SMS Inventory Tool for HP ProLiant and Integrity Update User Guide

Transcription

1 SMS Inventory Tool for HP ProLiant and Integrity Update User Guide Part Number December 2007 (Third Edition)

2 Copyright 2006, 2007 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR and , Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor s standard commercial license. Microsoft and Windows are U.S. registered trademarks of Microsoft Corporation. Windows Server 2003 is a U.S. trademark of Microsoft Corporation. Intel, Itanium, Pentium, and Celeron are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. Audience assumptions This document is for the person who installs, administers, and troubleshoots servers and storage systems. HP assumes you are qualified in the servicing of computer equipment and trained in recognizing hazards in products with hazardous energy levels.

3 Contents Overview... 6 Introduction... 6 About this guide... 7 Benefits... 7 Features... 7 HP ProLiant Support Pack requirements... 8 HP Integrity Support Pack requirements... 8 Management protocol requirements... 8 Supported hardware platforms... 8 Supported operating systems... 9 SMS platform support... 9 System requirements... 9 SMS site servers SMS client servers Related documents SMS site hierarchy Software components Inventory tool components Packages HP Updates program HP Updates (expedited) program HP Updates Sync program HP Insight Inventory Collector Advertisements HP Updates advertisement HP Updates Sync advertisement Collections HP Updates collection HP Updates (pre-production) collection HP Updates Sync collection HP Servers collection Reports Installation Installation overview Using the software Identifying HP servers to manage Modifying the list of scanned systems Running the hpcplverify.exe utility on Itanium servers Scanning managed servers Obtaining the latest HP manifest catalog SMS site server with an FTP connection SMS site server without an FTP connection Obtaining the HP manifest catalog with the sync tool Software update reports Contents 3

4 Authorizing and deploying software updates Filtering updates using the DSUW Obtaining information about updates Obtaining components from the network Tracking software update deployment Advanced topics Running the setup wizard from the command line Switching between the Internet and network share to obtain HP catalog and components Using the scan tool Scan tool command line syntax Changing default parameters for scan tool advertisement Scan tool status Using the sync tool Sync tool command line syntax Sync tool status Access rights Default access rights assigned to resources created during setup Required access rights for components used during setup Default access rights for resources used by the sync tool Required access rights for resources used by the sync tool Providing WMI permissions for the remote sync host machine Disabling the HP Updates Sync advertisement Viewing update details with Resource Explorer Updates that require reboots Configuring the sync tool for unattended mode Setting the permissions for the HP Updates package folder Providing WMI permissions for the sync host machine Changing the HP Updates Sync program properties Providing access to the sync host machine to update the SMS database Adding the sync host machine to software updates Setting permissions on the HP Updates package object Updating distribution points Running the HP Updates Sync advertisement Configuring updates after deployment Downgrading components Removing the inventory tool Using the hpsmstool utility HP Insight Inventory Collector Introduction to the Collect utility Enabling SMS Hardware Inventory cycle to obtain Collect.MIF files...62 Collect command line options MIF file contents Compaq0.mif inventory tables Compaq1.mif inventory tables Compaq2.mif inventory tables Compaq3.mif inventory tables Compaq4.mif inventory tables Compaq5.mif inventory tables Compaq6.mif inventory tables Compaq7.mif inventory tables Compaq8.mif inventory tables Compaq9.mif inventory tables Contents 4

5 Troubleshooting Viewing the log files Smart Component installation log file Setup log file Sync and scan tool log files Common error messages hpcplverify.exe utility Known issues The previous version of the scan tool is executed after uninstalling and reinstalling the inventory tool Specifying an authentication account for the synchronization task Enabling access privilege for the synchronization task when obtaining the manifest catalog from a local share The inventory tool does not recognize HP software before version 4.05 (HP Integrity servers) The inventory tool falsely reports default drivers as compliant (HP Integrity servers) Smart Component information is not available without a direct Internet connection IA-64 and x64 platforms must be selected manually when creating a custom package using the DSUW The Software Update status for components does not reflect newly installed hardware Compliant status for support packs might not reflect actual system status Log files in 64-bit managed system contains incorrect path information Errors and inconsistencies for compliance and requested status in Reports and the DSUW Acronyms and abbreviations Index Contents 5

6 Overview Introduction The SMS Inventory Tool for HP ProLiant and Integrity Update is a new inventory tool that: Facilitates the use of existing software management features for HP ProLiant and Integrity servers through Microsoft SMS 2003 SP1, SP2, and SP3. Expands the existing ProLiant integration with SMS 2.0 and SMS Adds SMS support for HP Integrity servers that HP ProLiant SMS site servers manage as clients. Enables you to use SMS 2003 SP1, SP2, and SP3 to manage and distribute HP system software, firmware (ROM and BIOS updates), and ProLiant or Integrity Support Packs to a group of servers. When you use SMS 2003 to manage system hardware inventory and software update deployments, you can do so more effectively with ProLiant and Integrity servers. This functionality complements HP Systems Insight Manager and the HP OpenView suite of system management tools. You can download the kit containing the tool and associated documentation from the HP website at no cost. With the inventory tool, you can: Inventory HP ProLiant and Integrity servers within the scope of the management collection. You can limit and adjust management collections to suit your needs. For example, you can create a collection of servers related to a specific application to ensure that servers for that application are managed consistently. Sort server inventory by server model or Microsoft Windows version. This feature simplifies the definition of update requirements and facilitates large-scale software deployments using SMS. Scan HP servers within a management collection to determine the current configuration of software, firmware, and support packs. Predefined SMS reports provided with the inventory tool simplify your review of installed components. Authorize and deploy software updates to servers. Deployment of full ProLiant and Integrity Support Packs is comprehensive and complete. Support packs are pretested together to ensure smooth integration. You can deploy user-defined groups of components with the inventory tool, but HP does not support (and cannot guarantee) such deployments. You must perform adequate testing to ensure that your combination of individual components integrates with your environment. Manage distributions of specific components from within ProLiant and Integrity Support Packs. The inventory tool simplifies the installation of a single software module (a driver update, for example) to a group of servers. Monitor component installation and results. Log files are available to allow post-deployment audits of updates. Inventory certain hardware-specific information through the HP Insight Inventory Collector. You can install the inventory tool from the HP website or from the CD. Overview 6

7 If you have experience with SMS, using the inventory tool might seem intuitive. Familiarity with HP update resources enables you to simplify your development of an efficient SMS environment. About this guide Benefits Features This guide is intended for use by system integrators and network administrators who are familiar with HP branded server and client system products and Microsoft SMS SMS 2003 and the inventory tool are both highly complex software systems that rely on many distributed components and network-based external resources to function correctly. For even the most highly experienced users, successful installation of the product is highly dependent on following the detailed installation instructions included in this guide. A clear understanding of the product architecture is important. Use of this guide and other suggested resources is critical in installing, using, and troubleshooting the inventory tool. For detailed setup and installation instructions, see the SMS Inventory Tool for HP ProLiant and Integrity Update Setup and Installation Guide. To troubleshoot installation and configuration problems with the inventory tool, see the SMS Inventory Tool for HP ProLiant and Integrity Update Troubleshooting Assistant. The SMS Inventory Tool for HP ProLiant and Integrity Update is available from, and supported by HP and Microsoft and provides the following functionality: Enabling users that choose to use SMS to enjoy all the advantages of the HP software update infrastructure Facilitating updates of ProLiant and Integrity system software with the same tool many users choose to manage Windows components updates Simplifying options for SMS users by functioning completely within the scope of SMS There are no features unique to HP that users must understand. Supporting distribution of both ProLiant or Integrity Support Packs and individual software components Providing automated HP Insight Inventory Collector installation Is available from, and supported by, HP and Microsoft Complementing the full line of HP management tools The SMS Inventory Tool for HP ProLiant and Integrity Update includes the following main features: Expansion of previously available features to include full software deployment through SMS User-initiated scan of an operational environment for HP servers Ability to identify and define the HP servers that will be members of a management collection Sort and view HP servers by model (ProLiant servers only) or Windows operating system version Scan HP servers to inventory current ProLiant or Integrity server software configurations (this feature includes software components, firmware, and ProLiant or Integrity Support Packs) Overview 7

