Date:   January 29, 2007

Patch:  4.1.1-LCF-0046

Component: Tivoli Framework 4.1.1

General Description:

    4.1.1-LCF-0046 is a patch for endpoints. Although this is a 4.1.1
    endpoint patch, it can be installed on 3.7B or later systems to
    allow for subsequent endpoint upgrades. No other patches or fixpacks
    need to be installed prior to the installation of 4.1.1-LCF-0046.

Problems Fixed:

  New fixes in 4.1.1-LCF-0046:

    Internal CMVC defect 191717
    Symptoms: Endpoints fail to run on the new os400 i-series V5R5. The
    following message is displayed: "Program or module not convertible".

    APAR IY89601
    Symptoms: In order to avoid possible data corruption in the last.cfg
    and lcf.dat files during write operations, the endpoint now creates
    backup versions of these files by default. If an endpoint boots up
    and either last.cfg or lcf.dat is not found, then the last.cfg.bak
    or lcf.dat.bak backup files will be used. This new behavior can be
    disabled by setting disable_backup=true in last.cfg with a text
    editor or by using the wep command. For example, "wep <ep_label>
    set_config disable_backup=true".

    APAR IY91783
    Symptoms: An endpoint running on Solaris 10 can go into an infinite
    loop and use all the CPU. The "pfiles" command shows that the lcfd
    process is using 1024 file descriptors.

    Additional Information: This is also fixed in 4.1.1-LCF-0043LA.

    APAR IY91944
    Symptoms: Codeset 930 cannot be translated correctly to and from UTF8
    using the libtis library. Codeset 930 is a Japanese, pre-ANSI, EBCDIC
    codeset. To enable correct translations, create a readable file,
    930variant, in the directory $BINDIR/../generic/codeset/.

    Additional Information: The fix in this patch is for endpoints. The
    fix for TMRs, Managed Nodes, and Gateways is in 4.1.1-TMF-0085.

    APAR IY92369
    Symptoms: On Windows endpoints, errors when spawning a process are
    output in the system default language. The exception message sent to
    the gateway is not converted to UTF8 before sending and gets
    corrupted when the gateway tries to translate the message from UTF8.

    APAR IY94068
    Symptoms: When the "ifdown" command is invoked, the TEC logfile
    adapter running in a 390-z/Linux environment leaks file descriptors
    up to the 1024 file descriptor limit.

  Fixes from 4.1.1-LCF-0043LA:

    APAR IY91783
    Symptoms: An endpoint running on Solaris 10 can go into an infinite
    loop and use all the CPU. The "pfiles" command shows that the lcfd
    process is using 1024 file descriptors.

  Fixes from 4.1.1-LCF-0042 (includes fixes from 4.1.1-LCF-0040LA and
    4.1.1-LCF-0041LA):

    Internal CMVC defect 186447
    Symptoms: The following parameters were added for endpoints running
    on Windows 2000 (or newer) so an endpoint can adjust its Windows
    service recovery configuration during startup, shutdown, and self-
    check events. 

    svc_recovery={true,false}  Default is false.
        true:  Set service recovery options based on the following
               parameters. These parameters are a subset of the possible
               service recovery actions that can be configured for
               Windows services.
        false: Do not configure service recovery options. For example,
               svc_recovery should be set to false in situations where
               an administrator wants to set a configuration not defined
               by the following parameters or a situation where the
               endpoint should not be changing any of the service
               recovery settings.

    svc_recovery_count={0,1,2,3}  Default is 0.
        0: Do not restart after failure.
        1: Restart on first failure only.
        2: Restart on first and second failure only.
        3: Restart on all failures.

    svc_recovery_delay=<minutes>  Default is 1.
        Number of minutes to wait before restarting service after
        failure. 

    svc_recovery_reset=<days>  Default is 0.
        Number of days without a failure before resetting fail count.

    When svc_recovery is set to false, the endpoint will not alter its
    Windows service recovery configuration regardless of the other
    svc_recovery_* parameter values. The existing configuration will be
    left unchanged.

    When svc_recovery is set to true, the endpoint will set the "First
    failure", "Second failure", and "Subsequent failures" actions to
    "Restart the service" or "Take no action" depending on the values of
    the svc_recovery_count parameter. Note that setting
    svc_recovery_count to 0 will effectively set all recovery actions to
    "Take no action".

    The "wep <eplabel> repair" command adds a new "svc_recovery"
    suboption. For example,

        wep <eplabel> set_config svc_recovery...

    can be used to set svc_recovery on the endpoint and

        wep <eplabel> repair svc_recovery...

    can be used to initiate the repair action on the endpoint.

    Note: The "wep <eplabel> repair" command has the "-c" option to
    check status, but not repair the endpoint. When "-c" is specified,
    the svc_recovery suboption compares the svc_recovery_* options to
    the current service configuration and reports the results. If "-c"
    is not specified for the svc_recovery option, the endpoint
    svc_recovery parameter is ignored, and the remaining svc_recovery_*
    values are set in the endpoint service.

    Both wep and wepstatus will report a new error code 13 if the
    configuration of Windows service recovery actions does not match the
    endpoint svc_recovery_* parameters (when svc_recovery=true).

    Additional Information: The fix for this defect requires both this
    patch and 4.1.1-TMF-0076.

    Internal CMVC defect 187581
    Symptoms: Modify the InstallShield package to allow endpoint
    installations on the Microsoft Windows Vista operating system.

    Internal CMVC defect 187582
    Symptoms: Modify additional InstallShield and ntconfig installation
    tools to support endpoint installations on the Microsoft Windows
    Vista operating system.

    Internal CMVC defect 188375
    Symptoms: An endpoint on Solaris 10 (Sparc) is unable to connect to
    its gateway if the gateway resides on the same system as the
    endpoint. The endpoint log file (lcfd.log) may contain an error
    message similar to the following:

      lcfd Failed to send login: ../../src/comm/netio.c:542
      [cti_create_client or cti_timed_create_client] : loc=4, cls=2,
      dec=16, sys=2, tli=9, evt=0".

    Internal CMVC Defect 191695
    Symptoms: If the default tmersrvd account is renamed to the same
    name with a combination of lower and uppercase characters (for
    example, TMErsrvd), the Tivoli Authentication Package (TAP) will
    fail to authenticate the account and display the error "Error: Logon
    failure: account currently disabled."

    Additional Information: The fix for 191695 in this patch is for
    endpoints. The fix for 191695 in 4.1.1-TMF-0076 is for TMRs, managed
    nodes, and gateways. See the Additional Installation Instructions
    section below for information about rebooting endpoints to have the
    fix for this APAR.

    Internal CMVC Defect 194007
    Symptoms: Resolves access violations in several TMF-supplied GNU
    utilities which can occur on Windows systems using hardware-enforced
    Data Execution Prevention (DEP).  Refer to Microsoft knowledge base
    article 875352 for more information on DEP.

    Internal CMVC Defect 197458
    Symptoms: Correct a potential memory corruption problem that can
    cause endpoint catalog corruption and affect distributions to
    endpoints.

    Internal CMVC Defect 198364
    Symptoms: Extend the spawning of interactive processes from the lcfd
    service to support the Microsoft Windows Vista operating system.

    Internal CMVC Defect 200540
    Symptoms: Add Windows Vista support to handle WindowStation/Desktop
    objects on a per-session basis.

    APAR IY83963
    Symptoms: The Windows endpoint checks for resumes after suspend
    events but does not handle resumes after other conditions, such as
    the PBT_APMRESUMEAUTOMATIC power management event.

    APAR IY84086
    Symptoms: Running ntconfig.exe with the "-v" option does not report
    missing account privileges on Windows systems. 

    APAR IY85120
    Symptoms: The Tivoli Authentication Package (TAP) running on a
    domain controller can fail to authenticate a domain user and display
    the error "One or more input parameters are invalid.". Similarly,
    when wsettap or wlcftap is run on a domain controller with a TRAA
    account set to a domain account, these commands may fail with error
    code -2147504136 or 0x80005008, which means "One or more input
    parameters are invalid.".

    Additional Information: The fix for IY85120 in this patch is for
    endpoints. The fix for IY85120 in 4.1.1-TMF-0076 is for TMRs,
    managed nodes, and gateways. See the Additional Installation
    Instructions section below for information about rebooting endpoints
    to have the fix for this APAR.

    APAR IY85979
    Symptoms: Add a new endpoint configuration option, bypass_match_guid,
    which defaults to FALSE. When bypass_match_guid is TRUE, then on
    endpoint startup, the endpoint will generate a new local unique id
    using the lcfid if:
      - there is no existing local unique id,
      - the endpoint is the first instance endpoint on the system, and
      - a global unique id (GUID) exists.
    The default behavior (i.e., when bypass_match_guid is FALSE) will
    set the local unique id equal to the global unique id value for the
    primary Endpoint instance.

    Additional Information: This is also fixed in 4.1.1-LCF-0039LA.

    APAR IY87262
    Symptoms: Change the endpoint login processing to ignore responses
    to login requests that arrive after the endpoint has completed its
    login cycle, unless the response is for an isolated login request
    that assigns the endpoint to a new gateway.

    APAR IY87678
    Symptoms: During an ACP upgrade distribution, attempts to overwrite
    a tecad_logfile on a system with multiple adapters fail with "Text
    file busy" due to other adapters locking the single binary in common
    use.

    APAR IY89137
    Symptoms: If a Multicast distribution is interrupted by a gateway
    reboot and the same Multicast distribution is sent again within two
    hours, then the multicast receiver on the endpoint may sometimes
    close.

    APAR IY89255
    Symptoms: Endpoints on a Solaris machine using IPsec or IPQoS may
    not be able to login. An error similar to the following may be
    reported: "Aug 31 11:14:42 Q lcfd ../../src/comm/netio.c:682
    [cti_create_client or cti_timed_create_client] : loc=4, cls=2,
    dec=16, sys=2, tli=9, evt=0".

    Additional Information: This is also fixed in 4.1.1-LCF-0041LA.

    APAR IY89307
    Symptoms: When updating configuration parameters using the "Network
    Addresses Configuration" link, the last parameter is ignored and is
    not processed.

    APAR IY90450
    Symptoms: When the Windows "ComSpec" environment variable has been
    removed from the system variables list and the endpoint then tries
    to spawn a process, the endpoint can terminate abnormally.

    APAR IY91100
    Symptoms: Distributions to Mobile endpoints that are interrupted by
    a sudden failure on the endpoint (such as the power cable being
    removed) may not be able to resume after the endpoint reboots. The
    distribution can get stuck in the INTERRUPTED state or FAIL without
    doing a Check Point Restart.

    Additional Information: This fix requires the updated Mobile in
    patch 4.1.1-TMF-0061 as well as the fix in this patch.

  Fixes from 4.1.1-LCF-0039LA:

    APAR IY85979
    Symptoms: Add a new endpoint configuration option, bypass_match_guid,
    which defaults to FALSE. When bypass_match_guid is TRUE, then on
    endpoint startup, the endpoint will generate a new local unique id
    using the lcfid if:
      - there is no existing local unique id,
      - the endpoint is the first instance endpoint on the system, and
      - a global unique id (GUID) exists.
    The default behavior (i.e., when bypass_match_guid is FALSE) will
    set the local unique id equal to the global unique id value for the
    primary Endpoint instance.

