Failed to copy 'Symantec Management Agent install service'

[Clint]

I'm running SMP 7.1 SP2 MP1.1 and trying to troubleshoot a client deployment issue on some Windows 7 Pro systems.  Getting the error as indicated in the title of this post where I'm using domain admin credentials for the SMA pushes.  Target systems have domain admins listed in the Administrators group and no problem accessing the $Admin share.  Any ideas why my Altiris client pushes aren't flying on some PCs?

[andykn101]

Check the log on the NS, it often has more information.

[Migration User]

Symantec Management Agent (SMA) - Failed to copy ' Symantec Management Agent Install service'

 

Article:TECH195731

|

Created: 2012-08-28

|

Updated: 2013-03-04

|

Article URL http://www.symantec.com/docs/TECH195731

 

[Clint]

Got the following a.log entry from my server after attempting to push the SMA to a PC which was rebooted beforehand.

<event date="Jan 30 23:50:57 +00:00" severity="2" hostName="CCHSMP1" source="Altiris.NS.Utilities.RemoteServiceMgr" module="AeXSVC.exe" process="AeXSvc" pid="2012" thread="90" tickCount="1334494422"><![CDATA[Failed to copy the eXpress Client service to \\HFD_ASB24.cchnl.hnl\ADMIN$\AltirisAgentInstSvc.exe. Error:The network path was not found.
 This type of failure can occur if a client push is currently in progress or has completed but some files are still locked. This problem can typically be solved by rebooting the computer]]></event>

Getting closer to the source of the problem because although I can get to the workstation's Admin$ share from my PC, found that I can't from my SMP server itself.  Any ideas why?

[Migration User]

Check the link below for more details, ianatkin commets:

https://www-secure.symantec.com/connect/forums/issue-installation-symantec-management-agent-70-windows-7

[Clint]

Using Domain Admin credentials, I tried accessing the Admin$ share on a Win7 Pro box from 3 different Windows 2008 R2 servers prepped by 3 different groups of server admins but was unable to get to it.  However, I mentioned in my original post that I'm able to get to this same admin share via my Win7 Pro workstation (again, logged in with DA account) so you'd think there's something I have to tweak in W2k8 but what?

Note that I am able to get to some admin shares from my SMP server as I've pushed the SMA to about 1200 Win7 machines thus far.  Don't think this is a DNS issue since connection to the admin share fails even when using an IP address, and disabling UAC on my SMP server doesn't make a difference.  Perhaps the affected Win7 systems are blocking admin share access but why can I get to these same systems with my Win7 PC?

Oh...in any of the SMA deployment docs, has anyone seen whether disabling UAC on the targets was a requirement?  I don't even recall seeing disabling the firewall as being a requirement although in this case, the Win7 client I can't get to from my SMP server already had it off.

[andykn101]

Perhaps the Windows firewall settings in Group Policy. allow selective access from IP ranges or by certain accounts.

run

gpresult /h gpresult.html

on your Win7 boxes.

[Clint]

I found the problem!  Our security guys had put firewalls in place to block client access from our VLAN backbone where most of our servers are to certain subnets in our network.  Didn't realize they had made an exception for my old Altiris 6 server years ago.  After they added my SMP server into their exceptions list, I can now get to the admin share of clients I weren't able to access before!

Anyway, I was almost going to open up a case with Symantec Tech Support although wasn't sure if they'd even help since not being able to access the admin share is technically not an Altiris problem.  Sorry for not thinking of this network firewall issue sooner but I do appreciate everyone chiming in.