What to know about SWD 6.1SP2

Things to Know for 6.1 SP2
In Software Delivery Solution Task Server Plug-in, the Post Program Run Actions are handled through the Task Server
In Software Delivery Solution Task Server Plug-in, the post program run actions, such as No action required, Restart computer, and Log off user are handled by the Task Server. The After Running drop-down list on the Programs tabview of the Packages page lists all the post program run actions.

On the Task Server a Task Server Power Management task needs to be added to a job. The Task Server Power Management task takes care of post program run actions that are required to be carried out.


Installation, Upgrade, and Uninstallation
Prerequisites
On the Target Computer
Altiris Agent
Client Task Agent 2.3
On the Notification Server
Notification Server 6.0 SP3 or later

For Software Delivery Task Server Plug-in
Altiris Task Management 6.0

Software Delivery Solution 6.1 SP 1 or later

Custom Console 6.5 and Custom Console Data 6.5

Application Metering and Software Delivery Updated

Most bug fixes....for App Metering

SWD 6.1SP2 :
Release Notes
What's New in this Release

What is New in this Release?
Updated User Interface for Data Purging
Software Delivery Solution Task Server Plug-in

Known Issues
The following are unresolved issues and workaround instructions for issues in this release:

Known Issue Article ID
Software Portal functions incorrectly due to the unregistered MSCOMCTL.OCX file 26018
A duplicate copy of software delivery package is created on the client computer 26021
Clicking a New Program tool opens a Software Delivery Program Page 26245
Deliver Software task fails the first time for the packages that have Package Servers option set to manual pre-staging 26244

What are the 'Known Issues' in DS 6.8?

Known Issues

Why do I receive a "Server Error in '/Altiris/NS' Application after instaling KB23784 (R2)?

After installing KB23784 (R2) onto five NS SP3 computers, I found that I could no longer access the Altiris Console on two of them

How to determine which Dell systems may have a battery for recall.

How to determine which Dell systems may have a battery for recall.

---

Question
	How do you determine which systems in your environment may have a battery that needs to be replaced with the Dell laptop battery recall?

---

Answer

You can run the following SQL query. NOTE: This query requires that your Notification Server have the Dell Client Manager installed. Select vc.[name] AS 'Computer Name', bat.[name] AS 'Battery', bat.[SerialNumber] AS 'Serial Number' FROM vComputer vc Inner Join dbo.Inv_OMCA_Battery bat on vc.Guid = bat._ResourceGuid Inner Join (SELECT DISTINCT ResourceGuid FROM CollectionMembership cm Inner Join dbo.Dell_OMCA_SupportedModels sm on cm.Collectionguid = sm.Collection AND sm.ID LIKE '%Latitude%' OR sm.ID LIKE '%Inspiron%' OR sm.ID LIKE '%Precision%' OR sm.ID LIKE '%XPS%') A on vc.Guid = A.ResourceGuid WHERE bat.[Name] LIKE '%C5340%' OR bat.[Name] LIKE '%D6024%' OR bat.[Name] LIKE '%JD616%' OR bat.[Name] LIKE '%U586%' OR bat.[Name] LIKE '%7X5333%' OR bat.[Name] LIKE '%3K590%' OR bat.[Name] LIKE '%C5446%' OR bat.[Name] LIKE '%D6025%' OR bat.[Name] LIKE '%JD617%' OR bat.[Name] LIKE '%U5882%' OR bat.[Name] LIKE '%X5875%' OR bat.[Name] LIKE '%59474%' OR bat.[Name] LIKE '%C6269%' OR bat.[Name] LIKE '%F2100%' OR bat.[Name] LIKE '%KD494%' OR bat.[Name] LIKE '%W5915%' OR bat.[Name] LIKE '%X5877%' OR bat.[Name] LIKE '%59474%' OR bat.[Name] LIKE '%C6270%' OR bat.[Name] LIKE '%F5132%' OR bat.[Name] LIKE '%M3006%' OR bat.[Name] LIKE '%X5308%' OR bat.[Name] LIKE '%Y1333%' OR bat.[Name] LIKE '%C2603%' OR bat.[Name] LIKE '%D2961%' OR bat.[Name] LIKE '%GD785%' OR bat.[Name] LIKE '%RD857%' OR bat.[Name] LIKE '%X5329%' OR bat.[Name] LIKE '%Y4500%' OR bat.[Name] LIKE '%C5339%' OR bat.[Name] LIKE '%D5555%' OR bat.[Name] LIKE '%H3191%' OR bat.[Name] LIKE '%TD349%' OR bat.[Name] LIKE '%X5332%' OR bat.[Name] LIKE '%Y5466%'

 

 

Solution Removal Tool (Removes Solution from Database)

Problem

Sometimes after uninstalling a solution from either the Add/Remove Programs or from the Solution Center you find that this has not removed the solution completely from the Database.  Some symptoms that you will see is referrences to the Solution in the Tree Structure on the Notification Server Admin Console.  You may also see a refference to the Solution when attempting to view the GetLicenseDetails.aspx page which would returns a ASP Dump.

---

Environment

---

Cause
	At this time the root cause is undetermined.  It may be a combination of things including SQL Deadlocks or Security.

