Environment

8.7 to 9.6

Description

1. The client looks if it has a package in its local cache (sdmcache).
2. It performs a subnet-directed multicast broadcast and basically asks the following to the peers: "Looking for packet X with a hash value of Y"
3. A peer (or several) will respond with "Yes, I have this package"
4. The client requesting the package will open a connection on port 33354 (More details about ports used by LANDESK: Ports used by LANDesk Management Suite - Full List) to the other client which holds the package, and pull the file down via unicast.

Note

When staging packages, the package must be placed into:

Program Files\LANDesk\LDClient\sdmcache

After the file is distributed or placed on the staging machine, the multicast service must be restarted in order to write the registry settings.

The peers will now be able to download the package from this machine.

Staging

To stage the file, create a distribution package (for instance a bat distribution package) and add the to be staged file into the additional files.

If the files are to be moved to a different location on the machine, that can be handled by modifying the bat file that this package was created with.

Otherwise the files may be left in the sdmcache folder where it can be launched at a later time.

Environment

8.7 to 9.6

Adding a Local User

A batch file can be used to add a local user to many machines at once.

The following is a sample batch file that will accomplish this task.

REM Add a user batch file

net user john1 passwd! /add

However, maybe you do not want the username and password in the batch file in clear text. That batch file will hang out in the ldclient\SDMCache for a short time, as well as being echoed to the sdclient_task#.log in the ldclient\data directory.

So you can store the password in the command line of the Distribution Package.

REM Add a user
REM %1 is the username
REM %2 is the password

REM Turn echo off so the password is not echoed to the log
@echo off
net user %1 %2 /add

Now in the distribution package simply put the username and the password in the command line.  The password is still clear text in the Distribution Package, but only LANDesk administrators can see that so there is more security there.

Deleting a Local User

To delete a user, it is just as simple.

REM Add a user batch file

net user John1 /delete

Adding Local Users from a .CSV File

Here is an simply one command in a batch file that will add all the users from a .csv file.

REM Add all the users from a .csv file

REM Turn echo off so the passwords are not echoed to the log
@echo off
FOR /F "tokens=1,2 delims=," %%a IN (users.csv) DO net user %1 %1 /add

REM Now delete the .csv file.  We need to delete it, it has clear text passwords
del /F /Q users.csv

The .csv file would look like this:

John,passwd!1234
Jane,passwd!1234
Jared,passwd!1234

Adding a Local Group

Use the following batch file to add a local group.

REM Adding a local group

net localgroup MyGroup /Comment:"My own Group" /add

Deleting a local Group

Use the following batch file to delete a local group.

REM Adding a local group

net localgroup MyGroup /delete

Adding a User to a Local Group

Use the following batch file to add a user to a local group.

REM Adding a user to a local group

net localgroup MyGroup john /add

Deleting a User from a Local Group

Use the following batch file to delete a user from a local group.

REM Deleting a user to a local group

net localgroup MyGroup john /delete

Managing a Local Administrator Account in Workgroup Enviroments

It may be beneficial, especially in Workgroup environments, to have the a local administrator account that has the same username and password on all workstations.

This can be done with this batch file.

REM Adding a local administrator
REM Turn echo off
@ECHO OFF

REM Add the user
net user ITAdmin %1 /add
REM Put the password in the distribution package's command line

REM Add the user to the group
net localgroup administrators ITAdmin /add

REM Remove the user from the default "users" group
net localgroup users ITAdmin /delete

Environment

8.x to 9.6

Description

There are many options for deploying a Registry key:

• Batch Files

  (The topic of this article.)

• Package Builder Executable

• Custom Vulnerability

• VBScript

Before modifying or querying a registry key, it is important to understand the options available to you for doing so.

This document focuses on working with Registry keys in a batch file.

Accessing Registry Keys

All registry keys are accessible at all times through the following hives:

HKEY_LOCAL_MACHINE

HKEY_USERS

While there appear to be other hives, these are actually just reference locations that already exist under the above two hives.

What does it mean to reference another hive?  It means that if hive X references hive Y, then both hives are the exact same hive with just different names pointing to the same place.  Making a change to either hive X or Hive Y modifies the same hive since they both are just name references for the same hive.

