Standalone System Update Tool for updating ZCM Agents to 11.2




ZENworks Agent Standalone System Update - is a script based solution for standalone method to apply the ZCM system update(SU) on the Windows Agent to update to the ZCM 11.2 version.

This update can be applied on Windows managed devices only running an older ZCM agent version to update to 11.2.0. This tool prepared as an alternative derived scripted approach and can be used to update ZCM full agent only devices by the offline method. Sometimes even devices with the assigned System update are not able to download and apply the update on specific managed devices via standard update process using the ZCM Server, due to either the agent service is unresponsive, hung, or cache is corrupted.

The tool comprises of two scripts and Update commands XMLs:

  1. extractSU-Win-11.2.bat - This script is used to extract the Windows Agent System Update content in a expected structure from the mounted ZENworks-11.2 (SP2) media folder.

  • ZASSU-Win-11.2.bat - This standalone update script needs to be executed on the Windows Agent (32-bit/64-bit) to apply the 11.2 update, by using the system updates extracted using the previous extract script.

  • update_commandsXX.xml - These are server generated system update command XMLs, used to apply SU commands on the corresponding 32-bit or 64-bit Windows agent, by calling ZENUpdater from the Standalone Script.


Applicable to Windows Managed Device running ZCM agent version 10.3.x or 11.x version below 11.2.0 ( 11 SP2 )


  • Extract the 11.2 Agent System Update Content by using the extractSU-Win-11.2.bat script above, verify the contents size and files in the folder.

    PS: Verify that the total system update content files extracted under 'su_base' folder should be 90 and size of update is nearly 289 MB.

  • Copy the generated "su_base" folder to the %ZENWORKS_HOME% folder on the managed device.


    Note: The "su_base" folder should contain the update-guid folder 5011020000fc50000000002012030723, having system update content inside which was extracted using the script 1 above. It also contains SU command files for Windows Agent: update_commands32.xml and update_commands64.xml. It is used for updating 32-bit and 64-bit Windows agent.

  • Copy in the batch script ZASSU-Win-11.2.bat to %ZENWORKS_HOME% path, update the value of SERVERURI to the ZCM server IP or DNS, to ensure updating of the SU progress and status message. For example:

  • Run the batch script ZASSU-Win-11.2.bat provided, from the DOS command prompt to trigger the standalone update.

    Note: This script must be run on Windows Version 6 as Elevated Command Prompt with Administrator Privileges. Open the DOS command prompt from the Start menu to "Run as administrator" option.

  • Force Reboot is suppressed in the script, hence a notification dialog shown to Allow or Cancel reboot after the Windows Agent update to 11.2 is completed successfully. In this case a manual reboot is required to start the agent services back. See FAQs below for instructions on setting force/auto reboot in the script.

  • Cleanup the "su_base" folder from the device after the update is completed as cleanup is disabled by default. Uncomment the below line in the script by removing "REM", to clean it automatically.

    REM rd /q /s %SU_BASEDIR%

The steps described in the update ZASSU-Win-11.2.bat script should be run on the managed device solely based on user choice and not supported/tested by Novell.


  1. How to track update status of devices updated using standalone SU via ZCC?

    You can monitor the progress status locally on ZENUpdateWatcher in the taskbar. If the Update is already assigned to devices from ZCC (future date), then set the value for SERVERURI in the script:


    This allows to update its progress / status in ZCC periodically under:

    ZCC > Configuration > System updates > Deploying System Updates and selecting the pending devices of the 11.2 deployed System Updates.

    ZCC > Devices > device object for section "Assigned System Updates"

    After the registered device is rebooted and refreshed, the version is updated on the ZCM Server

  • How to deploy the Standalone SU content to the managed devices before triggering the script?

    You can deploy the SU to the Windows managed devices using either Bundle or manually copying the SU packages on the agent device and then triggering offline update.

  • When to use the standalone method of updating your managed devices?

    In case the standard method of applying SU does not trigger on any specific devices, due to agent in inconsistent/unresponsive state and cannot be recovered to get the new update, or it cannot communicate with the server for content download, or if there is any specific restriction in the device (Deep Freeze) which prevents applying the update any specific time, or remote location devices need to apply offline update.

