KNOWN ISSUE: Deployment Server Win32 console security does not properly pass through authenticate users from AD groups

KNOWN ISSUE: Deployment Server Win32 console security does not properly pass through authenticate users from AD groups

Problem/Symptoms

When the Deployment Server Win32 console security is enabled with imported AD group, and a user attempts to log into the console (using AD pass through authentication), they are prompted for credentials. If they do not enter the credentials it will open the console with no security rights. If they do enter in their proper credentials it opens the console with all security rights that the user should have. It also creates a new security user in the Deployment Solution console security instead of just using the group membership.

There are multiple types of environments that can cause this behavior. The following are 3 different known scenarios that exhibit this behavior:

Scenario 1

1. AD environment is set up as follows: There are two domain controllers, "parent.com", and "child.parent.com" which is a child domain of "parent.com".
2. A security group is added to "child.parent.com" domain called "Console Users".
3. A domain user is created called "Altiris" and is added to the "Console Users" group.
4. Deployment Solution 6.8 SP2 build 378 is installed with all default options.
5. Console security is enabled, and the "Console Users" AD group is given full administrative rights to the Deployment Solution console.
6. Log onto a computer that has a Win32 console installed using the account AD "Altiris" from the "child.parent.com" domain.
7. Notice how the console security prompts for the username and password. Enter that information and continue.
8. From the console select Tools > Security and notice how that user ("Altiris@child.parent.com") is now listed as a security user even though it was never added directly, but only through AD group membership.

Scenario 2

1. AD environment is set up as follows: There is one domain controller, "company.com", which was given a NETBIOS name of "MYCOMPANY" (which is different than the UPN domain name).
2. A security group is added to "company.com" domain called "Console Users".
3. A domain user is created called "Altiris" and is added to the "Console Users" group.
4. Deployment Solution 6.8 SP2 build 378 is installed with all default options.
5. Console security is enabled, and the "Console Users" AD group is given full administrative rights to the Deployment Solution console.
6. Log onto a computer that has a Win32 console installed using the account AD "Altiris" from the "company.com" domain.
7. Notice how the console security prompts for the username and password. Enter that information and continue.

Scenario 3

1. AD environment is set up as follows: There is one domain controllers, "company.com", which is set up with default settings (where the NETBIOS name is "COMPANY" which is default).
2. A security group is added to "company.com" domain called "Console Users".
3. The domain user "Administrator" is added to the "Console Users" group.
4. The domain user account of "Administrator" does not have the UPN name. Other accounts on the domain controller also might not have a UPN name, but have a SAM name. 
5. Deployment Solution 6.8 SP2 build 378 is installed with all default options.
6. Console security is enabled, and the "Console Users" AD group is given full administrative rights to the Deployment Solution console.
7. Log onto a computer that has a Win32 console installed using the account AD "Administrator" from the "company.com" domain.
8. Notice how the console security prompts for the username and password. Enter that information and continue.
9. From the console select Tools > Security and notice how that user ("Administrator@") is now listed as a security user even though it was never added directly, but only through AD group membership.

Cause

The original express.exe from DS SP2 build 378 was incorrectly caching the NETBIOS domain name in the database. Because the users were cached incorrectly they were not being identified by Active Directory.

Resolution

Solution:

1) Backup Express database and express.exe: Backup the database - usually named 'express' - before making any changes.  Make a copy of express.exe.
2) Remove improperly cached users:  Users who have attempted to login to the Deployment Console with security enabled prior to this fix will have users incorrectly cached in the database.  These users must be removed from the securityuser table. To remove these users run the following query against the SQL server:

DELETE FROM securityuser WHERE ad_user = 1 AND user_guid = ''
3)  Replace Express.exe:  Replace the original express.exe included in SP2 with the express.exe attached to this knowledgebase article. 
4) Appy License to Express.exe:  Open the license tool under your Deployment Server program files directory. (License.exe) Run the tool to license the express.exe with all applicable licenses.

Note 1:  This executable has been through the official Symantec Hotfix process and is supported by Symantec Support Services.

Note 2:  No services need to be stopped to affect this change. Only verify that console users have closed any remote sessions to the console. For locally installed consoles, this exe will need to be deployed via DS or NS once licensed.