8 Rapid analysis of current software configurations with predefined reports for HP servers Authorization and deployment of selected HP software components to appropriate HP servers HP ProLiant Support Pack requirements HP ProLiant Support Pack software components must carry specific digital signatures to operate in an SMS environment. These requirements differ for Microsoft Windows Server 2000 and Windows Server Windows Server 2000 products support the following ProLiant Support Packs: HP ProLiant Support Pack 7.3 for Windows. Later versions of HP ProLiant Support Packs for Windows 2000 (when available) Windows Server 2003 products support the following ProLiant Support Packs: HP ProLiant Support Pack 7.4b for Windows Later versions of HP ProLiant Support Packs for Windows 2003 (when available) The latest HP ProLiant Support Packs are available on the HP website ( The HP Catalog contains only the three latest ProLiant Support Packs. HP Integrity Support Pack requirements HP Integrity Support Pack 4.05 for Windows and later is required. The latest Integrity Support Packs are available on the HP Integrity server website ( Management protocol requirements SNMP is required locally on each managed HP server to enable correct operations of the inventory tool. Supported hardware platforms The SMS Inventory Tool for HP ProLiant and Integrity Update supports SMS client functionality on the following HP ProLiant servers: HP ProLiant BL series servers HP ProLiant DL series servers HP ProLiant ML series servers NOTE: The inventory tool does not support HP ProLiant ML and DL 100 series servers as SMS clients. The SMS inventory tool supports SMS client functionality on the following HP Integrity servers: HP Integrity rx1620 Server HP Integrity rx2600 Server HP Integrity rx2620 Server Overview 8

9 HP Integrity rx2660 Server HP Integrity rx3600 Server HP Integrity rx4640 Server HP Integrity rx5670 Server HP Integrity rx6600 Server HP Integrity rx7620 Server HP Integrity rx7640 Server HP Integrity rx8620 Server HP Integrity rx8640 Server HP Integrity BL860c Server HP Integrity BL870c Server HP Integrity Superdome series servers HP Integrity Virtual Machine Server NOTE: Running the scan tool on an unsupported server will generate an error code. See "Troubleshooting (on page 74)" for more information. Supported operating systems The inventory tool supports SMS operations for HP ProLiant servers running the following operating systems: Microsoft Windows Server 2003 Microsoft Windows Server 2003 x64 Editions Microsoft Windows Server 2000 with SP4 or later The inventory tool also supports SMS operations for HP Integrity servers running the following operating systems: Microsoft Windows Server 2003, Enterprise Edition with SP1 for Itanium-based Systems Microsoft Windows Server 2003, Datacenter Edition with SP1 for Itanium-based Systems SMS platform support The SMS Inventory Tool for HP ProLiant and Integrity Update was developed and tested for use with Microsoft SMS 2003 SP1, SP2, and SP3. To use the inventory tool, update previous versions of SMS and apply all applicable Microsoft hotfixes. System requirements The SMS Advanced Client Agent must be installed on managed servers. In addition, you must run a hardware inventory cycle on the managed servers that are to be grouped by the predefined HP collections. Overview 9

10 SMS site servers For a comprehensive list of minimum hardware and software requirements, see the Microsoft website ( HP Integrity servers are not supported as SMS site servers or sync hosts. HP recommends the following minimum system requirements on HP ProLiant servers running Microsoft SMS 2003 SP1, SP2, or SP MHz Intel Celeron processor or equivalent 256 MB RAM Hard disk space 72.5 MB o Installation directory 10 MB o Installation log files 20 MB o Scan tool 12.5 MB o Scan tool log files 30 MB CD or DVD drive NIC Windows 2000-compatible VGA Microsoft SMS 2003 SP1, SP2, or SP3 with all applicable hotfixes One of the following supported database applications: o Microsoft SQL Server 7.0 Standard Edition o Microsoft SQL Server Enterprise Edition with SP3 or later o Microsoft SQL Server 2000 Standard Edition o Microsoft SQL Server Enterprise Edition with SP3a or later Additional requirements o Microsoft Internet Information Services for some SMS site system roles o If the sync tool is installed on the system, Internet access ("Obtaining the HP manifest catalog with the sync tool" on page 25) IMPORTANT: Localized language support for SMS Servers is provided by specific Microsoft hotfixes. HP expects to support German, French, Japanese, Simplified Chinese, and the SMS International Client Pack on SMS Servers at a later date. At that time, you will need to apply the appropriate hotfixes to use localized versions of the SMS server. The required hotfixes are available on the Microsoft website ( Use of localized versions of SMS without these hotfixes will not work and is not supported. NOTE: Hard disk space for the HP repository is maintained in a local or network share folder. The current size of the HP repository is approximately 1.08 GB, and it will continue to grow as additional updates are released. Overview 10

11 SMS client servers Most HP ProLiant and Integrity servers are supported as SMS clients. Those that are not supported have not been tested by HP and might not display inventory information correctly. Specific exclusions include the following systems: Older ProLiant servers that precede the BL, DL, and ML product lines Older HP NetServer servers IMPORTANT: Localized language support for SMS Servers is provided by specific Microsoft hotfixes. HP expects to support German, French, Japanese, Simplified Chinese, and the SMS International Client Pack on SMS Servers at a later date. At that time, you will need to apply the appropriate hotfixes to use localized versions of the SMS server. The required hotfixes are available on the Microsoft website ( Use of localized versions of SMS without these hotfixes will not work and is not supported. Related documents For more information on topics discussed in this guide, see the following resources: HP SIM user documentation from the HP Management CD Insight Management Agents for Microsoft Windows user documentation from the HP Management CD SMS Inventory Tool for HP ProLiant and Integrity Update Setup and Installation Guide SMS 2003 SP1 Supported Configurations product documentation Systems Management Server 2003 for Windows Administrator's Guide Microsoft SQL Server for Windows System Administrator's Guide Microsoft Windows Administrator's Guide Overview 11

12 SMS site hierarchy SMS sites are arranged in a hierarchy. Using the inventory tool requires an understanding of the SMS site hierarchy. This hierarchy can include several site categories: Category Central site Primary site Secondary site SMS site server Description Single SMS site that stores system-wide information in a Microsoft SQL Server database. Manages all other SMS sites. Stores subsystem information in an SMS database. Can manage additional primary or secondary sites. Created by running the SMS setup application. Stores information in the SMS database of the associated primary site. Manages no additional sites. Created by the associated primary site. The machine at a particular site that is responsible for managing that site and channeling all SMS information to and from the site. An SMS site can include one or more domains and can be a parent, a child, or both: A parent site contains information on all associated child sites and can manage certain operations at these child sites. A child site receives information from and reports information to a parent. The central site is a parent site. A primary site is a child site (with the central site or another primary site as parent) and can be a parent site (with secondary sites or other primary sites as child sites). Overview 12

