ZENworks 2017 Update 3 Troubleshooting Policy Deployment

August 2018

This document provides troubleshooting guidelines for common problems related to deployment of policies in a ZENworks system. If, after completing the troubleshooting steps, the problem is not resolved, please contact Micro Focus Technical Support for additional help.

Section 1.0, A policy is not displaying on a device
Section 2.0, Security policies and security settings fail after changing zone to intermediate CA
Section 3.0, Legal Notice

1.0 A policy is not displaying on a device

Verify that the policy is published:
1. In ZENworks Control Center, click Policies to display the Policies list.
2. Locate the bundle in the Policies list:
3. If the Version column displays a version number (for example, 0), the policy is published. If it displays Sandbox, the policy is not published. Click the policy, then click the Publish button next to the Displayed Version field.
  
  NOTE:If the policy is not showing up on a test device or for a test user, make sure that the Sandbox version is the active version. Only Sandbox policies can be deployed to test devices and users.
If the policy is user assigned, check the following:
- Is the user logged in to ZENworks on the device?
- Has the device been refreshed (ZENworks icon > Refresh) since the policy assignment was made and the user logged in?
- Is user authentication configured correctly? For troubleshooting help, see ZENworks 2017 Update 3Troubleshooting Authentication.
If the policy is device assigned, check the following:
- Has the device been refreshed (ZENworks icon > Refresh) since the policy assignment was made?
If the policy assignment is through a device group or folder, check the following:
- Is the device is a member of the group or folder?
- If the policy assignment is to a dynamic group, has the group refreshed after the device was added to the group? To refresh a dynamic group, select the check box in front of the group in the Devices list, then click Action > Update Group Membership.
If the policy assignment is through a user group or folder, make sure that the user is a member of the group or folder.
Click the policy to display its properties, then check the following:
- System requirements: Have system requirements been defined that cause the policy to not show up on the device. To check, click the Requirements tab and compare the defined system requirements against the device.
- Enabled: Is the policy enabled? Disabled policies are not applied to devices. To check, click the Summary tab and verify that the Enabled setting is Yes.
Ensure that DNS is working correctly by performing an nslookup (on the device) of the IP address or DNS name of the Primary or Satellite Server from which the device receives its policy content. You can run zac zc -l on the device to see the IP addresses and DNS names of the content servers.
On the device, run the following command at a console prompt to reestablish trust between the device and the ZENworks servers:

zac retr

2.0 Security policies and security settings fail after changing zone to intermediate CA

Issue: After changing a zone certificate authority to an intermediate CA, security policies or security settings fail, displaying the following message in the Event Viewer:

“ZESMPolicyHandler.ZESMSETTINGS_DESERIALZATION_FAILED: Unable to deserialize “Location” settings data. Please contact Technical Services.”

NOTE:For other error messages related to this issue, reference TID 7017785 at Knowledgebase.

This issue is resolved in security policies and security settings configured in devices with ZENworks 11 SP4 or later versions. However, for security policies and settings configured in devices with an earlier version than 11.4, the following applies:

The zone CA is changed to an intermediate CA after the 11.3.x device is updated to an 11.4 or later ZENworks version.

No action required.
The zone CA is changed to an intermediate CA before the 11.3.x device is updated to an 11.4 or later ZENworks version:

Action: Make a small change to the security policy or security settings in the updated device, as applicable, and save the changes. The changes can then be reverted.
The zone CA is changed to an intermediate CA, but the 11.3.x device is not updated to an 11.4 or later ZENworks version.

Action: Update the device to an 11.4 or later version of ZENworks, and perform the action from the previous bullet comment.

NOTE:If the 11.3.x device cannot be updated to ZENworks 11.4 or a later version, please contact Micro Focus Technical Support.

3.0 Legal Notice

For information about legal notices, trademarks, disclaimers, warranties, export and other use restrictions, U.S. Government rights, patent policy, and FIPS compliance, see https://www.novell.com/company/legal/.