IT Management Suite 7.6 HF4 is now available

[Migration User]

IT Management Suite 7.6 HF4 is available through SIM. The release has the following highlights:

• Support for Windows 10. For more information, refer to the full support statement at http://www.symantec.com/docs/DOC9007

• OpenSSL is updated to the latest 1.0.1p.

For more information, refer to the IT Management Suite 7.6 HF4 release notes avaiable at www.symantec.com/docs/DOC8949.

[Stefan S]

Hi kedar_k

The link to the release notes seems to be wrong. Correct link should be:

http://www.symantec.com/docs/DOC8949

Stefan

 

[MRC-CBSU]

I have just looked to install this update and found that there was also a SIM update waiting. I allowed this to run and after it restarts it now reports that I cannot install the hotfixes. It seems to indicate something wrong with the user account you are logged in with, which in my case is a domain adminstrator account with full admin rights over the server.

The full error message is:

Cannot continue to run the install product/update product/repair product/install hotifx with the current logged in credentials. Log in using application identity user credentials and try again.

I have never had this error message before and we have been running ITMS since 7.5. The version of SIM that is installed is 7.6.75

[Stefan S]

Check out this article 'Error message while upgrading SIM' (TECH232317).

[Igor Perevozchikov]

MRC-CBSU,

now you must be logged in under "App Identity" account, open SIM and then install/upgrade your ITMS.

• See release notes for 7.6 HF4: https://support.symantec.com/en_US/article.DOC8949.html

Thanks,

IP.

[MRC-CBSU]

Hi Igor,

I am logged in with that account and it is now allowing me to download and install the updates. I find it somewhat amusing that this is listed as a fix when in fact the new SIM update broke things for me. I never had to log in with this account to perform updates till now, and my own domain admin account always worked before.

Thanks again Igor!

[Migration User]

Thanks, Stefan!

[[e-mail]]

It is also listed under the Upgrade to IT Management Suite 7.6 HF4 section:

[Migration User]

When is there going to be a hotfix for 7.5 SP1 regarding Windows 10 support?

[JohnVee]

I agree, we are running Altiris 7.5 SP1 HF5 and to have Windows 10 support would be nice. We do plan on going to 7.6 but not until sometime next year and we are currently working on Windows 10 pilot testing. I sure hope Symantec does not come back and say upgrade and if you dont sorry. That is sort of a bad take on thier part if they do.

[JasonI]

You may want to review the support statement.  https://www-secure.symantec.com/connect/blogs/early-support-statement-windows-10-it-management-suite-customers

[Migration User]

I've read the support statement.  From what I've also read 7.5 is a product that is still supported.  Shouldn't that include functionality for a large OS such as Windows 10?  In some businesses moving to 7.6 may not be a logical option in the near future.

[JasonI]

I have ran into this issue before so maybe we can clarify.  Is the Server Inventory Agent Version correct on the release documentation?  Release document states 7.6.1625. The site server has 7.6.1395.

Yes the policy is on and set to run on a schedule and the site server is not applicalble for the upgrade. (The filter has no (zero) machines listed)

I have added the machine manullay to the policy and ran the upgrade manually and the agent is still at version 7.6.1395

[MichaelCivitillo]

Out of curioisity, what factors are keeping you from upgrading to 7.6 from 7.5? 

[SHauck]

I understand what's on your mind. But a product in an outdated version still being supported doesn't mean you'll get new features for it. And that's what it is, Windows 10 support is a new feature. You want new features? You need to upgrade.

[Migration User]

Never said I wasn't upgrading.  It would simply be beneficial to have the question answered because I'm not the first person to ask it.  Symantec added support for Windows 8 for 6.9, I would consider this to be a similar circumstance.

[Migration User]

Thanks for your opinion.  It's a simple question that would be helpful if Symantec would respond to.  As I mentioned above, in past Windows releases, specifically Windows 8, Symantec released support for 6.9.

[Alex Isakov]

Regarding Server Inventory Agent. Version is correct.

1. Make sure  update distribution point and package refresh scheduled tasks were executed after Hf4 (or run them  manually)

1. Make sure, that SMA is upgraded on a  site server

2. Make sure Inventory Agent is updated on site Server

3. Run Server Inventory Agent policy

Let me know if you still dont see updated Server Inventory Agent version.