  • How to know if the Standalone SU has been updated successfully?

    You can verify this by viewing the system-update.log file locally under the logs/system-update/5011020000fc50000000002012030723/ folder or checking the version of Agent Modules at ZENworks Icon. On the server - Checking the version of devices object at ZCC, under its summary page.

  • How to verify/know if the Standalone SU has updated all the required files and version on device?

    There is no file verifier for Agent to check the consistency of agent files. If Agent Version is updated during the system-update process, the update should be fine. Running the MSIList.exe tool from (Setup Page > Administrative tools) ) on the device, allows you to check the installed MSI versions if needed.

  • Is there a logging to know in case standalone SU fails to update?

    The logs for system update are stored into the same logs/system-update-guid folder, which is used by the standard system update process.

  • What are the supported versions/platforms where this can be applied?

    This Update is applicable on any Windows device running ZCM Agent 10.3.x or pre 11.2 version for 32-bit/64-bit architecture to update it to 11.2.0

  • What are the pros/cons of using this against the original method of SU via ZCM Server?

    You can perform offline update if your managed device is unable to communicate to the server to download SU over the network. If assigned SU cannot trigger the update on some adhoc devices, whose agent service is inactive/crashed/unresponsive.

  • How to obtain the update contents for applying the agent standalone system update?

    This is the most important part of the pre-requisite to get the required SU content for any version of the update. The agent update packages can be collected from the media/ update source into a folder named as update-guid as one time activity using the script extractSU-Win-11.2.bat.

  • How this standalone SU works and is it different/derived from existing SU?

    The standalone SU works the same way as the standard System update on the agent but it does not depend on server for fetching the system-update content and update commands, based on its platform and architecture. The update content/packages is made locally available on the device as offline process and the update package path is updated in the control file "update_commandsXX.xml". This xml file containing the update commands gets generated on the agent based on its platform(Windows/Linux) and architecture(x86/x86_64) as per System update response sent from the ZCM Server and is locally made available on the devices.
    Note : The tool posted as zip contains this update_commandsXX.xml for corresponding 32bit and 64bit agents.
    When the ZENUpdater.exe is launched locally with appropriate options, it reads the arch specific control file, having all its SU commands and the location of packages to update for the command, and finally triggers the update process locally to update with existing options configured. Once the update is completed the details are logged and the required files are updated as part of script to reflect the device state.

  • How to control Reboot options when applying standalone update?

    You can modify the script to change the reboot option as an argument to ZENUpdater.exe in the script. By Default, automatic reboot is suppressed in the script with "-s" option and User is prompted to Allow/Cancel Reboot at the end of system update. You can force reboot by replacing this with "-r" option.

  • Can Devices updated with Standalone SU, receive the next assigned ZCM updates through the standard process (ZCC)?

    Yes, as long as the Standalone update has been applied successfully on the device with the latest version updated and the agent is communicating with the server properly. Additionally you can verify the SU guids entry in the files 'updates-completed' and 'updates-inprogress' under the system folder %zenworks_home%\works\system-update.

  • Can the standalone system update be used if selective Agent components are enabled/installed on the managed device?

    Standalone SU performs full Agent update - for agent having all installed components. So it is not recommended to run this, if devices have only selective Component installed on them. However, if agent has selective components installed then SU first updates all the components initially, and after the update completes, the non-enabled components are removed on the next device refresh from the Server, based on configured settings for "ZENworks Agent" features under ZCC and activation status of the Products.

Known issues:

  1. Sometimes during system update from Script, if launching of ZENUpdater crashes then try to restart agent service, and attempt the update again.

  • The default update_commands.xml does not allow standalone system update for Agent running on Windows Server due to ZESM/FDE Update commands. To allow updating ZCM Agent running on Windows Server (32-Bit/64-Bit), perform the following steps:

    • Rename the update_commands32_WinServer.xml to update_commands32.xml and replace it under su_base folder on 32-Bit Windows Server before running Standalone SU Script.

  • Rename the update_commands64_WinServer.xml to update_commands64.xml and replace it under su_base folder on 64-Bit Windows Server before running Standalone SU Script.


