sri1\ldlog\provisioning What if the task completed successfully, but the Landesk console shows differently? A return code of 0 (zero) is the standard code for success. Some vendors (MicroSoft Office 2007) use different return codes for success. Sometimes a batch file is set to use a different code for success Sometimes the computer didn t send the status back to the Landesk server. (See article ) Landesk Log Files Software Distribution C:\Program Files\LANDesk\LDClient\data\sdclient_task#.log C:\Program Files\LANDesk\LDClient\sdclient.log C:\Program Files\LANDesk\LDClient \ tmcsvc.log C:\Program Files\LANDesk\LDClient\ SDClientTask.[Core-Name].[task#].log C:\Program Files\LANDesk\LDClient \ [MSI Name].log (created during installation of MSI packages) Policy Software Distribution C:\Program Files\LANDesk\LDClient \ policy.cgi.log C:\Program Files\LANDesk\LDClient \ policy.client.portal.log C:\Program Files\LANDesk\LDClient \ policy.client.invoker.log C:\Program Files\LANDesk\LDClient \ policy.sync.log Security and Patch Manager C:\Documents and Settings\All Users\Application Data\vulScan\vulscan.log C:\Documents and Settings\All Users\Application Data\ vulscan\ vulscan.#.log (The vulscan log will roll and create a vulscan.1.log, vulscan.2.log, etc) C:\Program Files\LANDesk\LDClient \ vulscan.log C:\Documents and Settings\All Users\Application Data\ vulscan\ softmon.log LANDesk AntiVirus C:\Program Files\LANDesk\LDClient\Antivirus\UpdateVirusDefinitions.log C:\Program Files\LANDesk\LDClient\Antivirus\UpdateVirusDefinitions.old C:\Documents and Settings\All Users\Application Data \LANDeskAV\avservice.log C:\Documents and Settings\All Users\Application Data \LANDeskAV\avservice_channel.log C:\Documents and Settings\All Users\Application Data \LANDeskAV\AVScanShExt.log C:\Documents and Settings\All Users\Application Data \LANDeskAV\LDAV.log C:\Documents and Settings\All Users\Application Data \LANDeskAV\avservice_update.log

5 How to Add a Machine into Landesk console MANUALLY: Note: Only needed if a machine does not appear in your devices in your console 1. Open up Landesk console 2. Near the top window notice the Network View section 3. Click/Expand the Configuration section 4. Right mouse click on Bare Metal Server 5. Click on Add. You have the option of adding in a machine by Mac Address or Serial Number When you add a machine, it will take anywhere from minutes to appear in your console. If you choose Serial Number, when you try to image a machine, you will need to specify to boot to a WinPE Environment when you press F12 on booting up a machine. Otherwise, you will not need to do this with a MacAddress. If you choose to import a file (for multiple machines), make sure that the Computer Name is in column 1 and the MacAddress (or Serial Number) is in column 2. Sample Batch file to install an MSI: REM tell the MSI to NOT reboot. REM If a reboot is required, an MSI usually returns 3010, meaning Error_Success_reboot_required. REM So we check if the reboot is needed or not. REM My Batch file to install an MSI :installer someinstaller.msi /q /noreboot REBOOT=REALLYSUPPRESS REM Check if it works REM Usually it returns 0 if it works and does NOT need a reboot IF "%ERRORLEVEL%"=="0" GOTO end REM Usually it returns 3010 if it works and DOES need a reboot IF "%ERRORLEVEL%"=="3010" GOTO reboot :reboot sdclient.exe /reboot :end Sources: How to quickly troubleshoot a Software Distribution job: How to open a command prompt running as Microsoft's "Local System" account? Understanding Batch File Distribution Packages Landesk Client Log Files