---

Resolution

Use the following Solution Removal Tool.  In the sample below this will remove Web Administrator for Windows from the Altiris Database.  Please remeber when running this tool to select the correct database to run the query against.  Please note that you use this Removal Tool at your own risk, Database backup is higly recommended before running. Change the @Guid to the Product Guid of the solution you wish to remove: DECLARE @GUID varchar(40) REM Replace GUID with Product GUID of the Solution you wish to Remove from the Altiris Database SET @GUID = '{B2CF75A5-C442-4945-A979-1EAFDD182A76}'   Delete from Item where Guid = @Guid Delete from Item where ProductGuid = @Guid Delete from Item where SecurityGuid = @Guid Delete from ItemClassUserCreatable where ProductGuid = @Guid Delete from ItemDeleted where ItemGuid = @Guid Delete from ItemNameCache where ItemGuid = @Guid Delete from LicenseStatus where ProductGuid = @Guid Delete from SecurityACE where EntityGuid = @Guid Delete from SecurityACEChanged where EntityGuid = @Guid Delete from SecurityEntity where Guid = @Guid Delete from String where BaseGuid = @Guid Delete from StringCacheRN where BaseGuid = @Guid

Script to install SVS Agent

Question
How do you do a silent install of the Software Virtualization Agent?

Answer

Run the following from a command line or in a script:
msiexec.exe /qb? /i \Software_Virtualization_Agent.msi PRODUCT_KEY=

Replace:

= Path to folder containing Software_Virtualization_Agent.msi
= Your SVS product key in xxxx-xxxx-xxxx-xxxx format

Altiris licensing technical FAQ

All the technical questions about license usage can be read here

DS Console slow to load, freezes, or users in AD groups don't have correct rights in the console after console opens

A) OU Structure is usually the biggest cause of this. When a user object exists in a Sub OU that is too deep or the Sub OU has commas in it, the DS Console will display the following symptoms:
Slow load for the console.
Cannot log onto the console.
Console freezes when security is enabled.
When logged on, the user has no rights even though AD group has the correct rights set.

B) DNS Queries can have issues when running in an isolated environment. This is usually displayed by a DS Console taking 2-5 minutes to log into.



--------------------------------------------------------------------------------
Resolution


There is a new express.exe that fixes most of these issues. Attached is that .EXE in ZIP format. This express.exe will need to be licensed with a valid eXpress license. DS 6.5 SP1 needs to be installed prior to this fix.

You can download the .EXE from the KB When clicking on this link

How to compress WinPE PXE Images

You can create a compressed WinPE PXE Image in an SDI file. This will reduce the image size by 35 percent. A PXE Image that is normally 145 MB will be reduced to 95 MB

You find more info in this KB of Altiris

Link to : Using Software Delivery Solution to Install Internet Explorer ActiveX Compatibility Patch for Mshtml.dll

http://kb.altiris.com/article.asp?article=21749&p=3

This article contains a download link to the XML ( at the right side of the page )

Installing/Updating Aclient + custom settings with Altiris job

From the deployment console, use the remote agent installer tool, change the agent settings the way you want them, by clicking the change settings button, Add a test computer but dont click the finish button, click on export, this will export clients.rci file which holds the settings, then rename that clients_pcname.inp file
to Aclient.inp. You can do two things with the Aclient.inp.
Create a deployment job to install the Aclient using these settings by running something like
Aclient.exe aclient.inp -Install -Silent
Or if you just want to change settings and not install aclient,, create a copy job in DS
Point the file to copy to the aclient.inp
use the destination just like
settings:aclient.inp

Thx Tim.

Steve Gibson made a GPO for this, you can find more info at : Steve's site
Thx Steve

Helpdesk: These common words were ignored:" every word we search for"

Here is what I suggest you try, keeping in mind all the best practices concerning backups and testing and not suing me if something goes wnrgo:

Using SQL Enterprise Manager, expand the incident database (usually Altiris_Incidents), then click on Full-Text catalogs. There should be one: HD_workitem_comment. Right-click on that and choose " Rebuild catalog" .

Also, find the workitem table in Tables and right-click on that. Drill into the Full-Text Index menu and make sure Change Tracking and Update Index in Background are checked. That' s what keeps the full-text index up to date.

SQL 2005 has a new UI that is a little different but the same basic capabilities are there: look under the Storage folder to find the full-text catalog. The Full-Text Index menu for the workitem table has Track Changes Automatically available as a choice if tracking hasn' t been turned on.

It seems like SP3 doesn' t correctly turn that tracking on for SQL 2005 when you create a new database. I don' t know why it would turn it off on sql 2003 or 2000 if it was on previously. Are these new databases that you' re seeing the problem in?

