Scheduled Push to Computers with different credentials?

[Carl Fortin]

Hello,

We would like to install the Altiris Agent using "Scheduled Push to Computers" but we need to use a domain admin account. Is there a way to use different credentials as we do in the "Roll out Agent to Computers" section? 

I have reviewed this document from Broadcom, but it's unclear to me which credential it actually uses.

Thank you.

[Igor Perevozchikov]

Good morning Carl Fortin!

Here is discussion about what account can be used for "Symantec Management Agent" push install on Windows computers.
https://community.broadcom.com/symantecenterprise/discussion/failed-to-logon-using-the-admin-account-access-to-the-network-resource-was-denied-getting-this-error-what-rights-do-we-use-while-using-an-account-as-seen-an-article-which-says-use-an-account-with-the-proper-rights-in-that-domain#bm93dd140b-2448-45ac-b9d6-5be7d496ccaf

For scheduled push install, you can open "Default Settings" and specify there required credentials.
Specify local administrative account which is available on each targeted windows computer, or use separate administrative domain account instead of current "NS App Identity" domain account.

Best regards,
IP.

[Carl Fortin]

Thank you so much! It's working perfectly on the server with the latest version. However, we've encountered an issue with our other server, which is running an older version; strangely, it doesn't seem to make any attempt to push the agent.

[Igor Perevozchikov]

Make sure that you specified correct schedule.
Also you can find this schedule in "Task Scheduler" on ITMS server and try to run it manually and then check Altiris Log Viewer to see if push install started, etc.

[Carl Fortin]

Thx,  I figured it out. It was a permission issue. It worked once I added read permission to the server communication profile for the user.

 

I had the following message in the logs: 

Unable to push agent to newly discovered machines.

 

The current user 'John Doe' does not have required permission 'read' to load item: 8a641c88-fe90-41dc-9fb4-10e666c14f90

   [Altiris.NS.Exceptions.AeXUnauthorizedAccessException @ Altiris.NS]

[Carl Fortin]

One last question for you, if you don't mind.
I'm importing computers from AD and creating new resources by matching the computer name. The problem is that Altiris tries to communicate using the short name instead of the FQDN. What dataclass do I need to fill to make sure Altiris is using the FQDN?

Thanks!

[Igor Perevozchikov]

Hi Carl Fortin!

Required field is "Domain" in "AeX AC Identification" data class.

I hope that you do not change any values in "AeX AC Identification" sql table directly from SQL Management studio and use a "Data Connector" to modify existing data or populate new data in this sql table.

First need to create a data connector "CSV" data source rule
Example

Create "Resource Import Export Rule" to export all required computers without Agent installed

Now create another "Resource Import Export Rule" data connector rule to import same computers without Agent installed but with manually modified columns to change them for "AeX AC Identification" sql table

Best regards,
IP.

[Carl Fortin]

I just want to clarify something about the column mappings for the export rule. What are the column names in your csv file? I do not have ResourceGuid or ResourceType in my csv. I only have the hostname, domain and some other information.

My csv looks like this:
AD Computer Name;OS;AD Domain
PC-01;Windows 10 Enterprise;Mydomain;

[Igor Perevozchikov]

Previously I described example of data connector usage, when user imported all required computers from AD using AD Import rule

therefore all my AD imported computers have own GUID and other information in "AeX AC Identification" sql table

For your case when you do not use AD Import rule to import computers and just use a csv file for first time computers import, you can try to use this "CSV" data source 

Create a "Resource Import Export Rule" data connector rule and specify there these fields (including Domain field with custom value)

Best regards,
IP.

[Carl Fortin]

Hi,

It's pretty much what I was already doing. I can confirm that the domain is properly populated in AeX AC Identification.

If you look at the logs below, you will see that for some reason Altiris is creating a new resource and trying to push the installation to that GUID instead of using the one in my import rule.

I end up with 2 computers in Altiris after running the agent push.