Accessing the User's hive (HKEY_CURRENT_USER)

There is the misconception that the only way to modify a user's registry key is to modify HKEY_CURRENT_USER, which is not the case.  Each user's registry hive is available under HKEY_USERS.  HKEY_CURRENT_USER actually references the hive under HKEY_USERS.

If the process is run by Local System, the HKEY_CURRENT_USER hive references the HKEY_USERS\.DEFAULT user hive, which is a reference to the HKEY_USERS\S-1-5-18 hive.

If the process is run by a logged in local or Domain user, then the HKEY_CURRENT_USER hive references that of the current logged in user.  The HKEY_USERS equivalent would be something like the following:

HKEY_USERS\S-1-5-21-1937564237-1933792563-196172844-1031

The long string is a Security ID or SID.

Matching Security IDs (SIDS) with Usernames

Microsoft explains that the easiest way to determine which SID belongs to which username is to do the following:

1. Open Regedit.
    

2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion \ProfileList
    

3. Under the ProfileList key, you will see the SIDs. By selecting each one individually, you can look at the value of the ProfileImagePath string and see what user name is associated with that particular SID by looking at the folder that is used in Documents and Settings.

Sometimes you will see different folders for a user as follows:

Administrator 
Administrator.ComputerName
Administrator.Domain

If a username has a .Computername or .DomainName, it is not part of the username, but the .computername or .domain is used to differentiate a local user and a domain user that have the same name.  The first user to login gets the name without a .Domain or a .ComputerName.  If a domain user then logs in second and has the same name, a .domain extension is added.  If a local user logs in second and has the same name, a .computername extension is added. This is important to note when parsing user names with a batch file, vbscript, or other coding tool.

The _Classes keys can be ignored.  There will be a similar registry key that looks as follows:

HKEY_USERS\S-1-5-21-1937564237-1933792563-196172844-1031_Classes

Notice it ends in _Classes. This registry key is not a user hive, but is just another reference to a key inside the same user hive:

HKEY_USERS\S-1-5-21-1937564237-1933792563-196172844-1031\Software\Classes.

Modifying the Registry within a Batch File

Now that you know how all registry keys can be accessed from HKEY_LOCAL_MACHINE and HKEY_USERS, and how to find out which user key is which, it is now time to determine the best method for updating a registry key.

Accessing the Registry with a Batch File

The way a batch file is written to deploy as a Distribution Package is different than the way it would be written to be run by a user who double clicks on it.  In fact, a batch file that works by double-clicking on it is probably not going to work in a Distribution Package.  Before writing a batch file to deploy as a Distribution Package in LANDesk, it is beneficial to read the following document to avoid common errors.

Understanding Batch File Distribution Packages

Batch files can be deployed with LANDesk and run as Local System if using either a Push Delivery Method. If using a Policy Delivery Method but the user is not a local administrator to their workstation, the batch file also runs as Local System. If using a Policy Delivery Method and the user is a local administrator to their workstation, the batch file will run as that user. A tool called StartAsUser.exe can be called in the script to run commands as a user despite using either a Push Delivery Method or Policy Delivery Method to a user who is not a local administrator.  However, the user must be logged in and must have permissions to perform the command for it to be successful.  In LDMS 8.8 and later, the distribution package has an option to run as the logged in user, which automatically launches the batch file using StartAsUser.exe.

Using Regedit to Add, Change, or Remove a Registry Key

Regedit.exe can add, change, or remove registry keys, however, it cannot simply query them.  It also cannot alter Registry key permissions.

This example uses Regedit.exe to add a simple registry key.  It requires one additional file.  When creating the LANDesk Batch File Distribution Package, make the batch file the primary package and make sure to add the .reg file as an additional file.

REM Add a registry key and values with Regedit.exe
REM and a .reg file
REM
REM /s is used to avoid an "Are you sure" prompt

regedit.exe /s somefile.reg

The somefile.reg would look something like this.  For more information on the syntax of a .reg file, including the syntax for deleting a registry key or registry value, see this site:

http://support.microsoft.com/kb/310516

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\SomeRegKey]
"SomeDWORD"=dword:00000001
"SomeString"="Hello, World!"

