Overriding Lock Status for one Action/Baseline

Usage and Config Patch
1

(imported topic written by Shogo23)

We have some servers that stay locked, but we need to apply one specific action to them without causing other pending actions to run. Is there a way to override the lock status for just one action or baseline?

Thanks,

Don

2

(imported comment written by BenKus)

Hey Don,

Yes… but it is a secret… quick history:

  • We had a bug in an earlier version of BigFix where the locked constraints weren’t properly being respected by custom Fixlet content.
  • We fixed the bug, but a couple customers had found the behavior and liked it… so we put in a special option to allow them to take actions even if a computer was locked (but only from a custom action or custom Fixlet/Task).

Here is the setting for the console to enable this behavior:

Setting:
“HKCU\Software\BigFix\Enterprise Console\Settings” "SkipLockedConstraint"DWORD=1

Description:
If non-0, an action taken from a custom task/fixlet, or a custom action, will run even on locked computers. Console user will be prompted for confirmation on each action taken in this mode.

Important note: This is not a documented or fully supported feature of BigFix. I expect it is here to stay for future versions, but it might potentially be removed some day. Use at your own risk and make sure you test before sending out to production computers.

Ben

3

(imported comment written by Shogo23)

Thanks for the info! We’ll give it a try.

Don

4

(imported comment written by robbieb91)

I’m noticing that when i use SkipLockedConstraint I am unable to push an action for a fixlet that is not in my custom operator site. But, if i create a custom copy of that fixlet and put it in my operator site, i can successfully deploy it. Any suggestions on how to get past this limitation?

Thanks,

Robbie

5

(imported comment written by BenKus)

Yes… you can consider adding a lock exemption for other Fixlet sites (see http://forum.bigfix.com/viewtopic.php?id=4406)

But a general rule is that if you are playing too much with lock exemptions, you might be setting yourself up for trouble…

Ben

6

(imported comment written by robbieb91)

thanks. I’ll look into that and give it a try.

7

(imported comment written by cj6591)

This works for an individual action … how can I do this for a baseline?

I have controlled machines that we lock and I need to make sure that only specific tasks run against the machine. I need to do this with baselines. It seems to work fine for tasks and fixlets.