White-list Symantec Management Agent installation Service

[Weiliang Teoh]

Hi All,

 

Im currently facing another issue where Symantec Management Agent Installation Service status is stuck on Staring at Notification Server.

Up on check the logs on client. An existing connection was forcibly closed by the remote host (10054). 

 

2018-10-04 11:13:43 P:3584   T:6040    INFO HttpOperations: Sending 'Remote Install Started: Success' message to 'http://alt01.abc.com.my:80/altiris'.
2018-10-04 11:13:44 P:3584   T:6040   *ERRR NetworkOperation: Operation 'Direct: Head' failed. 
Protocol: HTTP 
Original Host: :0
Real Host: alt01.abc.com.my:80
Path: /Altiris/NS/Agent/PostEvent.asp 
Id: 0.3584 
Error type: Network error 
Error code: An existing connection was forcibly closed by the remote host (10054) 
Error note: SocketIOStrategySyncSelect::Receive error
2018-10-04 11:13:44 P:3584   T:6040    INFO HttpOperations: Failed to send event to 'HTTP://alt01.abc.com.my:80/Altiris/NS/Agent/PostEvent.asp', error: An existing connection was forcibly closed by the remote host (10054)
2018-10-04 11:13:44 P:3584   T:6040    INFO HttpOperations: Sending 'Checking Prerequisites: Success' message to 'http://alt01.abc.com.my:80/altiris'.
2018-10-04 11:13:45 P:3584   T:6040   *ERRR NetworkOperation: Operation 'Direct: Head' failed. 
Protocol: HTTP 
Original Host: :0
Real Host: alt01.abc.com.my:80
Path: /Altiris/NS/Agent/PostEvent.asp 
Id: 0.3584 
Error type: Network error 
Error code: An existing connection was forcibly closed by the remote host (10054) 
Error note: SocketIOStrategySyncSelect::Receive error
2018-10-04 11:13:45 P:3584   T:6040    INFO HttpOperations: Failed to send event to 'HTTP://alt01.abc.com.my:80/Altiris/NS/Agent/PostEvent.asp', error: An existing connection was forcibly closed by the remote host (10054)
2018-10-04 11:13:45 P:3584   T:6040    INFO InstallService: Requirements check: 
Required: Windows XP SP3 (x86), Windows XP SP2 (x64), Windows Server 2003 SP2 or above.
Detected: Windows Server 2008 R2 Standard x64 Service Pack 1 (Version 6.1.7601)

Requirements met OK.
2018-10-04 11:13:45 P:3584   T:6040    INFO HttpOperations: Sending 'Checked Prerequisites: Success' message to 'http://alt01.abc.com.my:80/altiris'.
2018-10-04 11:13:45 P:3584   T:6040   *ERRR NetworkOperation: Operation 'Direct: Head' failed. 
Protocol: HTTP 
Original Host: :0
Real Host: alt01.abc.com.my:80
Path: /Altiris/NS/Agent/PostEvent.asp 
Id: 0.3584 
Error type: Network error 
Error code: An existing connection was forcibly closed by the remote host (10054) 
Error note: SocketIOStrategySyncSelect::Receive error
2018-10-04 11:13:45 P:3584   T:6040    INFO HttpOperations: Failed to send event to 'HTTP://alt01.abc.com.my:80/Altiris/NS/Agent/PostEvent.asp', error: An existing connection was forcibly closed by the remote host (10054)
2018-10-04 11:13:45 P:3584   T:6040    INFO HttpOperations: Sending 'Starting Download: Success' message to 'http://alt01.abc.com.my:80/altiris'.
2018-10-04 11:13:46 P:3584   T:6040   *ERRR NetworkOperation: Operation 'Direct: Head' failed. 
Protocol: HTTP 
Original Host: :0
Real Host: alt01.abc.com.my:80

Im suspecting the intallation service being stopped by anti virus on the client.

Any file can be whitelist of this remote push installation ?

 

Thanks

Wei Liang

[CraigEV]

Hi,

Have you tried to install this with the AV disabled? Once installed, take down the services (.exe) and place them in the AV's exclusion list.

Thanks!

[Weiliang Teoh]

Hi CraigEV,

Nope, i didt try to disable the AV during remote push. Due to it is production server.

Is that any way we can whitelist the installation services or any thing can we excluded on AV side?

Thanks

[andykn101]

I think it runs as a service so if you look in Services you can find the executable name. But check firewall logs first.