Client Management Suite

We have just recently started using software delivery and we are using it for the first time to push out anti-virus software to our entire enterprise.  We started out by pushing it to a Pilot group of about 30 machines, which went well.  We then attempted to push the software out to one of the divisions within our company.  This did not go as well as I would have hoped.  The targeted collection had ~180 machines in it.  Out of those, about 15 FAILED and about 50 SUCCEEDED, but the rest still show as NOT RUN.  I don't quite understand the error codes either.  The job is a Sequential Software Delivery Task that is running three programs.  The first installs the software, the second runs a five minute delay using a ping command, and the third is a vbscript to run Hardware Inventory after a reboot.  On most of the failures, I am getting an exit code of -4 for the first task and -1 for the second. 

A second question would be: We have this job set to run "Only if a user is logged on" due to some problems with drive mappings during the installation.  If a user is not logged on at the scheduled installation time, will the job fail?  I would think that it would wait for someone to log on prior to attempting the installation, but is it possible that the job is timing out before someone logs in to the computer causing the job to fail.

I have to prove that Software Delivery works and any help would be appreciated.  Thanks.

Sequential delivery can be a bit touchy, so some items to check would be.

1. Do all systems have both the SWD and Task Sync agents? These are not required for 'regular' SWD but they are for sequential

2. Sequential is always 'forced'. So if the user is not logged on, it should only show as "Not Run", not failed.

3. For the exit codes, -4 is probably being defined by the software package, while -1 is basically a general failure. This could be a failure to run the vbscript due to file association.

4. Do you have any dependencies on each task? I've had this cause problems as well.

As always logs from a client are very helpful in figuring out the root causes.

The drive mappings on the machine will often be for the logged in user only, the NT Authority [Local]\System account that the altiris agent and software delivery use by default probably hasn't access to these shares.

Like Jim, I avoid sequential delivery. And I think for your purposes, you don't need it anyway as you seem to be purely using it to refresh the hardware inventory so that (I guess) your add/remove programs table is updated?

Most of our package installs use a single script essentially reduce to,

1. Checks environment, exists with specific codes if a problem found
2. Install app
3. Performs hardware inventory

Relying on mapped drives with the 'logged on user' feature is generally best avoided where practical. It presents too many hurdles to a successful deployment. If you are need to use this for profile changes, use ActiveSetup in your application delivery -this is much more robust.

Kind Regards,
Ian./

What does it mean that "Sequential is always 'forced'"?  Does that explain why I have jobs that are timing out and showing as Task Never Started.  I am getting that quite a bit and I have looked through the logs, but there is nothing in them because the job is never actually getting started.  They do have both agents.

The job is set to run as user.  and all of our users are currently local administrators....I know, topic for another day, right...

Ian,

Would it be possible to see a sample of the aforementioned script? 

I hesitate to even ask this question, but...I'm not familiar with 'ActiveSetup'...is there somewhere that I can find more information on this topic?

and yes, the Hardware Inventory is being run to update the add/remove programs table for tracking purposes.

Hi gtingen,

Below is a bare-bones script to install adobe reader and execute a hardware inventory following. Its had a lot of the guts removed, but should be instructive.

 Dim wshShell,fso,strCurrDir,ret

Set wshShell = CreateObject("WScript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")

'Get current directory and altiris inventory folder
strCurrDir = Replace(WScript.ScriptFullName, WScript.ScriptName, "")
sAltirisDir = wshShell.ExpandEnvironmentStrings("%ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{01B54EB5-3679-4C73-9E10-E169D5A5EC59}\cache\")

'launch adobe reader installation
ret = wshShell.Run ("msiexec /i """ & strCurrDir & "AcroRead.msi"" TRANSFORMS=""" & strCurrDir & "AcroRead8.1.3.mst"" ALLUSERS=1 /norestart /qn", 0, True)

'if inventory solution installed, launch hardware inventory
If Not fso.FileExists(sAltirisDir & "AeXInvSoln.exe") Then
 Exit Sub
End If
wshShell.CurrentDirectory = sAltirisDir
wshShell.Run "AeXInvSoln.exe /hidden /s AeXInvSolnAdm1.ini", 0, True
 

Here is a link for Active Setup.... 

http://www.etlengineering.com/installer/activesetup.txt

And it's written by our very own EdT. You can normally find him hanging out in the Wise area in Endpoint Management.

1. Checks environment, exists with specific codes if a problem found

Is there an example of something you might be looking for in this step that would be pretty easy to explain?  I am brand new to this so sorry if these are ridiculous questions.

Fair question. You can sometimes find that your collections are not completely uptodate with a particular computer's software status. As a result, there will be instances where you will sometimes try to install application 'x' to a machine where 'x' already exists. A simple check can be used to determine if the app is already there before you commit your install.

You could concievably  also want to go into a 'hold off' loop in cases where the Windows Installer is busy (can happen if you have an MSI based AV) with an eventual timeout error code.

You might also have a dependency check in the script... like .NET for example and exit if that is missing. Or you could proceed to install that too...

Options are many.... and I bet you wished you had not asked...

Actually, that's perfect!  I am very interested in the "hold off" loop that you mentioned.  We ran into a similar problem when attempting to package Office 2007 where Windows Installer stayed active and this would have been very beneficial then as well.  Do you implement this in software deployments frequently at your organization?

Also, can you explain what it means that Sequential Software Delivery Jobs are always "forced"?

Also as noted above...you really should try to avoid using any mapped drives.  Just put the files you need in the actual package source directory and reference them like they are local, or create separate packages that use an existing UNC path.  The trick with SWD is to imagine that the files in your package are in a directory, and you are sitting at a command prompt in that directory.  So the command line you run (as per Ian's example) would be just "MyAVInstall.exe /switches /norestart" or similar. 

Also like Ian, 95% of our packages are executed from a VBS script that checks the system, sets up installation options, shuts down conflicting processes (IE, etc), then executes the install via msiexec or directly calling the .exe file, then launches the machine inventory.

Ian: I like your way of executing inventory even better than what we do...we create an Altiris.NSAgent (??) object, then use the method to start a specific SWD advertisement.  It works, but yours neatly by-passes the issue with the Agent only executing one task at a time!

I concur with the msi-based A/V statement Ian made.  We are finding that SEP 11 doesn't like it when we modify Outlook.  Rather than hunt down the .dll's that are being accessed, we just add in a three-time loop that checks for code 1618 (another installation in progress) and then back off for five minutes.

We are currently running a very old revision of NS6 and the sequential tasks function has a bug.  We built a multi-reboot wrapper that we use to auto login to the workstation as many times as needed. 

The only caveat is that you will need to build a custom inventory, because you leave the agent thread after the first reboot.

Hi gtingen, has this been enough to get you moving in the direction of a more robust SWD process?

Thanks for the help guys.  We have a much better success rate on this install thanks in part to the information collected from you guys here.  I'm sure I'll be back with more questions the next time we start rolling out something new.