Receiving an error involving pending file operations while installing SVS

You can find more info about this error at the forum

Forum Link

Thanks Stephane ;-)

Deployment Solution 6.5 Hardware Independent Imaging

here you can find how to make an hardware independent image for to be used with Deployment Server 6.5 and Sysprep

http://kb.altiris.com/article.asp?article=21224&p=3

Using Software Delivery Solution to Install Internet Explorer ActiveX Compatibility Patch for Mshtml.dll (MS06-013)

Using Software Delivery Solution to Install Internet Explorer ActiveX Compatibility Patch for Mshtml.dll
Problem
The Altiris Console reacts differently to ActiveX Controls after installing the patches included in Microsoft's KB article 912945, "Internet Explorer ActiveX update," or KB912812, "MS06-013: Cumulative security update for Internet Explorer."
Environment
Microsoft Windows XP Service Pack 2
Microsoft Windows Server 2003 Service Pack 1 (SP1)
Notification Server 6.0 SP3 (6.0.6074), older versions will most likely react to the ActiveX update in the same way.
Cause
Microsoft made minor changes to the way that Internet Explorer handles some Web pages that use ActiveX controls. See Microsoft Security Advisory (912945) published Feb 28,1006:

http://www.microsoft.com/technet/security/advisory/912945.mspx

and press release:

http://www.microsoft.com/presspass/press/2003/oct03/10-06EOLASpr.mspx
Resolution

Install Microsoft Compatibility Patch KB917425 Internet Explorer ActiveX compatibility patch for Msdhtml.dll. See:

http://support.microsoft.com/kb/917425/en-us

Note: You only need to install this patch if you have previously installed the KB912945 or KB912812 patches. This patch should give you an error if you have not previously installed one of the other two patches. The preferred method of installing these patches is to follow the instructions on the Microsoft Web site, especially for your Microsoft 2003 Server computers.

However, to help facilitate the installation of these patches, you may download the attached Compatibility Patch (KB917425).xml file that contains two Software Delivery Tasks that utilize the same Software Delivery Package and import it into your Notification Server console.

Download both the Windows 2003 and Windows XP patch files from the URL above. The two filenames are:
WindowsServer2003-KB917425-x86-ENU.exe
WindowsXP-KB917425-x86-ENU.exe

Place these two files in a folder that is local to your NS server.
Import the Compatibility Patch (KB917425).xml file by right-clicking on a suitable location in your Console and selecting import. A good location might be the Task tab > Software Management > Software Delivery > Windows > Software Delivery Tasks.
Modify the Package Location: field in the "ActiveX Compatibility Patch (KB917425)" package to point to the folder you created in step 1.
Apply the change and be sure to "Update Distribution Points".
The tasks are set to apply to the "All 32-bit Windows 2003 Servers"/"All 32-bit Windows XP Computers" collections. If the KB912945 or KB912812 patches are not installed on the computers in these collections, you will need to modify the Applies to collections: field appropriately.
Enable the tasks.

Items to help improve Console and Server performance in Notification Server

QuestionWhat can be done to improve the speed of the Notification Server and Altiris Console? What items can increase efficiencies?

Answer
Disabling Alert Manager Synchronization
How to Disable Alert Manager and Notification Server synchronization: below are the registry changes needed to disable the synchronization functionality of AlertManager/Helpdesk. This has proved to produce performance improvements on busy notification servers where AlertManager/Helpdesk asset and contact synchronization from the Notification Server is not required.
Using regedit, add the following two REG_SZ entries :
HKLM\Software\Altiris\eXpress\Helpdesk Package\DisableAutoUpdateProcessing = true
HKLM\Software\Altiris\eXpress\Helpdesk Package\DisableSyncIncidentProcessing = true
Stop the Altiris Service (AeXSvc.exe) and the Altiris Client Message Dispatcher service.
Go to Start > Run, and type "iisreset" and click OK. This will recycle IIS, including the worker process.
Start the Altiris Service (AeXSvc.exe) and the Altiris Client Message Dispatcher service.
Increasing SQL Performance by defragging the SQL indices
Several defrags can increase SQL performance.

1. SQL script to defrag all database indices for the Altiris database:


declare @index_name nvarchar(255)
declare @table_name nvarchar(255)
declare index_cursor cursor for
select
si.name as index_name,
object_name(si.id) as table_name
from sysindexes si
left outer join sysobjects so on so.name=si.name
where objectproperty(si.id, N'IsUserTable') = 1
and objectproperty(si.id, N'IsUserTable') = 1
and si.name <> object_name(si.id)
and si.impid <> -1
open index_cursor
fetch next from index_cursor into @index_name, @table_name
while @@FETCH_STATUS = 0
begin
print 'Attempting defrag of index [' + @index_name + '] on table [' + @table_name + ']'
dbcc INDEXDEFRAG( 0, @table_name, @index_name )
fetch next from index_cursor into @index_name, @table_name
end
close index_cursor
deallocate index_cursor

2. The above script defrags all the indices used in the Altiris database. Run this against the Altiris database using SQL Query Analyser or other SQL scripting tool.

3. Defrag SQL data and log volumes. Post upgrade the log files of the Altiris database can be heavily fragmented. Use Enterprise Manager or similar SQL management tool to defrag these volumes to greatly improve SQL performance Post-upgrade.

SQL Configuration Optimization

The following items can increase SQL performance, thus increasing the speed of the Notification Server and the Altiris Console.

