This document provides a resolution for issues with Agent installs after recently updating to Patch for Windows Servers 9.3.4440.
After upgrading, you are able to start a manual agent install and select the policies but when clicking register the registration fails.
The console certificate failed to renew on upgrade.
This is verified by Looking at the Logs on the agent and the console machine. C:\ProgramData\LANDESK\Shavlik Protect\Logs
From Agent: STAgentManagement.log:
RegistrationServiceClient.cpp:419 Unable to register agent with host 'https://ConsoleMachineName.local:3121/ST/Console/AgentRegistration/Registration'. Error: 'class STServiceModel::Wws::CWebServiceException at RegistrationServiceClient.cpp:409: Unable to register the agent with the provided registration key.
Error detail: The body of the received message contained a fault. The fault reason was: 'Database error'.
From Console: ST.Service.Host.managed.log:
AgentRegistrationService.cs:199|ST.Agent.Common.ServiceStoreException: Database error ---> ST.Data.DbAccessLayer.StatementConflictException: Statement conflicted with constraint. SQL exception message: The INSERT statement conflicted with the FOREIGN KEY constraint "FK_AgentAttachment_Attachment". The conflict occurred in database "ShavlikProtect", table "dbo.Attachment", column 'uid'.
The statement has been terminated.
Wait 30 days for the certificate to automatically update.
The following SQL query is used to get the Date of upgrade
Select * FROM PropertyCollection WHERE collectionId ='9d2a58a7-a5e6-4d80-9997-a442099cce80'
- Close the console
- Stop the Ivanti Patch for Windows Servers Console Service
- Change directions to C:\Program Files\LANDESK\Shavlik Protect
- Open the STEnvironment.config
- Copy the data in "" from the consoleId="********-****-****-****-************" Section
- Close the Configuration file
- Open an elevated command prompt
- Run the following command stmgmt.exe -console_installation -id "consoleID" Replaceing consoleID with the data from step 5 above
- When this is complete start the console service
- Install the agent on the target machine.
You can following this document to test the certificate, specifically STMgmt.exe -test_console Shavlik Protect Console Certificates
If the Certificate Serial Number test does not pass, we will need to get the certificate serial number and replace what is in the STEnvironment.config with the correct Serial number.
- Open the MMC and load the local certificates snap-in.
- Under personal then certificates find the one Issued by ST Root Authority and double click on it.
- Click on the details tab and copy the serial number and paste it to a notepad.
- Now in the notepad remove the spaces from the serial number and copy the number again.
- Open Notepad as administrator then open STEnvironment.config from the C:\Program Files\LANDESK\Shavlik Protect folder.
- Replace the consoleCertificateSerialNumber="***************************************" with the one you just copied from your notepad.
- Save exit and try the console again.
If all the above fails, you could try this:
- Uninstall Patch for Windows Servers.
- Using MMC as noted above, delete the ST Root Authority certificates (Issued by) from these locations.
- Trusted Root Certificates Authorities\Certificates
- Re-install Patch for Windows Servers.
- Attempt to install an agent.
Ivanti Patch for Windows Servers 9.3.4440