Real World Examples for Guaranteed State

Application Health Check

There are times when we have an application that we need to make sure is running and up to date like Windows Defender or other anti-malware solutions. This exercise will build a policy to check the state of our Application Virtualization Client (App-V), but this scenario could be used for any application. We will check for the installation, the service state (running) and the current version installed. We will add two triggers, one to fire the rule if the service stops and one to fire on a schedule.

Create the Missing Rule

This rule will check to see if the device has the application installed. Since this is a critical application, we will call the device non-compliant if the App-V Client is not installed. If we do not care to report on devices that do not have the application installed, we could use a Pre-Condition check and only report on devices that actually have the application in question installed.

1. Log on as Manager1
2. In Guaranteed State, navigate to Administration->Rules
3. Click on New Rule in the far right
4. In the Name field type in Check that the App-V Client is installed
5. In the Description field type in Check that App-V Client is installed
6. Scroll to the Triggers section.
7. Start typing Periodic in the field and Choose Periodic (hours)
Normally, you do not want to use the interval triggers as one of the huge benefits of Guaranteed State is the ability to only run the rule if specific things change on the device. Here we are checking for the installation so we will run this rule weekly to make sure that devices have the application installed.
8. In the Interval Hours field type in 168
9. Scroll to the Check section
10. In the Select check to be performed field start typing check for WIM and select Check for WMI namespace <WMI namespace to check for>
11. In the Namespace field type in root\Microsoft\appvirt
12. Click Save

Create the Service Rule

13. In Guaranteed State, navigate to Administration->Rules
14. Click on New Rule in the far right
15. In the Name field type in Check that the App-V Client Service is running
16. In the Description field type in Ensures the App-V Client Service is running
17. Scroll to Triggers and start typing when the state and select When the state of the named Windows service changes
18. In the Service Name field type in sftlist
19. Scroll to the Check section
20. In the Check field start typing Check that service and then choose Check that service "ServiceName" is State
21. In the ServiceName field type in sftlist
22. In the State field select Running
23. Scroll to the Fix section
24. In the Fix field start typing Request Service and Choose Request service "ServiceName" to action
25. In the ServiceName field type in sftlist. In the Action name field choose Start
26. Click Save

Create the Version Rule

We will check to make sure the latest version of the App-V Client is installed. We will run this check each time the App-V Client process starts. 

27. In Guaranteed State, navigate to Administration – Rules
28. Click on New Rule on the right
29. In the Name field type in Check that the App-V Client is the Latest Version
30. In the Description field type in Check that the App-V Client is the Latest Version
31. Scroll to the Triggers section and start typing When a Process and select When a process starts (Windows Only)
32. In the Executable field type in C:\Program Files\Microsoft Application Virtualization Client\SftList.exe
33. Scroll to the Check section
34. In the Check field start typing Check that registry and choose Check that registry key Hive\Subkey\Name has ValueType value of "Value"
35. In the Hive field select HKLM
36. In the Subkey field type in SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DB9F70CD-29BC-480B-8BA2-C9C2232C4553}
37. In the Name field type in DisplayVersion
38. In the Value field type in 4.6.1.20870
39. In the Value Type field select REG_SZ
40. Click Save

Create the Policy

Now, we will create the policy that will contain all of our rules.

41. In Guaranteed State, navigate to Administration->Policies
42. Click on New Policy in the column on the right
43. In the Name and Description fields type in App-V Client Health Check
44. In the All Rules section filter for contains App-V Client and select the 3 rules that we just created Check the App-V Client Version, Check that the App-V Client Service is running, and Check that the App-V Client is installed
45. Click the double arrows to the right to add them to the Assigned Rules section
46. Click Save

Deploy the Policy

47. Select App-V Client Health Check and click Assign Mgmt Grp
48. Select the All Win10 Lab Workstations Devices Management Group and click Save
49. Click Deploy. Select Ok
50. Navigate to Overview and select the App-V Client Health Check policy in the drop-down
51. You may have to refresh in order to see the results

Set the Stage for Broken Application

Now we will "break" our application to see how Guaranteed State shows the results.