An I/O is generally a separate hard drive. This is not true when using ATA/IDE drives and the two drives are mastered and slaved. Consequently, the hard drives would need to be on separate IDE/ATA ribbon cables. For SCSI, two separate drives can be on the same SCSI cable.
In SQL enterprise manager open the database properties.
In the Data Files and Transaction Log tabs, note the current location of the .MDF and .NDF (if used) data file(s) and the .LDF transaction log file(s).
Close the properties and right-click on the database > All Tasks > Detach Database.
Once the database is detached, manually move the .MDF, .NDF (if used), and .LDF files.
One of the suggestions from Altiris development is to place the .LDF file(s) on a separate physical disk from the data file(s). This should allow transactions and data reads and writes to operate independently and concurrently.
After moving the .MDF, .NDF (if used), and .LDF files on the various drive locations, reattach to the database.
Open SQL enterprise manager, right-click on the Databases folder > All Tasks > Attach Database.
Use the ellipsis button ( … ) to browse to the current location of the .MDF file. This will populate a list of all the data files and their physical locations. The .MDF will be set based on the current location based on browsing with the ellipsis button. However, all the other data files will retain their paths as it knew them before the database was detached.
Each path location will need to be corrected for the new location of that file until the red X turns into a green checkmark.
Once all the file path locations have been set correctly, make sure that the database is the correct database name.
Click Verify and then, if that does not bring any errors, hit OK.
The database will not be using the new locations for each of the files. This should be verified by the properties of the database on the Data Files and Transaction Log tabs.
Another suggestion that comes from SQL is to move the tempdb to a FAST I/O physical disk drive. This makes a lot of sense given how heavy Altiris uses the tempdb (anytime a temporary table is created). If the server has three physical disks, the operating system should be on one, most of the database files on the other, and the third, with the fastest I/O, should have the transaction logs and tempdb data files.
Moving the tempdb data files is done a little differently than moving data files of other database because the tempdb cannot be detached. Microsoft provided a different way to do this for the tempdb database only.
In Query Analyzer run this command (substitute the correct drive and folders, placing these files on a fast I/O drive)
ALTER DATABASE tempdb modify file (name=tempdev, FILENAME= ‘e:\SQLDATA\tempdb.mdf’)
ALTER DATABASE tempdb modify file (name=templog, FILENAME= ‘e:\SQLDATA\tempdb.ldf’)
Stop and restart SQL Server service
Verify that the new tempdb.mdf and tempdb.ldf files have been created. Then go ahead and delete the older original copy.
If there are more than three physical disks available it is possible to split a little further. Spanning the tempdb data files across multiple physical disks increases performance further.

Microsoft Recommended SQL Optimizations
The following are optimizations recommended by Microsoft for increased performance of SQL in general.

Optimizing Transaction Log Performance. General recommendations for creating transaction log files include:
Create the transaction log on a physically separate disk or RAID (redundant array of independent disks) device. The transaction log file is written serially. Therefore, using a separate, dedicated disk allows the disk heads to stay in place for the next write operation.
Set the original size of the transaction log file to a reasonable size to prevent the file from automatically expanding as more transaction log space is needed. As the transaction log expands, a new virtual log file is created. Write operations to the transaction log wait while the transaction log is expanded. If the transaction log expands too frequently, performance can be affected.
Set the file growth increment percentage to a reasonable size to prevent the file from growing by too small a value. If the file growth is too small compared to the number of log records being written to the transaction log, then the transaction log may need to expand constantly, affecting performance.
Manually shrink the transaction log files rather than allowing Microsoft SQL Server 2000 to shrink the files automatically. Shrinking the transaction log can affect performance on a busy system due to the movement and locking of data pages.
Optimizing tempdb Performance - General recommendations for the physical placement and database options set for the tempdb database include:
Allow the tempdb database to automatically expand as needed. This ensures that queries that generate larger than expected intermediate result sets stored in the tempdb database are not terminated before execution is complete.
Set the original size of the tempdb database files to a reasonable size to avoid the files from automatically expanding as more space is needed. If the tempdb database expands too frequently, performance can be affected.
Set the file growth increment percentage to a reasonable size to avoid the tempdb database files from growing by too small a value. If the file growth is too small compared to the amount of data being written to the tempdb database, then tempdb may need to expand constantly, thereby affecting performance.
Place the tempdb database on a fast I/O subsystem to ensure good performance. Stripe the tempdb database across multiple disks for better performance. Use file groups to place the tempdb database on disks different from those used by user databases

Microsoft .NET Frequently Asked Questions (FAQ)

Question
This article (taken from the "Microsoft .NET FAQs" help topic in Wise for Windows Installer and the Windows Installer Editor) answers questions about Microsoft .NET and defines important concepts you should understand before you use Wise for Windows Installer or the Windows Intsaller Editor to build .NET installations.

Answer
What does the common language runtime do?
The common language runtime manages the execution of code and provides services such as cross-language integration, code access security, object lifetime management, and debugging and profiling support. See Common Language Runtime in the MSDN Library.

What's the difference between managed and unmanaged code?
Code developed with a language compiler that targets the common language runtime is called managed code. All code based on Microsoft intermediate language (MSIL) executes as managed code. Managed code is self-describing; it contains metadata that describes every element managed by the common language runtime. The runtime uses the metadata to provide services.

Code that runs outside the runtime and does not contain metadata is called unmanaged code. Examples of unmanaged code are COM components, ActiveX interfaces, and Win32 API functions. Unmanaged code executes in the common language runtime environment with minimal services.

I don't want to rewrite all my applications as managed code. Can I add managed code to an existing application?
Few developers will be able to rewrite existing applications completely as managed (.NET) code. Instead, you can combine managed and unmanaged components in one installation. Code that contains a mix of managed and unmanaged elements is called interoperable code.

The common language runtime supports COM interoperability (interop). For backward compatibility, COM interop provides access to existing COM components without requiring you to modify the original components. COM interop also enables your COM clients to access managed code as easily as they access other COM objects. This is accomplished by adding information to the system registry so .NET components are called as though they were COM components. At runtime, the common language runtime marshals data between COM objects and managed objects as needed.