The additional file can be avoided by having the batch file create the additional file when it runs, like this:

REM Add a registry key and values with Regedit.exe
REM and a .reg file

REM Create the Registry key
 > "%temp%\somefile.reg" ECHO Windows Registry Editor Version 5.00>> "%temp%\somefile.reg" ECHO.>> "%temp%\somefile.reg" ECHO [HKEY_LOCAL_MACHINE\SOFTWARE\SomeRegKey]>> "%temp%\somefile.reg" ECHO "SomeDWORD"=dword:00000001>> "%temp%\somefile.reg" ECHO "SomeString"="Hello, World!"

REM /s is used to avoid an "Are you sure" prompt

regedit.exe /s "%temp%\somefile.reg"

Using Reg.exe

Reg.exe is another tool that can access the registry, however, as well as add, modify, or delete Registry values, it can query, copy, compare, import, export, and more. It cannot alter Registry key permissions.  Reg.exe is included by default Windows XP and later Operating Systems but is not included by default in Windows 2000 or earlier Operating Systems and had to be added from the Windows 2000 Resource Kit.

More information on Reg.exe can be found by searching REG command on Microsoft's web site or going to this Technet site: http://technet.microsoft.com/en-us/library/bb490984.aspx

The options to Reg.exe can be seen by running Reg.exe /? at a command prompt.

C:\>reg /?

Console Registry Tool for Windows - version 3.0
Copyright (C) Microsoft Corp. 1981-2001.  All rights reserved


REG Operation [Parameter List]

  Operation  [ QUERY | ADD | DELETE | COPY | SAVE | LOAD | UNLOAD | RESTORE | COMPARE | EXPORT | IMPORT ]

Return Code: (Except of REG COMPARE)

  0 - Successful  1 - Failed

For help on a specific operation type:

  REG Operation /?

Examples:

  REG QUERY /?  REG ADD /?  REG DELETE /?  REG COPY /?  REG SAVE /?  REG RESTORE /?  REG LOAD /?  REG UNLOAD /?  REG COMPARE /?  REG EXPORT /?  REG IMPORT /?

C:\>

Using Reg.exe to Add Registry Keys and Values

To add the same Registry keys as shown in the Regedit example, the following batch file could be used.

REM Add a registry key and values with Reg.exe

REG ADD HKLM\Software\SomeRegKey
REG ADD HKLM\Software\SomeRegKey /v SomeDWORD /t REG_DWORD /d 1
REG ADD HKLM\Software\SomeRegKey /v SomeString /t REG_SZ /d "Hello, World"

Create a Batch File Distribution Package and deploy the batch file with any Delivery Method.

Using Reg.exe to Query Registry Keys

Registry keys can also be queried and the values can be accessed and used in a batch file.

Example 1

The LDClient directory may be in different places on different agent workstations.  Some XP embedded workstations don't even have a C drive.  So calling c:\program files\LANDesk\LDClient with a hard set path may not work for all your devices.  Here is a simple example of how to query the registry key to get the LDClient directory.

@ECHO OFF
REM
REM Copyright Jared Barneck
REM

GOTO main

:f_ldmain
  REM This :f_ldmain works as a function and can be run in :main using this syntax:  REM call :f_ldmain  REM It has an "f_" beginning to mark it as a function.  REM Get the correct path to the managementsuite directory.  REM "tokens 2* makes token 2 and 3, with 3 having all remaining data on the line, including spaces/  FOR /F "tokens=2*" %%a in ('REG QUERY HKLM\SOFTWARE\LANDesk\ManagementSuite\WinClient /v Path ^|FINDSTR Path') DO SET ldclientdir=%%b
GOTO end


:main
  CALL :f_ldmain  ECHO "The LDClient directory is here:"  ECHO %ldclientdir%  ECHO .
GOTO end

:end

Example 2

Here is another example to get a list of SIDs from HKEY_USERS the REG QUERY command can be used as shown.

C:\>REG QUERY HKU

! REG.EXE VERSION 3.0

HKEY_USERS

HKEY_USERS\.DEFAULT

HKEY_USERS\S-1-5-19

HKEY_USERS\S-1-5-19_Classes

HKEY_USERS\S-1-5-20

HKEY_USERS\S-1-5-20_Classes

HKEY_USERS\S-1-5-21-1715567821-879983540-682003330-36408

HKEY_USERS\S-1-5-21-1715567821-879983540-682003330-36408_Classes

HKEY_USERS\S-1-5-21-1937564237-1933792563-196172844-1031

HKEY_USERS\S-1-5-21-1937564237-1933792563-196172844-1031_Classes

HKEY_USERS\S-1-5-18

While this command only provides a list of subkeys in HKEY_USERS and is not useful by itself in a batch file deployed by LANDesk, it can be used with other commands in batch file and become more useful.  For example, if a registry must be added to all the users registry keys, this output can be parsed to list the valid users that can login (since some of the SIDs are for the Network Service or other accounts that are not login accounts).

