Patch Management Solution

Hello,

compliance report says that this patch is intalled on all machine. But this report is not staged yet and not installed on the system - checked with WMIC QFE LIST

Hi Kada,

Assessment scan running on clients checks version of files in order to determine if this update is missing or not. Probably files have been already updated after installation of another patch on your computers.
You may compare expected versions of files provided by Microsoft (FILE INFORMATION section at http://support.microsoft.com/kb/2855844 ) with actual versions of same files located on any of affected client.

Also you may attach here STPatchAssessment.xml and STPatchAssesment.log. These files are usually located at "C:\Program Files\Altiris\Altiris Agent\Agents\SoftwareManagement\Software Delivery\{6D417916-467C-46A7-A870-6D86D9345B61}\cache\"

Thanks,
Roman

I have check the machine (Win 7 x86) and found these version of files:

Dwrite.dll 6.2.9200.16571 1,247,744 09-Apr-2013 23:34 x86 (http://support.microsoft.com/kb/2835361/sv)

Fntcache.dll 6.2.9200.16492 906,240 13-Jan-2013 20:30 x86 (http://support.microsoft.com/kb/2670838)

According MS13-081 files should have
Fntcache.dll 6.1.7601.18245 808,448 27-Aug-2013 08:21 x86
Fntcache.dll 6.1.7601.22434 808,448 27-Aug-2013 08:40 x86

Dwrite.dll 6.1.7601.18245 1,077,760 27-Aug-2013 08:21 x86
Dwrite.dll 6.1.7601.22434 1,077,760 27-Aug-2013 08:40 x86

I guess Shavlik recognize that 6.2.xxxx > 6.1.xxxxx and think that MS13-081 is installed.

As next action I will try to install the patch manually.

I did check machine (Win7 x86) and there are files:

http://support.microsoft.com/kb/2835361/sv
Dwrite.dll 6.2.9200.16571 1,247,744 09-Apr-2013 23:34 x86

http://support.microsoft.com/kb/2670838
Fntcache.dll 6.2.9200.16492 906,240 13-Jan-2013 20:30 x86

According KB2855844 there should be
Fntcache.dll 6.1.7601.18245 808,448 27-Aug-2013 08:21 x86
Fntcache.dll 6.1.7601.22434 808,448 27-Aug-2013 08:40 x86

Dwrite.dll 6.1.7601.18245 1,077,760 27-Aug-2013 08:21 x86
Dwrite.dll 6.1.7601.22434 1,077,760 27-Aug-2013 08:40 x86

I tried to trigger the patch manually and result is the update is not applicable to your computer. I guess it is MS problem. I think there should not be 6.2.xxxx version on Win 7.

Check the WindowsUpdate.Log file ( check in  Windows folder) and see when exactly this KB was installed on the machine. That will tell you if Altiris was involved in this update.

Alright, I looked at the screenshot closely and found that KB2855844 from MS13-081 was showing as installed. If you look at http://technet.microsoft.com/en-us/security/bulletin/ms13-081 , you can see that this KB replaced KB2835361 in MS13-054 that was released on July 2013. So, the report saying installed might be pointing to the installed ones for MS13-054. Check a complaince report for KB2835361 in MS13-054 and see if the number matches.

KESH,

I did check compliance report for KB2835361 (MS13-054) and there is same amount of PC as for KB2855844 (MS13-081).

It means everything is ok :)

Thank you for advice.

Kada,

Glad that I helped you! Please 'mark as solution' if my comments helped you in resolving this.

Thanks,

Kesh