Endpoints turn to be Not-Relevant after taking action on a baseline

(imported topic written by AviE91)

Hi,

I have a baseline which is comprised of several components, i configured the baseline to show me all applicable computers per each copmponent’s relevance.

Once i take action from the baseline itself and choose any number of computers they turn to non-relevant

i tried taking action and choosing:

“All computers with the property values selected in the tree below” and there i choose a group of computers

i made sure that:

“…the relevance clause from the original Fixlet or Task Message evaluates to true” on “Applicability” tab is checked

Help on this issue is much appreciated,

Thanks

Avi

(imported comment written by AviE91)

Anyone?

(imported comment written by BenKus)

What are the Fixlets in the Baseline and what is the relevance of the Baseline?

Ben

(imported comment written by AviE91)

Ben Kus

What are the Fixlets in the Baseline and what is the relevance of the Baseline?

Ben

Baseline relevance:

(version of client >= “6.0.0.0”) AND (exists true whose (if true then ((if (name of operating system as lowercase starts with “win”) then (if (name of operating system = “Win95” OR name of operating system = “Win98” or name of operating system = “WinME”) then “Workstation” else (if (value “ProductType” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions” of registry = “WinNT”) then “Workstation” else “Server”)) else "Unknown - " & name of operating system) as string as lowercase != “Server” as lowercase) else false))

Component 1 relevance:

“Update McAfee Agent to 4.5.0.1810”

(version of client >= “6.0.0.0”) AND ((exists true whose (if true then ((if (name of operating system as lowercase starts with “win”) then (if (name of operating system = “Win95” OR name of operating system = “Win98” or name of operating system = “WinME”) then “Workstation” else (if (value “ProductType” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions” of registry = “WinNT”) then “Workstation” else “Server”)) else "Unknown - " & name of operating system) as string as lowercase = “Workstation” as lowercase) else false)) AND (exists true whose (if true then ((exist running service “McAfeeFramework”) And (exist key “HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\Framework” of registry And (value “version” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\Framework” of registry < "))) else false)))

Component 2 relevance:

“McAfee VirusScan Enterprise 8.8”

(version of client >= “6.0.0.0”) AND ((exists true whose (if true then (exists (if (name of operating system as lowercase starts with “win”) then (if (name of operating system = “Win95” OR name of operating system = “Win98” or name of operating system = “WinME”) then “Workstation” else (if (value “ProductType” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions” of registry = “WinNT”) then “Workstation” else “Server”)) else "Unknown - " & name of operating system) whose (it as string as lowercase contains “Workstation” as lowercase)) else false)) AND (exists true whose (if true then ((((exists key “HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator” of registry) AND (not exists key “HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800” of registry)) AND (value “Version” of key “HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\Framework” of registry >= “4.5.0.1810”))) else false)))

(imported comment written by BenKus)

So the computers are showing as relevant for the baseline and are returning “Not Relevant” when you apply the Baseline to those computers?

Ben

(imported comment written by AviE91)

Ben Kus

So the computers are showing as relevant for the baseline and are returning “Not Relevant” when you apply the Baseline to those computers?

Ben

Only some of them are returning “Not Relevant” when i apply (take action) the baseline, in some i mean couple of hundreds, not 2 or 3 computers alone.

Also, Some computers are succesfully completing the relevant components of the baseline.

(imported comment written by BenKus)

Shot in the dark: Try clearing your console cache and see if those computers stay relevant…

Ben

(imported comment written by AviE91)

Ben Kus

Shot in the dark: Try clearing your console cache and see if those computers stay relevant…

Ben

Ok i’ve cleared my cache and it didn’t work,

i figured my relevance was buggy, maybe it was the:

((exist running service “McAfeeFramework”)

anyway i created custom copy with different relevance that works aswell.

seems to be solved for now i guess,

thanks tho

(imported comment written by SystemAdmin)

Hello,

I was actually having a very similar issue with McAfee 8.7 virus scan update that I wanted to push (as an individual action not a baseline).

The computers are showing applicable when I look at the “Task†tab. If I select an individual computer it has the task listed in the “Applicable Tasks†list as well. When I look at the registry it shows the 8.5 version – in other words its applicable. When I ran the push yesterday it showed “Not Applicable†for all the computers that were supposed to receive it except those which were online (those showed not reported).

Any advice that you can offer? I was going to just rerun the action tonight to see if it was some random glitch that happened but figured I would post on here as well to see if anyone had any new ideas in regards to this.

Thank you for any help,

Alex

(imported comment written by AviE91)

Hey Alex,

this is what i used eventually,

I think but i’m no big expert it was related to circumstancial relevances are not going to work since bigfix client works fast and send data to server very quickly, so if you set in relevence (running service) and during installation the service will be stopped = fail = not relevant anymore

from what you wrote i guess you set relevance to reg key that specifies 8.5 version?

isn’t this key being deleted or changed once task of installation kicks in?

in my client environment i wanted to check the following:

version 4.5.0.1810 of ePO agent installed

a workstation and not a server

check that no unc paths in %path% environment variable (mcafee has a KB for version 8.8 of VSE on UNC paths that errors out installation of VSE)

Good Luck, let us know if that worked or the issue was resolved/

(version of client >= 
"6.0.0.0") AND ((exists 

true whose (

if 

true then (exists (

if (name of operating system as lowercase starts with 
"win") then (

if (name of operating system = 
"Win95" OR name of operating system = 
"Win98" or name of operating system = 
"WinME") then 
"Workstation" 

else (

if (value 
"ProductType" of key 
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions" of registry = 
"WinNT") then 
"Workstation" 

else 
"Server")) 

else 
"Unknown - " & name of operating system) whose (it as string as lowercase contains 
"Workstation" as lowercase)) 

else 

false)) AND (exists 

true whose (

if 

true then ((((exists key 
"HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator" of registry) AND (not exists key 
"HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800" of registry)) AND (value 
"Version" of key 
"HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\Shared Components\Framework" of registry >= 
"4.5.0.1810"))) 

else 

false)) AND (exists 

true whose (

if 

true then (exists (

if exist (substrings separated by 
";" of (value 
"PATH" of key 
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" of registry as string)) whose (it starts with 
"\\") then (substrings separated by ";
" of (value "PATH
" of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
" of registry as string)) whose (it starts with "\\
") else "Empty
") whose (it as string as lowercase contains "Empty
" as lowercase)) else false)))

(imported comment written by SystemAdmin)

You are correct AviE - it was related to my relevance. I used a custom prebuilt relevance (that i always use on all other actions) so that the patch only goes to XP and 7 workstation but the way I had it written did not work correctly with the way the rest of the relevance statement for the fixlet… Fixed it now, thank you for your response though!

Alex