Frequently asked questions

This section is designed to help you better understand BigFix Software Distribution through questions and answers.

What is the definition of a package?: Packages are bundles of content and are the most important part of the software Distribution product. Packages contain a list of the files that are needed to install a specific software product. The list also includes the Fixlets that are needed to install the product on the actual endpoints. The Package establishes management relationships between files and Fixlets.

What is the definition of an Application Management Group?: Application Management Groups are collections of tasks that can be organized into groups of content and delivered to targeted groups of client computers. These tasks are viewed by BigFix clients as offers.

What is the role of MSTs in Software Distribution?: An MST, or Microsoft Transform file, is a subfile of an MSI, or Microsoft Installer file. Transform files are used to set or override installation options such as the product language, license key, or component selections. In the context of Software Distribution, you can use the Create Distribution Task wizard to automatically generate tasks for a package. The wizard creates a task for every MST included in a package. Each task contains a single .mst file.
Note: If you want to apply multiple .mst files in a single task, you must enter the installation command in the wizard.
Note: You can have different tasks apply different MSTs, but you can only apply one MST per Software Distribution task.

I created a Fixlet from the Create Fixlet Wizard - why does not it work?: See the Fixlet Authoring support page on the BigFix support website for general Fixlet authoring support.

I created a Fixlet in Current User mode and deployed it to the endpoints. Why did it not get installed at the endpoints?: The logged in user must have Administrator privileges to install the software.

Why do I need installation files in the root directory to create a Fixlet?: See the Technote on structuring software distribution packages in the BigFix support website.

Can I find the list of packages that are installed on an endpoint?: Because BigFix does not repackage the software in a new format, it uses vendor-specified tags, such as the package GUID. These attributes are already gathered in BigFix inventory for many common packaging systems. Alternatively, analyses can be used to identify attributes that indicate that a piece of software is installed. The BigFix SAM scanner is useful in this regard.

Are there any recommendations in creating packages?: See the Technote on structuring software distribution packages in the BigFix support website.

What are the currently supported file types?: BigFix Software Distribution can deploy any type of file. Auto-generation of package installation commands is supported for .exe, .msi, .bat, .dmg, .pkg, .rpm, .spb, and App-V files.

If I have deployed a software, why is my computer still relevant to the package?: The auto-generated Fixlet relevance is generalized to support common package characteristics. To further customize the applicability relevance of a Software deployment Fixlet, use the Target using the following applicability conditions option in either the Create Distribution Task dialog or Edit Distribution Task dialog.

What should I do if my software package has setup.exe and .msi in it?: This depends on the type of software that you are installing. Check with the specific software vendor for their recommendations.

What is a "relative path"?: The relative path concept can be used when you add files to a package. For example, an MSI transform file can be added to an existing package and placed into a subfolder by using this feature. Open actions that are based on this package must be re-created before they can take advantage of the new file. For more guidance, see the related Technote on the BigFix support website.

How do I bundle multiple installations into a single package?: This practice is not suggested. Instead, create individual Fixlets and use baselines to specify ordering. For more information, see the Best Practices section.

The system with the BigFix console is set up to go through a proxy except when it communicates with the BigFix server. When uploading files through the Manage Software Distribution dashboard, I noticed that it is still going through the proxy. Is there a way to ignore the proxy?

The upload manager (the tool that does the uploading) checks native Windows settings for proxy information. To prevent file uploads from going through the proxy, you need to set up a bypass list in the proxy settings for Windows. Complete the following steps:

Open the command prompt as an administrator.
For 64-bit Windows systems, open C:\Windows\sysWOW64\netsh.exe from the command prompt. For 32-bit Windows systems, use C:\Windows\system32\netsh.exe).
In the netsh.exe terminal, type winhttp and hit enter.
In the winhttp terminal, type set proxy proxy-server="<proxyURL:port>" bypass-list="<IEM-Server-address><other-addresses>;...".
To verify whether the bypass list was updated, you can type the command show proxy in the winhttp terminal to see whether your bypass list setting was set.

For more information about proxy settings, see the Microsoft TechNet documentation at https://technet.microsoft.com/en-us/library/Cc731131%28WS.10%29.aspx.

Why are my SPB tasks not becoming relevant?: To deploy SPB package types, you must first run the 'Deploy SIE' task from the Client Manager for TCM site on your endpoints. For more information about working with SPB package types, see the Supported package types section.

How do I know which actions are associated with the Manage Application Management Groups dashboard?: Actions that are created with the Manage Application Management Groups dashboard have titles with the following format: SWD AMG Action: title_of_the_originating_task.

