Patch Management Group

Hello there,

I have few Windows servers installed with client SMA, but the Software update agent component not installed. Please see attachment for further detail. I'd greatly appreciated to have a solution for this since we're really stuck and can't pass the Beta test for Altiris patching on Windows servers.

Thank you,

Charlie.

Hi Charlie,

May I ask some questions?

What version of Patch Management are you using? Is it clean install or upgrade from earlier version?
What OS are affected(version, Service pack, bitness)?
Could you please navigate to Software Update Plugin install policy(Settings > Agents/Plug-ins > Software . Patch Management > Windows) and check its targets - Is this policy enabled? Are there affected machines as targets?

If it is possible could you please also provide us with screenshot of Software Delivery tab from affected SMA, when expired packages are shown(Open Software Delivery tab, expand Options pane, enable checkbox to show expired packages)

Thank you,
Roman

Hi Roman,

1/What version of Patch Management are you using? It is version 7.1

2/ Is it clean install or upgrade from earlier version? Yes, it was clean install.

3/ What OS are affected(version, Service pack, bitness)?

it's server 2003, standard x64 edition, SP2, Dual-Core AMD Opteron, Processor 2216, 2.39GHz, 8.00 GB of RAM

They are server 2003, , Enterprise Edition, SP2, Quad-Core AMD Opteron, Processor 8356, 2.29 GHz, 3.24 GB of RAM

it's server 2008 R2 x64 standard, SP1, Quad-Core AMD Opteron, Processor 8356, 2.29 GHz, 4.00 GB of RAM

4/ Could you please navigate to Software Update Plugin install policy(Settings > Agents/Plug-ins > Software . Patch Management > Windows) and check its targets - Is this policy enabled? Yes, the Software Update Plug-in Install policy is enabled.

5/ Are there affected machines as targets? The filter for Targets is [exclude 'Windows Computers without Software Update Plug-in Install' ]

6/ If it is possible could you please also provide us with screenshot of Software Delivery tab from affected SMA, when expired packages are shown(Open Software Delivery tab, expand Options pane, enable checkbox to show expired packages)

Please see attached screenshots. I'm looking forward to hearing from you soon, please :).

Thank you so much, Roman, for your times and great support

Charlie.

Attachment(s)

SW Deliver Tabs.zip   461 KB 1 version

Hi Charlie,

If filter for Targets is [exclude 'Windows Computers without Software Update Plug-in Install' ] then policy will not be applied to computers where Software Update Plug-in is not installed. These computers will be excluded from policy targets.

I would recommend to use default target (All computers without Software Update Plug-In Installed) or modify your target so that required computers are included.
You may check which computers are really targeted by changing view from 'Targets' to 'Computers'. List of targeted computers for opened policy will be shown.

Thanks,
Roman

Hi Roman,

The "Software Update Plug-In Install" policy (Settings > Agents/Plug-ins > Software . Patch Management > Windows) has built up and a lot of abstraction, doubts, and confusion.

1/ I've been advised by reading and by a couple other Symantec tech support (from other cases) that the "Software Update Plug-In Install" policy is there to receive orders from NS/Task servers to install Microsoft security update (and other software) if the subject software is applicable and not-yet installed on the subject clients, followed by a schedule times and client-restart-able order established by the "Default Software Update Plug-In policy". If that was true, then Targets [exclude 'Windows Computers without Software Update Plug-in Install' ] would make sense, because Microsoft security update will NOT be able to be installed on those clients that do not have "Software Update Plug-in Install"

2/ You are also right. Because if the "Software Update Plug-In Install" policy is used to install Altiris Software Update Agent COMPONENT which is part of the installation of client SMA, then the target (All computers without Software Update Plug-In Installed) which is meant to include (not to exclude) those clients that do not have Altiris Software Update Agent.

There is conflict within (1) and (2). The conflict is Microsoft security update can not install on clients without Software Update Plug-in Install, and Altiris Software Update Agent need to be installed on clients without Software Update Plug-in Install.

Another thing is that there are clients successfully installed with client SMA with Altiris Software Update Agent. There are clients that sucessfully installed with client SMA, but WITH OUT Altiris Software Update Agent component. That happened in the same client SMA push from NS.

There are few keep coming short of Altiris Software Update Agent components, we desperately try to find the the solution/work-around. And I really do not completely understand the "Software Update Plug-in Install" policy and its functions.

Thank you so much, Roman, for your times and great support.

I am looking forward to hearing from you soon

Charlie.

The  "Software Update Plug-In Install" policy (Settings > Agents/Plug-ins > Software > Patch Management) installs the Plug in and that's all it does. The default Target is "All Computers without Software Update Plug-in Installed Target".

That target is used by other Policies which suggests to me that there might be hidden objects linked to this so I wouldn't change the target or clone the Policy. The only change I'd make would be to make the schedule recurring - once the Plug-in has successfully installed the computer will be removed from the Target. If it repeatedly fails this will show up in the Software Execution report and can be investigated.

The "Default Software Update Plug-in Policy" (Settings > Agents/Plug-ins > Software > Patch Management > Windows) can be cloned and is the one that controls how the Plug in operates. Only clones of that can have their Target changed.

Hi Andy,

Thanks for your confirmation. I guess I got the grip of what really is "Software Update Plug-in Install" policy.

I believe that the Software Update Agent is one of the components of the whold client SMA package. When trying to install client SMA package, I guess the "Software Update Plug-in Install" policy need to be set right to get the Software Update Agent component installed, which in turn we would get the Software Update tab (third tab in the user interface of the client SMA located an invoked at the lower right corner system tray on client target)

If true, Could  "Software Update Plug-In install" policy will install the whole client SMA package which including the Software Update Agent component? Or do we need to configure another policy for installation of the client SMA package? if so, how this client SMA policy schedule would be aligned with the "Software Update Plug-in Intall" policy?

I attached here the Software Update Plug-in Install policy settings, the mentioned Software updates tab on client target, and possible client SMA policy location. Please review to see if any setting is not right.

Please advise.

Thanks so much for your time and great support,

Charlie.

The SMA must be installed first. It then gets the polices from the NS and installs the plug-ins.

For reasons the Software Update tab might not be ready:

"Client's Altiris Agent GUI displays: 'Software Update Plug-in is not ready'"

http://www.symantec.com/docs/TECH158125