Parsing the output above is not easy. The output has a bunch of unneeded spaces and is not very clean.  The first addition we can make to the REG QUERY command is to pipe it to Findstr to get only the HKEY_USERS\.DEFAULT and any valid SIDs for users.  The Findstr syntax can be seen by running Findstr /? at a command prompt.  If you do not understand the Regular Expressions used in the Findst command, don't worry, just copy the syntax used in the example.

The following is an example output of this command on a workstation with only two valid login users.

C:\>REG QUERY HKU |Findstr /R "DEFAULT S-1-5-[0-9]*-[0-9-]*$"
HKEY_USERS\.DEFAULT
HKEY_USERS\S-1-5-21-1715567821-879983540-682003330-36408
HKEY_USERS\S-1-5-21-1937564237-1933792563-196172844-1031

Now we have a simple output that can be parsed with advanced batch file commands to make a Registry modification to the .DEFAULT hive, and each login user's hive.  By changing the .DEFAULT, all future new users will get the change, but the current users will not, so they have to be modified explicitly.

The following batch file will find all login users and add a Registry key to their hives as well as add the same Registry key to the .DEFAULT hive.

REM Modify a registry key in for all logged in users
REM Also modify it in the .DEFAULT hive so future users get it.
REM
REM Copyright Jared Barneck
REM

GOTO main

:modkey
  REM %1 is the value of %a that is passed.  REG Add HKU\%1\SomeRegKey  REG ADD HKU\%1\SomeRegKey /v SomeDWORD /t REG_DWORD /d 1  REG ADD HKU\%1\SomeRegKey /v SomeString /t REG_SZ /d "Hello, World"  REM Going to :end here only ends this instance of the call to the  REM :modkey label. It does not end the whole batch file.
GOTO end

:main
  FOR /F "tokens=2* delims=\" %%a IN ('REG QUERY HKU ^|Findstr /R "DEFAULT S-1-5-[0-9]*-[0-9-]*$"') DO CALL :modkey %%a  REM Going to :end here ends the whole batch file.
GOTO end

:end

Environment

8.5 to 9.x

Problems/Symptoms

If the file replicator log shows that it failed to copy some files, first try getting the file from a browser on the computer that's running the replicator. If the file cannot be downloaded with a browser, the file replicator will not be able to download it either. Some web servers prevent access to files they don't have MIME types defined for. If it's files with certain extensions that fail, create a MIME type for those extensions.

Solution

In Internet Information Server management tool add MIME types by doing the following:

1. On the web server, launch Internet Services Manager.

2. Navigate to the web site or folder holding the files you want to replicate, and from that folder's shortcut menu, click Properties.

3. Click the HTTP Headers tab and click File Types.

4. Click New Type and enter an (*) asterisks for the file extensions and type in LANDESK for the MIME type.

5. Restart IIS by running "iisreset" from the run command.

Description:

When creating a software distribution and then click save an error is displayed:

A software distribution task must have a valid name, a main distribution package, and a delivery method.

Caused:

The delivery method is disappeared in database default value for some reason. You need to have the default value set in databse.

Resolution:

Check the delivery method is set normally in database. For example:

DB name: coredb

SELECT *  FROM [coredb].[dbo].[AgentBehavior] where name = 'standard policy-supported push distribution'

The SQL will return a value to you. If not, try export and import the delivery method from other core servers.

Export delivery method:

Import delivery method, to gropus specified in the .ldms file:

Now check the database, you will have 'standard policy-supported push distribution' in AgentBehavior table. The AgentBehavior_Idn should be same as the IntValue in KeyValue table.

By befault, the value will be '2', but when you import the delivery method, the value should be new in AgentBehavior table. Now you should update the KeyValue table as following:

Update KeyValue Set IntValue = 99999*
Where KeyName='SWD_DefaultDeliveryMethod'

*The value 99999 should be replaced by the real one in your environment.