When I deploy an Application Management Group, why do I get an error that tells me the computer group exists? What do I do?: Deploying an Application Management Group creates an automatic computer group for that Application Management Group. During the stop process, you might receive a dialog request to delete the computer group. If you click cancel on this request, the group is not deleted. The next time that you attempt to deploy the Application Management Group, you will see an error that tells you that the computer group exists. To work around the error, delete the computer group and then deploy the Application Management Group again.

What do I do if I get a different error when I attempt to deploy an Application Management Group?

If you encounter a problem when you deploy an Application Management Group, complete the following steps:

Stop the Application Management Group to put it in a "Not Deployed" state.
Delete the corresponding computer group for that Application Management Group.
Deploy the Application Management Group again.

Why are my Application Management Group actions not showing in the Client Dashboard?

If you encounter a problem with the Client Dashboard, complete the following steps:

Check that the client is subscribed to the Application Management Group custom site.
Check that the client is a member of at least one of the targets that are listed in the Application Management Group.
Check that there is an automatic computer group for that Application Management Group in the custom site. If it is not there, stop the Application Management Group and deploy again.
Check that the ID referenced by the action matches the ID of the corresponding computer group in the custom site. If the IDs do not match, do the following steps:
1. Stop the Application Management Group.
2. Delete the corresponding computer group in the custom site.
3. Deploy the Application Management Group again.
Check that the originating task is relevant on the client.

The Manage Software Distribution Packages dashboard reports that my files are still uploading, but the uploads cannot take this long. How do I debug this issue?

Click Refresh from the dashboard to see if the uploading status goes away.
Check to see if the files are actually on the server. The files are stored on the BigFix server in <path_to_TEM_Server_directory>\wwwrootbes\Uploads\<sha1_of_the_file>. The default path is C:\Program Files\BigFix Enterprise\BES Server\wwwrootbes\Uploads\<sha1_of_the_file>.
If the files are not there, check the disk space on the server and try uploading the files again.
If the files are there, check if the Upload Maintenance Service is running. The Upload Maintenance Service is responsible for detecting that the uploads have completed and is responsible for changing the file status from "Uploading" to "Complete". To verify that this service is running, complete the following steps:
1. Open the Windows Task Manager.
2. View the running processes. The Upload Maintenance Service is shown under processes as uploadmaintenanceservice.exe.
3. If you do not see this process running, ensure that the BES Plugin service and the Upload Maintenance Service are installed. The installation tasks for these two services can be found in Systems Lifecycle > Software Distribution > Setup > Install Server Tools.
The Upload Maintenance Service log files are in <path_to_TEM_server_directory>/Applications/Logs. By default, the path is C:\Program Files\BigFix Enterprise\BES Server\Applications\Logs.
Check the Upload Manager log file that is in <Windows temp>\SoftwareDistributionLogs\Uploadmanager.

I removed a computer group as a target from a deployed Application Management Group. Then, I resynchronized the Application Management Group. Why are the actions from this Application Management Group still relevant for computers from the removed computer group?: During resynchronization, the existing automatic computer group for the Application Management Group is updated with the new listing of computer group targets. Occasionally, the client receives the action before its computer group information is updated. To avoid this issue, stop and redeploy the Application Management Group whenever a computer group is removed from a deployed Application Management Group.

Where can I find the Manage Software Distribution dashboard debug log?

Follow the steps to turn on the debug mode for the dashboard.

Click the Manage Software Distribution dashboard and press ALT+CTRL+SHIFT+D. The Debug Settings window opens.
Select the Track function calls in Diagnostic Panel check box.
In the Log Settings section, move the slider for Levels to Include to Debug.
Close the Debug Settings window.
Press Ctrl+F5 to reload the dashboard.
When the error message is displayed, press Alt+Ctrl+Shift+D again.
Click View Dashboard Log.

I am seeing duplicate Application Management Groups-related actions for master operators. What do I do?

Complete the following steps:

From the Manage Application Management Groups dashboard, click the Settings icon.
Click Clear AMG Action Cache.

Note: The cache must be cleared if a master operator deployed an Application Management Group before Software Distribution site version 35.

How do I create an offer for the self service portal?: To create an offer that becomes available in the self service portal, you must add a Portal Offer task to an Application Management Group.

I deployed an Application Management Group that contained portal offers. Then, I stopped the deployment. Why are the software offers still showing in the Self Service Portal. Is this behavior expected?: The list of software offers for a computer is generated once for each user login session. This session is considered as the time that a user is logged on to the portal. The software list does not update to incorporate changes in Application Management Group status until the user logs out and logs back in again.

Where can I find the logs for the Self Service Portal and Trusted Service Provider?: The Self Service Portal and Trusted Service Provider log files are in <path_to_TEM_Server_directory>\MDM Provider\log. The default path is C:\Program Files\BigFix Enterprise\Management Extender\MDM Provider\log.

