Adobe ARM - Time elapsed is less than time limit - returning 0

Issue

The AdobeARM.log file contains similar entries:

[YYYY-MM-DD HH:MM:SS] IsTimeElapsed...
[YYYY-MM-DD HH:MM:SS] Minutes elapsed: MMM
[YYYY-MM-DD HH:MM:SS] Time elapsed is less than time limit - returning 0

Cause

By default, the Updater performs an update check every 3 days. The Updater adds the update check interval (3 days) to the value of tLasT_Acrobat. If the current date/time is less than this value, the Updater will exit without checking for updates and log the message.

Solution

Removing the tLastT_Acrobat entry will allow the Updater to perform the check.

Run the following via a Command Prompt.

REG DELETE "HKEY_USERS\.DEFAULT\Software\Adobe\Adobe ARM\1.0\ARM" /V "tLastT_Acrobat" /F

UAC, Administrators and Logon Scripts...

Logon script implementations prior to User Account Control (UAC) were fairly simple. Apply a logon script to user and the script did what it was supposed to. Post-UAC is a much different experience. There are things to take into account that, hopefully, this post will help explain.

Logon scripts can be applied to user accounts using

• The Active Directory Logon script defined in the user account properties
  NOTE: Only one can be specified. Therefore, it would need to call others.

•  A GPO Logon script

When a user is not part of the local Administrators group, scripts execute under the standard user access token. But when the user is part of the local Administrators group, scripts execute differently.

In the following scenarios, two logon scripts were applied at each login. Either both batch (CMD) or both VBScript (VBS).

Red = Bad, Yellow = OK, Green = Good

In conclusion, we found that using the Active Directory Logon script defined in the user account properties in conjunction with a VBScript file provided the most reliable results. This provided accurate drive mappings for the standard user account and no drive mapping for the administrative user account (or elevation). Conversely, the use of a batch file did allow accurate drive mappings for the standard user account, it also provided unavailable drive mappings to the administrative user account.

NOTE: This post does not apply to mapping drives using Group Policy Preferences.

Oracle Java Deployment Rule Set still broken

When Oracle began building in stronger security measures in their Java products in December 2012 with version 7 Update 10, IT departments discovered that the product could no longer work correctly. End users found that the product could no longer access Java applets or applications without error messages being presented. Enterprises found that the additional security did not include measures to bypass it, even for their own internally owned sites.

In September of 2013, Oracle released Deployment Rule Set (DRS) with Java 7 Update 40. DRS introduced the use of an XML file that allowed for defining a site and whether it was allowed to run. An extension to allowing the site to run, the XML could also define which version of Java to run the site with.

These versions do not support the feature to use a specific version of Java for a specified site.

Java 7 Releases	Release Date
Java 7 Update 60 Limited Update	May 28, 2014
Java 7 Update 55 CPU	April 15, 2014
Java 7 Update 51 CPU	January 14, 2014
Java 7 Update 45 CPU	October 15, 2013
Java 7 Update 40 Limited Update	September 10, 2013

If you've been stressing-out attempting to get this functionality working, waiting until a version that works is released would alleviate that stress.

REFERENCE

Deployment Rule Set
http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/security/deployment_rules.html

The cache disk on a Citrix PVS target fills and a server that is attached to it crashes.

Symptoms

Above normal CPU utilitization by the DAgentUI.exe process(es).
The per-user log, DAgentUI{USERNAME}{PID}.log, contains the following entries, repeatedly:

[MM/DD/YYYY hh:mm:s.ms TID #] DAgentProxy.cpp:518 CDAgentProxy::WaitForDAgentService() Waiting 15000 ms for DAgent service
[MM/DD/YYYY hh:mm:s.ms TID #] DAgentProxy.cpp:546 CDAgentProxy::WaitForDAgentService() Wait returned - -1
[MM/DD/YYYY hh:mm:s.ms TID #] DAgentProxy.cpp:362 CDAgentProxy::WaitForDAgentData() entered
[MM/DD/YYYY hh:mm:s.ms TID #] HideTrayIconThread.cpp:37 CHideTrayIconThread::HideClientTrayIcon() entered
[MM/DD/YYYY hh:mm:s.ms TID #] HideTrayIconThread.cpp:51 Destroying tray icon

Cause

The Altiris Deployment Agent service is not running or has been disabled. This causes the per-user log to fill with events and subsequently fill the cache disk. 