  Fixes from 4.1.1-LCF-0038:

    Internal CMVC defect 186358
    Symptoms: Add additional hostname information to the endpoint login:

      - result of gethostbyname system call (hostbyname)  
      - fully qualified active directory hostname
          (ComputerNameDnsFullyQualified) 
      - fully qualified active directory physical hostname
          (ComputerNamePhysicalDnsFullyQualified)

    All the new hostname information will also be displayed on the
    endpoint HTTP interface and sent with the HTTP POST, as appropriate
    for each interp. This new information is in addition to the hostname
    that is already available for all interps. Note: The active
    directory information shown above is only available on Windows 2000
    or newer systems, so it will be omitted for all other interps.

    Additional Information: The fix for 186462 in 4.1.1-TMF-0070 requires
    the endpoint fix for 186358 that is provided in this patch. However,
    the fix for 186358 in this patch does not require that 4.1.1-TMF-0070
    be installed. This is also fixed in 4.1.1-LCF-0035LA.

    Internal CMVC defect 186680
    Symptoms: Software Distribution fails when moving data from a file
    on an OS400 endpoint to a file on a Unix / Windows endpoint because
    the TIS functions fail to convert strings correctly from EBCDIC to
    UTF8 when using a bidirectional language, such as Arabic or Hebrew.

    Additional Information: This is also fixed in 4.1.1-LCF-0029LA and
    4.1.1-LCF-0035LA.

    Internal CMVC defect 188122
    Symptoms: On iSeries (AS/400) endpoints with allow_proxy_upcalls set
    to true, upcalls can fail with a lcfd.log message similar to:
      Q lcfd Send Upcall Data: Opening upcall data file.
      Q lcfd ERROR: /QIBM/USERDATA/TIVOLI/LCF/updata/DATA2685: Open
                    failed: Permission denied.

    Internal CMVC defect 188565
    Symptoms: The "wep <eplabel> set_config <var>=<val>" command may
    cause incorrect values to be set for the following endpoint
    parameters on Windows endpoints: 

      auto_set_firewall
      firewall_scope
      diag_spawn_admin
      diag_spawn_tmersrvd
      login_nearest_gateway.

    Similarly, these parameters may be incorrect when they are viewed.

    APAR IY77089
    Symptoms: If an upcall process running on an endpoint fails to send
    the upcall data to the gateway due to either an intermittent network
    problem or a connection that is dropped / blocked by a firewall,
    then the LCFD process can send an exception message encrypted with a
    wrong key. This results in an "HMAC error" in the gatelog since the
    gateway process cannot decrypt the exception message. 

    APAR IY79438
    Symptoms: When setting the interface list on a Netware endpoint by
    using a command, such as:

      wep set interfaces -e <ep> IP+port:IP2+port:IP3+port

    only the first IP+port address is added to the interface list.

    Additional Information: This is also fixed in 4.1.1-LCF-0035LA.

    APAR IY80246
    Symptoms: The endpoint option 'lcs.machine_unique_id=ENDPOINT_ID' is
    not persistent across endpoint restarts. It reverts back to a
    previous value or changes to a newly generated value.

    APAR IY80515
    Symptoms: The task_endpoint executable on endpoints does not
    correctly handle certain multi-byte characters that have hex codes
    matching one of the special ANSI characters, such as 0x7c (the |
    pipe symbol).

    Additional Information: This is also fixed in 4.1.1-LCF-0035LA.

    APAR IY81876
    Symptoms: The task_endpoint executable on endpoints does not handle
    special characters like "|" or "\" correctly. These characters are
    incorrectly escaped with "\", which causes GNU shell script tasks to
    fail.

  Fixes from 4.1.1-LCF-0035LA:

    Internal CMVC defect 186358
    Symptoms: Add additional hostname information to the endpoint login:

      - result of gethostbyname system call (hostbyname)  
      - fully qualified active directory hostname
          (ComputerNameDnsFullyQualified) 
      - fully qualified active directory physical hostname
          (ComputerNamePhysicalDnsFullyQualified)

    All the new hostname information will also be displayed on the
    endpoint HTTP interface and sent with the HTTP POST, as appropriate
    for each interp. This new information is in addition to the hostname
    that is already available for all interps. Note: The active
    directory information shown above is only available on Windows 2000
    or newer systems, so it will be omitted for all other interps.

    Additional Information: The fix for 186462 in 4.1.1-TMF-0070 requires
    the endpoint fix for 186358 that is provided in this patch. However,
    the fix for 186358 in this patch does not require that 4.1.1-TMF-0070
    be installed.

    Internal CMVC defect 186680
    Symptoms: Software Distribution fails when moving data from a file
    on an OS400 endpoint to a file on a Unix / Windows endpoint because
    the TIS functions fail to convert strings correctly from EBCDIC to
    UTF8 when using a bidirectional language, such as Arabic or Hebrew.

    Additional Information: This is also fixed in 4.1.1-LCF-0029LA.

    Internal CMVC defect IY79438
    Symptoms: When setting the interface list on a Netware endpoint by
    using a command, such as:

      wep set interfaces -e <ep> IP+port:IP2+port:IP3+port

    only the first IP+port address is added to the interface list.

    APAR IY80515
    Symptoms: The task_endpoint executable on endpoints does not
    correctly handle certain multi-byte characters that have hex codes
    matching one of the special ANSI characters, such as 0x7c (the |
    pipe symbol).

  Fixes from 4.1.1-LCF-0034:

    Internal CMVC defect 183645
    Symptoms: If an invalid interface is sent to an endpoint, the
    endpoint will store it as it was sent. However, when the endpoint
    tries to resolve the name / IP to display the interface on the Web
    page, the name will not appear as the name that was typed if it is
    not resolvable.

    APAR IY76364
    Symptoms: A multicast distribution can fail if a Software Package is
    re-distributed to a target before the SWD method has finished
    processing the first distribution.

    APAR IY77127
    Symptoms: Currently, an out-of-band web post is not sent when an
    endpoint starts since HTTP POST messages are not sent until the
    web_post_interval has elapsed. The fix for this APAR defines a new
    HTTP POST message that is sent immediately after endpoint
    initialization completes. Afterwards, all HTTP POST messages will
    continue to be sent on the configured interval.

    APAR IY79052 (APAR IY78864.1)
    Symptoms: In some situations, the endpoint can leak memory when the
    endpoint repeatedly logs in to the gateway.

    APAR IY79297
    Symptoms: If address_notif_interval is set, the address notification
    upcall is sent at the defined interval. However, after a downcall to
    the endpoint, the address notification upcalls can cease. Then,
    after another downcall, they resume once again.

    APAR IY79927
    Symptoms: The lcfd process on an endpoint can terminate abnormally
    when it is repeatedly stopped and restarted. 

    APAR IY80239
    Symptoms: The lcf_env.csh script references the variable $?, which
    is not valid on some platforms. Instead of $?, the $status variable
    should be used.

  Fixes from 4.1.1-LCF-0032:

    Internal CMVC defect 181783
    Symptoms: Provide support for Solaris-ix86 on endpoints. Only
    Solaris-ix86 binaries are provided in this patch.

    Additional Information: The fixes in this patch are the same fixes
    provided in 4.1.1-LCF-0028 for other platforms.

  Fixes from 4.1.1-LCF-0029LA:

    Internal CMVC defect 186680
    Symptoms: Software Distribution fails when moving data from a file
    on an OS400 endpoint to a file on a Unix / Windows endpoint because
    the TIS functions fail to convert strings correctly from EBCDIC to
    UTF8 when using a bidirectional language, such as Arabic or Hebrew.

  Fixes from 4.1.1-LCF-0028:

    Internal CMVC defect 180607
    Symptoms: In some situations, the Mobile checkpoint restart does not
    work correctly, and the entire file is downloaded from the beginning.

    APAR IY75955
    Symptoms: The endpoint can terminate abnormally on Windows Server
    2003 with an access violation while attempting to retrieve the TAP
    password in order to request a process token.

    Additional Information: The fix provided for this APAR is also
    applicable to other programs, such as the oserv and FileIOServer.

    APAR IY76867
    Symptoms: In some environments, the widmap is set so that the
    BuiltInNTAdministrator account cannot be accessed. However, the
    endpoint health checking enables spawn tests by default and uses
    the tmersrvd and BuiltinNTAdministrator accounts. An option is
    available to disable all endpoint health checking by setting
    diag_interval=0, but a finer level of control is needed.

    Additional Information: The fix for this APAR adds two options to
    allow customers to customize their health checking. Specifically,
    the diag_spawn_tmersrvd and diag_spawn_admin options (which have
    default values of true) can be set to false in the last.cfg  file to
    disable spawn tests for the tmersrvd and BuiltinNTAdministrator
    accounts, respectively. 

    APAR IY77288
    Symptoms: The lcfd process can terminate abnormally on Windows when
    the netsh command is used to repeatedly add a virtual IP address and
    remove the IP address.

    Additional Information: This is also fixed in 4.1.1-LCF-0025LA.

    APAR IY78396
    Symptoms: After upgrading an endpoint to 4.1.1-LCF-0024 (endpoint
    version 41124), the "lcs.machine_unique_id" field can have garbage
    characters instead of a unique identifier when viewing the endpoint
    configuration settings using a browser.

    Additional Information: See item 5) in the "Database Changes and
    Special Considerations" section below.

    APAR IY78814, Internal CMVC defect 183979
    Symptoms: The local_ip_interface parameter on AS/400 endpoints is
    not handled correctly. When this parameter is specified, the AS/400
    endpoint binds to that interface only when connecting to a gateway.
    The endpoint continues to listen on all interfaces, however, which
    is inconsistent with the behavior of endpoints on other platforms.

    APAR IY78864
    Symptoms: The following commands can cause the endpoint to terminate
    abnormally:
      wep <ep label> set_config lcfid_GUID="..."
      wep <ep label> set_config lcfid="..."
      wep <ep label> set_config lcs.machine_unique_id="..."

    Additional Information: The fix for this APAR removes the fix for
    internal CMVC defect in 176980 that was made in 4.1.1-LCF-0024. A
    revised fix for the problem reported in 176980 will be provided in
    a future patch or fix pack. Also see item 5) in the "Database
    Changes and Special Considerations" section below.

  Fixes from 4.1.1-LCF-0025LA:

    APAR IY77288
    Symptoms: The lcfd process can terminate abnormally on Windows when
    the netsh command is used to repeatedly add a virtual IP address and
    remove the IP address.I 

  Fixes from 4.1.1-LCF-0024 (includes fixes from 4.1.1-LCF-0022LA):

    Internal CMVC defect 176931
    Symptoms: Migrating a 4.1.1-LCF-0010 (or later) OS/2 or Netware
    endpoint results in an LCF method failure when initiating the first
    downcall immediately after the migration.

    Internal CMVC defect 177011
    Symptoms: An error can occur when moving out-of-date files to the
    cache dir on Windows endpoints. The error message may be similar
    to: "lcfd Error moving out-of-date file to
    C:\data\lcf1\dat\1\cache\out-of-date\admin.exe".

    Internal CMVC defect 179515
    Symptoms: Add support to allow new endpoint installations (via
    InstallShield), upgrades, and winstlcf installations on the 64-bit
    Windows Server 2003 based on AMD64. (The endpoint runs as a 32-bit
    application in this AMD64 environment.)