I changed my Trusted Service Provider password, and now the endpoint user cannot log in to the Self Service Portal. What do I do?: Update the password in the tsp-config.yaml file, which can be found in <path_to_TEM_Server_directory>\MDM Provider\config. The default path is C:\Program Files\BigFix Enterprise\Management Extender\MDM Provider\config.

I encountered an issue with the Self Service Portal. Where can I get the information for troubleshooting?: Check Analysis 19: Software Distribution Self Service Portal to view information about the portal.

Is there a way to check if the Trusted Service Provider and the Self Service Portal were successfully configured?

For the Trusted Service Provider

Use the Trusted Service Provider diagnostics page to check if the Trusted Service Provider was successfully configured.
This page examines SSL certificates, and attempts to connect to the LDAP and to the BigFix. It also attempts to perform a sample relevance query.
The URL syntax for the Trusted Service Provider diagnostic page is as follows: https://<your_host_name>/diagnostics
Check the configuration file.
1. Open the tsp-config.yaml file, which can be found in <path_to_TEM_Server_directory>\MDM Provider\config. The default path is C:\Program Files\BigFix Enterprise\Management Extender\MDM Provider\config.
2. Reconfigure the Trusted Service Provider if any one of the following fields is missing:
  - :organization_name:
  - :hostname:
  - :ldap_admin_user:
  - :ldap_admin_pass:
  - :wr_path:
  - :wr_user:
  - :wr_pass:
  - :tem_user:
  - :tem_pass:
  - :tem_server:

For the Self Service Portal

Use the Self Service Portal diagnostics page to check if the Self Service Portal was successfully configured.
This page examines the connection to the Trusted Services Provider, which is required for authenticated enrollment.
The URL syntax for the Self Service Portal diagnostic page is as follows: https://<your_host_name>/ssp/diagnostics
Check the configuration file.
1. Open the ssp-config.yaml file, which can be found in <path_to_TEM_Server_directory>\MDM Provider\config. The default path is C:\Program Files\BigFix Enterprise\Management Extender\MDM Provider\config.
2. Reconfigure the Self Service Portal if any one of the following fields is missing:
  - :install_mode:
  - :organization_name:
  - :tsp_host:
  - :tsp_port:
  - :hostname:

Where are the PIN and registration information stored?

The information can be found in the following registry keys.

For Windows computers

PIN for Registration

HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\SSP_PIN

Registered Users

HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\SSP_Green

Blocked Users

HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\SSP_Red
For Mac, Linux, AIX, and Solaris computers

PIN for Registration

/var/opt/BESClient/SSP_PIN

Registered Users

/var/opt/BESClient/__BESData/SSP_Green

Blocked Users

/var/opt/BESClient/__BESData/SSP_Red

The user reports that the software installation from the Self Service Portal failed. The failure existed when I deleted a task from a package after it was deployed in an Application Management. How do I fix this issue?: The task does not exist, so it cannot be issued. It also is not shown in the actions view of the console. You need to find and stop all Application Management Groups that have a reference to the deleted task. Then, delete the reference to the no longer existent task, and redeploy those Application Management Groups.

Will unsubscribing to the Software Distribution site remove the Self Service Portal?: No, unsubscribing to the Software Distribution site does not remove the Self Service Portal. For more information about removing the Self Service Portal, see Uninstalling the Self Service Portal.

I got an error that says "Could not connect to Trusted Services Provider" when I tried logging in to the Self Service Portal. What do I do?

This error usually happens when the Self Service Portal is removed and installed back again. If you get this error, complete the following steps:

Go to the Self Service Portal diagnostics page at https://<your_host_name>/ssp/diagnostics.
If the TSP connection test and TSP root CA shows as "Connection refused", delete the certificate file for the Self Service Portal. You can find the certificate file in <path_to_TEM_server_directory>\BigFix Enterprise\Management Extender\MDM Providers\MDMExtender\private\ssp\trusted_certs\<your_certificate_file>.pem
Note: The certificate file is automatically generated the next time you log in to the Self Service Portal.

I have configured the Self Service Portal, but the URL cannot be found.: Software Distribution and Mobile Device Management share the SSP components. You might encounter this issue if you unsubscribed from the Mobile Device Management site without removing Mobile Device Management specific extenders. To fix this issue, re-subscribe to the Mobile Device Management site and remove its extenders properly before unsubscribing to the site.

I deleted a software distribution task, but its packages in the SHA1 folder that is stored in the C:\Program Files\BigFix Enterprise\BES Server\wwwrootbes\Uploads folder are not being deleted automatically. Why is that and what must I do?

