January 2020 Windows Security Patches - Login Agent Broken

[BrentonWestwood]

​All,

The implementation of this month's set of Windows Security Updates caused our Login Process to not work.   Has anyone else experienced this issue since patching this month?:   A call to the Login object's Log In action returned with an error of ""ERROR: Exception : : The operation has timed out.".    We tried repairs of the Login Agent, start - stops, reboots, event log review of resource and server, you name it, and no luck fixing the issue.   We did end up getting things to work again by uninstalling Blue Prism and the Login Agent on the resources, rebooting, installing Blue Prism and the Login Agent again, rebooting, logging back in, ran the Logout action from the control room of a client machine, and then tried the Login process from the Control Room on a resource and it worked at that point.    That was the sequence that worked for us.   This seems to detail the patch related information that likely caused the issue:  https://cyber.dhs.gov/ed/20-02/.

------------------------------
Brenton Westwood
Systems Analyst
Southern Company
------------------------------

[PhilipTrovato]

Applied Jan Updates to a "Beta" Group this weekend and all is well. I know one reason you get the "The operation has timed out." error is when the Security policies are not set or got stomped on. And i think installing the login agent may attempt to set these, but could be wrong about that.

I came across a similar situation when upgrading from 6.4 to 6.6. May apply to you as well (Group policy related).

After installing 6.6 and rebooting I would then receive the "timeout error". Rebooting did not resolve. 

Even though we have a AD OU with all are BP Assets in, and a Group policy which sets the Security Policy. The 6.6 install somehow messed up the existing policy or reg keys. If i waited several hours, group policy would update and all would be well. So It takes time to apply and a reboot does not force it to apply. I cant wait  very long and ended up forcing policy via a powershell script.

Something Like Below
$computers = @(Get-Content "C:\Scripts\Restart Computers\restart_pcs.txt")
$computers | ForEach-Object -Process {Invoke-GPUpdate -Computer $_ -RandomDelayInMinutes 0 -Force}

Security Policies - https://portal.blueprism.com/system/files/documents/v6%20User%20Guide%20-%20Login%20Agent_0_1.pdf

You can also try "Enable logging for Login Agent" but BP support may need to help read the logs.

------------------------------
Philip Trovato
------------------------------