[MichaelCivitillo]

Again, I'm simply curious what the delay is with going to 7.6...I could understand if you were on 6.9 or something. If you would be so kind as to enlighten us for our own knowledge, is there a feature that your're using in 7.5 no longer available in 7.6? 

[Migration User]

I won't be upgradiing to 7.6 for a number of reasons.

 

1.) PCAnywhere is gone (i know alot of people don't like it,  but I've never had an issue with it)

2.) Rdeploy is gone (this is how we image PC's)  Have gone and looked at the other ways of doing this,  but it seems very cumbersome to set up.

3.)  I will not be paying for bomgar licenses as it is too expensive.

4.)  I created my own filters and reports for windows 10  PC's in 7.5 (took all of 10 minutes)

5.)  7.5 has no issues for us at all.  Have heard 7.6 is buggy still.

[MichaelCivitillo]

PCAnywhere being EOL deffintely is a good reason, I admittely had forgotten about that. I'm suprised you're not having issues with it, towards the end of us using we it was plagued with issues, especially the OSX agent. Is PCAnywhere working for you in Windows 10?

Also, two Bomgar licenses should have been provided to you with your renewall, no? 

Rdeploy development is done, and has been for quite some time. If its working now I'd assume you would be better off moving to something new gradually, as opposed to having to rush to deploy ghost when it breaks. 

[Migration User]

PCAnywhere works fine on windows 10.  As do all of the other agents. 

2 bomgar licenses will not remotely do for us since we have 20 or so support personel who support PC's and need the ability to remote onto the PC's.  We also use teamviewer but that does not do audit tracking like pcanywhere does.

Rdeploy has been the only stable pc imaging solution for us.  All others seem to suck back network resources like crazy.  That being said,  we use rdeploy and use USB hard drives to store the images,  so I can effectively image a PC in 3 minutes with a USB 3,0 SSD portable hard drive using rdeploy.

[andykn101]

Symantec have partly backtracked on pcAnywhere removal, you can reinstate it on 7.6 officially and it works fine.

[SHauck]

Do you have a link to the official statement? Is it possible with HF4? I don't find anything about it in the release notes.

[Alex Hedley]

How to restore console integration for pcAnywhere Solution after upgrading to IT Management Suite 7.6

https://support.symantec.com/en_US/article.HOWTO110286.html

[andykn101]

It should be possible with HF4 but you might want to try and go to HF1 first if you can.

[Migration User]

I spent almost an hour trying to figure out what the heck was app identity credentials, and wondered what the IM had to do with the patch management I'm using a trial of - and then I realized they want us to log in with a SERVICE ACCOUNT? Really?
They don't really even explain what that error means - huh? What account is "app identity", never heard that term before. Where's a person supposed to find out what that message means?

And then it hit me, that's not good as around here those are protected, the passwords aren't supposed to be used by anything or anyone other than a service or app and no one is to log in using those same credentials. We have strict security and having to log in using the ID and password reserved for a thing and not a person is, well, that's against policy. 
I'm rather surprised we are forced to use a service or application ID which is to remain unknown to most IT even. 

I hope they soon remove that requirement - because it flies in the face of keeping specific IDs and passwords reserved for very specific purposes and reasons. Some accounts have god-rights, and others have just enough. Since we don't log in with those accounts for any reason, we actually have to get into a locked document to find the credentials. 

Was this a mistake? A bug? Is it broken?
Then I wonder -  why would one need to login as the service account to run IM when that is one app, and the service/app that the credentials belong to is another?

I guess I leave confused - it makes little sense to me. 
 

[andykn101]

When Notification Server was originally developed it used a lot of DCOM objects. Many ran under the credentials of a domain account, this is known in Microsoft COM terminology as the "Application Identity". Over the years the account has been more used as a Service Account but the terminology has persisted. In secure environments I don't log in with the Service Account ("App Identity") but use "run as" to run the Symantec Installation Manager installer. You can always change the password at the end, there's a kb article on the best way to do it - from memory it's easiest to change the service account in the console to a new account.

[HighTower]

And to be honest it's been like this for as long as I've used Altiris.  Like since 2005.

[Jan Trnka]

Gents, I like that discussion, but since 7.6 HF6 is out, we are having another upgrade to consider.

We have thousands ot managed devices around the world and any ugrade is a challenge:

• Testing and Change process must be strictly followed - there is lot of administration behind
• Pushing 25+ MB to every client is hard to explain if more than once or twice a year