Solution

If the service MUST be disabled, delete the DAgentUI registry value in the registry that starts the per-user process (DAgentUI.exe).

Otherwise, start the Altiris Deployment Agent service.

When multiple versions of Java are installed, what version wins?

The flow is, latest version > 64-bit > 32-bit. While the flow is understandable, different flows are used and present the following experiences.

Java Web Start

The installer registers the JNLP file association. This is a per-system registration and does not have corresponding 32-bit/64-bit entries.

A problem arises when both 32-bit and 64-bit of the same version are installed. The 64-bit version is registered and causes calls that require the 32-bit version to fail. For example, opening a JNLP file within the 32-bit version of Internet Explorer.

Control Panel

The installer uses the same GUID for Java 1.5, 1.6, 1.6 (x64), 1.7 and 1.7 (x64) when registering the Control Panel applet. This GUID is placed in both the 32-bit and 64-bit sections of the registry. When both 32-bit and 64-bit versions are installed, Windows uses the 64-bit registry section entry and discards the 32-bit section entry.

A problem arises when both 32-bit and 64-bit of the same version are installed. The the 64-bit version is available in the Control Panel allowing 64-bit versions to be managed. Conversely, the 32-bit version is not available in the Control Panel which does not allow 32-bit versions to be managed. For example, when using the 32-bit version of Internet Explorer users can manage which versions are available. This cannot be done if the user cannot manage the 32-bit versions.

Windows 8 0xC0000001

Error 0xC0000001 was encountered when a Windows 8 system was booted from a drive image that was restored using Active@ Disk Image. The drive utilized Unified Extensible Firmware Interface (UEFI) and a GUID Partition Table (GPT).

Booting the system using Microsoft Diagnostic and Repair Tool (DaRT) and enumerating the Boot Configuration Data (BCD) showed that both the device and osdevice settings on the {default} entry were unknown.

To resolve this issue, the following was done:

1. Locate the partition drive letter for the drive containing the OS. (In this instance, drive C.)
2. Set device setting on the {default} entry to Partition={DriveLetter}:. (in this instance, Partition=C:)
3. Set osdevice setting on the {default} entry to Partition={DriveLetter}:. (in this instance, Partition=C:)

GUID	Globally Unique Identifier
0xC0000001 STATUS_UNSUCCESSFUL	{Operation Failed} The requested operation was unsuccessful.

Symantec Management Platform Agent and Package Server Vulnerability

The Symantec Management Platform Symantec Management Agent and/or Package Server Agent Disk Space Check and Drive Overflow features can potentially cause the space of it's system drive to be fully consumed. When this occurs, no additional data can be written to the drive, such as security patches or antivirus definitions.

As an example, a system where the Package Server Agent is installed on drive D. The Package Server was assigned more packages than the D drive had space for. The only drive with enough space for the download was the system drive, drive C. This drive was promptly consumed of drive space. After this it was noticed that antivirus definitions for Thursday, November 21, 2013 are for Wednesday, November 20, 2013 r25, but a system having this issue is nearly a month old.

Drive Space Check will check whether there is free space available on the drive containing the Package Server Agent installation. The amount of free space on a drive must be, at least, the value of the Min Disk Free Space (Mbytes) registry key in addition to 120% of the download size. If there is enough drive space, it will download it to this drive. If there is not enough drive space, the Drive Overflow feature is implemented.

Drive Overflow will check whether a drive, other than the drive containing the Package Server Agent installation, has available disk space for the download. If space is available on the drive, a folder will be created using the Package Server Agent installation path, replacing the drive letter with the drive letter of the using a path as the  has the space and download there, if no other drive has this space then it will not download the package.

Symantec HowTo Article 77389: FAQ on Package Servers