    Internal CMVC defect 179638
    Symptoms: Microsoft added a firewall to Windows XP with the release
    of Service Pack 2 (SP2), which blocks all inbound connections by
    default. The fix provided in defect 179638 allows the gateway to
    communicate with existing endpoints once SP2 is installed and is the
    new default behavior for endpoints. An option is provided to disable
    this new functionality for special situations.

    Additional Information: Two endpoint parameters are provided to
    control this new behavior, which is only functional on Windows XP
    SP2 or Server 2003 SP1 (or newer) systems. (These parameters are
    defined but ignored for other platforms.)

      auto_set_firewall [boolean]: Enable or disable firewall
        interaction. This parameter is enabled [true] by default. 

      firewall_scope [string]: Specify the preferred scope of firewall
        exception. This parameter is NULL by default, which allows all
        incoming connections. Other options include "LocalSubnet" and
        valid IPaddr/mask values, such as "9.41.23.0/255.255.255.0"
        (without the quotes). If auto_set_firewall is not enabled
        [true], the firewall_scope parameter is ignored.

    Setting "auto_set_firewall=true" allows the endpoint to receive
    incoming connections when the Windows Firewall is "Off" or "On" as
    long as "Don't allow exceptions" is not checked in the firewall
    control panel and the source of the connection is allowed by
    firewall_scope (if specified). The use of auto_set_firewall does not
    affect the endpoint method (i.e., upcall / downcall) functionality.
    Therefore, additional procedures, such as using TFST or setting
    allow_proxy_upcalls=true, may be required.

    APAR IY66812.1
    Symptoms: If the scripts lcf_env.sh and lcf_env.csh are sourced
    multiple times, the value of the NLSPATH environment variable can
    grow to a large size.

    Additional Information: The complete fix for APAR IY66812 will be in
    a future Framework release, but the portion of the fix that affects
    the lcf_env.sh, lcf_env.csh, and lcf_env.cmd scripts is provided in
    this patch.

    APAR IY68277
    Symptoms: If the TEC gateway or Framework gateway is down during an
    upcall, application processes that are linked with libmrt and
    running on the endpoint can leak memory.

    APAR IY69511
    Symptoms: After migrating an endpoint, two mcast_receiver processes
    can sometimes be started simultaneously on the endpoint.

    APAR IY70413
    Symptoms: The mcast_receiver executable that runs on the endpoint
    has a configuration file, mcast_receiver.cfg. Both the executable
    and the configuration file are in a dependency set that downloads
    them to endpoints. Thus, if any change is made to mcast_receiver.cfg
    on the endpoint, that file will be overwritten by the
    mcast_receiver.cfg file from the gateway when mcast_receiver is
    restarted. This can result in the loss of customer-specified
    configuration information for that endpoint.

    Additional Information: This fix for this APAR adds support for a
    new endpoint file, mcast_receiver.conf, that can be modified to
    include changes that should be local to an endpoint. Thus, the
    following two files can be used to set multicast configuration
    information:

      mcast_receiver.cfg - This is the global configuration file for the
          mcast_receiver. Make changes to it for ALL your endpoints.
          mcast_receiver.cfg is found in gateway bundles on gateways:

            lcf_bundle.41100/bin/$INTERP/TMF/LCF/mcast_receiver.cfg

          When automatically downloaded to the endpoint, it will be
          located in:

            $LCF_DATDIR/mcast/mcast_receiver.cfg

      mcast_receiver.conf - This is the new optional local configuration
          file that can be created on individual endpoints to set new
          values not specified in mcast_receiver.cfg or to override
          existing values in mcast_receiver.cfg. If used,
          mcast_receiver.conf should be created in the following
          location:

            $LCF_DATDIR/mcast/mcast_receiver.conf

    APAR IY71885
    Symptoms: The -M option is listed as an available option in the
    lcfd.exe usage statement:

      -M (used with -i) install service as manual start

    However, when -M is specified as a command line option for lcfd.exe
    on Windows, an error message is displayed indicating -M is an
    illegal option.

    APAR IY73810
    Symptoms: The endpoint parameter diag_accts was added with the fix
    for IY70216 in 4.1.1-LCF-0020. If this parameter is set to false
    (i.e., diag_accts=false), then it reverts to "true" when the
    endpoint is restarted. Instead, it should retain the "false" value.

  Fixes from 4.1.1-LCF-0021LA:

    Internal CMVC defect 179370
    Symptoms: In the current endpoint normal login process, there is no
    option to check if an endpoint has moved to a different geographic
    location or a subnet. This can create a problem for mobile endpoints
    because any pending distribution is started from its assigned
    gateway, which can be in a different location.

    Additional Information: The fix provided in 179370 is based on the
    following  assumptions:

    1. The "select_gateway_policy" should be modified by the user to add
       logic to detect (based of endpoint’s subnet or some other
       criteria) and assign the correct gateway. 
    2. This modified login mechanism:
       - Is optional with the default behavior set to "disable".
       - Is mutually exclusive with endpoint manager "automigrate"
         option that forces endpoints to migrate to their preferred
         gateway. 
       - Does not support migration of endpoints across a TMR boundary.
       - Is not supported in a TFST or NAT environment.
    3. Distributions will start from the migrated gateway.

    The following changes are made to provide this new functionality:

    1. Based on certain criteria during endpoint normal login, the login
       status is changed from LOGIN_NORMAL to LOGIN_ISOLATED, and the
       login request is forwarded to the endpoint manager. Logic can be
       added in the select_gateway_policy so that the endpoint manager
       can migrate the endpoint to a nearby gateway.
    2. A new attribute "ep_iprange" is added in the gateway that
       specifies a range of endpoint IP addresses the gateway manages.
       By default this attribute is set to NULL (i.e., the 'login
       nearest' option is not enabled). The normal login function
       changes login status if:
        - The LCFD flag "login_nearest_gateway", which is a new
          parameter in LCFD, is set. 
        - The gateway attribute "ep_iprange" is not NULL. 
        - The endpoint's current IP address is not in the defined range
          (i.e., not in "ep_iprange").

    The following is a simple example using the environment:

      TMR with two gateways and an endpoint
      Gateway 1 (GWA) is in subnet-A (9.53.23)
      Gateway 2 (GWB) is in subnet-B (9.41.23)
      Endpoint (EP01) is assigned to gateway-A

    A select_gateway_policy might be written as:

      # !/bin/sh

      SUBNET_A="9.53.23"
      SUBNET_B="9.41.23"
    
      GWA_OID="1705116281.1.579"
      GWB_OID="1705116281.3.23"
    
      EP_IP=$5
      SUBNET_EP=`echo $EP_IP | awk -F"." '{ print $1"."$2"."$3 }'`
    
      if [ "$SUBNET_EP" = "$SUBNET_A" ]
      then
          echo "$GWA_OID"
          exit 0
      fi
    
      if [ "$SUBNET_EP" = "$SUBNET_B" ]
      then
          echo "$GWB_OID"
          exit 0
      fi

    The ep_iprange for the gateways can be set as follows:

      wgateway GWA set ep_iprange "9.53.23.1-9.53.23.254"
      wgateway GWB set ep_iprange "9.41.23.1-9.41.23.254"

    and the endpoint configuration can be set as follows:

      wep EP01 set_config login_nearest_gateway=TRUE

    When the endpoint is restarted in this example, it will migrate to
    the GWB gateway. (The "login_nearest_gateway" flag can also be set
    in the last.cfg file instead of using the wep command.)

    Note: The fix for 179730 requires the fix in this patch as well as
    the fix in 4.1.1-TMF-0048.

  Fixes from 4.1.1-LCF-0020:

    Internal CMVC defect 176221
    Symptoms: In some situations, such as with endpoints that are
    repeatedly migrating while downcalls are in progress, there can be a
    small memory leak.

    Internal CMVC defect 176906
    Symptoms: In some situations, upgrading an endpoint can report error
    17 during the file renames of wlcftap.exe to wlcftap-W32.exe and
    TivoliAP.dll to TivoliAP-W32.dll.

    Internal CMVC defect 178201
    Symptoms: TCM applications, such as Inventory, running on RHEL 4.0
    linux-ppc can get an error loading the shared library libmd2ep272.so
    similar to "R_PPC_REL24 relocation at 0x0ffa2a30 for symbol `malloc'
    out of range".

    Internal CMVC defect 179093
    Symptoms: On Solaris 10 endpoints, upcalls can fail with the
    following error in the lcfd.log file: "Upcall test exception:
    ../../src/comm/netio.c: 510 [cti_create_client or
    cti_timed_create_client] : loc=4, cls=2, dec=16, sys=2, tli=9,
    evt=0". 

    Additional Information: For environments where a Solaris 10 endpoint
    is on the same machine as its associated gateway, the endpoint will
    not be able to communicate with its gateway if the endpoint's
    local_ip_interface is not set to the IP address of the Solaris 10
    machine. This restriction should be removed in a future endpoint
    patch.

    APAR IY67620
    Symptoms: In cases where multiple endpoints are installed on the
    same Windows system and their IP addresses are different, but the
    port used by the endpoints is the same, the algorithm used to
    generate named pipes produces the same name for the endpoints.

    APAR IY67848
    Symptoms: If the endpoint lcfd process is not running, applications
    (such as the TEC adapter) will leak memory when attempting to make
    upcalls.

    Additional Information: This is also fixed in the superceded patch
    4.1.1-TMF-0015LA.

    APAR IY68031
    Symptoms: The Tivoli Authentication Package (TAP) fails when
    authenticating a locked out built-in Administrator account with an
    error "The referenced account is currently locked out and may not be
    logged on to." even though the DOMAIN_LOCKOUT_ADMINS flag is not
    set, i.e. disabled.

    Additional Information: The fix for IY68031 in this patch is just
    for endpoints. Patch 4.1.1-TMF-0044 contains the IY68031 fix for TMR
    servers / managed nodes / gateways. Note: The fix for this APAR is
    also in the superseded patch 4.1.1-LCF-0014LA.

    APAR IY69226
    Symptoms: When a Framework 4.1.1 endpoint is shutting down (i.e.,
    with the "net stop lcfd" command or by stopping lcfd from the
    Service Control panel), an exception is thrown if VPN is being used
    and detect_address_change=true.

    APAR IY70216
    Symptoms: The endpoint health repair code does not work correctly
    for status codes 7, 8, and 9. Repairs are attempted when no repair
    is needed.

    Additional Information: The fix for this APAR allows users to
    specify if the tmersrvd account and the Tivoli_Admin_Privileges
    group on endpoints should be checked as part of standard endpoint
    health checks. Users may want to disable this checking to avoid
    erroneous results from Active Directory servers. The fix for this
    APAR adds the new configuration parameter diag_accts whose default
    value is true. To prevent checks of the tmersrvd account and the
    Tivoli_Admin_Privileges group, set the value of diag_accts to false
    using the following command:

      wep <label> set_config diag_accts=false

    or edit the %LCF_DATDIR%\last.cfg file and add the line
    "diag_accts=false". After diag_accts has been set to false, restart
    the endpoint service. Note: This is also fixed in the superceded
    patch 4.1.1-TMF-0017LA.

  Fixes from 4.1.1-LCF-0017LA:

    APAR IY70216
    Symptoms: The endpoint health repair code does not work correctly
    for status codes 7, 8, and 9. Repairs are attempted when no repair
    is needed.

