7 Replies Latest reply on Sep 18, 2009 9:26 AM by JoeBidgood

    I have just checked Patch 8 for 8.5 into Epo but dont know why it is deploying?

      Hi all,

      I have just checked Patch 8 for VSE 8.5 into Epo but dont know why it is deploying? I
      have checked my tasks and everything is disabled?

      I'm at a loss. Please help.

      Regards
        • 1. RE: I have just checked Patch 8 for 8.5 into Epo but dont know why it is deploying?
          Its deploying to everything or just certian machines. Do you have global updating turned on?
          • 2. RE: I have just checked Patch 8 for 8.5 into Epo but dont know why it is deploying?
            Its appears to be everything.

            How do I check if Global Updating is on?

            I thought everything is generally controlled by the client tasks and as I have them disabled it shouldn't deploy?

            I then created a test group which doesn't have inheritance and created a new task to deploy the update but then realized it has been deploying since I checked in the package?
            • 3. RE: I have just checked Patch 8 for 8.5 into Epo but dont know why it is deploying?
              JoeBidgood


              There's a few things here that can trap the unwary happy
              Effectively there are two types of update tasks that the agent can run: selective updates, where you control which products get updated, and "everything" updates (sometimes referred to as one-click updates) where the agent will update all the products that it finds on the machine.

              By the sound of it, therefore, there's an "everything" task running where you're not expecting it.

              Firstly as seatsr4couches says, global updating will do this. You can see if it's enabled by checking under Configuration/Server Settings/Global Updating.

              Secondly, the default update task that is installed along with VSE is an "everything" task - it runs at 5pm daily by default. If you don't want this to happen you can disable it in the VSE policy under User Interface Policies/Disable default autoupdate task schedule.

              The final one is the "right-click/update now" option provided by the agent tray icon: this is also an "everything" type task. There's no real way to prevent the users from accessing this apart from setting the policy to hide the icon.

              HTH -

              JB
              • 4. RE: I have just checked Patch 8 for 8.5 into Epo but dont know why it is deploying?
                Hi Joe,

                Thanks for your reply.

                I have checked Global Updating and this was enabled for the below.

                Signatures and engines:

                DAT
                Engine

                Patches and service packs:
                McAfee Agent for Windows 4.0.0

                Other:
                VirusScan Enterprise 8.5.0

                I guess this means if I had unticked the VSE 8.5 option but left it enabled the patch wouldn't have deployed everywhere?
                • 5. RE: I have just checked Patch 8 for 8.5 into Epo but dont know why it is deploying?
                  JoeBidgood


                  Not quite happy This is a common misunderstanding, unfortunately...

                  What global updating actually does is this:
                  1) Wach the master repo to see if anything has changed
                  2) If it has, replicate to any distributed repos
                  3) Send a superagent wakeup call to any superagents, which in turn send an "update everything now" command to the machines on their subnet
                  4) Set a flag which tells any machines not in range of a superagent to update everything the next time they contact the server.

                  The settings you mention above control step 1 - i.e. it's saying "only trigger the global update process if DATs, engines or VSE 8.5 patches are checked in." But once triggered, the global update process will update everything on the machines.

                  So even if you only had DATs and engines selected, and global updating was enabled, then checking in a DAT file would cause your client machines to update everything, and so apply the VSE patch.

                  I *think* this behaivour is changed in ePO 4.5 / MA 4.5 so that it only updates those products that are selected, but I'm not 100% sure. I'll check and update the thread.

                  Joe
                  • 6. RE: I have just checked Patch 8 for 8.5 into Epo but dont know why it is deploying?
                    Hi Joe,

                    Thanks for your help here.

                    Does this mean I need to disable Global Updating if I want to test the VSE patches on only a few machines?

                    I don't understand this bit as surely unticking VSE should stop any patchs from been deployed? Why would a patch deploy when only dats and engines are selected?

                     

                    So even if you only had DATs and engines selected, and global updating was enabled, then checking in a DAT file would cause your client machines to update everything, and so apply the VSE patch.



                    Thanks
                    • 7. RE: I have just checked Patch 8 for 8.5 into Epo but dont know why it is deploying?
                      JoeBidgood


                      No - unticking VSE will only stop the global update being triggered if you check in a VSE patch. Checking in a DAT will still cause the global update process to start, and that process will update *everything* on the machine - which means that it will apply the patch if it's in the current branch.

                      HTH -

                      Joe