Symantec Management Platform (Notification Server)

I know that Patch Management Solution won't download new updates if you fail to renew your AUP.  However, I was curious what happens when you have more managed clients than the licenses you've purchased?  If any, wondering what stops working on the unlicensed nodes.

Hi Clint,

here is description of different case of license state:

License count exceeded: Clients that have pulled a valid license will continue to return Patch Inventories. However, newly added clients will not return Patch Inventories if they do not have a valid license.

• https://support.symantec.com/en_US/article.HOWTO59456.html

About license consumption for other Solutions:

• https://support.symantec.com/en_US/article.HOWTO1201.html

Thanks,

IP.

Thanks for the info but this now begs the question...Is there a report that lists all of the unlicensed clients in the SMC?  I think this would be helpful; especially to know which machines aren't being patched so we can manually address these vulnerabilities until more licenses can be purchased.

I don't have a ready report but this information can be found in default filters/report, just need to know that:

1. Managed computer without Patch Agent installed ---/// Doesn't consume Patch License

SQL Query to see them from default "Windows Computers without Software Update Plug-in Installed" filter

select * from fnGetAllMachinesWithoutPatchAgentInstalled('%Windows%')

2) Managed computer with Patch Agent installed but with "Retired" status ---/// Doesn't consume Patch License

SQL Query to see them:

SELECT
   [vri1_Computer].[Guid] AS [Guid]
FROM
   [vRM_Computer_Item] AS [vri1_Computer]
      LEFT OUTER JOIN [Inv_AeX_AC_Client_Agent] AS [dca2_AeX AC Client Agent]
         ON ([vri1_Computer].[Guid] = [dca2_AeX AC Client Agent].[_ResourceGuid])
      LEFT OUTER JOIN ([ScopeMembership] AS [ajs3_ScopeMembership]
         LEFT OUTER JOIN [FolderBaseFolder] AS [ajs4_FolderBaseFolder]
            ON ([ajs3_ScopeMembership].[ScopeCollectionGuid] = [ajs4_FolderBaseFolder].[FolderGuid]))
         ON ([vri1_Computer].[Guid] = [ajs3_ScopeMembership].[ResourceGuid])
      INNER JOIN [vAC_AssetStatus] AS [ajs5_vAC_AssetStatus]
         ON ([vri1_Computer].[Guid] = [ajs5_vAC_AssetStatus].[Guid])
WHERE
   (
      (
         ([ajs4_FolderBaseFolder].[ParentFolderGuid] = N'91c68fcb-1822-e793-b59c-2684e99a64cd')
         AND
         ([vri1_Computer].[IsManaged] = 1)
         AND
         ([ajs5_vAC_AssetStatus].[Asset Status] = '492c463b-afa2-4dd6-ae73-6fd2c7b0e489')
         AND
         (LOWER([dca2_AeX AC Client Agent].[Agent Name]) LIKE '%' + N'%software update%' + '%')
      )
   )

3) Managed computer with Patch Agent installed and are with "Active" status ---/// Currently consumes Patch License

SQL Query to see them:

SELECT
   [vri1_Computer].[Guid] AS [Guid]
FROM
   [vRM_Computer_Item] AS [vri1_Computer]
      LEFT OUTER JOIN [Inv_AeX_AC_Client_Agent] AS [dca2_AeX AC Client Agent]
         ON ([vri1_Computer].[Guid] = [dca2_AeX AC Client Agent].[_ResourceGuid])
      LEFT OUTER JOIN ([ScopeMembership] AS [ajs3_ScopeMembership]
         LEFT OUTER JOIN [FolderBaseFolder] AS [ajs4_FolderBaseFolder]
            ON ([ajs3_ScopeMembership].[ScopeCollectionGuid] = [ajs4_FolderBaseFolder].[FolderGuid]))
         ON ([vri1_Computer].[Guid] = [ajs3_ScopeMembership].[ResourceGuid])
      INNER JOIN [vAC_AssetStatus] AS [ajs5_vAC_AssetStatus]
         ON ([vri1_Computer].[Guid] = [ajs5_vAC_AssetStatus].[Guid])
WHERE
   (
      (
         ([ajs4_FolderBaseFolder].[ParentFolderGuid] = N'91c68fcb-1822-e793-b59c-2684e99a64cd')
         AND
         ([vri1_Computer].[IsManaged] = 1)
         AND
         ([ajs5_vAC_AssetStatus].[Asset Status] = '0a0203a5-d2b6-49f1-a53b-5ec31a89437c')
         AND
         (LOWER([dca2_AeX AC Client Agent].[Agent Name]) LIKE '%' + N'%software update%' + '%')
      )
   )

Regards,

IP.

So an underlicensed condition would NOT install the Patch Agent on a new Altiris client?  Looks like there's already a report via Home>Patch Management>Missing Software Update Plug-In whose result looks like that from the filter you specified.  If this is the case, I'm still a bit confused because the number of machines in this report is far fewer than the number of licenses I think I'm short by.  Also, note that I Delete as opposed to Retire clients from the system so retired machines shouldn't come into play.

Another thing I wanted to verify is whether that "Windows Computers Not Reporting System Assessment Scan Data" report lists only machines that have the Patch Agent installed but for whatever reason isn't reporting new info to the server?  At first I thought this report would be useful to determine by how many clients I'm underlicensed by although this doesn't seem to be the case.

Hi Clint,

I believe you can still install the Patch Agent to as many machines as you'd like, however they will not function if they are not licensed.

In regards to the Windows Assessment Scan data not reporting new info to the server - is this for clients that you don't have a license for? Again I believe this will not function without a license and essentially make that report worthless. The report is more for checking up on your machines to ensure they are working as expected, not to count licenses.

If you open the SIM and click on licenses, you will see how many you have available overall - comparing that to how many machines you require to use the Patch Management Agent should give you how many you are missing.

Thanks

Hi Clint,

here is a report which shows current Patch Management Solution license node(s) usage by managed client computers:

• https://www.symantec.com/connect/downloads/custom-report-see-current-patch-management-solution-license-consumption

Hi Igor,

I appreciate the over-the-top effort in creating these reports!  Gives me a good handle on the licensing situation in my environment.  Thanks!

Clint

Hi Clint!

There are similar reports for other solutions as well

• Custom report to see current "Software Management Solution" license consumption
• Custom report to see current "Inventory Solution" & "Inventory Pack for Servers" license consumption
• Custom report to see current "Deployment Solution" license consumption