13 A secondary site is a child site. Overview 13

14 Software components Inventory tool components The SMS Inventory Tool for HP ProLiant and Integrity Update kit contains software supporting HP ProLiant and HP Integrity servers. The kit consists of the following components: SMSITHU.msi The self-extracting installer runs the setup wizard to build the package, collections, and advertisements to deploy components of the inventory tool in the SMS environment. Sync tool ("Using the sync tool" on page 39) (hpsync.exe and hpupdatecatalog.exe) The sync tool is deployed by SMS and runs on a single SMS client. After you install the sync tool, the tool periodically checks the HP website or dedicated network share folder to obtain the latest HP manifest catalog. The catalog is updated in the SMS Software Updates list and deployed to managed servers in the SMS environment. Scan tool ("Using the scan tool" on page 36) (hpscan.exe) The scan tool is deployed by SMS and runs on the managed servers in the SMS environment. The scan tool performs automated, periodic scans of SMS client servers for installed software, firmware, and HP ProLiant and Integrity Support Pack updates. HP Insight Inventory Collector (on page 62) (Collect.exe) The Collect utility is incorporated in the inventory tool to enable users familiar with this tool to continue to use the utility. hpsmstool utility ("Using the hpsmstool utility" on page 59) The hpsmstool utility enables you to remove HP specific SMS database and WMI elements installed by the setup wizard. Packages (on page 14) Advertisements (on page 15) Collections (on page 16) Reports (on page 18) Before you can install the inventory tool, SMS 2003 SP1 and SP2 hotfixes from Microsoft are required (SMS SP3 does not require any hotfixes from Microsoft). Hotfixes are available on the Microsoft website ( See the SMS Inventory Tool for HP ProLiant and Integrity Update Setup and Installation Guide for more information. Packages The inventory tool installer creates the package, HP Updates, to deploy the sync tool and the scan tool. The following programs are provided with the package: HP Updates program (on page 15) HP Updates (expedited) program (on page 15) HP Updates Sync program (on page 15) HP Insight Inventory Collector (on page 62) Software components 14

15 CAUTION: The setup wizard automatically generates new packages and collections and overwrites properties for any existing package or collection with the same name. Be sure to back up or rename any customized package or collections before beginning the installation. NOTE: The package, collection, and advertisement names that are created will be prefixed with the name specified in the Distributions Settings screen of the setup wizard. This document uses "HP Updates" as the distribution setting name. Each program is installed with default settings. See "Advanced topics (on page 35)" for information on changing the default settings. HP Updates program The HP Updates program is distributed for advertising the scan tool. HP Updates executes the scan tool and returns the result of the scan to the SMS site server at the next hardware inventory cycle. You can enable the advertisement for HP Updates to the HP Updates collection (on page 16) when installing the inventory tool. HP Updates (expedited) program Similar to HP Updates, the HP Updates (expedited) program is distributed to advertise the scan tool. HP Updates (expedited) executes the scan tool and returns the result to the SMS site server by issuing an immediate hardware inventory collection. You must manually advertise HP Updates (expedited). The advertisement cannot be enabled when installing the inventory tool. HP Updates Sync program The HP Updates Sync program is used to advertise the sync tool. You can enable the advertisement for HP Updates Sync to the HP Updates Sync collection ("HP Updates collection" on page 16) when installing the inventory tool. HP Updates Sync downloads the latest HP manifest catalog file from HP. The HP manifest catalog contains a list of the latest software, firmware, and HP ProLiant and Integrity Support Packs. The sync tool processes and updates this information in the SMS database. HP Insight Inventory Collector The HP Insight Inventory Collector program is distributed to advertise the Collect utility to managed client servers. You must manually advertise the Collect utility. The advertisement cannot be enabled when installing the inventory tool. Advertisements Advertisements for the sync tool and the scan tool can be enabled during installation. If these options are enabled, the following advertisements are created: HP Updates advertisement (on page 16) HP Updates Sync advertisement (on page 16) Software components 15

16 HP Updates advertisement The HP Updates advertisement distributes the scan tool to the SMS clients. By default, this advertisement runs weekly on the HP Updates collection (on page 16) to take inventory of the HP software. The results are collected at the next hardware inventory cycle. HP Updates Sync advertisement The HP Updates Sync advertisement runs the sync tool on the targeted system. By default, this advertisement runs daily on the HP Updates Sync collection (on page 17) to obtain the latest HP manifest catalog and update the SMS site server. Collections The setup wizard automatically generates the following collections to identify HP ProLiant and Integrity servers and the installed operating system: HP Updates collection (on page 16) HP Updates (pre-production) collection (on page 16) HP Updates Sync collection (on page 17) HP Servers collection (on page 17) o o o ProLiant Servers by Model ProLiant Servers by OS Integrity Servers CAUTION: The setup wizard automatically generates new packages and collections and overwrites properties for any existing package or collection with the same name. Be sure to back up or rename any customized package or collections before beginning the installation. NOTE: The HP Servers collection name is automatically generated. The collection name is fixed and cannot be changed during or after installation. For information about creating or modifying default collections, see the Microsoft website ( HP Updates collection The HP Updates collection is the default collection for advertising the scan tool. During installation, you can advertise the scan tool to the HP Updates collection. After installation, this collection contains only the test system that was specified during the setup process. See "Using the scan tool (on page 36)" for more information about the scan tool. HP Updates (pre-production) collection The HP Updates (pre-production) collection enables you to test the scan tool before putting the inventory tool and target system into the production environment. This collection is not advertised. Verify that the scan tool is properly running by checking status of the advertisement and reviewing the software update Software components 16

17 reports. See "Using the scan tool (on page 36)" and "Software update reports (on page 26)" for more information. HP Updates Sync collection The HP Updates Sync collection is the default collection for advertising the sync tool. During installation, you can advertise the sync tool to its default collections. Depending on the settings for the sync tool, the systems within this collection might require an FTP connection for the sync tool to function properly. See "Using the sync tool (on page 39)" for more information. HP Servers collection The HP Servers collection enables you to quickly identify and categorize the following HP ProLiant and Integrity servers in your SMS environment. Each collection uses specific query statements, enabling you to identify systems by model type or operating system. HP Servers Includes all HP servers and previously released Compaq servers NOTE: The HP Servers collection name is automatically generated. The collection name is fixed and cannot be changed during or after installation. For information about creating or modifying default collections, see the Microsoft website ( ProLiant Servers by Model Includes all ProLiant BL, DL, and ML series servers and previously released ProLiant servers, including the following: o ProLiant Servers BL Includes all ProLiant BL servers o ProLiant Servers DL Includes all ProLiant DL servers o ProLiant Servers ML Includes all ProLiant ML servers ProLiant Servers by OS Includes all ProLiant BL, DL, and ML series servers and previously released ProLiant servers, including the following: o o o ProLiant Servers Windows Server 2000 Systems Includes all x86 ProLiant servers that are running Windows Server 2000 ProLiant Server Windows Server 2003 System Includes all x86 ProLiant servers that are running Windows Server 2003 ProLiant Server Windows Server 2003 x64 Editions System Includes all x64 ProLiant servers that are running Microsoft Windows Server 2003 x64 Editions NOTE: The inventory tool does not support HP ProLiant ML and DL 100 series servers as SMS clients. Integrity Servers Includes the following Integrity model servers running Microsoft Windows Server 2003 with SP1 for Itanium-based Systems operating system: o HP Integrity rx1620 servers o HP Integrity rx2600 servers o HP Integrity rx2620 servers Software components 17

18 o o o o o o o o o o o o o HP Integrity rx2660 servers HP Integrity rx3600 servers HP Integrity rx4640 servers HP Integrity rx5670 servers HP Integrity rx6600 servers HP Integrity rx7620 servers HP Integrity rx7640 servers HP Integrity rx8620 servers HP Integrity rx8640 servers HP Integrity BL860c server blades HP Integrity BL870c server blades HP Integrity Superdome servers HP Integrity Virtual Machine servers Reports In addition to the standard SMS reports, HP specific reports are also installed during installation. These reports contain information specific to each supported HP server within the SMS environment. See "Software update reports (on page 26)" for more information about using these reports. Software components 18