If you used the Software Distribution Wizard to create the task, no automatic cleanup occurs. This behavior is expected of the wizard. You must locate and delete the files or folders from the repository manually. Any cleanup of payloads must be done manually. It is suggested that you use the Manage Software Distribution dashboard instead of the Software Distribution Wizard to create software distribution tasks.

If you used the Manage Software Distribution dashboard to create the task, and yet its packages are not automatically deleted upon deleting of the task, ensure that you have:

Deleted the files from the software distribution package
Deleted all tasks that reference the file
Stopped all open actions that reference the file

If any of these measures were not taken, the file and sha1 folder remains.

Note: The upload maintenance service for software distribution does the actual cleanup. To check the cleanup activity, see the log file that is found at C:\Program Files (x86)\BigFix Enterprise\BES Server\Applications\Logs\swd_uploadmaintenanceservice.log.

The installation of .pkg files on Mac endpoints was successful, but the task remains relevant. Why is that? How do I verify whether the software installation was truly successful?: The task remains relevant because the inspector to check whether the Mac .pkg files are installed on an endpoint is not yet available. For information on how to manually check whether the package was deployed successfully, see Package type verification.
Note: Reinstalling a .pkg file does not cause any issues.

Can I easily migrate created software packages from one BigFix Deployment to another?: Yes. Software packages can now easily be exported and imported from the Manage Software Distribution dashboard. For more information about this feature, see Import and export packages.

Why does the status of a software deploy action not accurately reflect the installation status of the deployed application?: Software distribution is unable to determine whether a software installation was successful in many cases. The issues that are related with the actual package installation are outside of the control of Software Distribution. It runs the package, but cannot track the result of that execution.

Why are Solaris .pkg files failing to install?: Solaris .pkg files may fail due to conflicts. The default option is to quit when encountering a conflict. If you would like to ignore conflicts and proceed with the installation, you can edit the Actionscript to change these values. These three settings, conflict, idepend, and rdepend, are set to 'quit' by default. Change 'quit' to 'nocheck' and then rerun the task.

I created an App-V 5.0 client task, but the task is not becoming relevant for the endpoints.

Ensure that the App-V 5.0 clients meet the following prerequisites:

Microsoft .NET Framework 4
Windows Powershell 3.0
Visual C++ 2010 Redistributable Package (x86)
Download and install KB2533623 or later

For more information, see the following Microsoft documentation at http://technet.microsoft.com/en-us/library/jj713458.aspx.

I added preinstallation and postinstallation commands, but the commands failed: Ensure that the syntax is correct. The dashboard does not check the validity of the actionscript, batch script, or shell script commands. These script types are just wrappers so you do not need to directly edit the actionscript.

Import or export is taking too long. What might be causing this delay?: Importing and exporting large packages, both in size and quantity, might take a while to process due to the large amount of data. Check the logs to see if the process stopped running. If so, restart the process.

What are the possible causes for the export and import features to fail?

To find out why export or import failed, check the logs from the console system at <Windows Temp>\SoftwareDistributionLogs\<Export or Import>.

Here are some possible causes of failure:

File or Fixlet name is too long.: The export and import processes might fail when an uploaded installation file or Fixlet has a file name that is over 100 characters.; To fix this issue, rename the file or Fixlet name in the console with a shorter name. Renaming the file names in the compressed file is not advisable.

Resource is lock.: This issue is caused when the import or export process was ended prematurely. An example scenario is when you leave the dashboard when the export or import process is still in progress.; To fix this issue, restart the BigFix console to clear the console cache or restart the system.

Cannot download the zip or unzip utility.: To process exports and imports, the dashboard needs to download a zip or unzip utility if it has not been previously downloaded. If the download fails, a possible issue might be due to unconfigured proxy settings. The dashboard does not use the same proxy as the rest of the console. To fix this issue, configure the proxy setting using Internet Explorer's Internet Options.

A package failed to export. The export log has an entry that says "Unexpected HTTP response: 404 Not Found". What do I do?

The file failed to export because it cannot be found on the server. A file can go missing if it was deleted in the BigFix server or if it was originally uploaded under a different file name.

To fix this issue, complete the following steps:

Check whether the file was previously uploaded to the BigFix server in the following location <IEM Server directory>/wwwrootbes/Uploads/<sha1 of file>. If the sha1 folder exists, delete that sha1 folder.
Refresh the Manage Software Distribution dashboard. An X mark displays beside the missing file. It might take several minutes before the change is reflected in the dashboard.
Upload the missing file again.

I specified the file's URL but the file failed to download. How can I troubleshoot?

There are a couple of ways to troubleshoot:

Verify if the file URL is correct.
Check if you can download the file in a browser.
Check your proxy settings in Internet Explorer's Internet options. The dashboard does not use the same proxy as the rest of the console.
Check the download logs, which can found at <Windows Temp>\SoftwareDistributionLogs\Downloads.