    Additional Information: The fix for this APAR allows users to
    specify if the tmersrvd account and the Tivoli_Admin_Privileges
    group on endpoints should be checked as part of standard endpoint
    health checks. Users may want to disable this checking to avoid
    erroneous results from Active Directory servers. The fix for this
    APAR adds the new configuration parameter diag_accts whose default
    value is true. To prevent checks of the tmersrvd account and the
    Tivoli_Admin_Privileges group, set the value of diag_accts to false
    using the following command:

      wep <label> set_config diag_accts=false

    or edit the %LCF_DATDIR%\last.cfg file and add the line
    "diag_accts=false". After diag_accts has been set to false, restart
    the endpoint service.


  Fixes from 4.1.1-LCF-0016:

    Internal CMVC defect 172244.3
    Symptoms: The installation of an endpoint using 4.1.1-LCF-0008 can
    fail on Windows NT 4.0 systems if the Active Directory Client
    Extension (DSClient) for Windows NT 4.0 had been used to install the
    Secur32 library on those systems.

    Additional Information: This fix is also in 4.1.1-LCF-0011LA and
    4.1.1-LCF-0012LA.

    Internal CMVC defect 174803
    Symptoms: When an endpoint fails to bind its preferred port, the
    exact cause of the error is not logged, which makes diagnosis of the
    problem difficult.

    Internal CMVC defect 176766
    Symptoms: In some situations, when an endpoint is migrating and also
    initiating an upcall, the endpoint will not log into the correct
    gateway, which causes the upcall to hang.

    Internal CMVC defect 177312
    Symptoms: Clicking on the Run or Apply buttons on the endpoint
    Health HTTP web page can cause Solaris endpoints to terminate
    abnormally.

    APAR IY44312, Internal CMVC defect 176569
    Symptoms: When a Framework 4.1.1 TMR is installed on a Japanese
    Windows 2000 machine, registry keys are added under
    HKEY_LOCAL_MACHINE/SOFTWARE/Tivoli and the oserv starts
    successfully. If InstallShield is then used to install a 4.1.1
    endpoint on the same machine, however, these registry keys are
    deleted and the oserv will no longer start.

    APAR IY61722
    Symptoms: According to the 'Enterprise Installation Guide', the
    lcfd<x>.rc file should be installed in the /etc/init.d directory on
    Solaris endpoints. Instead, that file is installed in the
    /sbin/init.d directory if it exists.

    APAR IY63058
    Symptoms: If a 4.1.1 endpoint is installed, scanned with Inventory,
    deleted from the endpoint machine, and then reinstalled, the "wep
    eplabel" command will get an LCF ID value that is different from the
    Inventory Computer System ID value.

    Additional Information: There two IDs in an endpoint environment:

      GUID - Global Unique ID
      LCF ID - Local Unique ID

    Configuration management products created the GUID on the endpoint
    before the 4.1.1 release. However, in the 4.1.1 release, the GUID is
    created by the Framework component. 

    The fix for IY63058 includes the following:

      - A GUID will be created by the endpoint only if the endpoint also
        creates the LCF ID. The first time an endpoint is installed
        (where there is no LCF ID or GUID), then both are created by the
        endpoint. If a customer deletes the GUID from the system, but not
        the LCF ID, then the endpoint will not create a new GUID.

      - A copy of the GUID is put in the LCF ID only for the first
        instance of the EP (i.e., the endpoint associated with the
        .../dat/1 directory). If additional endpoints are installed on a
        machine that already has an endpoint, a new LCF ID will be
        generated that will be different from the GUID for these
        additional endpoints. A new LCF ID will also be generated if the
        .../dat directory indicates that this is not the first endpoint
        instance on a machine.

    If the GUID is deleted, it can be recreated by executing one of the
    following:

      - The wep command.  For example:
        wep <ep> set_config GUID=XXXXXXXXXXXXXXXXX
        wep <ep> set_config lcfid_GUID=XXXXXXXXXXXXXXXXX

      - Deleting the lcfd.id and restarting the endpoint. (If the
        endpoint had already logged into a gateway and an lcf.dat file
        was created, then the LCF ID that is generated will be the same
        as the previous value since the value in the lcf.dat file will be
        used.  If no lcf.dat file is present, though, the LCF ID will be
        different from the earlier value).

    APAR IY63452
    Symptoms: If a custom password filter is installed and the security
    policy has password complexity checking enabled, then when the
    installer tries to create the tmersrvd account, there is a
    possibility that a password might be created that fails the
    complexity requirements. This can cause the install to fail. However,
    the installer shows an empty dialog box titled "Severe" with only an
    "OK" button and doesn't give any indication of what actually went
    wrong. 

    APAR IY64581
    Symptoms: The LCF_DATDIR environment variable is not exported from
    lcfd.sh, which can cause problems for TEC adapters when endpoints are
    in installed in directory names that are symbolic links.

    APAR IY64729
    Symptoms: When arguments are specified for endpoint installations /
    upgrades / startup and these arguments are not supported for certain
    platforms, the endpoint logs an error message for the incorrect
    argument, display the usage syntax, and exits. Such arguments should
    be ignored on those platforms where they are not applicable. This
    situation happens when the endpoint is started from the command line,
    during an upgrade via 'wepupgd', or during an installation with
    'winstlcf'.

    Additional Information: For new installations with 'winstlcf', the
    "-u' option must be specified to cause unsupported arguments to be
    ignored.

    APAR IY65631
    Symptoms: In an environment with endpoints connected to gateways
    through a VPN, which provides the IP addresses, two endpoints can
    intermittently get the same name, dispatcher number, and private key
    in lcf.dat.

    Additional Information: This is also fixed in 4.1.1-LCF-0013LA. 

    APAR IY66599
    Symptoms: Performing a distribution can report a failure on a small
    percentage of endpoints with a "Timeout receiving method binary"
    message. This indicates that the endpoint encountered a period of
    network inactivity while receiving the method implementation
    binaries (prior to starting the actual mdist2 distribution) which
    exceeded the default 20 second CTI timeout.

    Additional Information: The fix for this APAR allows the user to
    specify the timeout for all method implementation downloads. Rather
    than adding a new endpoint parameter, the existing recvDataTimeout
    and recvDataNumAttempts parameters are multiplied to obtain a total
    receive data timeout.

    APAR IY66699
    Symptoms: In rare cases, such as when the endpoint/multicast receiver
    is killed or the depot is stored on an unreliable network share,
    entries in the multicast depot on the endpoint can become stuck /
    corrupted and must be removed manually.

    APAR IY66711
    Symptoms: Windows proxy endpoint installations using winstlcf can
    fail if the target system is running Windows XP Service Pack 2.

    APAR IY67182
    Symptoms: When an endpoint is set to allow proxy upcalls through its
    lcfd port, some upcalls fail and the endpoint or tmw2k can then
    crash with the Dr. Watson log indicating a problem with memory
    allocation.

    Additional Information: This is also fixed in 4.1.1-LCF-0013LA. 

  Fixes from 4.1.1-LCF-0015LA:

    APAR IY67848
    Symptoms: If the endpoint lcfd process is not running, applications
    (such as the TEC adapter) will leak memory when attempting to make
    upcalls.

  Fixes from 4.1.1-LCF-0014LA:

    APAR IY68031
    Symptoms: The Tivoli Authentication Package (TAP) fails when
    authenticating a locked out built-in Administrator account with an
    error "The referenced account is currently locked out and may not be
    logged on to." even though the DOMAIN_LOCKOUT_ADMINS flag is not
    set, i.e., disabled.

  Fixes from 4.1.1-LCF-0013LA:

    APAR IY65631
    Symptoms: In an environment with endpoints connected to gateways
    through a VPN, which provides the IP addresses, two endpoints can
    intermittently get the same name, dispatcher number, and private key
    in lcf.dat.

    APAR IY67182
    Symptoms: When an endpoint is set to allow proxy upcalls through its
    lcfd port, some upcalls fail and the endpoint or tmw2k can then
    crash with the Dr. Watson log indicating a problem with memory
    allocation.

  Fixes from 4.1.1-LCF-0012LA:

    Internal CMVC defect 172244.3
    Symptoms: The installation of an endpoint using 4.1.1-LCF-0008 can
    fail on Windows NT 4.0 systems if the Active Directory Client
    Extension (DSClient) for Windows NT 4.0 had been used to install the
    Secur32 library on those systems.

    Additional Information: 4.1.1-LCF-0012LA contains the Windows fixes
    in 4.1.1-LCF-0010.

  Fixes from 4.1.1-LCF-0011LA:

    Internal CMVC defect 172244.3
    Symptoms: The installation of an endpoint using 4.1.1-LCF-0008 can
    fail on Windows NT 4.0 systems if the Active Directory Client
    Extension (DSClient) for Windows NT 4.0 had been used to install the
    Secur32 library on those systems.

    Additional Information: 4.1.1-LCF-0011LA does not contain the fixes
    in 4.1.1-LCF-0010.

  Fixes from 4.1.1-LCF-0010:

    Internal CMVC defect 167891
    Symptoms: The login_interfaces stores a list of gateways for the
    endpoint to contact during the login cycle. If this list is modified
    during a login cycle, the endpoint may not process this list
    correctly.

    Internal CMVC defect 168674
    Symptoms: When an assigned gateway can't be contacted in a single
    attempt, pre-4.1.1 endpoints will immediately start an isolated
    login using the defined login_interfaces. The 4.1.1 endpoint, on the
    other hand, retries the assigned gateway "login_attempts" times
    waiting "login_timeout" seconds between each attempt. The fix for
    this defect restores the pre-4.1.1 behavior.

    Internal CMVC defect 170360
    Symptoms: When spawning methods, a Windows endpoint may encounter
    external errors caused by an incorrect Tivoli Authentication Package
    (TAP), tmersrvd, or the Tivoli_Admin_Privileges configurations. The
    fix for this defect allows the the endpoint to analyze the failure,
    try to fix the problem, and attempt to spawn the method again.

    Internal CMVC defect 170361
    Symptoms: Extend the wep command with new options to check and
    repair Windows endpoints.

    Additional Information: The fix for 170361 provides an interface to
    the actual endpoint repair routines added with defects 170360,
    170362, and 172349. The "wep repair" command has this format: 

      wep <label> repair [-cv] -s {tap|accounts|service|traa|all}
          [-u username]

    This command checks and repairs several aspects of a Windows
    endpoint:

      -c   checks status, but does not repair the endpoint. 
      -v   prints help text for the error codes that are returned.
      -u   required when setting the TRAA account (-s traa). When using
           this option, you will be prompted for a password. The -u
           option cannot be used with the -c option.

    Suboptions of the -s option:
      tap       Checks/repairs TivoliAP.dll in the system directory.
      accounts  Checks/repairs the tmersrvd account, the
                Tivoli_Admin_Privileges group, and the permissions on
                the system directory.
      service   Checks/repairs the lcfd service ensuring it is set to
                autostart.
      traa      Checks/sets the TRAA (Tivoli Remote Access Account).
      all       Performs all of the above checks/repairs.

    Note: The fix for this defect requires binaries contained in this
    patch, as well as the binaries in patch 4.1.1-TMF-0030 (or a later
    patch that supersedes 4.1.1-TMF-0030).

    Internal CMVC defect 172349
    Symptoms: Add a new page to the endpoint HTTP interface to monitor
    endpoint health and request manual repair actions when automatic
    actions are insufficient, and / or remote (wep) commands are not
    possible. The new page obeys the existing http_disable parameter for
    access and change permission. 