52. Log into 1ETRNW101 as 1ETRN\Tachyon_AdminG
53. Stop the Microsoft Application Virtualizaion Client Service

54. In Guaranteed State - Overview with the App-V Client Health Check Policy selected
55. Notice the device move into the non-compliant state (the rule will also restart the service, so you may miss it moving to non compliant, but if you click on view history on the device you will see the service stop and be restarted)
You can see from this sample exercise how powerful this tool can be. Play around with other rules and policies to see how Tachyon handles the different triggers that you can utilize. Remember that the rules are all evaluated when the policy is initially deployed, after that it will only be re-evaluated according to the trigger that is assigned.

Service Desk Ticket Symptom

There are times when we have an incident reported to the Service Desk that has the potential for wide-spread impact in our environment. It may be related to a global application or a business-critical functionality. Typically, what we see happening is the first user to experience the issue calls the service desk and a fix is determined and applied. The Service Desk must depend on the spread of that solution to the other help desk agents using a KB article or other such knowledge transfer. When the next user has the issue, they call the Service Desk, and if they are lucky the agent will know the resolution and be able to apply it. Alternatively, the Agent may have to come up with the solution again, duplicating efforts and wasting time for both the agent and the end user. With Guaranteed State we can create a policy for this issue and have the device remediated immediately without a need for a service desk call and maybe even before the end user knows they have the issue. In this exercise we will use a harmless event to show you the functionality. We will call it Help Desk Issue #2.

Create the Rule

In this exercise we will use a specific event in the Event Viewer as our trigger. This way we can perform the fix each time that event fires. In our example, the fix is simply going to be restarting the service but we could just as easily do anything else to the device that we needed to.

56. In Guaranteed State, navigate to Administration->Rules
57. Click on New Rule on the right
58. In the Name field type in Check For Help Desk Issue #2
59. In the Description field type in A great description that tells you what Help Desk Issue #2 is
60. Scroll to Triggers. Start typing When an event Choose When an event log entry is created (Windows only)
61. In the Channel field type in Application
62. In the Query field type in *[System[(Level=2) and (EventID=1000)]] and *[EventData[Data='onenote.exe']]
63. In the Debounce time (seconds) field type in 60
64. Scroll to the Check section
65. In the Select check to be performed start typing Check that service and choose Check that service "Servicename" is State
66. In the ServiceName field type in Windows Update
67. In the State field select Running
68. Scroll to the Fix section
69. In the Fix box start typing Request service and select Request service "serviceName" to action
70. In the Service name box type in Wuauserv
71. In the Action box select start
72. Click Save

Create the Policy

73. In Guaranteed State, navigate to Administration - Policies
74. Click New Policy on the right
75. In the Name and Description boxes type in Help Desk Issue #2
76. In the All Rules section choose our Check for Help Desk Issue #2 rule
77. Click the double Arrows to move the rule to the assigned rules box
78. Click Save

Assign and Deploy the Policy

79. Select our Help Desk Issue #2 policy and click Assign Mgmt Grp
80. Select the All Devices management group and click OK
81. Click Deploy and OK on the message popup

Viewing the Initial Results

82. Open the Services applet and stop the Windows Update Service.
83. Navigate to C:\ProgramData\1E\Client and open 1E.Client.log in CMTrace
84. Look in the log for "Policy Rule "Check for HelpDesk Issue #2""
85. You will see entries for downloading the policy, processing the instruction, and running the fix (starting the service)

Set the Stage

Since our rule has a trigger to look for a specific event from the event logs we will force that event to occur on a device. This will force our rule to run again.

86. Open the Services applet and stop the Windows Update service again
87. Launch an Administrative command prompt
88. In the command prompt type in the following:

eventcreate /ID 1000 /L Application /SO onenote.exe /T Error /D "onenote.exe"

View the Results

89. Open the 1E.Client.log again and notice the entries for the reprocessing of the rule
90. Open the Services applet and notice the Windows Update service has been started. If you did not close the applet you may have to refresh

Removing Unauthorized Software

In this exercise we will create a policy that will remove a piece of software that is not allowed to be used in our environment. We have several devices in our environment with unapproved software installed and this is leading to non-productive workers. We will create a policy that looks for Orca and perform the removal. We will use the process of Orca starting as a trigger for the rule so that we can also remove subsequent installations of the application after we remove it the initial time.