19 Installation Installation overview SMS 2003 and the inventory tool are both highly complex software systems that rely on many distributed components and network-based external resources to function correctly. For even the most highly experienced users, successful installation of the product is highly dependent on following the detailed installation instructions included in this guide. A clear understanding of the product architecture is important. Use of this guide and other suggested resources is critical in installing, using, and troubleshooting the inventory tool. Be sure to carefully follow the instructions to install and use the inventory tool. Installing the inventory tool on the SMS site server includes the following steps: 1. Completing the preinstallation checklist 2. Downloading and installing the inventory tool 3. Reviewing installation results 4. Completing all post-installation procedures For detailed setup and installation instructions, see the SMS Inventory Tool for HP ProLiant and Integrity Update Setup and Installation Guide. Installation 19

20 Using the software Identifying HP servers to manage Multiple collections are created during installation to enable you to identify HP servers within the SMS environment. These collections can be modified to fit individual needs. The HP Updates collection (on page 16) is the default collection targeted for advertising the scan tool. This collection must be properly updated so that the scan tool is advertised to the correct target system. Modifying the list of scanned systems If the installation has proceeded normally, the query statement that performs collections accurately represents the servers in the collection. However, the statement might need to be modified if new HP servers are released and should be added to the collection. To modify the list of scanned systems on which the scan tool runs: 1. In the SMS Administrator console, select Systems Management Server>Site Database>Collections. Using the software 20

21 2. Right-click HP Updates collection, and select Properties. The HP Updates Collection Properties dialog box appears. 3. In the Membership Rules tab, right-click Collection Query, and select Properties. Using the software 21

22 4. Select Limit to collection, and then click Browse. IMPORTANT: This collection can also be configured by using the Collection Query membership rule. The membership rule is a query statement that can be modified to add or remove computers from the collection. To run the scan tool on the systems specified by this query statement, set the collection limiting option to Not collection limited. 5. Select the collection to scan, and click OK. NOTE: Listing HP Integrity servers by operating system will not differentiate between Microsoft Windows Server 2003 Enterprise Edition or Microsoft Windows Server 2003 Datacenter Edition. Using the software 22

23 6. In the Query Rule Properties dialog box, click OK. 7. In the HP Updates Collection Properties dialog box, click OK. Running the hpcplverify.exe utility on Itanium servers Users of the initial release of Windows Server 2003 for 64-bit Itanium-based Systems must first run the hpcplverify.exe utility to access SMS clients from the Control Panel. The Control Panel of early versions of Windows Server 2003 does not contain the View x86 icons folder. To add access to the SMS clients from the Control Panel: NOTE: This utility is for 64-bit machines only. Executing this utility on a 32-bit machine triggers the error message, "The image file C:\hpCplVerify.exe is valid, but is for a machine type other than the current machine." 1. Locate the file hpcplverify.exe in the directory C:\Program Files\SMS Inventory Tool for HP Update\Tools of the SMS server. 2. Copy the file to the hard drive of the SMS client. 3. On the SMS client, go to the command prompt, change to the location where the file was copied, and execute the file. 4. On the SMS client, access the Control Panel, and confirm that the View x86 icons folder displays. Double-click View X86 icons to view the System Management icon. 5. Double-click System Management to confirm the icons display. Scanning managed servers The HP Updates advertisement (on page 16) triggers the scan tool to run at the recurring schedule on all servers in the HP Updates collection (on page 16). The scan tool scans all servers in the collection and Using the software 23

24 obtains information about the installed and missing HP software and firmware updates for each system. This information can then be viewed on the software update reports (on page 26). To modify the HP updates collection, see "Identifying HP servers to manage (on page 20)" for more information. NOTE: Running the scan tool on an unsupported server will generate an error code. See "Troubleshooting (on page 74)" for more information. Obtaining the latest HP manifest catalog During installation, the setup wizard can obtain the latest HP manifest catalog from either the HP website or a network shared folder: For SMS site servers with access to the Internet, see "SMS site server with an FTP connection (on page 24)" for instructions on downloading the HP manifest catalog from the HP website. For SMS site servers without access to the Internet, see "SMS site server without an FTP connection (on page 24)" for instructions on downloading the HP manifest catalog from a network shared folder. The sync tool can also be used to download the latest HP manifest catalog after the inventory tool is installed. See "Obtaining the HP manifest catalog with the sync tool (on page 25)" for more information. IMPORTANT: If the inventory tool is configured to use a network share during installation, components updated with DSUW will also be obtained from network share. Components will be obtained from the HP FTP site if the tool is configured to use FTP during setup. See "Switching between internet and network share to obtain HP catalog and components ("Switching between the Internet and network share to obtain HP catalog and components" on page 36)" for more information. SMS site server with an FTP connection If the SMS site server has an FTP connection, HP recommends using the setup wizard to download the latest HP manifest catalog from the HP website. The SMS environment might use a proxy that requires authentication to access the Internet. Be sure to run the setup wizard using an account that has the following characteristics: Access to the Internet SMS administrative permissions (SMS admins group) Local administrative permissions (Local administrators group) Also, be sure to verify that your network access, including firewalls or proxy servers are setup to allow active FTP access. See "Access rights (on page 39)" for more information on setting up Internet connections. SMS site server without an FTP connection If the SMS site server does not have an FTP connection, the HP manifest catalog and all component files must be provided on a local network share. Using the software 24

25 In this case, the setup wizard downloads the HP manifest catalog from the network shared folder. Before running the setup wizard, be sure the selected network shared folder contains the latest HP manifest catalog and individual components. After the sync tool is configured to obtain the HP manifest catalog and individual components from the network shared folder, you must verify that the share is regularly updated with the latest manifest catalog to ensure information in the SMS site server is current. To download the HP manifest catalog and individual components to a network shared folder: 1. Create the folder C:\HPBinaries on a local system or network (C:\HPBinaries is an example; there are no restrictions on the folder name). 2. Create the folder C:\HPBinaries\Catalog. This folder stores the HP manifest catalog. 3. Create the folder C:\HPBinaries\Components. 4. Create the folder C:\HPBinaries\Components\ProLiant. This folder stores manually downloaded components for ProLiant updates. Proceed to step 6 if you are not managing Integrity servers within your SMS environment. 5. Create the folder C:\HPBinaries\Components\Integrity. This folder stores manually downloaded components for Integrity updates. 6. Download the HP manifest catalog (catalog.cab) from the HP website (ftp://ftp.hp.com/pub/softlib/software2/col3293/) to the Catalog folder created in step Download the latest support pack and components for your HP ProLiant server or Integrity server from the appropriate HP website to the corresponding Components folder created in step 4 and step 5. Download ProLiant components and support packs from the HP website ( and download Integrity components and support packs from the HP website ( 8. Share the folders created in steps 1 through 5, and give Read permissions to all users. NOTE: The network share folder specified must have the two subfolders, "Catalog" and "Components." Download the HP manifest catalog to the Catalog folder and the HP ProLiant or Integrity Support Pack to the appropriate Components subfolder. Obtaining the HP manifest catalog with the sync tool There are two methods to obtain the HP manifest catalog with the sync tool: Sync with the Internet HP recommends that the sync tool be used to automatically download the HP manifest catalog from the HP website. Using this method, new catalog updates can be automatically implemented with no user intervention. Be sure that the sync host has an FTP connection so that the sync tool can automatically download the latest HP manifest catalog. If the SMS environment uses a proxy that requires authentication, see "SMS site server with an FTP connection (on page 24)" for more information. Sync with a network shared folder If the sync host does not have an FTP connection, HP recommends configuring the sync tool to obtain the HP manifest catalog from a local folder or a network shared folder. The SMS administrator must manually download the HP manifest catalog and HP ProLiant or Integrity Support Pack components from the HP website and place the files in the appropriate locations. See "SMS site server without an FTP connection (on page 24)" for more information. Using the software 25