    Internal CMVC defect 172730
    Symptoms: When the login interfaces of an endpoint is set to
    "undefined" and the udp_attempts parameter is set to 2, the endpoint
    begins its broadcast cycle at 2 of 2. The endpoint should instead
    begin with 1 of 2.

    Internal CMVC defect 173492
    Symptoms: The endpoint log message "Leaving net_recv: byte= ..." was
    removed in the 4.1.1 release and needs to be re-added for debugging
    support.

    Internal CMVC defect 174236
    Symptoms: Report endpoint MAC address in the main HTTP web page and
    in the web post.

    Internal CMVC defect 174400
    Symptoms: Setting the LCF_TEMPDIR environment variable does not set
    the value of LCF_TEMPDIR actually used by the lcfd and the methods
    that lcfd spawns.

    Additional Information: The fix for 174400 changes this behavior so
    that setting the LCF_TEMPDIR environment variable will now directly
    set the value of LCF_TEMPDIR used by lcfd. (Caveat: On Windows, if
    LCF_TEMPDIR is used to change the temporary directory used by the
    endpoint, the machine must be rebooted before the endpoint can use
    the change since the Service Control Manager won't pick up the
    change until Windows is restarted.)

    In addition:

    * Specifying "-D temp_dir=<dir>" on the lcfd command line will set
      the LCF_TEMPDIR. (Note: During endpoint installations using
      winstlcf, the lcfd command line option "-D temp_dir=<some dir>"
      can be specified with the -L option on winstlcf. For endpoint
      installations using setup.exe, the "-D temp_dir=<some dir>" can be
      specified in the Options field of the Advanced Configuration
      screen.)

    * Specifying "temp_dir=<dir>" in the last.cfg file on the endpoint
      will set the LCF_TEMPDIR.

    If either of the above two methods are used to change the temporary
    directory, the endpoint must be restarted for this change to take
    effect. If the temporary directory is set in multiple places, then
    when the lcfd starts up, it will choose the value using the
    following priority:

    1. "lcfd -D temp_dir=<dir>" (always used if set)
    2. last.cfg (used if the above method is not used)
    3. LCF_TEMPDIR environment variable (used if neither of the above
       two methods are used)

    Finally, the wep command (i.e., wep <ep> set_config temp_dir=<some
    other dir>) allows the temporary directory to be changed at any time
    after endpoint startup without requiring that lcfd be restarted.
    The change made with wep will be recorded in last.cfg so that it is
    retained when the endpoint is restarted.

    Internal CMVC defect 174459
    Symptoms: When allow_proxy_upcalls=TRUE and filefree_upcalls=TRUE,
    the endpoint process can leak memory when doing upcalls.

    Internal CMVC defect 174502
    Symptoms: Extend the NtLcfInst executable to provide additional
    capabilities for copying binaries, like TivoliAP.dll, to the
    system32 directory.

    Internal CMVC defect 175254
    Symptoms: The master file which determines the list of files to send
    during an endpoint upgrade is missing some needed files. This can
    cause later endpoint installations that use the upgraded endpoint as
    a proxy to fail.

    Additional Information: A similar problem exists in the 3.7.1
    release for upgrades from 3.7.1 to 4.1.1 endpoints.  This will be
    addressed by APAR IY63688 in patch 3.7.1-LCF-0020.

    In order for a 3.6.x to 4.1.1 upgrade to be completely successful
    (i.e., to support full self-repair capabilities and operate as a
    proxy for remote installations), it will necessary to either:

    1. Upgrade to 3.7.1 on a gateway which has patch 3.7.1-LCF-0020 (or
       later) with the fix for IY63688 and then upgrade to 4.1.1, or

    2. Upgrade directly to 4.1.1 and then run a second "forced" upgrade
       (e.g., "wepupgd -f <eplabel>") to run the updated admin method
       that was installed by the initial upgrade.

    Internal CMVC defect 175332
    Symptoms: Resolve endpoint crashes which may occur during network
    address change detection and MAC address detection procedures on
    w32-ix86 systems.  

    APAR IY51380
    Symptoms: When allow_proxy_upcall=true is enabled, each upcall
    generated by an application is queued at the endpoint to wait for
    data coming / going to the gateway / endpoint. In some cases, such
    as when the gateway is down or the gateway / endpoint is very busy,
    this can lead to 100% CPU utilization on the endpoint.

    Additional Information: When the allow_upcall_proxy=true is set, the
    endpoint operates in upcall proxy mode. The fix for this APAR adds
    two additional parameters, upcall_pool_size and upcall_pool_timeout,
    to the endpoint configuration to allow for the control of upcall
    proxy behavior.

    The upcall_pool_size configuration parameter specifies a maximum
    for the number of connections in the proxy upcall pool. When the
    number of connections in the proxy upcall pool reaches and exceeds
    this value, the older connections in queue are gracefully aborted to
    make room for newer proxy upcall connections. The default value for
    the upcall_pool_size is 100. This value is reset to the default
    value if the upcall_pool_size is set to 0 or less than zero. The
    upcall_pool_size should not be set to be greater than the maximum
    number of file descriptors specified by the 'ulimit -a' (on UNIX
    platforms). The upcall_pool_size should be a low value rather than a
    large value.

    The upcall_pool_timeout configuration parameter specifies the
    maximum number of seconds that a proxy upcall connection can reside
    in the pool until it is gracefully aborted to make room for newer
    proxy upcall connections. The default value for upcall_pool_timeout
    is 300. This value is reset to the default value if the
    upcall_pool_timeout is set less than or equal to the value of the
    recvDataTimeout.

    Note: It is not necessary to restart your endpoint in order for
    changes made to upcall_pool_size and upcall_pool_timeout to take
    effect.  However, in some situations it may be beneficial to restart
    the endpoint if these parameters are changed.  Specifically:

    * If you accidently set a parameter to an invalid value, such as
    setting upcall_pool_size to zero, the endpoint will attempt to use
    this invalid value, which can cause problems.  Restarting the
    endpoint will automatically validate all parameters and reset any
    invalid values to the appropriate default values.

    * Decreasing the upcall_pool_size can cause upcalls to be lost in
    some situations.  For example, if the upcall_pool_size was set to
    1000 and the pool size actually being used was 200, then setting
    upcall_pool_size to 100 would cause upcalls in the pool to be
    discarded to achieve the 100 setting.  In a situation such as this,
    it might be beneficial to restart the endpoint to resynchronize with
    this lower value.  It should be noted that if the upcall_pool_size
    were set to 200 (or a larger value) in this example, then no upcalls
    would be lost and no restart of the endpoint would be necessary.

    APAR IY58391, Internal CMVC defect 170362
    Symptoms: Expand the list of supported event codes to include the
    new self-repair actions provided in defect 170360 and add new
    environmental information to the information sent with web post.
    This new information includes the addition of the 'uname' of the
    endpoint as well as the lcs.machine.name of the endpoint, which was
    already provided.

    APAR IY58418
    Symptoms: If a Windows endpoint is installed with English as the
    language, and after the installation, the system locale and default
    system locale are changed to Russian, then when the lcfd process
    starts and logs into the gateway, the English codeset file is created
    on the gateway instead of the Russian codeset.

    APAR IY59089
    Symptoms: If a user logs in to an endpoint using a domain user
    account that has restricted privileges on the local machine, the
    Mobile Agent does not start correctly. An error similar to the
    following is displayed: "The instruction at "0x00231337" referenced
    memory at "0xf3f3f3e7". The memory could not be "read"." This error
    only occurs if allow_proxy_upcalls=true is set on the endpoint.

    APAR IY60840
    Symptoms: The tmersrvd account on Windows endpoints creates lots of
    windows with EventLog security login / logout entries.

    Additional Information: A fix was made previously in APAR IY39408
    for customers who don't use the BuiltinNTAdministrator account for
    their $root_user ID map. This fix prevented the endpoint from
    pre-caching tokens for this account. However, other customers found
    that this fix caused monitoring alerts because every downcall using
    $root_user or $nobody [tmersrvd] generated a logon and logoff event.

    The solution provided for IY60840 is to make the token pre-caching a
    configurable option. Specifically, customers can specify
    "use_token_pool=false" (the default value) or "use_token_pool=true"
    in the endpoint's last.cfg file.

    With "use_token_pool=false", the endpoint should continue to operate
    as it did before the IY60840 fix, only the lcfd.log will contain new
    "InitTAPCache called" and "InitTAPCache cache status is 'disabled'"
    entries. Each downcall should log the fact that a token was
    generated. With "use_token_pool=true", the second message will
    change to "InitTAPCache cache status is 'enabled'". Downcalls should
    no longer generate a new token for each invocation.

    This fix is also in 4.1.1-LCF-0009LA.

    APAR IY60920
    Symptoms: The endpoint's lcfd process spikes to 40% - 60% of CPU
    usage for a sustained period of time (typically 5 to 10 minutes or
    longer). Entries in the lcfd.log file show many transactions with
    ITM.

    Additional Information: This fix is also in 4.1.1-LCF-0009LA.

    APAR IY61488
    Symptoms: The endpoint lcfd process leaks memory when upcall events
    are generated by Tivoli applications and "allow_proxy_upcalls=true"
    is set. This symptom can be seen when "filefree_upcall" is set to
    both "true" and "false".

    APAR IY61648
    Symptoms: The endpoint can crash during service shutdown when
    attempting to free a block of memory that was never allocated.
    Since this only happens when the service is being stopped, normal
    endpoint operation is not affected.

    APAR IY62005
    Symptoms: After endpoints were upgraded from version 41104 to 41108
    and were restarted, the lcfd seems to hang and the lcfd.log shows an
    error like: "Connect failed: ../../src/comm/netio.c:510
    [cti_create_client or cti_timed_create_client] : loc=3, cls=2,
    dec=7, sys=10061, tli=0, evt=0". The log file also has the message
    "Try alias 1 for assigned gateway".

    APAR IY63563
    Symptoms: A Windows 2000 endpoint with 4.1.1-LCF-0008 installed can
    terminate with a Dr. Watson error when doing an upcall.

  Fixes from 4.1.1-LCF-0009LA:

    APAR IY60840
    Symptoms: The tmersrvd account on Windows endpoints creates lots of
    windows with EventLog security login / logout entries.

    Additional Information: A fix was made previously in APAR IY39408
    for customers who don't use the BuiltinNTAdministrator account for
    their $root_user ID map. This fix prevented the endpoint from
    pre-caching tokens for this account. However, other customers found
    that this fix caused monitoring alerts because every downcall using
    $root_user or $nobody [tmersrvd] generated a logon and logoff event.

    The solution provided for IY60840 is to make the token pre-caching a
    configurable option. Specifically, customers can specify
    "use_token_pool=false" (the default value) or "use_token_pool=true"
    in the endpoint's last.cfg file.

    With "use_token_pool=false", the endpoint should continue to operate
    as it did before the IY60840 fix, only the lcfd.log will contain new
    "InitTAPCache called" and "InitTAPCache cache status is 'disabled'"
    entries. Each downcall should log the fact that a token was
    generated. With "use_token_pool=true", the second message will
    change to "InitTAPCache cache status is 'enabled'". Downcalls should
    no longer generate a new token for each invocation.

