Patch Management Solution

We've had MSRT-001 enabled for quite some time. The policy references a single executable, but the package contains every previous version since the policy/package was created. Therefore, instead of the package being 53 MB, it's nearly 1 GB.

The problem with this is that the package is invalidated and deleted after each successful execution. Then, when Microsoft releases a new version, the new version is added to the package for the policy, the policy updated and then every computer downloads the new package contents. For over 10000 clients, this is would be 1 TB of network data every time the package is updated.

Couple that with throttling and first-come-first-served package management, clients will wait even longer to accomplish tasks.

Unfortunately, showing this in a lab is rough as the lab would have had to have had MSRT-001 enabled prior to the last release in order to see that the previous versions are not being removed.

Is anyone else seeing this? How are you dealing with it?

Thank you, in advance.

I looked in the MSRT-001 Package an we got the same "Issue"

I have had the same issue with MSRT-001 and also with SURT-001. To fix it I have created a script which I run on the server using a scheduled task. Here the link to the download:

https://www-secure.symantec.com/connect/downloads/patch-clean-remove-unused-packages

We have a PowerShell script waiting to do the same thing, but have a case open with Symantec to understand where the issue is. It seems that nothing is managing the source location and therefore nothing is ever removed. This makes sense for packages owned by the consumer of the product, but not packages owned by the product itself.

I tried this as well with support. Here is the answer I have got around one year ago.

SOLUTION/WORKAROUND:

Issue was possible to reproduce internally with PM 7.1/7.5 versions. Microsoft releases the new version of this tool each month; however, this update remains the same. The update is already existing and therefore not 'Revised' by definition, this two particular Microsoft updates will be ignored for automatic cleanup due to Microsoft/vendor approach.

Hi Steven,

Did you get some answers from Symantec Support?

Stefan

We still have the case open and it has moved to development.

This is what we know so far.

• This issue only affects MSRT-001
• MSRT-001 must be enabled for download
• The payload for MSRT-001 must have had more than one iteration from the time of being enabled.
  • If the version was 27 when enabled for download, the issue would not exist until version 28 or higher was released. This is when 27 and any other versions would be sent to computers.
• The snapshot.xml for the package (on the SMP server) does reference all of the files, not just the latest
• The Check Software Update Package Integrity task does not correct the issue
• Deleting the non-latest files from the package directories, and having the snapshot.xml update, does provide a temporary remedation

I'll keep this post updated with new information.

This has been resolved and a pointfix is available.

TECH233535: Microsoft Removal Tool - Software Updates fail to be cleaned up from SMP & Package Servers

Unfortunately the pointfix is only available for PM 7.5 SP1 - 7.5 SP1 HF5 and not for 7.6. Seems like those running 7.6 have to wait for the 8.0 upgrade....