Create the Fragment

This fragment will be used to remove any software that was installed using MSI. We will ask for the Product Name and Publisher as our parameters.

91. Launch TIMS if it is already open then click File New to clear any previous code.
92. In the code block type in the following:

@Software = Software.GetInstallations(Publisher:"%Publisher%",Product:"%Software%");
IF (@Software)
	SELECT 0 as Passed, "%Software% installed" as Data;
ELSE
	SELECT 1 as Passed, "%Software% not installed" as Data;
ENDIF;

93. Click Run
94. Notice the results
We are using the Software.GetInstallations method to check to see if our Product is installed. In this case, Orca. If it is installed the device is non-compliant. We will add the parameter now. This will enable us to use the same fragment for any software products.
95. In TIMS click on Add Parameter
96. In the Name field type in Software
97. In the Hint Text type in Unauthorized Software Product
98. Click Add Parameter again and type Publisher in the Name field and Unauthorized Publisher Name in the Hint text field
99. Click OK
100. In the Instruction Definition section Comments field type in Checks to see if unauthorized software is installed
101. In the description field type in Does this machine have unauthorized software?
102. In the Instruction Type select Check
103. In the Name field type in 1E-GuaranteedState-Check-UnauthorizedSoftware
104. In the Readable payload type in Check for %Software% by %Publisher%
105. Click on Schema choose yes to create the schema. Change the length of the data field to 1024. Click OK
106. Save the file as 1E-GuaranteedState-Check-UnauthorizedSoftware.xml in C:\tools\AdditionalProductPacks\Product_Pack_Templates
107. Create a folder in C:\Tools\AdditionalProductPacks\Product_Pack_Templates called UnauthorizedSoftware
108. Move your fragment to C:\Tools\AdditionalProductPacks\Product_Pack_Templates\UnauthorizedSoftware\Fragments\Check (you will need to create the additional two folders)
109. Copy the manifest.xml from one of the other product pack folders to C:\Tools\AdditionalProductPacks\Product_Pack_Templates\UnauthorizedSoftware
110. Find a .ico file on your machine to use for your Product Pack. Copy the file to C:\Tools\AdditionalProductPacks\Product_Pack_Templates\UnauthorizedSoftware
111. Edit your manifest.xml for your Unauthorized Software Product Pack
112. Change the Name, description, and icon file references. Save the file as manifest.xml
113. Now we will edit this fragment and create a Fix for the removal of Orca. At the end of line 2 in your code block hit the enter key to create a new line 3 (below the IF)
If we just wanted to check for the existence of the unauthorized software we could use this check rule. Since we want to also remove the software we will create a rule to not only check for the software but remove it also.
114. Type in the following on your new empty line 3

Software.Uninstall(Publisher:"%Publisher%",Product:"%Software%");

115. In the Instruction Definition Section Comments field type in Checks to see if unauthorized software is installed
116. In the Description field type in Ensures that unauthorized software is not installed
117. In the Instruction Type select Fix
118. In the Name field type in 1E-GuaranteedState-Fix-UnauthorizedSoftwareRemoval
119. In the Readable Payload field type in Check for %Software% by %Publisher% and remove
120. Save file as C:\Tools\AdditionalProductPacks\Product_Pack_Templates\UnauthorizedSoftware\Fragments\Fix\1E-GuaranteedState-Fix-UnauthorizedSoftwareRemoval.xml

