avast!WEBforum

avast! support forums => avast! 4 WHS => Topic started by: shaun on June 16,
2008, 03:30:29 PM
   ______________________________________________________________________

   Title: Error updating Windows XP clients from console
   Post by: shaun on June 16, 2008, 03:30:29 PM
     _________________________________________________________________

   In a strange twist, I am having issues updating the avast! VPS
   database on Windows XP SP2 clients (ALL of them) from the avast!
   antivirus tab of the Windows Home Server console.  Each of my Vista
   clients works with no issues.
   Error Details
   When attempting to update, I get the following error returned in the
   WHS Console:
   "Error during communication with WORKSTATION; whsUpdate : Error
   0xFFFFFF9D. (4294967197)"
   The avastWHS log provides the following corresponding error:
   "Error during communication (whsUpdate) with WORKSTATION :
   4294967197."
   No other logs on the server have any errors which even come close to
   correlating with the time periods of the above errors.
   avast! Software Details
     * Clients:  avast! Prof Edition 4.8.1201
     * Server:  avast! WHS Edition 4.7.74

   Environment Details
     * Working Clients:  Windows Vista Enterprise SP1, Windows Vista
       Enterprise (non-SP1), Windows Vista Ultimate (non-SP1)
     * Failing Clients:  Windows XP Professional SP2

   Firewalls have been completely disabled on the Windows XP SP2 machines
   (again, ANY XP SP2 machine I connect fails).  I have verified all
   levels of communication between the server and clients (via telnet,
   shares, etc.).  Also, everything else works (scheduled scans run
   without issue on the failed clients, the WHS console shows the clients
   and their status without issue, I can look at scan logs on the clients
   from the console without issue, etc.).
   I had this issue on the original public release of WHS AND it
   continued after I updated WHS to the PP1 beta.
   Finally, the clients can update themselves without issue.
   Automatically or manually, I have no issues on the XP SP2 boxes with
   updating the VPS or Program (for example, right clicking on the tray
   icon and navigating throught the Update menu).  The problem is only
   with updating the XP SP2 client VPS from the WHS console.
   Any help is appreciated.
   ______________________________________________________________________

   Title: Re: Error updating Windows XP clients from console
   Post by: shaun on June 16, 2008, 04:02:56 PM
     _________________________________________________________________

   Figured it out, although it doesn't make any sense.  I decided to
   review the forums for the Server Edition and found the answer.  Keep
   in mind, I have 2 different environments, one with a proxy server and
   one without.  This solution fixed the XP SP2 issues in both
   environments.
   Basically, I finally found a post about reviewing the Alwil Software
   Setup Log:
   %PROGRAMFILES%\Alwil Software\Avast4\Setup\Setup.log
   In it, I found the following errors of interest:
   Code:
   11:45:02 min/pkg  Download servers.def, servers.def.vpu failed with
   error 0x20000005.
   11:45:02 min/pkg  Tried to download servers.def but failed with error
   0x20000005.
   11:45:02 min/gen  Err:The proxy needs authentication.
   Now, the proxy server does NOT require authentication.  Additionally,
   I don't have a proxy server in one environment.  So, I tried a variety
   of configuration changes in the Update Settings (such as Direct
   connected, etc.).  The only thing that worked was using the "Specify
   proxy server" option AND include a user for authentication in both
   environments.
   Makes absolutely no sense to me, but it works now...
   ______________________________________________________________________

   Title: Re: Error updating Windows XP clients from console
   Post by: Vlk on June 16, 2008, 05:25:41 PM
     _________________________________________________________________

   It makes some sense to me though. :)
   What proxy server are you using? (and what authentication types does
   it support?)
   Maybe you only think that the proxy doesn't need authentication, but
   in fact, it is using NTLM (implicitly)? The main idea behind NTLM is
   that you don't have to specify any usernames/passwords anywhere as
   your Windows security token is used instead (ie. you're using the
   identity of the logged-on user).
   The thing is, when you invoke an update from the WHS console, it takes
   place (on the client) in the context of the avast! system service.
   This service runs under the LocalSystem account. Therefore, NTLM
   authentication cannot be used as the users identity makes no sense to
   the proxy.
   Thanks
   Vlk
   ______________________________________________________________________

   Title: Re: Error updating Windows XP clients from console
   Post by: shaun on June 20, 2008, 01:56:13 PM
     _________________________________________________________________

   Thanks for the comments!
   The environments I am testing can use SurfControl, ISA and WebSense.
   I agree with what you are saying about NTLM authentication, but if I
   create a new local user account on the box, that account can get out
   on the Internet without issue.  It isn't part of any groups other than
   the local USERS group.  Why would it be able to do so, but not the
   Local System account?
   ______________________________________________________________________

   Title: Re: Error updating Windows XP clients from console
   Post by: Vlk on June 20, 2008, 03:46:05 PM
     _________________________________________________________________

   LocalSystem is a special account that has unlimited access to local
   resources, but no access to remote resources (as far as NTLM
   authorization is concerned). That's by definition.
   Well, in fact, it acts as the machine account with respect to NTLM
   authorization (unlike normal User account). So, in theory, if you
   granted the MACHINE account some rights (on ISA), it should work,
   too...
   Cheers
   Vlk
   ______________________________________________________________________

   Title: Re: Error updating Windows XP clients from console
   Post by: shaun on June 23, 2008, 02:03:48 PM
     _________________________________________________________________

   Ahhh... that makes some sense now.  I was about to say that a local
   user account is no different from LocalSystem when it comes to
   "network" rights.  I can't get to a network resource with a newly
   created local account any easier than LocalSystem, but the proxy piece
   still worked.
   However, if you're saying that LocalSystem acts more like a Machine
   account, than a User account, this starts to make some sense now.
   Thanks for the tip.  I'll research some more with Microsoft.
   ______________________________________________________________________

   Title: Re: Error updating Windows XP clients from console
   Post by: Vlk on June 23, 2008, 07:41:18 PM
     _________________________________________________________________

   Quote from: shaun on June 23, 2008, 02:03:48 PM
   However, if you're saying that LocalSystem acts more like a Machine
   account, than a User account, this starts to make some sense now.
   Thanks for the tip.  I'll research some more with Microsoft.
   That's what I'm saying. See e.g. here
   http://msdn.microsoft.com/en-us/library/ms684190(VS.85).aspx
   Cheers
   Vlk

        Powered by SMF 1.1.10 | SMF © 2006-2009, Simple Machines LLC