Now go back to your console and create a software distribution task, the task can be created successfully without any error.

Apply:

LDMS 9.6 and later

Environment

8.8

9.0

Question

What is the process SDCLIENTMONITOR.EXE used for on client workstations?

Description

SDClientMonitor.exe is a persistent application launched by the "Run" registry key or "Webportal.exe". It determines which Policies to display or apply to the client sent from Policy Based Distribution.

Environment

8.7 to 9.6 SP1

Question

How to deploy a software package silently.

Answer

For SWD and MSI based distribution packages:

In the delivery method, under "Feedback and Timing", choose the option of "Hide all feedback from user".

For packages based on executable packages:

All executable installers are different and support unique command line switches and answer files. There is no single way to silence all executable.

Methods for automating and silencing an executable install must be obtained from the vendor. Once this information is known, the executable distribution package can be configured to silence the install.

Running the .exe with a /? will sometimes show available options for installation. If there is a command line option to silence the executable, it can be added to the command line in the Install/Uninstall section of the distribution package.

Environment

8.7 to 9.6

Description

Error: CBA 8, the connection was not authorized.

Error: 0:1895 for the first command issued.

Error 1895

Error: -1917253785 or -2147481753

Unable to run any command in WinPE

"ERR_Fail",-1917253785..." in the log file.

"ERR_Fail",-1917481753..." in the log file.

Cause

The client does not have a .0 file that matches a valid certificate on the core.

Resolution

Ensure the core server has a valid certificate. These are stored in the c:\program files\LANDesk\Shared Files\keys directory. Each valid certificate will have three files. There should be one .crt file, .key file, and a .0 file with the same date/time stamp for each valid certificate.

The ldvpe1.img image should contain at least one .0 file that matches the .0 file on the core.

The .0 file resides in the cba8\cbaroot\certs directory in the ldvpe1.img.

1. Use WinImage to open the ldvpe1.img file in the \ldmain\landesk\vboot folder.

2. Copy all .0 files from the Shared Files\Keys folder on the core into the cba8\cbaroot\certs folder in ldvpe1.img

3. Save the changes to the ldvpe1.img through WinImage. Close WinImage.

4. Ensure that all the .0 files also reside in the ldlogon directory.

5. Redeploy the PXE Representatives using the scripts in the LANDesk console to all current PXE Reps.

Environment

8.x

9.0

Description

Access is denied using Software Distribution from a UNC share

UNC Shares require credentials to be accessed by default.

When a LANDesk agent attempts to access a UNC share during a Software Distribution task, it uses the Local System account.

Scheduled Tasks or Software Distribution jobs result in the error "Unable to  Access the Package" or "Access is Denied".

An error 207 may also appear in the SDCLIENT.LOG file on target workstations.

Resolution

For 8.7 and Later configure a Preferred Package server for and enter credentials to the UNC share.

For more information on configure a Preferred Package servers: How to Configure a Preferred Package Server

Use an HTTP path instead of the UNC share make sure to allow anonymous access.

If a UNC share is required:

1.    Add the Domain Computers AD group to sharing and security permissions.
     a.  Test the UNC share with the AT command from client machine.

          For more information on this How to open a command prompt running as Microsoft's "Local System" account?

2. Setup the UNC package share as a null session share on your server.

Use the SYSSHRS.EXE utility found in the LDMAIN\Utilities folder on the Core Server to setup null-session shares.

          Follow these steps to ensure success:

               1.    Run the SYSSHRS.EXE program.
               2.    Make sure that all users have read access to the share.
               3.    Make sure packages are located at the root of the share.

For more information on null session shares, visit the Microsoft web site at http://www.microsoft.com and search on "null session shares"

Hi,

Core LDMS 8.8 SP2a, DB SQL 2005 SP3

I create a package with MS Outllok 2007 and also a create another package for the uninstall of MS Outlook. I link both using the uninstall Association.

Now  I create a policy for deployment and create a LDAP Query based on a group to find target, aroud 7000 devices...

The application is deploying correctly, but sometimes on client, the application will uninstall himself, thern 5 minutes after will reinstall again. I do not touch anything on the task, query or groups! What's happend?

After a lot of problem and discussion , I woul like to remove the uninstall association of the task, but without uninstalling all devices. Is it possible to do that in anyway? Because if I delete the deployment task, if I cancel the tasks, If I stop query --> uninstall application.