Note 3: Changes made to express.exe in KB 38727 are also included in the express.exe attached to this KB.

What is the best way to replicate the Altiris Solutionsam web site?

Question
Our NS Servers don't have internet access. What is the easiest way to replicate the contents at SolutionSam to a local directory and keep it current without having to manually down the solutions?
Answer
Solutions are only maintained on www.SolutionSam.com/solutions/6_0. Some customers utilize a shareware product called HTTrack.. HTTrack can be used to mirror the SolutionSam site to a common local directory. It will update any changes made on www.SolutionSam.com/solutions/6_0 to the local directory automatically.http://www.httrack.com/

Scripts used to manage collections

Question
How can I find the following information about collections on a Notification Server?
The total number of dynamic and static collections.
A list of the dynamic and static collections by name.
A list of collections that have not been updated in over 7 days.
A list of collections that do not have any policies linked to them.
Answer
Displays Collections that Do not Have Policies Applied
select name [Collections without assigned policies] from vcollection where guid not in (select childitemguid from itemreference where hint like 'policyappliestocollection') and classguid like 'B8B666E1-FED3-4482-8D5A-0895658317B2' and attributes & 1 <> 1order by name asc
Collections not Updated in the Last Week

• select i.name [Collection Name], c.lastupdated [Date Last Updated], i.classguidfrom item i join collection c on i.guid = c.guid where c.lastupdated <> 1order by i.name asc

Displays Static Collection Names

• select Name [Static Collections] from item where classguid like 'B8B666E1-FED3-4482-8D5A-0895658317B2'and state like '%true%'and attributes & 1 <> 1order by name asc

Displays Dynamic Collection Names

• select Name [Dynamic Collections] from item where classguid like 'B8B666E1-FED3-4482-8D5A-0895658317B2'and state like '%false%'and attributes & 1 <> 1order by name asc

Displays a Static Collection Count

• select count(*) as name from item where classguid like 'B8B666E1-FED3-4482-8D5A-0895658317B2'and state like '%true%'and attributes & 1 <> 1

Displays a Dynamic Collection Count

• select count(*) as name from item where classguid like 'B8B666E1-FED3-4482-8D5A-0895658317B2'and state like '%false%'and attributes & 1 <> 1

Excluding/Controlling what Client MAC is reported to the DS Server

Problem/Symptoms
Many computers have multiple NICs, which can cause problems in Deployment Solution. For instance, a computer may only have one NIC connected, and Deployment Solution may report on the second NIC with no IP address, thus showing a missing IP address in the console. Clustered computers may have a single assigned MAC given to multiple computers, again causing problems within Deployment Solution if the incorrect MAC is tracked.Computers reporting multiple NICs may also encounter Deployment Server licensing issues when each NIC is assigned a separate license.
Cause
Because DS tracks a computer based only on a single NIC/MAC address, sometimes human intervention is necessary to prevent conflicts or incorrect data.
Resolution
A CustomData.ini file can be created to exclude NICs or MACs so that DS will only track the remaining NIC/MAC option. This file is created by duplicating the Dynamic.ini file, and renaming the duplicate to CustomData.ini. This can either be performed on the client computer directly, or on the server and then sent out with a job to the client computers.
First, be sure there is a [Filters] section in this file.
Since DS combines the contents of both the Dynamic.ini and CustomData.ini files, the CustomData.ini file does not need to have all the same information as the Dynamic.ini. However, for this exercise, at least the [Filters] section is required.
In this section, a line may be modified (or created) with "FilteredAdapterNameList" to include custom/unique types of adapters which should be excluded or ignored by DS (such as dial-up adapters, or WiFi adapters). The line should look something like this:

• FilteredAdapterNameList=Dial-Up Adapter,VPN,PPP Adapter

Alternatively, a "FilteredMACAddresses" line may be used to exclude certain the MAC addresses on adapters that may be otherwise legitimate. This would be the case for duplicate NICs, such as having two identical Intel NICs, where the above option would end up excluding both. This line is used to exclude specific MAC addresses, rather than a type of connection. This line should look something like this:

• FilteredMACAddresses=CCCCCCCCCCCC,FFFFFF000000,00038A000011

Finally, for those who may need it, there is one other way to filter, and that is based on user. By default, we already exclude one user, but you may add others.
The FilteredUserNames line looks like this (additional entries, as with the above options, should be seperated by commas):

• FilteredUsernames=SMSCliSvcAcct&,IWAM_

Currently, users are required to manually create a CustomData.ini file from a copy of the Dynamic.ini file and enter the MAC addresses of NIC cards that users do not want to register with Deployment Server.

