Behind the Scenes @ Shavlik

Ever do a comparison between a Shavlik scan and Windows Update?  If you just used the Shavlik Security Patch Scan you will see some differences.  We will catch 3^rd party products like Adobe, Firefox, Apple, etc, but WU will only tell you that you are missing and need to install Microsoft products such as IE8 and .Net frameworks, Microsoft Silverlight and all sorts of other fun stuff you may not really need or want installed on your network, and ignoring critical non-Microsoft applications on your system.  Shavlik can scan for all of these as well, but choose to separate them from security patch reports as most of our customers are focused on Security Patching first, and other items as needed or when critical testing is complete. 

However, if you find that you require additional software to be installed on your network, Shavlik can help.  Out of the box, Shavlik can deploy IE 7 or IE8, .NET frameworks, Acrobat Reader, Flash Player, Firefox, etc.  Here are quick and easy directions to scan for and install software using Shavlik NetChk Protect:

1. In the console go to Patch Scan Templates and create a new patch scan template. 
2. Name it Software Distribution
3. In the Patch Type Filter just uncheck Security Patches and check Software Distribution. 
4. Save.

Scan a machine with this template and you will find Firefox, Quick Time, Flash, .Net 1.1 – 3.5 SP1, Silverlight, windows desktop search, and much more.  You can deploy any of these items as easily as a patch.  The one thing we recommend is to scan for these separately and choose what you want to deploy to prevent unnecessary software from being deployed to systems like servers.  If you plan to make a product in this list standard, it is highly recommended to use a Patch Group to enforce only what you want and nothing else. 

- Chris Goettl

One of the biggest advantages of Agentless Technology is the ability to discover machines in an environment.  It would be nice to say that you know exactly what machines are in your environment at any given time, but it is not a claim that many can make with 100% confidence.  In most cases, there is simply too much activity happening on the network that is not in the IT administrator’s control, so they are often left to guess how many machines are in their environment.  The larger the environment, the more teams involved with staging of machines, the addition of virtual technology making it easier and faster to roll out machines, Dev and QA environments where employees hold the power to build and rebuild machines on a regular basis, the list goes on.  The result, however, is the same.  Machines slip through the cracks and go unmanaged as far as Patch, Threat, and Asset Management are concerned.  How do you manage this type of issue?

In NetChk Protect you can do this by doing a discovery scan using Patch or Asset agentless scan technology.  I typically do this with the Default Security Patch Scan template.  Create a new machine group.   Click on the IP Address\IP Range tab and enter the IP range of your entire environment.  Add multiple ranges for multiple subnets depending on how your environment is setup.  Then set credentials on the group.

Select your Discovery Machine Group you created and in the ‘Scan With’: drop down you should see Security Patch Scan.  Click “begin scan” and then “scan now.”  Depending on the size of the environment this could take a while, so let it run and once complete you can look at all the machines discovered and for those that failed to scan you can evaluate which are machines and which are not likely machine at all. 

In the scan result you can click on the Machines not Scanned and sort by the Reason Column.  Best way to determine what items are worth investigating further is by the error code.

Understanding the Scan Results:

200, 201, and 235 – Pretty much no machine was on that IP during that scan.

261 – Something is listening, either non MS or firewalled.  Likely try nslookup or rdp to the box to determine if it is something you can connect to.

300s – Admin shares were removed, go to tools options authentication and check Create a temporary system drive if none exists and next time you should be able to scan this machine.

451, 452 – Machine is definitely there but admin creds or another prerequisite prevented us from scanning.  Go to Forum.Shavlik.com and do a search of the 3 digit error code in the Shavlik Knowledgebase for detailed instructions to resolve.

500s – Definitely a windows machine but remote registry access is denied.  Win 7, Vista, and 2k8 disable this service by default.  Older OSs could have had it disabled or winreg permissions modified.  Forum search of 3 digit code will give additional steps to troubleshoot.

600, 700, 800, 900 – Level codes could come up but not likely under these circumstances as they pertain to other types of scanning.

You can run a report of Machines Not Scanned in a date range to get a list of all error codes for a time period.  In the report gallery select the Machines Not Scanned report and check the advanced filter and set a date range to capture the latest discovery scan you have run.  This can then be exported into different formats so you can work with the information easier.  Set up a Discovery Scan on a reoccurring basis and see what comes up.  Some people are very surprised at the findings.

We have had requests from many of our customers to provide an easy way to purge old data from NetChk Protect, and we now have made it available through a PowerShell Script.  NOTE: To use this script you must be running NetChk Protect v.7.2.  This script enables you to execute a purge of data older than xx number of days.  Below you will find details on prerequisites to run the script and instructions on how to set it up.

Prerequisites:

NetChk Protect 7.2 or later – Download Here.

Windows Powershell – Download Here.

Open Shavlik’s PurgeOldProtectData.zip File – Open Here.

Steps to Setup:
1. Upgrade to Protect 7.2

2. Install Microsoft Powershell 1.0 (link to download page provided above, make sure you download the version for your System OS)

3. Extract PurgeOldProtectData.ps1 to c:\program files\shavlik technologies\netchk
(Link Provided above)

4. Create PurgeScript.bat file – in c:\program files\shavlik technologies\netchk\ and paste the following syntax in the bat file replacing values for SQL instance, DB name, and number of days to purge as necessary:

powershell -command “set-executionpolicy Unrestricted”

powershell -command “& .\purgeoldprotectdata.ps1 -sqlinstance “sqlserver\instance” -database “ShavlikScans” -purgeAfterDays xx -timeout 30″

powershell -command “set-executionpolicy restricted”

5. Testing - For testing purposes I like to throw a pause command at the end of the bat in case an error occurs while testing.  Run the bat on its own first time out to ensure it will execute as expected.  First time it may take a while to purge depending on how much data there is.

Example Result:

GAC    Version        Location

—    ——-        ——–

False  v2.0.50727     C:\Program Files (x86)\Shavlik Technologies\NetChk\ST….

False  v2.0.50727     C:\Program Files (x86)\Shavlik Technologies\NetChk\ST….

False  v2.0.50727     C:\Program Files (x86)\Shavlik Technologies\NetChk\ST….

Delete operation complete.  All data older than

+

48

+

days old was removed from the

+

ShavlikScans

database.

6. Scheduling Reoccurring Task- Once you have tested the bat successfully we can move on to scheduling.  We will use the windows task scheduler to schedule the job.  Create a new scheduled task browse to the bat file, set reoccurrence pattern, set credentials.  Execute the task in the scheduler by right clicking and saying run to ensure the scheduled task will run as well.

(Special thanks to Hazzmat for making this script a reality.)

- Chris Goettl