Usage: extractSU-Win-11.2.bat <Full_Path_to_11.2_Media_Folder>

@echo off
REM ======================================================================================================
REM Title: Extract System Update Content from 11.2 Media
REM Author: tarvindkumar[at]novell[dot]com
REM Description: This script is used to create the 11.2 System update content to be used for updating the agent
REM Note : For Windows Version 6 , this script must be run as Elevated Command Prompt with Administrator Privileges
REM For Windows Version 6 , this script must be run as Elevated Command Prompt with Administrator Privileges
REM ======================================================================================================

If "%MEDIA_PATH%"=="" (Goto MISSING_PATH) else ( Goto RUN )
echo ----------------------------------------------------
echo Missing Script argument Path_to_11.2_Media_Folder
echo Usage: %0 "Path_to_11.2_Media_Folder"
echo ----------------------------------------------------
Exit /B

echo Running script %0 with 11.2.0 (11SP2) media path : %1
md su_base && echo Created "su_base" folder under : "�%"

set SU_BASE_PATH=�%\su_base
cd "%SU_BASE_PATH%" && md 5011020000fc50000000002012030723 && echo Created UPDATE_GUID folder : 5011020000fc50000000002012030723
cd ..
Set DEST="%SU_BASE_PATH%\5011020000fc50000000002012030723"
Set SRC="%MEDIA_PATH%\Common"
echo Beginning Copying files from SOURCE folder: [%MEDIA_PATH%] to DESTINATION folder : [�ST%]

Copy �%\update_commands*.xml %SU_BASE_PATH%

echo ======================== Copying SU files from 11.2 Media folder =================================="

Copy %SRC%\systemupdate\ZENUpdater.exe �ST%
Copy %SRC%\systemupdate\ZENUpdateWatcher.exe �ST%
Copy %SRC%\systemupdate\ZENUpdater.jar �ST%
Copy %SRC%\systemupdate\CASARegistryChange-Updater.exe �ST%
Copy %SRC%\systemupdate\ZENUpdateWatcher_* �ST%
Copy %SRC%\systemupdate\ndrec.tkb �ST%
Copy %SRC%\include\setup.exe �ST%

echo ======================== Copying MSIs from 11.2 Media folder ====================================="

Copy %SRC%\msi\authtokenclient* �ST%
Copy %SRC%\msi\CASA.* �ST%
Copy %SRC%\msi\novell-zenworks-action* �ST%
Copy %SRC%\msi\novell-zenworks-agent-help* �ST%
Copy %SRC%\msi\novell-zenworks-assetmanagementmodule* �ST%
Copy %SRC%\msi\novell-zenworks-auth-satellite-server* �ST%
Copy %SRC%\msi\novell-zenworks-bundle-* �ST%
Copy %SRC%\msi\novell-zenworks-content-distribution-point* �ST%
Copy %SRC%\msi\novell-zenworks-dlu-policyhandlers* �ST%
Copy %SRC%\msi\novell-zenworks-extnlibraries-* �ST%
Copy %SRC%\msi\novell-zenworks-fde- �ST%
Copy %SRC%\msi\novell-zenworks-fde-api-* �ST%
Copy %SRC%\msi\novell-zenworks-fde-sec-* �ST%
Copy %SRC%\msi\novell-zenworks-gp-policyhandlers-* �ST%
Copy %SRC%\msi\novell-zenworks-image-management-* �ST%
Copy %SRC%\msi\novell-zenworks-imaging-server-* �ST%
Copy %SRC%\msi\novell-zenworks-inventory- �ST%
Copy %SRC%\msi\novell-zenworks-inventory-langs-client- �ST%
Copy %SRC%\msi\novell-zenworks-patch- �ST%