See Interoperating with Unmanaged Code in the MSDN Library.

What is an assembly?
An assembly is the primary building block of a .NET application. An assembly contains its own naming, binding, versioning, deployment, and configuration information. It consists of two elements: a manifest, which is the metadata that describes information about the assembly and any resources it depends on; and a set of instructions in the form of Microsoft Intermediate Language (MSIL) code that is executed when the assembly is referenced.

You can group assembly elements into a single file assembly, which incorporates the manifest into a portable executable (PE) file, which can be an .EXE or .DLL, with the source code. You also can create a multifile assembly consisting of modules of compiled code, resources, or other files required by the application. In a multifile assembly, the manifest can be a standalone file or it can be incorporated into one of the PE files in the assembly.

When you add a .NET assembly to an installation, Wise for Windows Installer creates entries in the MsiAssembly and MsiAssemblyName tables.

See Assemblies in the Windows Installer SDK Help.

How does .NET reduce file sharing conflicts?
An important benefit of .NET installations is the reduction of file sharing conflicts. With the common language runtime, the assembly is described by a manifest; the registry is no longer relied upon for storing and accessing the COM activation data. This allows components to be fully isolated from each other.

Assembly sharing is accomplished in a number of ways:

To install .NET assemblies that are intended to be shared by many applications on the computer, make sure they are strongly named and install them into the Global Assembly Cache, which is a machine-wide code cache. Do not install assemblies into the Global Assembly Cache unless they specifically need to be shared. The Global Assembly Cache is available only if the .NET Framework is installed on the destination computer.

To safely share COM or Win32 assemblies among multiple applications and to minimize .DLL conflicts, use side-by-side assembly sharing. Instead of having a single version of an assembly that assumes backward compatibility with all applications, side-by-side assembly sharing enables multiple versions of a COM or Win32 assembly to run simultaneously on the system. Side-by-side assembly sharing is available only on Windows XP or later. See Side-by-Side Assemblies in the Windows Installer SDK Help.

To reserve a Win32 assembly for the exclusive use of one application, install it in a folder private to the application, typically the application directory. This is called a private assembly. The dependency of the application on the private assembly is specified in an application manifest file. On operating systems earlier than Windows XP, a copy of the private assembly and a .local file is installed into a private folder for the exclusive use of the application. A version of the assembly is also globally registered on the system and made available for any application that binds to it. The global version of the assembly can be the version installed with the application or an earlier version.
I thought .NET meant I could use XCOPY to install applications without registration. Why do I need to build a Windows Installer installation?
For a .NET application that uses only managed code and private assemblies, the installation process can be as simple as copying files to the destination computer. Most developers, however, will still need to create a compressed, single-file installation that is easy to deploy and that provides a friendly interface to the end user.

.NET applications that use shared assemblies, or that have a mix of managed and unmanaged code, cannot be installed via XCOPY. You should use the Windows Installer service for installations that do any of the following:

Install COM files
Install assemblies to the Global Assembly Cache
Require user information during the installation
Require security
Create a shortcut
Require elevated privileges to install on a locked-down computer
By creating a Windows Installer installation for your .NET applications, you can take advantage of the services Windows Installer provides: installation, repair, and removal of assemblies; roll back; install-on-demand; patching; and advertisement.

How does Wise for Windows Installer support .NET installations?
Wise for Windows Installer lets you install .NET assemblies into the Global Assembly Cache, or as side-by-side or private assemblies. It also lets you create mixed installations by registering .NET assemblies with COM.

If the .NET Framework is installed on your computer, Wise for Windows Installer can automate the process as follows:

Find all files in multifile assemblies and add them to the installation.
Scan for assembly dependencies and add them to the installation.
Determine attributes for registering the assembly files and add them to the MsiAssemblyName table.
Add registry keys for COM interop.

How to use the Import/Export Utility for NS

More info can be found at KB Altiris

Package server Security, Installer, and Collection Definition Hotfix

Problem

Section 1—Summary

This update, when installed on Notification Server SP3, replaces the existing Package Server Agent package. Package Servers in your environment need to be upgraded to this version for any update changes to apply. This update contains the following:

· Install, upgrade, and uninstall of Package Server Agent through Wise Installer. This was previously performed by Installshield.

· Registry key added to control whether or not the Package Server Agent can manage/change the security on its package directories.

· All Windows Computer requiring Altiris Package Server Agent Upgrade collection updated to only include Package Servers with Altiris Agent build 6.0.2338 (SP3), or greater.

Section 2—Installation

Name: Notification Server 6.0 SP3 Update 17613

Prerequisite software:

· NS build 6.0 SP3 Version 6.0.6074.

· Altiris Agent SP3 Version 6.0.2338 installed on Package Server.

IMPORTANT: The updated Package Server is not compatible with Altiris Agent versions earlier than 6.0.2338.

2.1—Install the Update
1. Download ftp://ftp2.altiris.com/Download/KB17613/Altiris_NS_6_0_SP3_KB17613.exe

to your Notification Server.

2. Run Altiris_NS_6_0_SP3_KB17613.exe.

2.2—Uninstall the Update
If, for any reason, you need to uninstall the update, the Notification Server will restore the original SP3 version of the Package Server Agent package. You can remove this via the ADD/REMOVE Programs option in the Control Panel on the Notification Server.