26 NOTE: The network share folder specified must have the two subfolders, "Catalog" and "Components." Download the HP manifest catalog to the Catalog folder and the HP ProLiant or Integrity Support Pack to the appropriate Components subfolder. Software update reports The inventory tool installer creates several HP specific software reports that can be used to view information about software, firmware, and support pack updates for HP ProLiant and Integrity servers. Multiple reports are linked together to enable easy access to related information. Computers that require HP ProLiant update Lists the overall status for all HP ProLiant servers that have been reported as Requested or Compliant by at least one software update (not limited to ProLiant software, ProLiant firmware, or ProLiant Support Pack update) Computers that require HP Integrity update Lists the overall status for all HP Integrity servers that have been reported as Requested or Compliant by at least one software update (not limited to Integrity software, Integrity firmware, or Integrity Support Pack update) Compliance report for HP ProLiant Support Pack updates Lists all HP ProLiant Support Pack updates within the SMS environment that have been reported as Requested or Compliant by at least one server Compliance report for HP Integrity Support Pack updates Lists all HP Integrity Support Pack updates within the SMS environment that have been reported as Requested or Compliant by at least one server Compliance report for a specific HP ProLiant software update Lists all servers that have reported the given HP ProLiant software update status as Requested or Compliant Compliance report for a specific HP Integrity software update Lists all servers that have reported the given HP Integrity software update status as Requested or Compliant Using the software 26

27 Compliance report for a specific HP ProLiant firmware update Lists all servers that have reported the given HP ProLiant firmware update status as Requested or Compliant Compliance report for a specific HP Integrity firmware update Lists all servers that have reported the given HP Integrity firmware update status as Requested or Compliant Compliance report for HP ProLiant firmware updates Lists all HP ProLiant firmware updates that have been reported as Requested or Compliant by at least one server Compliance report for HP Integrity firmware updates Lists all HP Integrity firmware updates that have been reported as Requested or Compliant by at least one server Compliance report for HP ProLiant Support Pack updates Lists all HP ProLiant Support Pack updates that have been reported as Requested or Compliant by at least one server Compliance report for HP Integrity Support Pack updates Lists all HP Integrity Support Pack updates that have been reported as Requested or Compliant by at least one server Compliance report for a specific HP ProLiant Support Pack update Lists all servers that have reported the given HP ProLiant Support Pack update status as Requested or Compliant Compliance report for a specific HP Integrity Support Pack update Lists all servers that have reported the given HP Integrity Support Pack update status as Requested or Compliant NOTE: SMS 2003 includes several reports, such as compliance, distribution status, and infrastructure health reports. For more information about using the standard SMS reports, see the Microsoft website ( Authorizing and deploying software updates The DSUW can be used to update the managed servers within the SMS environment. The DSUW authorizes applicable software, firmware, and support pack updates for HP ProLiant and Integrity servers. For more information about authorizing applicable updates, see the Microsoft website ( All applicable updates (including individual software updates) are installed in one process, and all components included in the update are tested together and supported by HP. However, individual software updates might need to be applied to address issues with specific components or when the updates are not included in the relevant HP ProLiant or Integrity Support Pack updates. In this scenario, you must first test the system with each individual installation package before advertising the update to the SMS environment to verify the proper sequence of component installation occurs. HP recommends deploying system updates using HP ProLiant or Integrity Support Pack updates and using HP ProLiant or Integrity Support Pack updates for deploying multiple software updates to guarantee the order of update execution. Updates can be grouped together and delivered in one package if the updates are the same type. For example, HP ProLiant firmware updates are not part of HP ProLiant Support Pack updates and must be deployed in a separate process. To troubleshoot any problems while authorizing and deploying software updates, see "Updates that require reboots (on page 48)." NOTE: Updates can only be grouped together and delivered as one package if the updates are the same type. For example, HP ProLiant software updates cannot be grouped with HP ProLiant firmware updates. To use DSUW to authorize HP Updates: Using the software 27

28 1. In the left pane of the SMS Administrator console, select Systems Management Server>Site Database. 2. Right-click Software Updates, and select All Tasks>Distribute Software Updates. 3. Click Next. The Specify a Software Update Type page appears. 4. In the Select an update type dropdown menu, select the type of update to be installed: o HP ProLiant Software o HP ProLiant Firmware Using the software 28

29 o o o HP ProLiant Support Pack HP Integrity Software HP Integrity Support Pack 5. Follow the remaining on-screen steps to authorize the desired HP Updates. Using the software 29

30 6. Modify the program properties of the package created to ensure that the platform requirement for the program is set appropriately. Using the software 30

31 Filtering updates using the DSUW The DSUW has filtering capabilities to eliminate unnecessary updates from displaying on the screen. To locate specific updates, enter part of the update name in the box under the Product column. For example, to locate all Windows Server 2003 updates, enter W2003 in the box under the Product column. Obtaining information about updates Additional information about each update is available on the HP website. To view details about a particular update: 1. Browse the list of updates, and select a particular update. 2. Click Information to be taken to the HP website. Obtaining components from the network The DSUW can automatically download the update binaries from the network shared folder or the HP website. If the system running the DSUW does not have an FTP connection or the network folder does not have the needed update binaries, manually import the update binaries: Using the software 31

32 1. From the Software Updates Status screen of the DSUW, select the component, and click Properties. 2. Verify the appropriate folder structure exists. See "SMS site server without an FTP connection (on page 24)" for more information. Using the software 32

33 3. Search for the appropriate components or support packs on the HP website ( using the entry in the Program field (in the format CP00xxxx or PSPxxx). 4. Download and extract the.exe files. 5. Copy the downloaded files to the appropriate Components folder created during installation. 6. Click Import to import the update from a local or network shared folder. IMPORTANT: Do not modify the properties for any of the updates imported. Using the software 33

34 Tracking software update deployment The software update reports (on page 26) track the deployment of software updates within the SMS environment. To troubleshoot any unexpected results, use the log file that is associated with the scan tool. See "Viewing the log files (on page 74)" for more information. NOTE: When using the log files to troubleshoot an error condition or failure, you must view the log files from each system where the condition occurred. Additionally, the various status messages generated can be used to determine what occurred. To view the status messages in the SMS Administrator console: 1. In the SMS Administrator console, expand Systems Management Server>Site Database>System Status. 2. Use the nodes below the System Status node to view status messages for individual advertisements or packages. 3. Use the Status Message Queries node below System Status to display status messages for specific SMS objects, such as packages, collections, advertisements, and programs. Use the built-in Software Update reports (on page 26), such as the report titled "Summary of software updates that failed to deploy," to determine the actual status of patch installation. NOTE: The installation log file displays the individual component install status from the target server and might be helpful. The installation log file, cpqsetup.log, is currently located at C:\Cpqsystem\Log directory in the target system. The log file location is subject to change with future releases. Using the software 34