Inventory Tasks not running on clients

Problem/Symptoms
A large number of clients are not running inventory. The express\inventory folder isn't getting created. Basis inventory is running successfully as are many software delivery tasks.These Inventory tasks are queued but never start.
Environment
Notification Server 6.0 SP3 R2 Inventory Solution 6.1 SP1
Cause
The inventory tasks' priority was changed from Normal to Low in order to give higher priority to Software Delivery tasks. However, because of problems with clients getting the packages to some of these Software Delivery tasks, they never complete. Because the higher priority tasks never completed, the lower priority items could never start.
Resolution
You have the option of resetting the priority of the inventory tasks back to "Normal" so that their priority level is at least equal to the priority of the Software Delivery tasks. The root cause of package downloads failing also needs to be resolved.

How do I modify AeXMachInv.exe to properly report my processor?

Question
How do I modify AeXMachInv.exe to properly report my processor? Inventory Solution incorrectly identifies my processor as "Intel Compatible".
Answer
The following process can be used to update the ProcessorDesc.ini file to include identification for a processor being labeled "Intel Compatible". This process is provided "as is" and contains no guarantees.
This process requires dbgview.exe, a debug utility from Microsoft, located here: http://technet.microsoft.com/en-us/sysinternals/bb896647.aspx.
After extracting the utility, launch it so the debug capture window is shown.
Go to Start > Run, type cmd, and click OK.
Browse to the following location: C:\Program Files\Altiris\Altiris Agent\Software Delivery\{01B54EB5-3679-4C73-9E10-E169D5A5EC59}\cache
Type the following Command line and press Enter: AeXMachInv.exe /norbin
The debug window will fill with trace information.
When the launch is complete, search within the trace elements for the word "family". There will be a series of numbers similar to the ones shown in the ProcessorDesc.ini file.
For example:
00 1111 0001 Intel Pentium 4 processor
00 1111 0010 Intel Pentium 4 processor Special
00 1111 0011 0100 Intel Pentium 4 processor

Check against the contents of the ProcessorDesc.ini file to see if the number sequence is already contained therein. The file is contained under \\NotificationServer\NSCap\Bin\Win32\X86\Inventory Solution\.
If it is not, add the number sequence followed by the name of the processor (that is, Intel Pentium M Mobile Processor or AMD Athlon). What you list here is what will be used for the identity of that processor. Note: You should add the sequence and identifier under the proper category (Intel's the first section, AMD the second, and so on).
Save the file. Once saved, you can manually update the Distribution Point for the package so the changes in the file are detected and the file is updated on the target client computers, or wait for it to automatically update. The next time Inventory runs, the new entry will be used using the identifier provided.

Active Directory Synchronization doesn't appear to be working 6.1

Problem/Symptoms
Computers that are deleted from Active Directory are not being deleting from the Notification Server database.
Cause
There can be several reasons that computers may not be deleted from the Notification Server database after being removed from Active Directory.
If the computer is set to a status other than Active, it will not be removed.
If the Import Rule that the computer was deleted with no longer exists, the computer will not be removed.
If the computer was never imported by the Microsoft Active Directory Component, it will not be removed.
If the computer shows that it has been deleted in the ItemResource table.
Directory Synchronization does not remove computers that are managed; it lets Purge Maintenance take care of those computers.
Resolution
Run the following SQL to determine the reason that the computers are not being deleted then do the appropriate action to correct it.

