Overview

This article provides detailed information related to the process of patch deployment in GFI LanGuard, the role of the deploy_patches.bat / agent_execute.bat files involved, and describes the communications between the LanGuard server and the target machines.

Information

Remote patch deployment with LanGuard can be initiated in two different ways:

1. Manually from the LanGuard UI.
2. Through the LanGuard Attendant service’s scheduled patch deployment module when:
• Patch deployment is scheduled for a later stage, or
• Automatic patch deployment was configured for a scheduled scan, or
• Automatic patch deployment was configured for any of the Agents.

Although the Agent handles the load during scanning, it will NOT perform any patch deployment. Instead, the scan result is returned to the LanGuard server, which then deploys any required patches. This is done to avoid having multiple patch repositories spread over the network.

It is possible to follow the process and cancel operations as described in Monitoring Remediation Operations. Canceling a deployment process is only possible via Cancel selected deployment, which is enabled in only two situations:

• The deployment task status is “Scheduled” (the deployment task is still waiting to begin execution)
• The deployment task status is “Running…” or “Incomplete” (the task has begun execution but is not finished yet) AND there are computers on which the deployment is rescheduled AND there is no computer on which the deployment status is “Incomplete.”

On any other deployment task status, the Cancel selected deployment option is disabled.

Regardless of the type - manual or automatic, and whether this is patch deployment, custom software installation, or any other remediation job, the actual remediation process always follows the same steps described below.

1. GFI LanGuard logs into the target machine and accesses the remote registry.

2. All files required for deployment are copied to the target machine. This includes PatchAgent.exe and any patch executables. By default, this is done via the standard admin shares to C:\Windows\Patches. However, the location can be changed to a custom share through the deployment settings.
   

   Depending on the various settings for the remediation job, more files may be copied. For example, if the remediation were configured to allow choosing the time to reboot, an additional file rebootattendant.exe would also be copied. 

   When the target computer has a GFI LanGuard Agent configured to use a Relay Agent, only the PatchAgent.exe and deploy_patches.bat are copied initially. The Patch Agent Service, once started, would request patch installer executables from the assigned Relay Agent.

   Each of the above steps should be completed for the remediation job to proceed. Verifying required network connectivity and security permissions from the LanGuard server to the target machine can help with the remote registry and the admin shares issues troubleshooting.

3. The batch file deploy_patches.bat containing the commands with parameters to install all selected patches silently is created and copied to the target computer.

4. A service called GFI LanGuard Patch Agent Service (PatchAgent.exe) is then installed and started on the machine. The credentials for this service, specified in the deployment settings, should have local administrator permissions on the target machine and the Log on as a service rights.

   Patch Agent Service:
   • calls and executes each command in the deploy_patches.bat file
   • monitors the status of each patch deployment
   • creates/writes to the PatchAgent.log
   • sends status updates such as Starting <patch> deployment, Finished <patch> deployment, etc., via HTTP to the GFI LanGuard server's communications port 1072 (by default)

5. For each command in the primary deploy_patches.bat file, a separate agent_execute.bat temporary batch file is created on-the-fly and executes just that one command/patch.

6. The GFI LanGuard Patch Agent Service returns the final result (success or fail) of each individual patch deployment to the GFI LanGuard server via the communications port 1072 (by default). This port needs to be open on the LanGuard server for it to receive the final status.

7. After the patch deployment, the service is uninstalled, and the system continues with performing any additional actions or triggers defined in the batch file, such as rebooting the machine, etc.

It is possible to receive Timed out: PatchAgent did not respond in the permitted time interval error message when deploying patches, but that doesn't mean that the process actually failed. Refer to the Remediation Error: "Timed out: PatchAgent did not respond in the permitted time interval" When Attempting to Deploy Patches for more information and the solution.

Related Articles

• Resolving Error 'The service did not start due to a logon failure' when Deploying Patches
• Remediation Error: "Timed out: PatchAgent did not respond in the permitted time interval" When Attempting to Deploy Patches