35 Advanced topics Running the setup wizard from the command line To run the setup wizard from the command line, use the following command line parameters to specify the components of the inventory tool. Command line AcceptEULA[1,0] INSTALLDIR WEBDOWNLOAD[1,0] CATALOG_SRC_SETUP PACKAGENAME ALL_DPUPDATE[1,0] TESTCOMPUTER=<computer name> SYNCHOST=<computer name> WEBDOWNLOADSYNC[1,0] CATALOG_SRC_SYNC CREATEADV[1,0] SYNC_DEST_FOLDER=<folder path> Description 0 Do not accept the license agreement 1 Accept the license agreement INSTALLDIR 0 Obtain the HP manifest catalog from a network shared folder 1 Obtain HP manifest catalog from the HP website The location from which the setup wizard obtains the HP manifest catalog The package prefix name that the setup wizard uses for the SMS components (packages, collections, advertisements, and programs) 0 Do not update all distribution points 1 Update all distribution points Name of the server on which the setup wizard creates test and production collections Name of the server that serves as the sync host machine 0 The sync tool obtains the HP manifest catalog from a network shared folder 1 The sync tool obtains the HP manifest catalog from the HP website The location from which the sync tool obtains the HP manifest catalog 0 Do not create advertisements for the sync tool and scan tool during installation 1 Create advertisements for the sync tool and scan tool during installation Destination folder for the sync tool to update the HP manifest catalog The following example enables the setup wizard to run with no user interface: Advanced topics 35

36 msiexec.exe /i SMSITHU.msi /q /l*v mysetuplog.log AcceptEULA=1 WEBDOWNLOAD=0 CATALOG_SRC_SETUP="\\smsps1\c$\HPBinaries" PACKAGENAME="HP Updates" ALL_DPUPDATE=1 CREATEADV=1 TESTCOMPUTER="smsdc" SYNCHOST="smsdc" WEBDOWNLOADSYNC=0 CATALOG_SRC_SYNC="\\smsdc\c$\HPBinaries" SYNC_DEST_FOLDER="\\smsdc\c$\Program Files\HP Update Inventory Tool \PkgSource" INSTALLDIR="\\smsdc\c$\Program Files\HP Update Inventory Tool" Switching between the Internet and network share to obtain HP catalog and components Both the catalog synchronization process and the binaries automatically downloaded using the DSUW use the same location for obtaining the files. This location is set up during the installation of the inventory tool. Changing the source location affects both the synchronization and the automatic download process. To change the source location after the tool is installed: 1. On the SMS site server, locate and open the hpsyncconfig.xml from the inventory tool installation directory. The default directory for the file is C:\Program Files\SMS Inventory Tool for HP Update\PkgSource. 2. Edit the line containing NetworkShareLocation to contain the correct value: a. Change the line for NetworkShareLocation to contain the network share location from where the files are obtained. See the "SMS site server without an FTP connection (on page 24)" section for the appropriate folder structure. <NetworkShareLocation value="c:\yourshare"/> b. Change the line for NetworkShareLocation to contain an empty string if the files are obtained directly from the Internet. <NetworkShareLocation value=""/> 3. Save and close the hpsyncconfig.xml file. 4. On the SMS Administrator Console, expand the HP Updates from the Package tab, right-click the Distribution Points for the package, and select All Tasks>Update Distribution Points to be sure the distribution point is using the updated file. 5. Re-advertise the HP Updates Sync program or manually run the sync tool to update the SMS database. Using the scan tool The scan tool is a software inventory tool deployed by SMS and targets servers within the SMS environment. The scan tool performs automated, periodic scans of SMS clients for installed and missing software, firmware, and ProLiant and Integrity Support Pack updates. The scan tool uses information available from the HP catalog to determine the state of the system. It reports to the SMS server that a software update is compliant if the installed version is compliant up to the current version of component. The scan tool reports "Requested" depending on the scan tool mode selected. NOTE: Running the scan tool on an unsupported server will generate an error code. See "Troubleshooting (on page 74)" for more information. Advanced topics 36

37 Scan tool command line syntax The scan tool has command line parameters that configure how the scan tool audits the servers, creating an inventory of missing and available HP components. The scan tool command line is: hpscan.exe /proliant:proliantcatalog /integrity:integritycatalog /scan:scanlist /mode:mode /scantype:scantype /result:result Command line parameter Description ProLiantCatalog (required) This entry specifies the name and location of the HP ProLiant catalog data file for the scan process. Depending on the server platform, either ProLiantCatalog or IntegrityCatalog is required for the scan tool to run properly. IntegrityCatalog (required) ScanList (required) Mode (optional) This entry specifies the name and location of the HP Integrity catalog data file for the scan process. Depending on the server platform, either ProLiantCatalog or IntegrityCatalog is required for the scan tool to run properly. This entry specifies the name and location of the Component List XML file for the scan process. This XML file contains two lists of components, the scan list and the exclude list. Components and support packs listed in the scan list are scanned by the scan tool, and components and support packs listed in the exclude list are excluded from the scan process. The scan list file should only be modified by HP. This optional entry defines the output mode of the scan tool. The scan tool runs in "Latest" mode if no entry is specified. The following entries are valid: Latest Only reports the status for the latest version of the component Applicable Reports the status for all versions of the applicable component All Report "Requested" for all components Advanced topics 37

38 Command line parameter ScanType (optional) Result (optional) Description This optional entry defines the type of components that the scan tool reports. If not specified, the scan tool scans all supported components. This entry can be specified multiple times to select multiple component types. The following entries are valid: HPProLiantSoftware Only reports the status for HP ProLiant Software components HPProLiantFirmware Only reports the status for HP ProLiant Firmware components HPProLiantSupportPack Only reports the status for HP ProLiant Support Pack components HPIntegritySoftware Only reports the status for HP Integrity Software components HPIntegrityFirmware Only reports the status for HP Integrity Firmware components HPIntegritySupportPack Only reports the status for HP Integrity Support Pack components This optional entry defines the output file name and path. If no entry is made, the default output file Results.xml is saved to the current directory. For example, the following command line entry generates the default output file containing the status for the latest version of the HP ProLiant software and firmware components: hpscan.exe /mode: latest /proliant:catalog.xml /scan:scan.xml /scantype:hpproliantsoftware /scantype:hpproliantfirmware The following command line entry generates the default output file containing the status for the latest version of the HP Integrity software components: hpscan.exe /integrity:integritycatalog.xml /scan:scan.xml /scantype:hpintegritysoftware Changing default parameters for scan tool advertisement To change the default parameters of the scan tool, manually modify ScanConfig.xml: 1. Open ScanConfig.xml from the PkgSource directory. 2. Locate < Argument Value="/mode:latest /proliant:nshc\catalog.xml /integrity:nshc\integritycatalog.xml /scan:nshc\scan.xml" RequirementID="1"/>, and modify the entry. CAUTION: Do not modify any other items inside ScanConfig.xml. The scan tool might not run if other values are modified. NOTE: If the name of the scan result file is changed from the default Results.xml, you must update the ScanResultFile field in the ScanConfig.xml file to match the new file name. 3. Save and close the file. 4. Update the distribution points of the package: Advanced topics 38

39 Scan tool status a. Right-click the package in the SMS Administrator Console. b. Select All Tasks>Update Distribution Points. The status of the scan tool is returned back to the SMS site server, and the success of HP Updates can be verified by verifying the advertisement status. In the case of a failure, review the file hpscan.log from the target system to determine the cause of failure. The log file is stored in the default SMS log file location. Using the sync tool The sync tool runs on a single SMS client system with either an FTP connection or access to the network shared folder that was specified during the setup process. The sync tool periodically checks the specified location to download the latest version of the HP manifest catalog to update the SMS site server. To verify that the components are downloaded, modify the hpsyncconfig.xml file, and manually run the HP Updates Sync advertisement. The inventory tool installer automates the process of deploying the sync tool. After the setup process is complete, settings, such as scheduling and command line options, can be customized in the SMS Administrator console. For more information on customizing the sync tool settings, see the Microsoft website ( Sync tool command line syntax The sync tool has three command line parameters: /config This optional entry specifies the file name of the HP Sync configuration file that the scan tool uses. /unattend The sync tool will not update the distribution point of HP Updates scan package. /nodpupdate This parameter performs the same function as the /unattend parameter. hpsync.exe [/config:<hp Sync Configuration File>] [/unattend /nodpupdate] Sync tool status The status of the sync tool is returned back to the SMS site server, and the success of HP Updates can be verified by checking the advertisement status. In the case of a failure, review the file hpsync.log from the target system to determine the cause of failure. The log file is stored in the default SMS log file location. Access rights The following sections define the default and required access rights assigned during installation: Default access rights assigned to resources created during setup (on page 40) Required access rights for components used during setup (on page 40) Default access rights for resources used by the sync tool (on page 42) Required access rights for resources used by the sync tool (on page 43) Advanced topics 39