IMPORTANT: All updated Package Server Agents rolled out must be uninstalled before uninstalling the update on the Notification Server.

2.3—Upgrading Package Servers
The All Windows Computer Requiring Altiris Package Server Agent Upgrade collection that applies, by default, to the Windows Package Server Agent upgrade task, will not contain Package Servers with an Altiris Agent version lower than 6.0.2338 (SP3). Once the Altiris Agent has been upgraded on the Package Server, they will appear in this collection.

When the Windows Package Server Agent upgrade task is run, the upgrade will take approximately 15–20 seconds. Do not be concerned if the Altiris Agent does not start back up immediately after the upgrade task has run; this pause is expected.

Note: If the Package Server Agent is accidentally upgraded before the Altiris Agent, (which may happen if you are using a collection other than the All Windows Computer Requiring Altiris Package Server Agent Upgrade collection) the Altiris Agent and Package Server will not function or run Software Delivery tasks until the Altiris Agent has been upgraded to the required version. To do this, go to the Altiris Agent Installation page on the Notification Server and push out the Altiris Agent to the computer. This will carry out an upgrade of the installed Altiris Agent, and both the Altiris Agent and Package Server will then function normally.

Section 3—New Features and Enhancements in this Update
3.1—Package Server using Wise Installer
The install, upgrade and uninstall of the Package Server Agent is now done by Wise Installer; it was previously done by Installshield. There is a known issue with Installshield Version 10.5 that causes installations to fail on some systems with terminal services enabled with the following error message:

An Error (-5006 : 0x80004005) has occurred while running the setup. Please make sure you have finished any previous setups and closed other applications. If the error still occurs, please contact your vendor: Altiris.

For information, see http://community.installshield.com/showthread.php?threadid=109023

3.2—Package Server Agent Upgrade Collection
The Windows Computers requiring Altiris Package Server Agent Upgrade collection that applies, by default, to the Windows Package Server Agent Upgrade Software Delivery task has been modified.

Previously, the collection didn’t check for Altiris Agent Version 6.0.2338 (SP3) or higher. This resulted in the SP2 Altiris Agent Version 6.0.1508 being eligible for the SP3 Package Server Agent Upgrade. The SP3 Package Server Agent requires an installed Altiris Agent Version SP3, so, if the Package Server Agent is upgraded before the Altiris Agent then both will be unusable.

3.3 — New Registry key for disabling Package Server directory security
A new Package Server registry key, EnableDACLManagement, has been created to allow you to change how a Package Server manages the security on its packages.

By default, a Package Server manages its packages by setting specific permissions on package directories; this includes overriding any custom permissions you may have set on the directories. When this registry key is activated, Package Server will no longer override existing permissions on package directories.

Take care when using this key as incorrect permissions could potentially render the Package Server directories inaccessible to the Package Server and Altiris Agents.

To ensure a fully functional Package Server, full control for Local Administrator and System need to exist on all package directories in addition to any other custom permissions.

Normally, Altiris Agents and other Package Servers access the packages located on the Package Server computer using the Agent Connectivity Credential (ACC), configured on the Notification Server. To ensure they continue to download packages, configure the Everyone or ACC account with read and execute privileges on the package directories. This is required because when the key is activated, Package Server is instructed not to manage permissions, which includes not applying the ACC or Everyone account to the downloaded packages.

To create the Registry Key

As the registry key does not exist on a default install of the updated Package Server, create the DWORD key, 'EnableDACLManagement' under the following location in the registry—HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent\Package Server. Before creating the key, stop the Altiris Agent Service and restart when finished.

The registry key can have one of the following settings:

· 0—Ensures that Package Server will not change existing security on package directories.

· 1—Will cause Package Server to function as normal by applying and resetting permissions on package directories.

--------------------------------------------------------------------------------
Environment


Notification Server 6.0 SP3 version 6.0.6074

Altiris Agent required—SP3 version 6.0.2338

The updated Package Server is not compatible with Altiris agent versions earlier than 6.0.2338

Cause
Software bug.

Resolution
This update, when installed on Notification Server SP3, replaces the existing Package Server Agent package, with an updated version. Package Servers within your environment will need to be upgraded to this version for any changes contained in the update to apply. Uninstalling the update on the Notification Server will restore the original SP3 version of the Package Server Agent package that existed prior to installing the update.


Important: Before upgrading your Package Servers to this updated version you must upgrade the Altiris Agent on your Package Servers to SP3 version 6.0.2338. The collection All Windows Computer Requiring Altiris Package Server Agent Upgrade, which applies by default to the Windows Package Server Agent upgrade task, will not contain Package Servers where the Altiris Agent version is lower than 6.0.2338 (SP3). Once the Altiris Agent has been upgraded on the Package Server, they will appear in this collection.

Nice SVS Sites

SVS Downloads
Juice Site
Install DS in a SVS layer

Unable to get the config XML for the specified item (With DeleteAnItem.cs as stext)

Orphaned objects in the database will cause these messages. The GUIDs displayed in the log errors frequently point to the "Software Deliver Agent Install" object and have been traced to uninstalling and then reinstalling Software Delivery and the "Software Deliver Agent Install" object not properly being removed.