Copy %SRC%\msi\novell-zenworks-patch-langs-client- �ST%
Copy %SRC%\msi\novell-zenworks-patch-management-agent- �ST%
Copy %SRC%\msi\novell-zenworks-policy* �ST%
Copy %SRC%\msi\novell-zenworks-primary-agent-* �ST%
Copy %SRC%\msi\novell-zenworks-remotemanagement-* �ST%
Copy %SRC%\msi\novell-zenworks-rm-md-core-* �ST%
Copy %SRC%\msi\novell-zenworks-status-collection-point* �ST%
Copy %SRC%\msi\novell-zenworks-system-update- �ST%
Copy %SRC%\msi\novell-zenworks-uninstall-* �ST%
Copy %SRC%\msi\novell-zenworks-usermanagement-* �ST%
Copy %SRC%\msi\novell-zenworks-vc90-redist* �ST%
Copy %SRC%\msi\novell-zenworks-version- �ST%
Copy %SRC%\msi\novell-zenworks-windows-desktop-* �ST%
Copy %SRC%\msi\novell-zenworks-winproxy* �ST%
Copy %SRC%\msi\novell-zenworks-zecp-policyhandlers-* �ST%
Copy %SRC%\msi\novell-zenworks-zencore-agent-* �ST%
Copy %SRC%\msi\novell-zenworks-zennotifyicon-* �ST%
Copy %SRC%\msi\novell-zenworks-zesm- �ST%
Copy %SRC%\msi\novell-zenworks-zesm-extn- �ST%
Copy %SRC%\msi\novell-zenworks-zesmui-langs-client* �ST%
Copy %SRC%\msi\novell-zenworks-zisdservice* �ST%
Copy %SRC%\msi\novell-zenworks-ziswin* �ST%

echo Copying files Completed . Verify the total files present to under %SU_BASE_PATH% folder should be 90.

exit /B

Usage: ZASSU-Win-11.2.bat

@echo off
REM ======================================================================================================
REM Title: ZENworks Agent Standalone SU script
REM Author: tarvindkumar[at]novell[dot]com
REM Description: This Script will perform standalone System Update for Windows Agent 32bit/64bit to 11.2.0
REM Environment: ZCM 10.3.4 / 11.x Windows Managed Devices
REM This script must be run on Windows Version 6 as Elevated Command Prompt with Administrator Privileges
REM ZCM11.2 Update-GUID : 5011020000fc50000000002012030723
REM ======================================================================================================

REM Replace the below with IP or DNS or ZCM Server to update the status


Set UPDATE_UID=5011020000fc50000000002012030723
Set ZENWORKS_SULOGDIR="%ZENWORKS_HOME%\logs\system-update"
Set SU_XML=update_commands.xml

If NOT Exist "%ZENWORKS_HOME%"\version.txt (
echo ========= No ZENworks Agent Version exist. Check if ZCM Agent installed =========
Exit /B

REM Uncomment if Check required for Prequisite Version to which this update should apply. This is currently set to 11.0.0
REM Find /c /i "11.0.0" "%ZENWORKS_HOME%"\version.txt>NUL
REM If %ERRORLEVEL% EQU 0 ( @echo ========= System Update is Applicable to existing ZENworks Agent Version-11.0.0 ========= ) else (goto :NOTAPPLICABLE )

If NOT "%PROGFILES86ROOT%"=="" ( echo ========= Performing System Update on 64-bit Windows Agent ========= )
If "%PROGFILES86ROOT%"=="" ( echo ========= Performing System Update on 32-bit Windows Agent ========= )

IF EXIST "%programfiles(x86)%" (GOTO 64-Bit) ELSE (GOTO 32-Bit)

ECHO 32-Bit O/S detected. Setting Update Commands Control File.
Set SU_XML=update_commands32.xml

ECHO 64-Bit O/S detected
Set SU_XML=update_commands64.xml

If Exist %SU_BASEDIR% (echo %SU_BASEDIR% folder already exists) else ( mkdir %SU_BASEDIR% && echo %SU_BASEDIR% folder created. Ensure the SU content is available from extracted SU zip )
If Exist %SU_CONTENTDIR% (echo %SU_CONTENTDIR% is folder already present ) else ( GOTO :NO_CONTENTDIR )
If Exist %SU_BASEDIR%\%SU_XML% ( echo %SU_XML% control file exists) else ( GOTO :NO_CONTROLXML )