40 Default access rights assigned to resources created during setup The following table lists the resources created by the setup process and the access rights granted to those resources by user group or account type: Resource User group or account Access rights granted SMS package source folder Local administrators System Full control Modify Read and execute List folder contents Read Write SMS package source folder SMS Admins Read Read and execute List folder contents Distribution package (SMS object) Local administrators System Administer Create Delegate Delete Distribute Manage folders Modify Read Required access rights for components used during setup The configuration of SMS Provider on the SMS site server determines the access rights required for components used during the setup process. SMS Provider can be local or remote to the SMS site server. The following table lists the access rights required for each component when the setup program runs on an SMS site server with a local SMS Provider. To obtain the proper access rights for a particular resource, run the setup wizard on the SMS site server under a user account that belongs to the designated user group. For example, to grant the required access rights for the SMS Provider database, run the setup wizard on the SMS site server under an account belonging to the SMS Admins group. Resource Access rights granted User group Registry keys that hold proxy Full control Local administrators authentication information Read SMS Provider database Database access Permit SMS Admins SMS Provider WMI Execute method Local administrators Full write Provider write Enable account Remote enable Advanced topics 40

41 Resource Access rights granted User group Distribution package (SMS object) Administer Create Delegate Delete Distribute Manage folders Modify Read Software updates (SMS object) Administer Create Delegate Delete Distribute Manage folders Modify Read Local administrators Local administrators The following table lists the access rights required for each component when the setup program runs on an SMS site server with a local SMS Provider. To obtain the proper access rights for a particular resource, run the setup wizard on the SMS site server under a user account that belongs to the designated user group. Resource Access rights required User group Registry keys that hold proxy Full control Local administrators authentication information Read SMS Provider database SMS Admins of the remote SMS provider SMS Provider WMI Execute method Full write Provider write Enable account Remote enable Distribution package (SMS object) Administer Create Delegate Delete Distribute Manage Folders Modify Read SMS Admins Add the user account to the SMS Provider WMI permission list on the remote SMS Provider Local administrators Advanced topics 41

42 Resource Access rights required User group Software updates (SMS object) Administer Local administrators Create Delegate Delete Distribute Manage Folders Modify Read Default access rights for resources used by the sync tool The following table lists the resources used by the sync tool and the access rights granted to those resources by user group or account type. Access rights are granted when the SMS environment is set up or when the inventory tool is installed. Resource User group or account Access rights granted Registry keys that hold proxy authentication information Registry keys that hold proxy authentication information Registry keys that hold proxy authentication information Registry keys that hold proxy authentication information Local administrators System Creator owner Users Power users Terminal server users Full control Read Special permission Read Read Special permission SMS package source folder Local administrators Full control Modify Read and execute List folder contents Read Write Change SMS package source folder System Full control Modify Read and execute List folder contents Read Write SMS package source folder SMS Admins Read Read and execute List folder contents Advanced topics 42

43 Resource User group or account Access rights granted SMS Provider WMI Everyone Execute Local service Provider write Network service Enable account SMS Provider WMI SMS Admins Execute Provider write Enable account Remote enable SMS Provider WMI Local administrators Execute Provider write Enable account Full write Partial write Remote enable Read security Edit security SMS Provider database SMS Admins Database access Permit Distribution package (SMS object) Local administrators Administer System Create Delegate Delete Distribute Manage folders Modify Read SMS updates (SMS object) Local administrators Administer System Create Delegate Delete Distribute Manage folders Modify Read Required access rights for resources used by the sync tool The configuration of SMS Provider on the SMS site server determines the access rights required for resources used by the sync tool. The sync tool can run on the following systems: An SMS site server with local SMS Provider. A remote client with SMS Provider on the SMS site server. Advanced topics 43

44 An SMS site server with remote SMS Provider. The following table lists the access rights required for each resource when the scan tool runs on the following systems: An SMS site server with local SMS Provider A remote client with SMS Provider on the SMS site server Resource Access rights How to obtain access rights Registry keys that hold proxy authentication information Read SMS package source folder Read Write SMS package source folder Change Read SMS Provider database Database access Permit SMS Provider WMI Execute method Full write Provider write Enable account Remote enable Distribution package (SMS object) Software updates (SMS object) Distribute Modify Read Read Add the sync tool user account to the resource permission list on the SMS site server. Add the sync tool user account to the resource NTFS permission list on the SMS site server. Add the sync tool user account to the share permission list on the SMS site server. Add the sync tool user account to the SMS Admins group on the SMS site server. Add the sync tool user account to the resource permission list on the SMS site server. Add the sync tool user account to the resource permission list on the SMS site server. Add the sync tool user account to the resource permission list on the SMS site server. The following table lists the access rights required for each resource when the scan tool runs on an SMS site server with remote SMS Provider. Resource Access rights required How to obtain access rights Registry keys that hold proxy authentication information Read SMS package source folder Read Write SMS package source folder Change Read Add the sync tool user account to the resource permission list on the SMS site server. Add the sync tool user account to the resource NTFS permission list on the SMS site server. Add the sync tool user account to the share permission list on the SMS site server. SMS Provider database Database access Permit Add the sync tool user account to the SMS Admins group on the SMS site server. Advanced topics 44

45 Resource Access rights required How to obtain access rights SMS Provider WMI Execute method Distribution package (SMS object) Software updates (SMS object) Full write Provider write Enable account Remote enable Distribute Modify Read Read Add the sync tool user account to the resource permission list on the SMS site server. Add the sync tool user account to the resource permission list on the SMS site server. Add the sync tool user account to the resource permission list on the SMS site server. Providing WMI permissions for the remote sync host machine 1. On the SMS site server desktop, right-click My Computer, and select Manage. The Computer Management window appears. 2. Click Local Users and Groups. 3. Double-click Groups, right-click Administrators, and select Add To Group. The Administrators Properties window appears. 4. Click Add. The Select Users, Computers, or Groups window appears. 5. Click Object Types, and then select the type of computer. 6. Click OK. 7. In Select Users, Computers, or Groups window, enter the host name of the remote sync host machine (for example, domain\synchostmachine$), and click OK. 8. Add the remote sync host machine to the network share server's Administrator Group when obtaining the catalog manifest from a network share instead of the Internet. 9. Click OK in the Administrators Properties window, and close the Computer Management window. Disabling the HP Updates Sync advertisement After the setup process completes, the HP Updates Sync advertisement schedules the sync tool to run on the server specified during the setup process, and then the sync tool downloads the latest HP manifest catalog. To turn off this automatic update process: Advanced topics 45

46 1. In the SMS Administrator console, select Systems Management Server>Site Database>Advertisements. 2. In the right pane, right-click the HP Updates Sync advertisement, and select All Tasks>Disable Program. Viewing update details with Resource Explorer After the scan tool runs on an HP ProLiant or Integrity server, Resource Explorer displays the Extended Software Updates node, and the hardware inventory cycle reports the status of the HP software updates. To view details about the HP software updates in Resource Explorer: Advanced topics 46