Upload into Guaranteed State

121. In File Explorer navigate to C:\Tools\AdditionalProductPacks\Product_Pack_Templates\UnauthorizedSoftware
122. Multi select all of the files in that folder and right click and choose Send to Compressed (zipped) folder
123. Rename the .zip file to UnauthorizedSoftware.zip
124. Copy the file to C:\Tools\ProductPacks\Integrated
125. Launch Tachyon.ProductPackDeploymentTool.exe
126. In the Server name field change .acme.local to .1etrn.local and click on Test Connection
127. Uncheck Select all and only select our Unauthorized Software Product Pack
128. Click Upload Selected

Create the Rule

We will be creating a rule to remove Orca. With this parameterized fragment you could make multiple rules to add to your policy if you wanted to remove a number of software titles. The Software.Uninstall module and method only works for software installed via the Windows Installer (.MSI format). We could just as easily use the NativeServices.RunCommand instead, we would just need to supply the command line for the unattended uninstall.

129. Launch Guaranteed State as our Admin 1ETRN\Manager1
130. Navigate to Administration->Rules
131. Click New Rule to create a new rule Name it Remove Orca
132. Put in a meaningful description
133. Scroll to the Triggers section
134. Start typing When a process into the Triggers field and choose the trigger When a process starts (Windows only)
135. In the Executable field type in C:\Program Files\Orca\orca.exe
In the precondition we could add only run on Windows since our trigger is only a windows trigger but we are only going to not include a precondition check and have it run on all of our devices since we only have Windows.
136. Scroll to the Check section
137. In the Check field start typing Check for Software select Check for Software by Publisher
138. In the Software field type in the Product Name in this case Orca
139. In the Publisher field type in the Publisher Name in this case Microsoft Corporation
Make sure you type in the exact syntax and case for the Product and Publisher (for example Apple is Apple Inc. with the period) this method and module is very specific. Use Software.GetInsallations(); to pull a table that contains all of the software and publisher information. This will help you to get the proper syntax for your fragment.
140. Scroll to the Fix section
141. Start typing Check for and Select the Check for Software by Publisher and remove
142. Type the product name in the Software field - Orca
143. Type the Publisher name in the Publisher field - Microsoft Corporation
144. Click Save

Create the Policy

145. Navigate to Administration->Policies
146. Click New Policy to create a new policy name it Remove Unauthorized Software
147. Put in a meaningful description
148. Select our Remove Orca Rule
149. Click the double right arrow to move it over to the assigned section
150. Click Save

Assign and Deploy the Policy

151. Select our Remove Unauthorized Software policy
152. Click Assign Mgmt Grp. Choose our All Win7 Lab Workstations Management Group
153. Navigate to Start - All Programs and notice that Orca is installed on this device
154. Click Deploy. Click OK

View the Results

155. Navigate to Overview. Click the dropdown to select our Remove Unauthorized Software Policy
156. You will see the devices become non-compliant the rule will then remove the software.
The log may show some errors on the rule evaluation when the fix is run since the software is being removed. It may also show an error in the uninstall log created by Tachyon located in c:\Program Data\1E\Client\Tachyon.Agent.Software.Uninstall.<DateStamp.Publisher.Product>.log especially if the MSI throws an error code because the software is open when Guaranteed State is trying to remove. Since the launch of the software is our trigger to re-run the rule - the software will always be open during the uninstall.

157. Navigate to C:\ProgramData\1E\Client and Open the 1E.Client.log using CMTrace
158. Check the Client entries for the processing of the policy. Leave the log file open
159. Notice that Orca has been removed
160. Reinstall Orca from the ConfigMgr Content location using the desktop shortcut
161. Open Software\Orca and double click Orca.msi. Select the Complete installation
162. Once the install completes launch Orca close Orca to allow the uninstall to complete
163. Navigate back to the 1E.Client.log and notice that Orca has been removed again. Look at Start - All Programs to ensure it has been removed.
Scenario for extra practice on your own - XML Notepad is also a piece of unauthorized software.

Lab Summary

In this lab we learned how to use Guaranteed State in some real-world scenarios. As you can see Guaranteed State is very flexible and can be used for many, many different jobs to keep our environment healthy and configured correctly. 

Next Page

Ex 9 - Tachyon v5.2 Advanced - Tachyon Activity Record