Altiris Windows Assessment Scan job error

[Phong Vu]

Hi all,

Recently I noticed that my Windows Patch Management Compliance report doesn't include the full list of my target computers. After a while of investigation, I found out that some computer agent couldn't run the Windows Assessment Scan job. Here the log from one

<event date='05/06/2020 16:00:33.0240000 +07:00' severity='1' hostName='XXXXXXXXXXXXXXX' source='Utils::ComException::ComException' module='AeXPatchAssessment.exe' process='AeXPatchAssessment.exe' pid='9540' thread='10196' tickCount='554651609' >
  <![CDATA[HR=0x800710DD, MSG='Shavlik::ShavlikPatchAssessmentImpl::OnInitialize()- The operation identifier is not valid.']]>
</event>
<event date='05/06/2020 16:00:33.0550000 +07:00' severity='1' hostName='XXXXXXXXXXXXXXX' source='Utils::ApplicationException::ApplicationException' module='AeXPatchAssessment.exe' process='AeXPatchAssessment.exe' pid='9540' thread='10196' tickCount='554651640' >
  <![CDATA[Message='Patch assessment failed' (ExitCode=4).]]>
</event>
<event date='05/06/2020 16:00:33.0550000 +07:00' severity='2' hostName='XXXXXXXXXXXXXXX' source='Application::runAssessmentWithWatchdog' module='AeXPatchAssessment.exe' process='AeXPatchAssessment.exe' pid='9540' thread='10196' tickCount='554651640' >
  <![CDATA[Exception during assessment scan]]>
</event>
<event date='05/06/2020 16:00:33.0550000 +07:00' severity='4' hostName='XXXXXXXXXXXXXXX' source='BaseApplication::Run' module='AeXPatchAssessment.exe' process='AeXPatchAssessment.exe' pid='9540' thread='10196' tickCount='554651640' >
  <![CDATA[Deinitializing environment...]]>
</event>
<event date='05/06/2020 16:00:33.0550000 +07:00' severity='1' hostName='XXXXXXXXXXXXXXX' source='BaseApplication::Run' module='AeXPatchAssessment.exe' process='AeXPatchAssessment.exe' pid='9540' thread='10196' tickCount='554651640' >
  <![CDATA[Application exception caught: Patch assessment failed]]>
</event>
<event date='05/06/2020 16:00:33.0860000 +07:00' severity='4' hostName='XXXXXXXXXXXXXXX' source='CAuxilliaryPackage' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='6372' thread='3680' tickCount='554651671' >
  <![CDATA['Patch Windows System Assessment Scan Tool Package' executed, exit code=4]]>
</event>
<event date='05/06/2020 16:00:33.0860000 +07:00' severity='1' hostName='XXXXXXXXXXXXXXX' source='AssessmentTool' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='6372' thread='3680' tickCount='554651671' >
  <![CDATA[Failed to launch assessment scan for provider: Traditional]]>
</event>
<event date='05/06/2020 16:00:33.0860000 +07:00' severity='4' hostName='XXXXXXXXXXXXXXX' source='AeXPatchUtil' module='AeXPatchUtil.exe' process='AeXPatchUtil.exe' pid='7312' thread='9600' tickCount='554651671' >
  <![CDATA[Error: E_UNEXPECTED]]>
</event>
<event date='05/06/2020 16:00:33.3050000 +07:00' severity='4' hostName='XXXXXXXXXXXXXXX' source='ProgramExec' module='smfagent.dll' process='AeXNSAgent.exe' pid='6372' thread='10068' tickCount='554651890' >
  <![CDATA[Program 'Windows System Assessment Scan' completed. Exit code=-2147418113. Execution context='Administrator'. RunAs='\']]>
</event>
<event date='05/06/2020 16:00:33.4610000 +07:00' severity='4' hostName='XXXXXXXXXXXXXXX' source='CleanupExpiredPackages' module='smfagent.dll' process='AeXNSAgent.exe' pid='6372' thread='7820' tickCount='554652046' >
  <![CDATA[Cleanup expired packages started: deleteAsynchCompletion = false, TreatFailedMdpAsActive = false]]>
</event>
<event date='05/06/2020 16:00:33.4770000 +07:00' severity='4' hostName='XXXXXXXXXXXXXXX' source='CleanupExpiredPackages' module='smfagent.dll' process='AeXNSAgent.exe' pid='6372' thread='7820' tickCount='554652062' >
  <![CDATA[Cleanup expired packages completed]]>
</event>
<event date='05/06/2020 16:00:33.4770000 +07:00' severity='4' hostName='XXXXXXXXXXXXXXX' source='SWDAgent::Run' module='smfagent.dll' process='AeXNSAgent.exe' pid='6372' thread='7820' tickCount='554652062' >
  <![CDATA[Main loop about to sleep 3600 sec ]]>​

I did some research but it seems there is no exact error like mine.
Much appreciated.

[Dmitri Gornev]

Hi Phong Vu,

is this problem specific to one machine or reproducible on many? What is the OS version?

May you check whether problem could be connected to integration between the assessment engine modules?
1. First reproduce the problem by executing assessment engine (C:\Program Files\Altiris\Altiris Agent\Agents\SoftwareManagement\Software Delive
ry\{6D417916-467C-46A7-A870-6D86D9345B61}\cache\AeXPatchAssessment.exe) manually (check the logs to confirm that problem was reproduced).
2. Then replace original AeXPatchAssessment.exe file with a custom version attached to this post (it uses a different approach for integration) + copy attached STPatchAssessment.dll to the same folder. 
3. Run test from step 1 again and check whether the same errors were logged or the problem was resolved.

AeXPatchAssessment.exe will be replaced by the original version automatically on the next scheduled assessment execution.

Thank you,
Dmitri.

Attachment(s)

Assessment.zip   1.66 MB 1 version

[T Bagi]

Hello Dmitri,

i have a similar problem on our Windows Server 2019 with  assessment Scan agent.
I´ve tried your solution with the new AeXPatchAssessment.exe but still the same.
Log File:

cMaybe you have an Idea.

Thx Tomasz

[Chris Farrell]

See if this is the issue Tomasz: https://knowledge.broadcom.com/external/article/164743

[T Bagi]

Hi CFarrell

Sorry for answering so late.
I have installed the 2 Cert´s on the Srv2019, the assessment Scan and Software Updates work fine.

br
Tomasz

[DANY LAVOIE]

Is the Dimitry advise about replacing AeXPatchAssessment.exe it still applicable to 8.5 RU4? the lastest RU

we have the same problem on hundred on computer and i'm actively searching for an issue.



------------------------------
National research council of Canada
------------------------------

[Chris Farrell]

Hi Dany,

Dmitri's scanner should work for you, but I would verify the the computers you are missing data from are running the scan successfully or not. If not, check your SW update plug-in policies that target the computers unless the default is enabled. In 8.5.x the scan will fail if the default is disabled and the computer is not targeted by a clone of the default.