47 1. In the SMS Administrator console, expand Collections, and then click the collection to view the software updates details. This example uses the HP Servers collection. All members of the collection display in the right pane. 2. Right-click the appropriate system, select All Tasks from the menu, and then click Start Resource Explorer. The Resource Explorer window opens. 3. Expand Hardware, and then click Extended Software Updates. The details about the software updates installed on the HP server display. Advanced topics 47

48 TIP: Scroll left to see more software update details, including the Status field. The Extended Software Updates node displays the details of the software updates. The Status field displays the status of the software updates: Installed The software update is installed on the HP server. Applicable The software updates are applicable to the HP server. This information is also available in the software update reports (on page 26). Updates that require reboots Some updates require the server to reboot to complete the installation. You can configure the server to reboot by setting the correct action for the update: 1. In the SMS Administrator console, click Site Database>Packages>HP Updates>Programs. 2. In the details pane, right-click HP Updates Sync, and select Properties. The HP Updates Sync Program Properties window appears. Advanced topics 48

49 3. In the General tab, select the appropriate action from the After Running field. The entire package of an HP ProLiant or Integrity Support Pack update can be installed before a reboot is necessary. The HP installer installs all software updates and then returns a specific exit code, indicating to SMS that a restart of the server is required. SMS then reboots the server. CAUTION: Be sure that only one advertisement targets any one server at a time. Multiple advertisements might cause the following conditions: Updates to be applied out of order, leading to error or failure System settings to be modified before the original advertisement runs again after rebooting To manage advertisements, use the SMS Administrator console. NOTE: SMS might report the first execution of the advertisement as failed. However, this information is relevant only for the status of the advertisement and not for the update. Updates are compliant if they are detected as installed, in which case, the reported status of the first execution of the advertisement can be ignored. Configuring the sync tool for unattended mode By default, the sync tool is set up to run in attended mode, which means that you must be logged on to the console when the sync tool runs. The simplest mode of operation is to have the sync host on the SMS Advanced topics 49

50 administrator's desktop, with all of the rights needed for Internet and SMS database access. If this mode of operation is not possible, then the sync tool must be configured to run in unattended mode. To configure the sync tool for unattended mode: 1. Set the permissions for the HP Updates package folder ("Setting the permissions for the HP Updates package folder" on page 50). 2. Provide WMI permissions for the sync host machine ("Providing WMI permissions for the sync host machine" on page 50). 3. Change the HP Updates Sync program properties ("Changing the HP Updates Sync program properties" on page 51). 4. Provide access to the sync host machine to update the SMS database ("Providing access to the sync host machine to update the SMS database" on page 53). 5. Add the sync host machine to software updates ("Adding the sync host machine to software updates" on page 53). 6. Set permissions on the HP Updates package object ("Setting permissions on the HP Updates package object" on page 54). 7. Update distribution points ("Updating distribution points" on page 55). 8. Run the HP Updates Sync advertisement ("Running the HP Updates Sync advertisement" on page 56). Setting the permissions for the HP Updates package folder To add permissions to the sync host machine: 1. In Windows Explorer, expand the installation folder, right-click the Package Source folder, and select Properties. The Properties window appears. 2. Click the Security tab, and click Add. The Select Users, Computers, or Groups window appears. 3. Enter domain\synchostmachinename$ in the Enter the objects names to select field, and then click Object Types. The Object Types window appears. 4. Select Computers, and then click OK twice. To inherit the rights to all subfolders: 1. In the Properties window, click Advanced. The Advanced Security Settings window appears. 2. Click domain\synchostmachinename in the Permission entries list box. 3. Select Replace permission entries on all child objects with entries shown here that apply to child objects, and then click OK. Providing WMI permissions for the sync host machine NOTE: The following procedures are based on the Windows 2003 operating system and are slightly different when using Windows On the SMS Provider machine desktop, right-click My Computer, and select Manage. The Computer Management window appears. 2. Click Services and Applications, right-click WMI Control, and select Properties. The WMI Control Properties window appears. 3. Click the Security tab, and then expand Root to select the SMS node. Advanced topics 50

51 4. Click Security. The Security for Root\SMS window appears. 5. Click Add, and then enter domain\synchostmachinename$. 6. Click Check Names, and then click OK. 7. In the Security for Root\SMS window, select domain\synchostmachinename$. 8. Under Permissions for domain\synchostmachinename$, select all of the checkboxes under Allow. 9. Click OK twice. 10. Click the Security tab, and then expand Root to select the SMS node. 11. Expand the SMS node, and select Site_sitecode. 12. Click Security. The Security for Root\SMS\ Site_sitecode window appears. 13. Click Add, and then enter domain\synchostmachinename$. 14. Click Check Names, and then click OK. 15. Select domain\synchostmachinename$. 16. Under Permissions for domain\synchostmachinename$, select all of the checkboxes under Allow. 17. Click OK twice. Changing the HP Updates Sync program properties 1. In the SMS Administrator console, click Site Database>Packages>HP Updates>Programs. 2. In the details pane, right-click HP Updates Sync, and select Properties. The HP Updates Sync Program Properties window appears. Advanced topics 51

52 3. Click the Environment tab, and then select Whether or not a user is logged on. 4. Select Run with administrative rights, and click OK. IMPORTANT: Do not select Use Software Installation Account. This option is only applicable for legacy clients. IMPORTANT: Do not select Allow users to interact with this program. The sync tool does not have a user interface. The sync tool runs under the sync host machine account (system account), which belongs to the SMS Admin group on the SMS site server. Advanced topics 52

53 Providing access to the sync host machine to update the SMS database 1. On the SMS Provider machine desktop, right-click My Computer, and select Manage. The Computer Management window appears. 2. Under Local Users and Groups, select Groups. 3. In the right pane, select SMS Admins. 4. Right-click SMS Admins, and select Add to Group. The SMS Admins Properties window appears. 5. Click Add. 6. Click domain\synchostmachinename$ or Domain\domain computers, based on availability. Adding the sync host machine to software updates 1. In the SMS Administrator console, click Site Database>Software Updates. 2. Right-click Software Updates, and select Properties. The Software Updates Properties window appears. 3. Click the Security tab, and select Object Class Security Right Properties (the yellow star icon). Advanced topics 53

54 4. Enter domain\synchostmachinename$ in the User name text box. 5. Select all of the checkboxes under Permissions, and then click OK twice. Setting permissions on the HP Updates package object 1. In the SMS Administrator console, click Site Database>Packages. 2. Right-click HP Updates, and select Properties. The HP Updates package Properties window appears. 3. Click the Security tab, and select Object Class Security Right Properties (the yellow star icon). 4. Enter domain\synchostmachinename$ in the User name textbox. Advanced topics 54

55 5. Select all of the checkboxes under Permissions, and then click OK twice. Updating distribution points 1. In SMS Administrator console, click Site Database>Packages. Advanced topics 55

56 2. Right-click HP Updates, and select All Tasks>Update Distribution Points. 3. Click Yes. Running the HP Updates Sync advertisement 1. In the SMS Administrator console, click Site Database>Advertisements. Advanced topics 56

57 2. In the right pane, right-click HP Updates Sync, and select All Tasks>Re-run Advertisement. 3. Click Yes. Configuring updates after deployment Some software updates require configuration to ensure proper function of the component. The components run at default settings and must be configured to enable full functionality. You can use Remote Desktop to connect to the client for component configuration. Downgrading components Software updates can be used to downgrade individual components and HP ProLiant Support Packs to maintain compliance within an SMS enterprise environment. Downgrading individual components is not supported on HP Integrity servers. By default, the scan tool runs in "Latest" mode, reporting only the status for latest components and, therefore, enables you to update to a newer version of the component only. You can downgrade a component by changing the scan tool mode with the force component installation option: Advanced topics 57