Select i.guid, i.name as 'Computer Name', 'Reason' = Case When ra.ResourceAssociationTypeGuid = '3028166F-C0D6-41D8-9CB7-F64852E0FD01'and childresourceguid not like '0A0203A5-D2B6-49F1-A53B-5EC31A89437C'Then 'Computer is not active'When i.guid in(select ii._resourceguidfrom inv_import_rule_imported_items iijoin item i on i.guid = ii._resourceguidwhere _resourceguid not in(select _resourceguidfrom inv_import_rule_imported_itemswhere importruleguid in(select guidfrom itemwhere classguid = 'B2378265-2779-49E6-998D-8BE620B3D9D9'))and i.classguid = '539626D8-A35A-47EB-8B4A-64D3DA110D01') Then 'Import Rule no longer exists' When i.guid not in (select i.guid from item i join inv_import_rule_imported_items ii on ii._resourceguid = i.guid Where i.classguid = '539626D8-A35A-47EB-8B4A-64D3DA110D01') Then 'Computer does not have import information (Generaly means it was not imported)' When i.guid in (select guid from itemresource where deleted = 1) Then 'The resource shows that it has been deleted in the ItemResource table' When i.guid in (Select guid from vcomputer Where ismanaged = 1) Then 'Directory Synchronization does not remove machines that are managed it lets Purge Maintenance take care of those computers.' Else 'This computer WILL be deleted when removed from Active Directory' end from vitem i left join resourceassociation ra on ra.parentresourceguid = i.guid where i.classguid like '539626D8-A35A-47EB-8B4A-64D3DA110D01' order by 'reason'

The resolution will depend on the cause. A report (you can find ite here) can be imported to help simpify the process.
If the computer is set to a status other than Active, it will not be removed. Find the computer in a report or collection and change the status back to Active or Delete it.
If the Import Rule that the computer was deleted with no longer exists, the computer will not be removed. Run the resolution in article 1815 to associate the computer with a current rule or delete it from the report.
If the computer was never imported by the Microsoft Active Directory Component, it will not be removed. Wait for Purge Maintenance or manually delete the computer.
If the computer shows that it has been deleted in the ItemResource table. Manually delete the computer from a report or collection.
Directory Synchronization does not remove computerss that are managed; it lets Purge Maintenance take care of those computers. Wait for Purge Maintenance or manually delete the computers.
If there is a problem with the schedule it may also help to disable and renable the Directory Synchronization task through the Altiris console.
Upgrading to the Microsoft Active Directory Component 6.1.x Resolves this problem if a previous version is currently installed.

Thx Gert

Fixing the Owner of DB Objects

Depending on the way you have your SQL database security set up you may end up with stored procedures and other objects having an owner other than dbo. The typical case of this happening is when running the upgrade with an account that is not an SA on the SQL Server.
If unresolved, this naming issue can give you grief. Here's a way to fix it.
This ownership issue will ultimately end up in causing a lot of errors such as the Deployment Console not opening or certain tasks failing. Basically anything that tries to call the stored procedure will fail because the name is wrong. For example: A stored procedure in the DS database called dbo.del_computer may have its name changed during an upgrade to username.del_computer.


To fix this situation run the following SQL script. Change the USERNAME to whatever the owner is for the objects that need to be changed.DECLARE

@OldOwner sysname,
@NewOwner sysname
SET @OldOwner = 'USERNAME'
SET @NewOwner = 'dbo'
DECLARE CURS CURSOR FOR
SELECT name FROM sysobjects WHERE type = 'p' AND uid = (SELECT uid FROM sysusers WHERE name = ldOwner) AND NOT name LIKE 'dt%' FOR READ ONLY

DECLARE @ProcName sysname
OPEN CURS
FETCH CURS INTO @ProcName
WHILE @@FETCH_STATUS = 0
BEGIN
IF @@VERSION >= 'Microsoft SQL Server 2005'
BEGIN
EXEC('alter schema ' + @NewOwner + ' transfer ' + @OldOwner + '.' + @ProcName)
exec('alter authorization on ' + @NewOwner + '.' + @ProcName + ' to schema owner')
END
ELSE
EXEC('sp_changeobjectowner ''' + @OldOwner + '.' + @ProcName + ''', ''' + @NewOwner + '''')
FETCH CURS INTO @ProcName
END
CLOSE CURS
DEALLOCATE CURS

But this will fix only the Stored Procedures so you need to fix other "types" such as F, V
So run this this querie at least 3 times.

Helpdesk : Customizing The Winuser Console (SP5)

WooHoo! Looks like Helpdesk pro David Falcon spent his holiday break customizing his company's helpdesk. If you've ever wanted to "tune" the forms in your helpdesk or just add your company logo to its pages, read on to follow David's lead at Juice Link