What is the best way to remove this without impacting the production?? Ans also where is stored the information regarding the uninstalling association, in the serveur or in the Client DB?

Many thansk for you suggestion.

Regards

Lionel

Hi Everyone,

Using LDMS 9.5 SP2 - Had a problem today when someone deleted a package that was part of a template, causing provisioning jobs to fail.

Is there a log file that would show the package and user who did the deletion? or maybe some other way to tell?

I have been searching like crazy with no luck.

Thanks!

Rob

I'm trying to audit our license usage for Acrobat Pro X. The only good way I can think of to do that is by extracting keys since we have several different groups of licenses purchased. However all the information on the internet about how to do that appears to be outdated. Does anyone have any suggestions?

I am wondering if there is a way to have landesk schedule a package install at windows startup?

I am familiar with the RunOnce registry key, but this requires a local pc admin be logged in to run that item.  I am looking for a way to have landesk  (the system account) kick off the install when the pc starts up next prior to user login (or at login if that is available), & then use the 9.6 reboot options to either require or not require a restart as my needs dictate for that particular package.

using 9.6 sp1

Is this even a possibility with the current platform, or should I submit this as an ER? Or is there already an ER for this?

Thanks!

I was asking myself, which are the differences between Start later and Frequency in 9.6. The only difference for me was, at the start later section I can say a time and I can set up, which clients are affected (Devices that did not succeded, ...). In the Frequency section, I think the policy will applied again for all clients.

Could someone clarify this?

Thank you for your feedback.

Purpose

Method for remote unprovisioning of vPro clients, for troubleshooting and correcting issues that may require the client to be unprovisioned.

The Intel(R) AMT Unprovision Utility is a simple command line utility that allows users to remotely unprovision an Intel(R) AMT system without requiring a

separate management console.

Steps

1. Download the Intel UnprovisionEx.exe tool.
2. Unzip the files to your Software Distribution Storage.
3. In the Management Suite Console, create a new Software Distribution Executable package.
4. In the Package Information section use the UnprovisionEx.exe as the primary file.
5. In the Install/Uninstall Options section add the following switches into the install/uninstall options: -hostname %computername% -user admin -pass P@ssw0rd -full
   • For the password please use the admin password for your vPro machines .
   • The -hostname can be either the listed variable, FQDN or IP address.
6. Save the package and schedule it out to the vPro devices you would like to unprovision.
7. Once these machines are in the pre-provisioned state attempt to zero-touch provision these devices.

(To verify the provisioning state of the machine please reference https://community.landesk.com/support/docs/DOC-31903)

Explanation

There are many new features to Software Distribution in LDMS 9.6 SP1. Some are visible, and some are enhancements that took place behind the scenes to improve performance. Below you will find a list of the most important and exciting changes.

Distribution Package Changes

1. Signed PowerShell Scripts

  LDMS 9.6 SP1 has the ability to deploy signed PowerShell scripts adding another layer of security to PowerShell deployments. However this requires that the environment be configured correctly ahead of time to allow the signed scripts to run. Basically put you have to be able to run them securly outside of LANDESK before you will be able to deploy a signed PowerShell script inside of LANDESK. For this you have to import your PowerShell certificate into each client that will be running the scripts.

  Also to control whether LANDESK is going to handle the script as signed or not we have added PowerShell Security Options to the Package UI. By default this value is unchecked, making no change for existing PowerShell packages. The default value can be changed to always pre-check this box in the Distribution Package Properties by clicking on the Default Package Settings cog icon in the toolbar. Select PowerShell security, check or uncheck the box as desired, click Save.

2. Metro App Distribution Packages

  Also new in LDMS 9.6 is the ability to deploy Metro Apps for Windows 8.1. Due to the security constraints placed on Metro Apps by Microsoft, the apps are only able to be "sideloaded" by LANDESK, and thus it requires your clients be configured to allow sideloading apps. You can find more information on this process here (Sideloading Requirements).

  To create a new Windows Metro Application package, in the console go to Tools - Distribution - Distribution Packages, in the toolbar click on "New Distribution Package", and select "New Windows Metro Application package." Point to the .APPX file as your primary file, and add any necessary additional files. Then schedule and deploy as you would any other software distribution task.