If NOT Exist %ZENWORKS_SULOGDIR% ( MkDir %ZENWORKS_SULOGDIR% && echo Created "system-update" folder created under "%ZENWORKS_HOME%"\logs )

If Exist %UPDATE_LOGDIR% ( Move %UPDATE_LOGDIR% %UPDATE_LOGDIR%_bak && echo Moved the existing %UPDATE_LOGDIR% folder) else ( MkDir %UPDATE_LOGDIR% && echo Log folder exists for the update "%UPDATE_UID%" )

If NOT Exist %ZENWORKS_SUWORKDIR% ( MkDir %ZENWORKS_SUWORKDIR% && echo Created "system-update" folder under %ZENWORKS_SUWORKDIR% )

If Exist %ZENWORKS_SUWORKDIR%\updates-inprocess.txt ( Goto UPDATE_INPROCESS ) else ( echo %UPDATE_UID% > %ZENWORKS_SUWORKDIR%\updates-inprocess.txt )

If Exist %UPDATE_LOGDIR% ( Copy %SU_BASEDIR%\%SU_XML% %UPDATE_LOGDIR% && echo Copying %SU_XML% file.. )

@echo off
tasklist /fi "imagename eq ZENUpdateWatcher.exe" 2>NUL | Find /I /N "ZENUpdateWatcher.exe">NUL
If "%ERRORLEVEL%"=="0" (
echo Process ZENUpdateWatcher.exe is already running, killing ...
taskkill /f /im ZENUpdateWatcher.exe 2> nul
If errorlevel 128 (echo SUCCESS: The process ZENUpdateWatcher.exe has been terminated.)

@echo off
tasklist /fi "imagename eq ZENUpdater.exe" 2>NUL | Find /I /N "ZENUpdater.exe">NUL

echo -----------------------------------------------------
echo Running SU Pre-Install Commands (Copying Content):
echo -----------------------------------------------------


echo -----------------------------------------------------------------
echo Running SU Install Commands ( Standalone System Update Started ) :
echo -----------------------------------------------------------------

If NOT Exist %UPDATE_LOGDIR%\system-update.log ( echo "Starting standalone System Update Process.."> %UPDATE_LOGDIR%\system-update.log )

echo 1. Starting ZENUpdateWatcher
If Exist "%ZENWORKS_BINDIR%\ZENUpdateWatcher.exe" (echo Launching ZENUpdateWatcher process .. ) else ( GOTO :NO_ZENUpdateWatcher)
Start /B "" "%ZENWORKS_BINDIR%"\ZENUpdateWatcher.exe -s -f %UPDATE_LOGDIR%\system-update.log

Set guid=type %ZENWORKS_CONFDIR%\DeviceGuid
For /F "usebackq" %%i IN (`%guid%`) DO Set DEVICEGUID=%%i

REM Set /p serveruri= <%ZENWORKS_CONFDIR%\initial-web-service
Set SERVERURI_SU=%SERVERURI%/zenworks-systemupdate/

echo Deviceguid : �VICEGUID% URI: %SERVERURI_SU%

echo 2. Starting ZENUpdater ( Triggering System Update )
If Exist "%ZENWORKS_BINDIR%\ZENUpdater.exe" (echo Launching ZENUpdater process.. System Update in Progress.. ) else ( GOTO :NO_ZENUpdater)

REM Launching ZENUpdater to start the update now.. To enable force-reboot change the "-s" below to "-r"

"%ZENWORKS_BINDIR%\ZENUpdater.exe" -w -v -c %UPDATE_LOGDIR%\%SU_XML% -g �VICEGUID% -u %SERVERURI_SU% -d 0 -s

If %ERRORLEVEL%==0 echo ZENUpdater Completed.

