TrueSight Server Automation (TSSA): Windows patch analysis is failing with error - STDERR: Error: Encountered error 0x800710dd initializing scanner.

Knowledge Article

Article Number

000352796

Old Article Number

000155145

Article Type

Solutions to a Product Problem

Title

TrueSight Server Automation (TSSA): Windows patch analysis is failing with error - STDERR: Error: Encountered error 0x800710dd initializing scanner.

Summary

Error STDERR: Error: Encountered error 0x800710dd initializing scanner - The operation identifier is not valid.Possible cause is: Signature verification certificates may not have been installed on this server. Re-run the patching job in debug mode and check log file AnalysisTrace.log for further details. Error: Unable to initialize analysis engine.Error: Analysis failed.

Product

TrueSight Server Automation

Component

TrueSight Server Automation

Applies to

TSSA version neutral

Problem

Windows patch analysis job fails with the following error:

Target OS: Windows server 2012, 2016, 2019 & 2022

<job run log>
Error STDERR: Error: Encountered error 0x800710dd initializing scanner - The operation identifier is not valid.Possible cause is: Signature verification certificates may not have been installed on this server. Re-run the patching job in debug mode and check log file AnalysisTrace.log for further details. Error: Unable to initialize analysis engine.Error: Analysis failed.
Info Analyzer execution complete on server: <target> , exitCode: -3
...

User-added image

The error can also be seen in Snapshot jobs.

Snapshot of target part 'HotFixes' of asset class type 'Windows Hotfix List' failed on target 'xxxxx': Error executing Analyzer: ExitCode = -3 on the host 'xxxxx':
Error: Encountered error 0x800710dd initializing scanner - The operation identifier is not valid..

And Live browsing the device fails with the following error:

Error BLPAT3206 occurs during patch analysis on Domain Controller servers – "No Route to Host."

Cause

Missing certain PKI certificates on the Windows Target Server. New Shavlik content is SHA2-signed, whose signature verification requires certain PKI certificates to be present on the target.

Solution

This 9.3 SDK is SHA-2 signed and the error implies that certain required certificates are not present on the Target Server.

A TSSA Compliance Template with remediation has been developed by BMC to automatically detect and resolve the issue with certificates.

The Component Template zip file is attached to this Knowledge Article and contains a Readme.txt file with full instructions in importing the Component Template and running the required Discovery and Compliance.

https://docs.bmc.com/docs//serverautomation/231/notification-of-a-critical-issue-with-the-windows-patch-analysis-and-snapshot-jobs-1205537152.html

Note: If the Remediation is applied and the compliance job marks a Target Server as compliant, but the Patch Analysis Job still fails with the same error, please re-run the Windows Patch Catalog Update Job and then rerun the Patch Analysis.

Update 05/17/2023: Attached zip file was updated to resolve a minor issue in the detection logic. The updated zip file is called 'WinPatchCerts_Solution_May17_2023.zip'

Update 2/Dec/2024: The discover rule definition of the attached template needs to be updated to include the latest RSCD agent (24.* or above) for the compliance job to work against targets with the latest RSCD agent

Attachment(s):

WinPatchCerts_Solution_May17_2023