3. Link Package Icons

  In line with changes made in LDMS 9.6 to allow you to use JPG and PNG files for your Portal Manager and Fuse icons, we have now extended that capability to Link Packages. Current packages with the standard .ICO files will continue to function the same, however any NEW Link Packages will require the link icon be provided as a JPG or a PNG file. For the best result please use a PNG that is formatted as 320x200 pixels in size.

Core Server Changes

4. SchedQry.exe and SchedLDAPResolver.exe improved, what took hours may only take minutes.

  The processes for resolving queries when tasks are started, and also in charge of running once an hour (Default schedule) to re-resolve those queries and add or remove machine from tasks as necessary has been improved with Multi-Threading and also Results Caching. With the Multi-Threading the processes are able to resolve queries much more rapidly, also we have implemented very strict logic to control how many threads are used to ensure the best use of resources. Likewise, we also employ results caching so that we avoid re-resolving the same query for each task it is targeted at, improving resolution time, and taking some of the load off of the database.

5. Enhanced Accelerated Push options

  A new option to control how long a task spends actively pushing out to clients has been added. "Maximum Task Run Time" allows you to choose how long you want a task to keep actively pushing out to devies before failing the task. This allows you to run a push, but ensure that it stops rolling out to machines after a certain amount of time to not overlap any other tasks that may need to run. By default the task will stop pushing out after 30 Minutes, this is also the smallest amount of time that you can set the Maximum amount to (option can range from 30-240 minutes), if the task finishes running before this, it is done and will move to a completed status. This setting only controls how long the core will actively try to contact machines to run the task, the minimum time of which is 30 minutes and if you have a task that takes longer than that to contact all the machines, you can allow up to 240 (4hrs) for the core to contact all the devices in the task.

  To access this option go to the Console and click on Tools - Distribution - Scheduled Tasks, click on the cog icon in the Scheduled Tasks toolbar, and select Default Scheduled Task Settings. Look at the Accelerated Push settings to see the slider bar to set the Maximum Task Run Time.

6. New option for when users are logged off their machine.

  We now have the option that if a user is logged off their machine, the task can be automatically delayed to Run at Next Logon. This allows flexibility in controlling when tasks are run on client machines. Also of note, is even if a user is logged on, you can also automatically defer the task until the next logon to ensure a cleanly logged in machine for installing packages. This is great for tasks that require programs to be closed when installing, as the install happens before the user opens their programs to begin their work.

  These options are found in the Distribution and Patch settings. In the console go to Tools - Configuration - Agent Settings, expand All Agent Settings and click on Distribution and Patch. Select the settings you would like to alter from the list or create a new setting. Once inside the Distribution and Patch setting Properties do the following:

• Logged Off User, Run at Next Logon option
  1. Expand Distribution Only Settings
  2. Select Logged Off User options
  3. Set the behavior to Run at Next Logon.
• User Logged On, Automatically Defer Until Next Logon option
  1. Click on Distribution-Only Settings
  2. Check the option "Defer Until Next Logon"

7. Task Visibility - Stages

  One of the most informative new features of LDMS 9.6 SP1 is the ability to see at a glance what stage machines are in while running a task. The stages from beginning to end are:

1. Core Initiated - Core is processing task, and contacting clients.
2. Starting - Client has received task and is preparing to run it.
3. Downloading - Client is downloading files.
   • During this stage, if "Send Detailed Task Status" is enabled, a progress bar showing the download percentage is visible in the task progress view.
4. Installing - Installation is running on client.
5. Completed - Task is done running on client machine (regardless of failed or successful status)

8. Scheduled Tasks and Diagnostics Utility

Learn more about it here:

Scheduled Tasks and Diagnostics Utility

9. Package Relationships UI

Learn more about it here:

Package Relationships new in LDMS 9.6 SP1

Environment

8.7 to 9.6

Adding a Local User

A batch file can be used to add a local user to many machines at once.

The following is a sample batch file that will accomplish this task.

REM Add a user batch file

net user john1 passwd! /add

However, maybe you do not want the username and password in the batch file in clear text. That batch file will hang out in the ldclient\SDMCache for a short time, as well as being echoed to the sdclient_task#.log in the ldclient\data directory.

So you can store the password in the command line of the Distribution Package.