If Exist %ZENWORKS_SUWORKDIR%\updates-inprocess.txt ( Del %ZENWORKS_SUWORKDIR%\updates-inprocess.txt && echo updates-inprocess state cleared )
echo %UPDATE_UID% >> %ZENWORKS_SUWORKDIR%\updates-completed.txt


echo ZENWORKS_HOME environment variable is not defined.

echo -----------------------------------------------------------------------
echo Requires Reboot to complete the System Update. Reboot is Supressed now.
echo ----------------------------------------------------------------------

echo Missing %ZENWORKS_BINDIR%\ZENUpdateWatcher.exe, still Continuing with System Update.

echo Missing SU control file %SU_BASEDIR%\update_commandsXX.xml.

echo Missing %SU_CONTENTDIR% folder containing System Update Contents.

echo Update might be already in progress.
echo If no ZENUpdater process running, clean the existing %ZENWORKS_SUWORKDIR%\updates-inprocess.txt file to re-launch

echo Missing %ZENWORKS_BINDIR%\ZENUpdater.exe file.

echo Command failed! Aborting Update..

echo System Update is not applicable on existing ZCM Version. Please check the ZCM Agent Version .

echo -----------------------------------------------------
echo Exiting System Update..
echo -----------------------------------------------------
Exit /B

echo -----------------------------------------------------
echo System Update Completed Successfully.
echo -----------------------------------------------------

REM UnComment the below 2 lines to allow clean up of "su_base" folder after update.
REM echo Cleaning the SU content from "su_base" folder..
REM rd /q /s %SU_BASEDIR%

echo "Standalone System Update for 11.2.0 completed. Check system-update.log for the status, if update failed. "
Exit /B



How To-Best Practice
Comment List
  • I've found a different approach that can upgrade it to any version, even directly to 11.2.2:

    I’m using the following method to upgrade from 11.x to 11.2.2 on Windows XP:
    - Stop all ZENworks services
    - Kill all zenworks processes in case they didn’t stop from the stop commands.
    - Patch ZESM using the setup.exe from the PreAgentPkg_AgentComplete.exe file.
    - Stop all ZENworks services
    - Kill all zenworks processes in case they didn’t stop from the stop commands.
    - PreAgentPkg_AgentComplete.exe –d tempfolder –Z –q
    - Automatic boot initiated by the above process, device now upgraded to 11.2.2
  • The update for ZCM 11.2.2 is soon to come.

    May we get an update for the script soon afterwards. I tried to understand it, but it is rather difficult to understand.

    I have compared my own update_commands.xml with the one in your zip file: I have less installations files in mine. Is that due to the fact that I do not have patch Mgmt licensed? Shall I than remove these lines from your update_commandsXX.xml file?

    Thanks Klaus
  • How do i get the clients to receive the update_commandsXX.xml file?
    - The download link for the tool has been updated . The zip has the generated update_commands xml (32bit/64bit) for agents. Once you extract the zip and run the script extractSU-Win-11.2.bat it automatically copies the update_commands.xml in the folder to the created su_base folder.
  • you can only upgrade agent from 10.3.4 to 11.2.0 directly as of now which is supported with the tool version. However if the tool is updated to include 11.2.1 packages and update_commands.xml then same can be done ie updating 10.3.4 agent directly to 11.2.1 . Update to 11.2.1 MU2 cannot be done now with this tool as MU2 only contains only the modified packages over 11.2.1, so it needs to be supported with tool .
  • I have updated the download link of the tool which contains the update_commands.xml for 32 and 64bit.
    On running the script extractSU-Win-11.2.bat within the extracted zip folder , su_base folder gets both these xml files copied. For agent installed on Windows Server , you can do this manually by copying update_commandsXX_WinServer.xml and renaming as update_commands32.xml as per agent arch which is mentioned in doc. FAQ 10 talks about the standard SU workflow on agent not very specific to tool.
  • Is it possible to create a bundle with above steps in order to upgrade my PCs from 10.3.4 to 11.2.1 with monthly update 2 so the PCs needs only 1 reboot?

    Or is it still required to get 3 reboots for above update scenario?

    Possibly it might be required to use entries in Windows Scheduler since the ZENworks services vanish/restart during the update.

    Thanks Klaus
  • I have deepfreeze and I have been waiting for something like this.. I will owe you big time once i can get it to work..

    I have one question however.. I have everything working with the exception of one part

    How do i get the clients to receive the update_commandsXX.xml file?

    None of my clients have this file currently.. is there a way I can generate the file and push it out to my clients or is it individual per client? and if so how do they actually get it.. I don't really understand the description for that portion in FAQ 10