    APAR IY60920
    Symptoms: The endpoint's lcfd process spikes to 40% - 60% of CPU
    usage for a sustained period of time (typically 5 to 10 minutes or
    longer). Entries in the lcfd.log file show many transactions with
    ITM.

  Fixes from 4.1.1-LCF-0008 and 4.1.1-LCF-008F:

    Internal CMVC defect 169682
    Symptoms: The Windows bash.exe command does not correctly handle
    newline characters within a data stream.

    Internal CMVC defect 170701
    Symptoms: Provide additional support for endpoints running newer
    versions of Linux, such as SUSE 9 and RHEL 4.0.

    Internal CMVC defect 172244
    Symptoms: Extend the Tivoli Authentication Package (TAP) to provide
    a 64-bit DLL ONLY for Itanium-based Windows systems (Windows XP /
    Server 2003) and to make the TAP clients work as 32-bit binaries on
    64-bit Windows systems.

    Additional Information: The fix for 172244 in this patch is just
    for endpoints.

    APAR IY36652
    Symptoms: If the pipe symbol "|" is used in the select gateway
    policy, then gateway interfaces are returned to the endpoints as
    hostnames rather than IP addresses. However, the hostname returned
    to the endpoint is not the hostname in the select_gateway_policy,
    but rather the result of a gethostbyaddr call.

    Additional Information: This is a revision to the IY36652 fix that
    was in the 4.1.1 GA release.

    APAR IY49044
    Symptoms: When creating multiple AEF actions of the same type for
    user or group profiles, the actions are generated and queued as
    expected.  However, when the distribution that initiates the actions
    is performed, the last action of any type executes multiple times,
    and the other actions of the same type do not execute at all.

    APAR IY54512.2
    Symptoms: The Tivoli Authentication Package (TAP) can fail to
    authenticate an account that is no longer locked out. It returns an
    error indicating that the account is currently locked out and may not
    be logged in to, even though the account actually is no longer locked
    out. 

    Additional Information: This fix is an extension of the IY54512.1 fix
    in 4.1.1-LCF-0004. The fix for IY54512.2 in this patch is just for
    endpoints. Patch 4.1.1-TMF-0021 contains the IY54512.2 fix for TMRs /
    managed nodes / gateways.

    APAR IY56597
    Symptoms: Method downcalls intermittently fail on Windows systems in
    situations were the lcfd.log file is locked by an external process.
    This fix also corrects a problem where random heartbeats are missing
    from random endpoints, which causes the lcfd to stop logging to the
    lcfd.log.

    APAR IY56774, Internal CMVC defect 171089
    Symptoms: When there is a timeout while receiving a dependency on
    iSeries endpoints, the method fails and the save file where the
    dependency is being stored remains locked. This usually happens when
    there is a slow link between the gateway and the iSeries endpoint.

    APAR IY57130
    Symptoms: Inventory get its CSID (Computer System ID) from the GUID,
    if the GUID exists. In earlier releases, the GUID was not always
    present, but in the 4.1.1 release, it is always present and will be
    used by Inventory. However, there is no way to update the GUID so
    customers can set their own values. The fix for this APAR provides:

      1) A way to change the GUID or the lcfid as follows:
         - wep <ep> set_config GUID="value"
           Changes the GUID to "value" in the system.
         - wep <ep> set_config lcfid_GUID="value"
           Changes lcfid and GUID to both have the same value.
         - wep <ep> set_config lcfid="value"
           This is the same as  the old command "wep <ep> set_config
           lcs.machine_unique_id='new_lcf_id_value" 

      2) A new wadminep command option to see the GUID value:
         - wadminep <ep_name> view_GUID

         To see the lcfid, view_machine_id will continue to be used: 
         - wadminep <ep_name> view_machine_id

      3) A fix for a problem where the lcfd.id file is edited, but a new
         line is not added to the end of the string in the file and
         causes the ID to be truncated by one character.

      4) When upgrading to 4.1.1 with an lcfd.id file that has read-only
         permissions, the libguid fails to store a new value in the
         file.  Thus, the "wep <ep> set_config lcfid='new_lcf_id_value'"
         command does not work.

     The above fixes for IY57130 do not apply to Netware or OS/2. 

    APAR IY57855
    Symptoms: The Tivoli Authentication Protocol (TAP) does not allow a
    TRAA account to be specified using a DNS-style or fully qualified
    domain name, such as csurya.austin.ibm.com\carry.

    Additional Information: The fix for IY57855 in this patch is just
    for endpoints. Patch 4.1.1-TMF-0021 contains the IY57855 fix for
    TMRs / managed nodes / gateways.

    APAR IY58727
    Symptoms: The InstallShield silent install for endpoints can display
    a message saying "read only file detected" for the TivoliAP.dll
    file.

    Additional Information: The fix for this APAR was made via the
    internal CMVC defect 173265.

    APAR IY59018, Internal CMVC defect 173138
    Symptoms: During lcfd service shutdown for some Windows XP and
    Server 2003 machines, an application error dialog (usually an access
    violation or privileged instruction) may be generated.

    APAR IY60017
    Symptoms: Upcalls for cached TEC events are not sent to the gateway
    correctly if allow_proxy_upcalls=true in a Windows environment.

  Fixes from 4.1.1-LCF-0006LA:

    APAR IY58356
    Symptoms: Some NetWare endpoints connected with slow links, i.e.,
    128kb or 256kb, can become disconnected (that is, ports in TIME_WAIT
    state) during a Tivoli backup. When these endpoints are restarted
    after the backup is completed, they do not reconnect and ITM monitor
    events are not received.

  Fixes from 4.1.1-LCF-0004:

    Internal CMVC defect 169480
    Symptoms: After an iSeries endpoint has been upgraded, lcfd does not
    start. The workaround is to remove / rename the cache directory and
    start the endpoint manually with the STRTMEEPT command. This problem
    doesn't happen with fresh endpoint installations.

    Internal CMVC defect 169888
    Symptoms: Batch jobs on iSeries endpoints automatically create spool
    files for output written to stdout since there is no terminal
    session. Since Tivoli jobs are batch jobs, they send output to
    stdout initially until access to the lcfd.log file is available for
    subsequent stdout output. This can be a problem when many jobs are
    run on an endpoint since many spool files can be generated. The fix
    for this defect sends job output to the job log instead of
    stdout. Although, the job log is also a spool file, this file is
    deleted when the job ends with no errors.

    Internal CMVC defect 170810
    Symptoms: The following error can occur at the beginning of the
    lcfd.log file when it attempts to roll-over and write to the lcfd.bk
    file:
      Failed to create backup. errno=22 Exception:
      C:\data\411lcf\lcf1\dat\1\lcfd.bk: Open failed: Permission denied.

    APAR IY46529
    Symptoms: If the start_delay parameter in the last.cfg file is set
    to a value larger than 15 seconds, then it will be reset to 15
    seconds when the endpoint is upgraded.

    Additional Information: The fix made for this APAR is not applicable
    to Netware endpoints.

    APAR IY53132
    Symptoms: Upcalls from an endpoint to a gateway can fail if DES is
    enabled on the gateway and allow_proxy_upcalls is set to true on the
    endpoint.

    APAR IY53319, Duplicate of APAR IY51443
    Symptoms: After multiple (20+) execute program actions have been run
    on an endpoint, further attempts to run an execute program action
    can cause spd_eng.exe exceptions until the lcfd is restarted.

    APAR IY54373
    Symptoms: When trying to pass the redirection character '>' as an
    argument to a task, the task fails with a syntax error.

    APAR IY54395
    Symptoms: If a space is appended to the end of a numeric value, such
    as the lcfd_port value, in the last.cfg file, then the value will be
    ignored and reset to the default value (i.e., 9495 for lcfd_port)
    when the endpoint is restarted.

    APAR IY54512.1
    Symptoms: Using the TivoliAP.dll version from Framework 4.1.1 on a
    AD domain controller whose computer name is 15 characters produces
    the error 'The file name is too long'. If the computer name is 14
    chars or less, this error will not occur. This fix is an extension of
    the IY54512 fix in 4.1.1-LCF-0001 that replaces the use of Windows NT
    provider used to compute the account lockout flag with the standard
    LDAP provider using the lockoutTime property.

    Additional Information: The fix for IY54512.1 in this patch is just
    for endpoints. A future 4.1.1 patch will contain the IY54512.1 fix
    for TMRs / managed nodes / gateways.

    APAR IY54833
    Symptoms: The Tivoli Authentication Package does not correctly handle
    Windows 2000 active directory nested global group members.  Hence,
    rights assigned to top level groups are not found.

    Additional Information: The fix for IY54833 in this patch is just
    for endpoints. A future 4.1.1 patch will contain the IY54833 fix for
    TMRs / managed nodes / gateways.

    APAR IY55564
    Symptoms: If the endpoint encounters a network timeout while
    receiving and writing files in the cache directory, the resulting
    exception leaves the file open.  Any subsequent attempts to download
    and write the same file will fail because the file is locked (error
    32 on Windows).

    APAR IY56474
    Symptoms: When a Framework 4.1.1 endpoint running on Windows XP is
    shutting down (via "net stop lcfd" or stopping lcfd from the Service
    Control panel), an exception can be thrown. The information from the
    exception is a popup message with the title: "lcfd.exe - Application
    Error", and the text of the message is: "The instruction at
    "0x00321346" referenced memory at "0xf3f3f3f7". The memory could not
    be "written"."

    APAR IY56646
    Symptoms: When an upgrade is done on an endpoint, a shutdown and a
    restart of the lcfd service is done. Sometimes, the shutdown service
    call takes a long time and before it completes, a start for lcfd is
    issued. This restart fails because it sees that lcfd is running and
    doesn't retry starting the service.

  Fixes from 4.1.1-LCF-0003:

    APAR IY53733.1
    Symptoms: After the installation of 4.1.1-TMF-0005 on a gateway or
    4.1.1-LCF-0001 on an endpoint, network drives cannot be mapped if
    the machine has a TRAA account (or sets a new TRAA account), and
    then reboots the machine.  On Windows 2003, the reboot may fail.

    Additional Information: The fix for IY53733.1 in this patch is just
    for endpoints. Patch 4.1.1-TMF-0007 contains the IY53733.1 fix for
    TMRs / managed nodes / gateways.

  Fixes from 4.1.1-LCF-0001:

    Internal CMVC defect 140981
    Symptoms: When specifying a command similar to "lcfd -D
    lcs.gateway_address=1.2.3.4 -D gateway_port=24450", the lcfd code
    expects the gateway address to contain the gateway port in the form
    "x.x.x.x+port#", but since there is no port number, it tries to bind
    to address 1.2.3.4 at port 0.

    Internal CMVC defect 168808
    Symptoms: The installation of an endpoint on a machine with an
    Itanium processor fails because the "uname -m" returns "ia64" and
    this is not recognized.

    Additional Information: The fix for this defect in 4.1.1 requires
    the winstlcf from 4.1.1-TMF-0007 and a corresponding fix in this
    endpoint path.  Thus, both this patch and 4.1.1-TMF-0007 must be
    installed to have this fix.

    Internal CMVC defect 169428
    Symptoms: For endpoints on non-MULTIPROTO platforms, such as AIX,
    Solaris, etc., the following steps can cause a problem: If an
    endpoint logs into its assigned gateway, the gateway shuts down, the
    endpoint then migrates to an alternate gateway, and a downcall is
    performed, then the endpoint may attempt to log in to the original
    gateway.

