7 Replies Latest reply on Sep 29, 2017 10:17 AM by cwinning

    Package repository content deleted

    Hugues Rookie

      Hello,

      We performed the installation of Ivanti patch for SCCM and performed different test.

      Someone advised us that there were installation packages that were removed from the repository. We searched in different SCCM Log and found in the WSUS synchronization log file (wsyncmgr.log) that it had a recurring task that was trying to delete the files. We checked all the tasks (Windows, SCCM, others) without finding the source. Since the information was in the WSUS log file we suspected Ivanti patch for SCCM. It was  the only change we had made.

      So we have uninstalled Invati patch for SCCM and the removal attempts in the log have completely stopped. And no trace of attempted deletion. We have lost a lot of package in dev. Some of the folders were not deleted because there was a denied access on the folder.

      We are trying to find out why Ivanti patch was doing this action?

      We have fears to install the product in production

      Do you have any idea what might have caused this incident?

       

       

      Here is an example of the log:

       

      Deleting file \\?\UNC\..\...\...\.. , FAILED, Win32 Error = 5

      Failed to delete orphaned content folder \\...\...\..\..., error 0x5

       

      Thank you for the support

       

      Ivanti patch for SCCM version: 2.3.960

        • 1. Re: Package repository content deleted
          cwinning CommunityTeam

          Hello,

           

          We do have a Delete function, but it only pertains to 3rd party product and updates supported in the Ivanti catalog.  Were these installation packages specific to the 3rd party updates the Ivanti catalog?  Did one of your users choose to remove patch(es) or Vendor-Product Categories through the Patch for SCCM plugin?  Deleting a Vendor or Category would remove ALL updates associated with them.

           

          Do you still have the logs for Patch for SCCM?  They may tell us more.

          C:\Users\*SCCM-Admin*\Shavlik\Shavlik Patch

          • Contains both logs and datafiles/binaries used by Shavlik Patch plugin.
            • Logs found here:
              • AutoPublish.log - Contains logging of publishing process.
              • Shavlik Patch.log - Contains logging of Shavlik Patch plugin operations.

           

          Thanks,

          Charles

          • 2. Re: Package repository content deleted
            Hugues Rookie

            Hello,

             

            These installation package was not related to 3rd party update, it was a repository of application packag for distribution in SCCM

            Efffectivly we choos to remove some vendor product from the SCCM Shavlik plugin but it tried to delete our package to

            We stiil have the log file and we can see it try to delete but it can't because acces was denied to delete  for some folder but we lost a couple of them

            When we remove the plugin the delete attemps stop to run.

             

            Thanks you for the following,

             

            Hugues

            • 3. Re: Package repository content deleted
              cwinning CommunityTeam

              Hello,

               

              When you delete a product category, the following actions are performed:

              All published updates for that product are expired

              The updates are removed from all deployments and deployment packages in Configuration Manager

              The updates are removed from all Software Update Groups in Configuration Manager

              The updates are deleted from WSUS

               

              It's my understanding the packages these updates are included in are removed too.  I'll do some more research on this to verify this information.  I should have more by Monday.

               

              Thanks,

              Charles

              • 4. Re: Package repository content deleted
                cwinning CommunityTeam

                Hello,

                 

                We only have our 1 scheduled task in Scheduled tab of Settings but it wouldn’t delete anything. If you did somehow delete the vendor, we kick off one execution of AutoPublish.exe to do the work.  There is no retry to our Delete function.

                 

                So if you deleted a vendor from Managed Products, we remove the vendor’s updates(packages in the form of .cab files) from associated deployments and we do delete them then. There is a dialog warning the user that this is going to happen and makes them confirm.  If we need to verify which items were deleted, the updates deleted would be listed in the user directory under Shavlik\Shavlik Patch\AutoPublish.log.

                 

                Thanks,

                Charles

                • 5. Re: Package repository content deleted
                  Hugues Rookie

                  Hello,

                   

                   

                  We did several tests and we were finally able to reproduce the problem.
                  We noticed that someone created the Deployment package at the root of the share (same location as folder1):
                       \\% servername% \ Share $ \ Folder1 \ folder2 \ SoftwareUpdates \ Folder3 ..
                  And when we remove the vendor from the list available through "Manage product", the WSUS cleanup process start to delete everything that was at the same level (foder1) as the Software Package. (It's done +ou- 2 days after de deletion)

                   

                   

                  We are currently testing with the native product found in WSUS (Microsoft).

                   

                   

                  I will return with the results

                   

                   

                  N.B. level 2 (Folder2) contained the distribution packages for SCCM

                   

                  Thanks for the support

                  • 6. Re: Package repository content deleted
                    Hugues Rookie

                    Hello ,

                    We found what caused the incident affecting the files in the development environment:

                     

                    We have created a package deployment for testing purposes those sources was located at folder1 level :

                         \\UNC\folder1\folder2\folder3

                    After testing, we removed the product from the WSUS environment. It was then that when the WSUS was cleaned all the contents (folders) at the same level where the sources were located (folder1) were erased as long as the WSUS computer account had the necessary access (modify).

                     

                    We replicated the problem with Microsoft products and the behavior turned out the same.

                     

                    The WSUS server does not seem to recognize the content (folder) that was not digitally signed by it and considers it as an orphan product. It is then that he tries to remove it (delete).

                     

                    So, be careful about the location when you drop the sources from the WSUS.

                     

                    Thanks to all

                    1 of 1 people found this helpful
                    • 7. Re: Package repository content deleted
                      cwinning CommunityTeam

                      Hello,

                       

                      I'm positive your findings will be helpful to others.  Thanks for taking the time to post them here.

                       

                      Best regards,

                      Charles