Endpoint Management Community Blog

Microsoft’s Security Intelligence Report Volume 12, released earlier this week discusses the continuing challenges of the Conficker worm in enterprises. Conficker came about in later 2008 and continues to plague Windows systems despite patches for the originally exploited vulnerability being available for over 3 years. Conficker continues to spread via one of two methods: exploiting weak passwords or unpatched systems and according to Microsoft’s Tim Rains, in an article by eWeek, 92% of recent infections are due to the exploit of weak passwords.

In terms of exploiting weak passwords, the Security Intelligence Report states “This type of attack uses the credentials of the logged-in user to access local or network resources, or else attacks password-protected resources using a built-...

I have seen what I thought was a one off problem with a secondcustomerInventory Rule Management (IRM) web-service in Patch 7.0 is a key element of the Patch cycles, as its the single point of contact for the Inventory Rule Agent to get rule xml hashes and strings.

However this single point of failure is coming under serious stress in recent times, as I have seen two live systems encountering this very same issue.

Important note! This problem mostly impacts the 7.0 environment as Patch Management 7.1 SP1 and upward is unaffected due to changes in the patch compliance checks (we now have the Patch Assessment Tool instead of the Inventory Rule Management).

Now what is the issue? 

In the Notification Server application logs you will find messages related to EventId 2262 [1] and the InventoryRuleManagement application pool (as you have split the pool, right?). The messages are logged...

Voici une information importante pour les utilisateurs PC anywhere:

We have recently been advised that some of our customers are trying to uninstall pcAnywhere Solution version 7.1 SP1 through the ITMS Console. Doing so will disable DCOM services on the machines that have the agent installed, this is a known issue as outlined in http://www.symantec.com/docs/TECH109673

Disabled DCOM Services can cause an application to stop working such as Symantec Backup Exec System Recovery.

To perform a successful uninstall of pcAnywhere Solution version 7.1 SP1 from a customer’s environment, a customer should first upgrade to pcAnywhere Solution 7.1 SP2 and ensure that all machines with an active agent  are upgrade to version 7.1 SP2. Once all machines are upgraded it will then be possible to perform a successful uninstall without affecting DCOM services.

Problem...

SELECT     vComputer.[Guid],
        vComputer.Name,
        vComputer.[User],
        vComputer.[OS Name],
        vComputer.IsManaged,
...