    APAR IY48151
    Symptoms: When a dependency in the endpoint cache gets corrupted
    (for some reason), the dependency is not downloaded to the endpoint
    again because the endpoint only checks for the existence of the
    file, but it doesn't check its size.

    APAR IY48425
    Symptoms: The TEC-Winadapter causes CLOSE_WAIT states on Windows
    2000 endpoint ports when the endpoint network adapter is disabled.

    APAR IY52504
    Symptoms: When sending a web post to a configured URL, the original
    design attempts to resolve the destination host address during
    initialization.  If network connectivity is not available at that
    time, the web post feature becomes effectively disabled.

    APAR IY52510
    Symptoms: The endpoint can appear to hang when disconnecting from
    the network because of a race condition in the logic which handles
    system events and the network address change detection.

    APAR IY53733
    Symptoms: The Tivoli Authentication Package (TAP) returns an error
    when authenticating a user with a TRAA account that does not exist.

    Additional Information: The fix for IY53733 in this patch is just
    for endpoints. Patch 4.1.1-TMF-0007 contains the IY53733 fix for
    TMRs / managed nodes / gateways.

    APAR IY53906
    Symptoms: The Tivoli Authentication Package (TAP) returns an error
    indicating that a user account has expired even though the account
    did not expire.

    Additional Information: The fix for IY53906 in this patch is just
    for endpoints. Patch 4.1.1-TMF-0007 contains the IY53906 fix for
    TMRs / managed nodes / gateways.

    APAR IY54512
    Symptoms: Using the TivoliAP.dll version from Framework 4.1.1 on a
    AD domain controller whose computer name is 15 characters produces
    the error 'The file name is too long'. If the computer name is 14
    chars or less, this error will not occur.

    Additional Information: The fix for IY54512 in this patch is just
    for endpoints. Patch 4.1.1-TMF-0007 contains the IY54512 fix for
    TMRs / managed nodes / gateways.

Architecture(s):

    Solaris, AIX 4, HPUX 10, Windows 2000, OS/2, NetWare
    Windows 95, Linux-ix86, Linux-s390, Solaris2-ix86, OS/400 (Endpoint
      Only) 

    Note: This patch contains endpoint fixes for all the above platform
    types.  The first six platform types listed can also be gateways,
    and this patch can be installed on those gateways in order to
    upgrade endpoints of any of the above platform types with the fixes
    in this patch.

Patches superseded by this patch:

    4.1.1-LCF-0001
    4.1.1-LCF-0003
    4.1.1-LCF-0004
    4.1.1-LCF-0006LA
    4.1.1-LCF-0008
    4.1.1-LCF-0009LA
    4.1.1-LCF-0010
    4.1.1-LCF-0011LA
    4.1.1-LCF-0012LA
    4.1.1-LCF-0013LA
    4.1.1-LCF-0014LA
    4.1.1-LCF-0015LA
    4.1.1-LCF-0016
    4.1.1-LCF-0017LA
    4.1.1-LCF-0020
    4.1.1-LCF-0021LA
    4.1.1-LCF-0022LA
    4.1.1-LCF-0024
    4.1.1-LCF-0025LA
    4.1.1-LCF-0028
    4.1.1-LCF-0029LA
    4.1.1-LCF-0032
    4.1.1-LCF-0034
    4.1.1-LCF-0035LA
    4.1.1-LCF-0038
    4.1.1-LCF-0039LA
    4.1.1-LCF-0040LA
    4.1.1-LCF-0041LA
    4.1.1-LCF-0042
    4.1.1-LCF-0043LA

Dependencies:

    TMF_3.7

Database Changes and Special Considerations:

    1) The following is a summary of the directory names used on a
    gateway for the endpoint binaries in different Framework releases:

    36x binaries (endpoint version < 80) are in lcf_bundle
    37x binaries (endpoint version 80 - 40999 ) are in lcf_bundle.40
    41 binaries (endpoint version 41000 - 41099) are in lcf_bundle.41000
    411 binaries (endpoint version >= 41100) are in lcf_bundle.41100

    2) In order to install this patch on a NetWare gateway, the
    directory $BINDIR/../lcf_bundle.41100 must first be created on that
    gateway.  This limitation will be addressed in a future patch or fix
    pack.

    3) The following comment is copied from the Release Notes for
    4.1.1 and describes changes to two commands that were made between
    the 4.1 and 4.1.1 releases.  This may be of interest to customers
    upgrading endpoints from 4.1 to 4.1.1.

      --------------------------------------------------------------
      The following changes apply to the lcfd and wep commands:

        - The udp_attempts and udp_interval variables now apply only to
          broadcast logins.
        - The new login_attempts and login_timeout variables apply only
          to directed logins.

      If you have fine-tuned the udp_attempts and udp_interval values
      for your enterprise, you should adjust the new login_attempts and 
      login_timeout variables to match. See the Tivoli Management
      Framework Reference Manual for more information.
      -------------------------------------------------------------- 

    4) This patch provides support for installing endpoints on 64-bit
    Itanium-based Windows systems. After installing this patch on a
    gateway, the InstallShield images provided in the patch directory
    411LCF46/LCF/WINNT or the winstlcf command can be used to install
    an Itanium endpoint and connect to that gateway. The wepupgd command
    can also be used to upgrade an existing Itanium endpoint.

    NOTE 1: Before you can install an endpoint on a 64-bit version of
            Microsoft Windows Server 2003, you will have to apply a
            hotfix available from Microsoft to correct the problem
            described in KB833620. You can contact Microsoft Product
            Support Services to obtain the hotfix.

    NOTE 2: TMF endpoint support for the Itanium-based Windows systems
            does not imply that TME application support is also
            available for those systems. Please verify application
            support with each TME application.

    5) If patch 4.1.1-LCF-0024 was previously installed on an endpoint
    and any of the following commands were executed for that endpoint:

      wep <ep label> set_config lcfid_GUID="..."
      wep <ep label> set_config lcfid="..."
      wep <ep label> set_config lcs.machine_unique_id="..."

    then that endpoint will still be accessible until the endpoint is
    rebooted. After the reboot, however, the endpoint will fail to login
    to the Gateway because login information will not match, and the
    endpoint will become isolated. To allow the endpoint back into the
    TMR, orphaned logins must first be enabled:

      wepmgr set epmgr_flags 1
      wepmgr update

    Then, the current endpoint on the TMR must be deleted:

      wdelep <ep label>

    This should allow the endpoint to log in again.

    Note: If any of the wep set_config commands above were run on an
    endpoint with 4.1.1-LCF-0024 installed, but the endpoint was not
    rebooted prior to an upgrade to 4.1.1-LCF-0046 (or a later endpoint
    patch), then the above steps for an orphaned endpoint should be
    performed to allow the endpoint back into the TMR.

    6) The fix for IY81897 in 4.1.1-TMF-0070 (and later patches that
    supercede 4.1.1-TMF-0070) corrects a problem that affects endpoint
    patches built when Daylight Saving Time (DST) was in effect.
    Although 4.1.1-LCF-0046 was not built during DST, it is still
    recommended that 4.1.1-TMF-0070 (or a later patch that supercedes
    4.1.1-TMF-0070) be installed before this patch is installed to have
    the IY81897 fix.

    7) The following items may be of interest to customers that have
    Windows Vista endpoints:

    * User Account Control - Methods and tasks which run as a member of
      the local Administrators group (but not the built-in Administrator
      or a domain administrator) will not be elevated to their full
      privilege level because they are not running as interactive
      processes. 

      Credentials used to access network resources on a remote Windows
      Vista system are also affected by UAC. Accounts other than the
      built-in local Administrator and domain administrators will not be
      able to access administrative shares.

      When installing an endpoint on Windows Vista using InstallShield,
      right-click setup.exe and select "Run as administrator" (unless
      logged on as the built-in Administrator or a domain administrator)
      in order to grant necessary install privileges.

    * Local Security Policy - Performing a remote LCF installation on
      any Windows 2000 or newer system requires access to an
      administrative network disk share on the target system. In order
      to access this share for remote installation, the proxy endpoint
      must provide valid credentials as specified by the winstlcf
      command. 

      Local administrative accounts on Windows Vista are now subject to
      UAC (see previous section), so these accounts do not provide
      useful credentials for remote installations. 

      A default installation of Windows Vista sets a blank password for
      the built-in Administrator account as well as setting "Accounts:
      Administrator account status" to disabled and "Accounts: Limit
      local account use of blank password to console logon only" to
      enabled in the Security Options section of the Local Policies. 

      In order to use the built-in Administrator account for LCF remote
      installations on Windows Vista, a non-blank password must be set
      or the local account restriction must be disabled (NOT
      recommended). 

    * Windows Firewall - Any firewall that exists between an LCF
      endpoint and its gateway(s) must be configured to allow
      communication between these TMF components. Microsoft has
      provided the Windows Firewall, beginning with Windows XP Service
      Pack 2 and Server 2003 Service Pack 1 and continuing with Windows
      Vista.

      Setting the endpoint parameter auto_set_firewall=true (the default
      value) enables the LCF endpoint to automatically create an
      exception for itself in the Windows Firewall (when running on
      Windows XP SP2, Server 2003 SP1, and Vista) to accept incoming
      connections. In order to ensure that outbound communications also
      work properly, the endpoint parameter allow_proxy_upcalls=true
      should also be set so that upstream LCF communications will be
      sent through the endpoint rather than directly.

      Performing a remote LCF installation requires that a proxy
      endpoint be able to remotely access shared network resources and
      the registry on the target system. All target systems running the
      Windows Firewall must enable the "File and Printer Sharing"
      firewall exception so the proxy can successfully transfer files to
      the target system.

      In addition, all Windows Vista target systems must also enable the
      "Remote Service Administration" firewall exception in order for
      the proxy endpoint to remotely create and start the lcfd service
      on the target system. By default, both of these firewall
      exceptions are created but disabled on a Windows Vista
      installation.

    * Windows Services - LCF remote installations on Windows 2000 and
      newer systems require the "Remote Registry" service to be started
      in order to gather information about the target system and create
      the lcfd service. Windows Vista configures this service for manual
      start by default.

Files Replaced by this Patch (for all supported values of INTERP):

    See the image report in the file 411LCF46/411LCF46.image.rpt for a
    complete list of the files replaced by this patch.

Patch Contents:

    - This README file
    - The cdrom image for this patch
    - The image report for this patch
    - The endpoint installation images for NetWare 4, OS/2, Windows
      2000, and Windows 95.  These installation images are in the
      directory 411LCF46/LCF that is created when the patch is extracted
      from the tar file.
    - Software Package Blocks (SPBs) are provided for the installation
      of endpoints using Software Distribution version 4.1. SPBs for
      Solaris, AIX, Linux-ix86, and Windows 2000 are in the 411LCF46/SPB
      directory.  See the Additional Installation Instructions section 
      below for details. 

Applying the Patch:

    1)  Extract the patch:

        On a Unix system:

        Extract the contents into a scratch directory. For the purpose
        of this release note, assume that the symbol $PATCH points to
        this directory.

        # cd $PATCH
        # tar xvf 4.1.1-LCF-0046.tar

        On a Windows 2000 system:

        Extract the contents into a scratch directory. For the purpose
        of this release note, assume that the symbol %PATCH% points to
        this directory. 

