Lock and Unlock in Maintenance Windows

(imported topic written by cburfordjr91)

I know this has probably been answered somewhere before, but I cannot find it. I was able to find the task for setting up the maintenence windows, and that is working great, but that was the easy part. I now need to unlock and lock the computer within those windows. I am using the MaintenanceWindows.bes that I found. This task creates registry keys that look like this:

HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\MaintenanceWindow

“StartTime”=“Sun, 02:00”

“EndTime”=“Sun, 04:00”

“Period”=“0”

“Enabled”=“yes”

What i am wonderig is if there is a corresponding task that locks and unlocks the machines, and if not, how would I go about making one. Any help with this would be greatly appreciated.

(imported comment written by BenKus)

Welcome to the forum…

I assume you were looking here: http://forum.bigfix.com/viewtopic.php?id=1241

This might help too… http://forum.bigfix.com/viewtopic.php?id=662

Basically, you change the “enable” and “disable” task to also set the lock state… It will look like this:

regset “HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\MaintenanceWindow” “Enabled”="no"
setting “__LockState”=“true” on “{now}” for client

And then the inverse for enable task…

Note that you probably will run into the issue where th agent won’t run the action to unlock when it is locked (because it won’t run actions when it is locked)… to get around this problem, you will need to use the skiplockconstraint trick: http://forum.bigfix.com/viewtopic.php?id=746

Ben

(imported comment written by cburfordjr91)

Thanks Ben, but that wasn’t exactly what i was looking for. That will lock the machine when i am enabling the maint windows, and unlock when i disable it, but I am looking for something that I can set as a policy that will dynamically unlock the machine when the maint window starts and lock it back when it is over.

Ben Kus

With a simple modification, we would take the steps of directly tying the “LockState” to the “true/false” value of “In Maintenance Window”. These attached properties don’t do that, but it isn’t very hard to modify the properties to be tied to lock state.

Ben

I was looking at the property “In Maintenance Window”, and thought I may be able to create a policy that uses that for relevance, and that would unlock it when it became true, but I would need a second policy to lock it back when it became false. Would there be a way to do it all in one policy. Create the relevance just to see if the Maintenance Window is enabled and then use the script in the property inside of the action script?

relevance:

Maintenance Window Enabled

action:

if {“In Maintenance Window”}

Unlock

else

Lock

endif

I’m sorry if I am making this harder than it has to be… Thanks in advance…

(imported comment written by BenKus)

You could do it with a single “dynamic setting”, but the way I sent you should accomplish the same thing and it should be easier… To get it to work, you will need to take action from the Fixlets and set them as a policy (one to unlock, one to lock).

Ben

(imported comment written by BenKus)

http://forum.bigfix.com/viewtopic.php?id=6158

(imported comment written by BenKus)

http://forum.bigfix.com/viewtopic.php?id=6158

http://support.bigfix.com/bes/misc/maintenancewindow.html