--------------------------------------------------------------------------------
Resolution


Complete the following:

To remove an orphaned object from the Notification Server tree use the following script:
nscript.exe deleteanitem.cs
and this will delete the object associated with this GUID. Always validate the GUID before removing it. This can be done by the following steps:
a. Open SQL Query Analyzer.
b. Make sure that you select the correct database, i.e. Altiris.
c. Type the following: select * from vitem where guid like ''

If it does not show, then go ahead and complete step 1.

Note: The nscript.exe file is found on the Notification Server in ...\program files\altiris\notification server\bin. The deleteanitem.cs file must be created and the blue part at the end of this article must be pasted in that file.

(Optional) If the script in step 1 does not remove the NS tree object, then there is likely an association that needs to be removed. This can be done with the following script:
delete from ItemReference where hint = 'policyappliestocollection' and ParentItemGuid =


this is DeleteAnItem.cs (Copy and paste the code)

using System;
using System.IO;

using Altiris.NS.ItemManagement;
using Altiris.NS.Security;


class MyScriptClass
{
static void Main( string[] args )
{
//
// Set the context for the current user
//
SecurityContextManager.SetContextData();
Guid itemGuid = Guid.Empty;

try
{
itemGuid = new Guid( args[ 0 ] );

}
catch( FormatException )
{
throw new ApplicationException( "Must pass a GUID as an argument" );
}


//
// Get the collection item
//
IItem itemToExport = Item.GetItem( itemGuid ) ;
if( null == itemToExport )
throw new ApplicationException( "The GUID does not match an item" );
itemToExport.Delete();

//
// Export the item
//
}

}

DS Console slow?

From Microsoft KB article:http://support.microsoft.com/kb/296264/
By default, opportunistic locking is enabled for server message block
(SMB) clients that run one of the Windows operating systems that is
listed at the beginning of this article. Opportunistic locking allows
clients to lock files and locally cache information without the risk of
another user changing the file. This increases performance for many file
operations but may decrease performance in other operations because the
server that grants the opportunistic lock must manage the breaking of
that lock when another user requests access to the file.

On dedicated servers running Windows 2000 Professional, Server, Advanced
Server, or Windows XP Professional, create the following

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parame
ters

Create the following:
Value Name: EnableOplocks
Data Type: REG_DWORD
Parameter Value: 0 Hex (False)

(If your server is not a dedicated server you will also need to create
the workstation keys listed below.)

On workstations with Windows 2000 Professional, or Windows XP
Professional, in this key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\P
arameters

Create the following:
Value Name: UseLockReadUnlock
Data Type: REG_DWORD
Parameter Value: 0 Hex (Disabled)

Value Name: UseOpportunisticLocking
Data Type: REG_DWORD
Parameter Value: 0 Hex (Disabled)

Value Name: UtilizeNtCaching
Data Type: REG_DWORD
Parameter Value: 0 Hex (Disabled)

Reboot all servers and clients affected

REF : Forum

License Removal Tool not working for NS6.0 SP3

[quote]--------------------------------------------------------------------------------

Problem

The License Removal Tool is not working to remove licenses (in NS6.0 SP3) that were installed in SP2 before the upgrade to SP3.

--------------------------------------------------------------------------------

Environment

NS 6.0 SP3

--------------------------------------------------------------------------------

Cause

The naming of the licenses have changed from Computing Edge to Altiris Licensing. The license removal tool has a static pointer to the Computing Edge certificates and does not detect the new storage location of licenses with SP3.

--------------------------------------------------------------------------------

Resolution

This has been reported as a bug for the license removal tool.

Workaround:
To manually remove licenses without the license removal tool, you can perform the following steps:
1- Start > Run > MMC.
2- Choose File > Add/Remove Snap-in.
3- Choose Add and highlight Certificates, then click Add.
4- Choose the radio button for " Computer account" , then click next.
5- Leave the default of " Local computer: .." , and click finish.
6- Close the Add Snap-in dialog box.
7- Click ok to apply the settings.
8- Highlight the Certificates folder under the Altiris Licensing to see the installed certificates.

If you remove all license certificates in this window, it will remove all licensing from the Notification Server similar to the way the license removal tool did. If you do not need to remove everything, you can find a specific license that will need to be removed by opening each license certificate and viewing the details (see below):

**Note: Once the licenses have been removed from the Microsoft Certificate Store, you will need to refresh the licensing page within the Notification Server for the results to show.
[/quote]

Use Notification Server as package server

Create a Site that contains the local clients subnets, have no Package Servers exist in this Site.
When no Package Servers exist in a Site the Altiris Agents will download from the Notification Server.
Then create separate Sites containing Package Servers for those clients you do not wish to download from the NS.

Deployment Solution Groups empty

Deployment Solution Groups that are scraped into NS do not show correctly in the Altiris Console. They may exhibit one or more of the following symptoms: No instance of a server appears or the Deployment Server Group does not update its Groups and/or Computers.

The reason is that the Deployment Server’s database tracks any changes made to it since the last synchronization occurred. If the Notification Server never receives the data that was sent during the last synchronization or if a backup copy of the Notification Server database was restored that doesn’t have that data or if for any other reason the Notification Server does not have the data that was sent in prior synchronizations, the Deployment Server Agent will not resend that data to the Notification Server, it will only send changes that were made since the last time synchronized data was sent.