REM Add a user
REM %1 is the username
REM %2 is the password

REM Turn echo off so the password is not echoed to the log
@echo off
net user %1 %2 /add

Now in the distribution package simply put the username and the password in the command line.  The password is still clear text in the Distribution Package, but only LANDesk administrators can see that so there is more security there.

Deleting a Local User

To delete a user, it is just as simple.

REM Add a user batch file

net user John1 /delete

Adding Local Users from a .CSV File

Here is an simply one command in a batch file that will add all the users from a .csv file.

REM Add all the users from a .csv file

REM Turn echo off so the passwords are not echoed to the log
@echo off
FOR /F "tokens=1,2 delims=," %%a IN (users.csv) DO net user %1 %1 /add

REM Now delete the .csv file.  We need to delete it, it has clear text passwords
del /F /Q users.csv

The .csv file would look like this:

John,passwd!1234
Jane,passwd!1234
Jared,passwd!1234

Adding a Local Group

Use the following batch file to add a local group.

REM Adding a local group

net localgroup MyGroup /Comment:"My own Group" /add

Deleting a local Group

Use the following batch file to delete a local group.

REM Adding a local group

net localgroup MyGroup /delete

Adding a User to a Local Group

Use the following batch file to add a user to a local group.

REM Adding a user to a local group

net localgroup MyGroup john /add

Deleting a User from a Local Group

Use the following batch file to delete a user from a local group.

REM Deleting a user to a local group

net localgroup MyGroup john /delete

Managing a Local Administrator Account in Workgroup Enviroments

It may be beneficial, especially in Workgroup environments, to have the a local administrator account that has the same username and password on all workstations.

This can be done with this batch file.

REM Adding a local administrator
REM Turn echo off
@ECHO OFF

REM Add the user
net user ITAdmin %1 /add
REM Put the password in the distribution package's command line

REM Add the user to the group
net localgroup administrators ITAdmin /add

REM Remove the user from the default "users" group
net localgroup users ITAdmin /delete

Purpose

Method for remote unprovisioning of vPro clients, for troubleshooting and correcting issues that may require the client to be unprovisioned.

The Intel(R) AMT Unprovision Utility is a simple command line utility that allows users to remotely unprovision an Intel(R) AMT system without requiring a

separate management console.

Steps

1. Download the Intel UnprovisionEx.exe tool.
2. Unzip the files to your Software Distribution Storage.
3. In the Management Suite Console, create a new Software Distribution Executable package.
4. In the Package Information section use the UnprovisionEx.exe as the primary file.
5. In the Install/Uninstall Options section add the following switches into the install/uninstall options: -hostname %computername% -user admin -pass P@ssw0rd -full
   • For the password please use the admin password for your vPro machines .
   • The -hostname can be either the listed variable, FQDN or IP address.
6. Save the package and schedule it out to the vPro devices you would like to unprovision.
7. Once these machines are in the pre-provisioned state attempt to zero-touch provision these devices.

(To verify the provisioning state of the machine please reference https://community.landesk.com/support/docs/DOC-31903)

Environment

8.x to 9.6

Description

There are multiple ways to open a command prompt running as the Local System account.  Here are some easy ways to do this:

• Download a Sysinternals tool called PSexec. This tool can also be used to launch other programs or scripts as the local system (regedit.exe!).  Run:

  psexec -i -s cmd.exe

• Download and run this batch file as an administrator.  This batch file will do the work for you.  LocalSystemCommandPrompt.bat

• On a LANDesk agent, run the following command from a command prompt as a local administrator:

  "c:\program files\landesk\ldclient\localsch.exe" /exe=cmd.exe

   

• On a workstation without a LANDesk agent, use Microsoft's Scheduler service by running the following command at the command prompt. Note: Determine the current system time and replace the time in the example below with the current time on your system plus 1 or 2 minute(s).  For example, the command for 2:23 PM would be this:

  at 14:24 /interactive cmd.exe

   

• When remote controlling a LANDesk agent, in the top of the screen there is a Run: field.  Simply type "cmd.exe" in the Run:  field and click the green arrow. Note: This doesn't work with the Management Gateway on-demand agent, because the user launches the on-demand agent.  It only works with the agent service.

   

• Download the attached script to the scripts directory on your Core Server.  Schedule the attached script as a scheduled task from the Console.  It will open a Local System command prompt on the target workstation. 
  Local System Command Prompt.ini