        > %SystemRoot%\system32\drivers\etc\Tivoli\setup_env
        > X:              
          ^-- 'X' is drive letter where %PATCH% is found
        > cd %PATCH%
        > tar xvf 4.1.1-LCF-0046.tar

        NOTE:  If you are extracting the tar image on a Windows 2000
        system, you will find an executable for tar in the TME
        installation on Windows 2000 under bin/w32-ix86/tools/tar.exe.

    2)  If this patch is to be installed on a release level of 3.6 or
        greater, follow these instructions for using Software
        Installation Service (SIS).  If not, skip to step 3 below.

        NOTE: SIS can install Tivoli products on any hardware
              platform supported by Tivoli, but there are some
              hardware platforms on which SIS cannot be run. Please
              check your SIS User's Manual for the list of platforms
              on which SIS can be run.

        NOTE: You must have the install_product and super authorization
              roles to successfully install this patch.

        a)  From the Tivoli Desktop, pull down 
            Desktop --> Install --> Software Installation Service.
        b)  SIS will initialize, and bring up the Get Installation
            Password Dialog.  Enter your Installation Password.
        c)  Click the Install Button on the dialog which contains
            the Tivoli image.
        d)  Click the Select Product Button on the Install Spreadsheet
            Dialog.
        e)  Click the Import Product Button on the Select Product
            Dialog.
        f)  Locate the media to 4.1.1-LCF-0046 using the file browser,
            and select the PATCHES.LST file by double-clicking it.
        g)  Select 4.1.1-LCF-0046 in the Import Product Dialog, and
            click the Import Button.
        h)  When the import is complete, click the OK Button on the
            Global Progress Dialog.
        i)  Select 4.1.1-LCF-0046 in the Select Product Dialog, if it
            is not already selected, and click the OK Button.
        j)  Now click the Select Machine Button on the Install
            Spreadsheet Dialog.
        k)  Select the machine(s) you would like to install
            4.1.1-LCF-0046 on and click the OK Button.
        l)  Click the appropriate cell(s) in the Install Spreadsheet
            Dialog. (NOTE: This should yield an "X" in the cell(s)
            for the machines you want to install 4.1.1-LCF-0046 to).
        m)  Click the Install Button.
        n)  Select the install algorithm you want to use on the
            Installation Algorithm Dialog, and click OK.
        o)  SIS will perform the installation(s) you designated
            in the Install Spreadsheet Dialog.
        p)  Installation is complete. Check the Additional 
            Installation Instructions section below.

    3)  Use the following steps to install the patch using the Tivoli
        GUI install mechanism.
        NOTE: You must have the install_product and super authorization
        roles to successfully install this patch.

        a)  Select the "Install -> Install Patch..." option from the
           "Desktop" menu to display the "Install Patch" dialog.
        b)  Press the "Select Media..." button to display the "File
            Browser" dialog.
        c)  Enter the path to the directory containing the patch,
            $PATCH, in the "Path Name:" field.
        d)  Press the "Set Media & Close" button to return to the
            "Install Patch" dialog.
        e)  The patch install list now contains the name of the patch.
            Select the patch by clicking on it. 
        f)  Select the clients to install this patch on. This patch
            needs to be installed on gateway machines.
        g)  Press the "Install" button to install the patch.

Additional Installation Instructions:

    This patch upgrades the endpoints from earlier versions to version
    41146.  In order to upgrade your endpoints: 

    1) Make sure the endpoint has logged into the TMR.

    2) Verify that the endpoint has logged in by using the "wep ls"
       command.

    3) Before the upgrade, do:
  
        wadminep <ep_name> view_version

       The version number returned should be a value less than 41146,
       depending on which other patches affecting endpoint code have 
       been applied.

    4) For Framework 4.1 or 4.1.1, perform step 4a) below. For Framework
       3.7 or 3.7.1, perform step 4b) below.

       4a) (Framework 4.1 / 4.1.1) From the Tivoli region server or the
           gateway that the endpoint is logged into, enter the following 
           command: 

             wepupgd <ep_name>

           NOTE: For Framework 4.1, the wepupgd command will upgrade the
           endpoint to the 4.1 binaries in lcf_bundle.41000 by default,
           and not to the 4.1.1 binaries in lcf_bundle.41100. To upgrade
           an endpoint to the 4.1.1 binaries in lcf_bundle.41100, the
           path to the lcf_bundle.41100 directory should be specified on
           the wepupgd command. For example, 

             wepupgd -p <path to lcf_bundle.41100> <ep_name>

       4b) (Framework 3.7 / 3.7.1) From the Tivoli region server or the
           gateway that the endpoint is logged into, enter the following
           command: 

              wadminep <ep_name> upgrade

           NOTE 1: The wadminep command will use binaries from the
           machine on which the upgrade command is executed.  So, for
           example, if wadminep is executed on a Tivoli region server
           and the endpoint's gateway is a different machine, then the
           binaries on the Tivoli region server (not the endpoint's
           gateway) will be used for the upgrade.

           NOTE 2: For Framework 3.7 / 3.7.1, the wadminep command will
           upgrade the endpoint to the 3.7.1 binaries in lcf_bundle.40
           by default, not to the 4.1.1 binaries in lcf_bundle.41100.
           To upgrade an endpoint to the 4.1.1 binaries in
           lcf_bundle.41100, the path to the lcf_bundle.41100 directory
           should be specified on the wadminep command.  For example,

              wadminep <ep_name> upgrade <path to lcf_bundle.41100>

    5) After the upgrade, do: 
 
        wadminep <ep_name> view_version

       It should return a 41146.

    ------------------------------------------------------------------

    This patch contains the Windows library TivoliAP.dll. Since
    TivoliAP.dll may already be in use by Windows, the Windows system
    must be rebooted after an upgrade (or a new installation where an
    older version of TivoliAP.dll was in use) so that this new version
    of TivoliAP.dll will be loaded into memory. If you do not reboot,
    then Windows will continue to use the older TivoliAP.dll that was
    previously loaded.

    (The TivoliAP.dll being replaced is used by the Windows security
    service. Due to this library being locked, we must follow the
    Microsoft solution for handling locked libraries. This solution
    dictates that we must reboot the Windows system to allow the locked
    library to be replaced at boot time.)

    Note: The version of TivoliAP.dll supplied in this patch is the same
    as the version (28) supplied 4.1.1-LCF-0040LA except for timestamp
    information, but is different from all earlier endpoint versions.
    Thus, if you are upgrading from 4.1.1-LCF-0040LA (or later) to this
    patch, then it is not necessary for the Windows endpoints to be
    rebooted. For earlier endpoint versions, however, there is no
    problem in continuing to run with an older version of TivoliAP.dll
    on Windows except that certain fixes will not be available. Thus,
    this endpoint reboot does not have to be done when an endpoint is
    upgraded and can be deferred until a later time.

    ------------------------------------------------------------------

        Installing Components using Software Package Blocks (SPBs)

    Before installing images from software package blocks, the Software
    Distribution version 4.1 (or later) component of IBM Tivoli
    Configuration Manager must be deployed. (Software Distribution
    version 4.0 is not supported.) To install an image from a software
    package block (SPB) to an existing endpoint, perform the following
    steps:

    1)  From the Tivoli desktop, double-click the appropriate policy
        region icon to display the Policy Region window.
    2)  In the Policy Region window, double-click the appropriate
        profile manager icon to display the Profile Manager window.
    3)  Select Profile from the Create menu to display the Create
        Profile window.
    4)  Create a software package profile.
    5)  Right-click the new software package profile and select Import
        to display the Import window.
    6)  In the Location of Input File group box, select Managed Node
        from the drop-down list.
    7)  Click the Browse (...) button to display the Select Input File
        window.
    8)  In the Select Input File window, perform the following steps:
        a) In the Managed Node list, select the machine where tar file
           was extracted. 
        b) In the Input File Path list, select the 411LCF46/SPB
           directory.
        c) Select the image to import.
        d) Click Set File & Close to return to the Import window.
    9)  In the Location of Source Host group box, perform the following
        steps:
        a) Ensure that the Build check box is selected.
        b) In the Source Host Name text box, type the source host name.
        c) In the SPB Path text box, type the path to the software
           package block. 
    10) Click Import & Close to return to the Profile Manager window.
    11) Right-click the software package profile, and select Install to
        display the Install Software Package window.
    12) In the Available Subscribers list, select the endpoints where
        you want to install the image.
    13 Click Install & Close to begin the installation. The window
        remains open until the operation is submitted.

    ------------------------------------------------------------------

    To install a new endpoint on an iSeries machine, run the following
    command from the gateway:

      w4inslcf.pl -g gateway_name 
          -L 'log_threshold=3 lcs.machine_name=ep_name' \
          iSeries-machine-name-or-IP-address

    To install an iSeries endpoint with multiple network cards from a
    gateway that has multiple network cards, as shown by the following
    example of a desired configuration: 

          Gateway NIC to use      : 146.84.36.37
          AS/400 TMA Network card : 146.84.39.126
          Endpoint HostName       : cheese (146.84.39.126)
          Endpoint name is        : queso
          AS/400 TMA local port   : 18752
          Log threshold is        : 3

    then the following command can be used to install that endpoint:

      w4inslcf.pl -L 'local_ip_interface=146.84.39.126 \
          lcs.machine_name=queso log_threshold=3' -l 18752 \
          -g ibmtmp1+8752 -T 146.84.36.37 cheese

    ------------------------------------------------------------------

    NOTE: The Linux endpoints do not support the following monitors:

      * Client RPC timeouts
      * NFS bad calls
      * RPC bad calls
      * Jobs in print queues
      * Total size queued
      * Page -scans

    Installation of an endpoint using the winstlcf command with its
    default options may fail or hang. This problem affects Red Hat 6.2
    (and higher). The default winstlcf endpoint installation uses the
    Linux rexecd daemon on both the source and the target for
    communication. On the Linux operating systems mentioned above, the
    rexecd daemon contains a defect which prevents Tivoli endpoints from
    installing. Because of security policy in Red Hat 6.2 (and higher),
    root access via the rexecd has been disabled, which prevents Tivoli
    endpoints from installing. 

    Workaround: Install the endpoint using the winstlcf command with the
    -e Trusted Host option as follows:

    Follow operating system instructions to configure the target's
    .rhosts file to allow trusted host root access for the gateway from
    which the installation is being performed. If configured properly,
    the following command executed from the gateway should return
    "hello": 

       rsh target_machine_name -l root echo hello

    If "Permission Denied" is returned, consult operating system
    documentation on how to correctly configure trusted host access and
    repeat the above test.

    From the gateway in which you successfully ran the test above,
    install the target endpoint using the Trusted Host access method as
    follows:

      winstlcf -e target_machine_name

    Contact the appropriate vendor to obtain the following service patch
    which corrects rexec:

    Red Hat 7.0: Patch "glibc-2.2-12" as described in Red Hat Service
    Advisory "RHSA-2001:001"

    Turbolinux: Contact vendor to obtain a rexec fix or use the
    workaround.

    Follow operating system instructions to properly enable rexec to
    allow root access to the target since, due to security
    considerations, many operating system vendors disable rexec by
    default. Tivoli strongly recommends that once the Tivoli
    installation is complete, rexec access to the target be disabled or
    restored to a configuration recommended by the operating system
    vendor.

Known Defects:

    None.