 

 

STEP 1:

Discovered computer details: [] => name=PC-01 (b8bcc12c-d885-4168-807f-8b5a13bc64d6), domain=Mydomain.com, sys type=Win32, os=Windows 10 Enterprise, version=10.0.19045

-----------------------------------------------------------------------------------------------------

Date: 2023-09-18 9:40:16 AM, Tick Count: 352563578 (4.01:56:03.5780000), Host Name: SERVER, Size: 408 B

Process: AeXSvc (1388), Thread ID: 180, Module: AeXSVC.exe

Priority: 4, Source: AgentPushDataWindowsDiscovery

File: C:\ProgramData\Symantec\SMP\Logs\a41.log

 

 

STEP 2:

Creating discovered resource: 'PC-01' (986d0e30-914a-4214-b3ff-e8f2d7af29f6 / 493435f7-3b17-4c4c-b07f-c23e7ab7781f)

-----------------------------------------------------------------------------------------------------

Date: 2023-09-18 9:40:17 AM, Tick Count: 352563906 (4.01:56:03.9060000), Host Name: SERVER, Size: 341 B

Process: AeXSvc (1388), Thread ID: 180, Module: AeXSVC.exe

Priority: 4, Source: DiscoverMachines

File: C:\ProgramData\Symantec\SMP\Logs\a41.log

 

 

 

STEP 3:

Failed to push the Symantec Management Agent to: 'PC-01.Mydomain' (986d0e30-914a-4214-b3ff-e8f2d7af29f6 / bd860a56-c255-45dc-aad9-543c16cb0f4b)

 

Failed to open the Service Console Manager on PC-01. Return value=0, Error:800706ba

   [System.Runtime.InteropServices.COMException @ Altiris.NS]

   at Altiris.NS.Utilities.RemoteServiceMgr.OpenSCManager(String sMachineName, Boolean bFirstTime)

   at Altiris.NS.Utilities.RemoteServiceMgr.QueryServiceStatus(String sMachineName, String sServiceName)

   at Altiris.NS.Utilities.ClientPushMgr.DoPush(PushAgentToComputersData data, DiscoveredMachineInfo dmi, String connectionName)

   at Altiris.NS.Utilities.ClientPushMgr.DiscoveryAndPush(PushAgentToComputersData data, AgentPushDataWindowsRow row, ParallelLoopState state)

 

COM Exception errcode: 0x6BA

 

Exception logged from: 

   at Altiris.NS.Utilities.ClientPushMgr.DiscoveryAndPush(Altiris.NS.Utilities.ClientPushMgr+PushAgentToComputersData, Altiris.NS.AgentManagement.ClientPushInstall.AgentPushDataWindowsRow, System.Threading.Tasks.ParallelLoopState)

   at Altiris.NS.Utilities.ClientPushMgr.Execute(Altiris.NS.Utilities.ClientPushMgr+AsyncPushRequest)

   at RuntimeMethodHandle.InvokeMethod(Object, Object[], Signature, Boolean)

   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object, Object[], Object[])

   at System.Reflection.RuntimeMethodInfo.Invoke(Object, System.Reflection.BindingFlags, System.Reflection.Binder, Object[], System.Globalization.CultureInfo)

   at Altiris.NS.TaskManagement.TaskThread.Execute(Altiris.NS.TaskManagement.TaskManagerServiceArgs, Altiris.NS.ContextManagement.ProgressContext)

   at Altiris.NS.TaskManagement.CoreTaskServiceThreadBase<T,TStartArgs>.ExecuteThreadProc(Object)

   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, Object, Boolean)

   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, Object, Boolean)

   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, Object)

   at System.Threading.ThreadHelper.ThreadStart(Object)

 

User [MYDOMAIN\user], Auth [MYDOMAIN\user], AppDomain [AeXSVC.exe]

 

-----------------------------------------------------------------------------------------------------

Date: 2023-09-18 9:40:19 AM, Tick Count: 352566265 (4.01:56:06.2650000), Host Name: SERVER, Size: 2.50 KB

Process: AeXSvc (1388), Thread ID: 180, Module: Altiris.NS.dll

Priority: 1, Source: Altiris.NS.Utilities.ClientPushMgr.DiscoveryAndPush

[Carl Fortin]

I was finally able to install the agent by setting AgentPushPreferFqdn to 1 in the core settings and mapping FQDN in AeX AC Identification in the import data.However, I'm still having problems with Altiris creating another resource.

[Igor Perevozchikov]

Here are KB articles about how it generates GUID for resource and when it will merge resources:

https://knowledge.broadcom.com/external/article?articleId=178416
https://knowledge.broadcom.com/external/article/180774/about-merging-process-altiris-agent-reso.html

Seems like manually modifying FQDN, domain name doesn't match to what NS discovers for appropriate computers when trying to resolve them by hostname in network, etc.

Better to open a support ticket to investigate all NS logs, all steps that are done and find correct way to avoid duplicate resources creation in database.

Best regards,
IP.

[Carl Fortin]

FYI: After opening a ticket with Broadcom, they found out that we need to change the column mappings to the following in order to avoid duplicate:

I have everything working now. I hope this helps others who want to do the same.