There are two steps to resolving this issue.

Step 1 is to run one SQL query against the Notification Server (Altiris) database to wipe out the corrupt data from that database.

Step 2 is to run one SQL query against the Deployment Server (eXpress) database(s) to force the Deployment Server Agent to send ALL data from the Deployment Server database to the Notification Server as if it were new data.

There are two options for Step 1. The Step 1 Option A query will remove data from the Notification Server (Altiris) database concerning the Deployment Server that was specified in the query. To wipe out data for more than one Deployment Server, run the query once for each Deployment Server. It is then necessary to run the Step 2 query against the (eXpress) database of each Deployment Server where the Step 1 Option A query was run.

The Step 1 Option B query will remove data from the Notification Server (Altiris) database concerning ALL the Deployment Servers. It will then be necessary to run the Step 2 query against the (eXpress) database of ALL the Deployment Servers.


Step 1 Option A: run this script against the Altiris database to selectively remove the Deployment Server(s) from the Altiris database. Before running this script, it is required to replace <ServerName> with the name of the Deployment Server to be removed from the Altiris database.

*****Begin Query*****
/*WARNING: This script is intended to wipe out any data in the Altiris
database pertaining to a specific Deployment Server. Replace <ServerName>
with the name of the Deployment Server you want your Notification Server
to "forget", then run the script against the Altiris database.*/
DECLARE
@servername varchar(255)
SELECT @servername = '<ServerName>'
DELETE FROM Inv_AeX_AC_Client_Agent
WHERE [Agent Name] = 'Deployment Solution Agent'
AND _ResourceGuid IN (SELECT ResourceGuid FROM CollectionIncludeResource
WHERE CollectionGuid IN (SELECT [NS Guid] FROM DSObjectMap
WHERE Server = @servername))
DELETE FROM Evt_AeX_DS_Assigned_Jobs
WHERE DBServer = @servername
DELETE FROM Inv_AeX_DS_Database
WHERE [Deployment Server] = @servername
DELETE FROM Inv_AeX_DS_Machine_Inventory
WHERE _id IN (SELECT _id FROM Inv_AeX_DS_Machine
WHERE [Deployment Server] = @servername)
DELETE FROM Inv_AeX_DS_Machine
WHERE [Deployment Server] = @servername
DELETE FROM DSComputerFolder
WHERE DatabaseID IN (SELECT DatabaseID FROM DSDatabase
WHERE DBServer = @servername)
DELETE FROM DSJobFolder
WHERE DatabaseID IN (SELECT DatabaseID FROM DSDatabase
WHERE DBServer = @servername)
DELETE FROM DSJobConditions
WHERE JobID IN (SELECT JobID FROM DSJobs
WHERE DatabaseID IN (SELECT DatabaseID FROM DSDatabase
WHERE DBServer = @servername))
DELETE FROM DSJobs
WHERE DatabaseID IN (SELECT DatabaseID FROM DSDatabase
WHERE DBServer = @servername)
DELETE FROM DSDatabase
WHERE DBServer = @servername
DELETE FROM Item
WHERE Guid IN (SELECT [NS Guid] FROM DSObjectMap
WHERE Server = @servername)
DELETE FROM Item
WHERE ClassGuid = 'F1E8956A-A158-487F-8185-4C3B492734E7'
AND ProductGuid = '74093212-3CBB-4E0E-AB79-6283D44DB5A1'
AND Name LIKE 'DS Server ' + @servername + '%'
DELETE FROM DSObjectMap
WHERE Server = @servername
DELETE FROM CollectionIncludeResource
WHERE CollectionGuid NOT IN (SELECT Guid FROM Item)
DELETE FROM ItemReference
WHERE ParentItemGuid NOT IN (SELECT Guid FROM Item)
AND ParentItemGuid != '00000000-0000-0000-0000-000000000000'
DELETE FROM ItemReference
WHERE ChildItemGuid NOT IN (SELECT Guid FROM Item)
*****End Query*****


Step 1 Option B, run this script against the Altiris database to remove ALL Deployment Server(s) from the Altiris database. Before you run the script, you must replace <ServerName> with the name of the Deployment Server you want to be removed from the Altiris database.


*****Begin Query*****
/*WARNING: This script is intended to wipe out ALL data in the
Altiris database pertaining to ANY Deployment Server.
Simply run the script against the Altiris database.*/
DELETE FROM Inv_AeX_AC_Client_Agent
WHERE [Agent Name] = 'Deployment Solution Agent'
DELETE FROM Evt_AeX_DS_Assigned_Jobs
DELETE FROM Inv_AeX_DS_Database
DELETE FROM Inv_AeX_DS_Machine_Inventory
DELETE FROM Inv_AeX_DS_Machine
DELETE FROM DSComputerFolder
DELETE FROM DSJobFolder
DELETE FROM DSJobConditions
DELETE FROM DSJobs
DELETE FROM DSDatabase
DELETE FROM Item
WHERE ClassGuid = 'B8B666E1-FED3-4482-8D5A-0895658317B2'
AND ProductGuid = '74093212-3CBB-4E0E-AB79-6283D44DB5A1'
DELETE FROM Item
WHERE ClassGuid = 'F1E8956A-A158-487F-8185-4C3B492734E7'
AND ProductGuid = '74093212-3CBB-4E0E-AB79-6283D44DB5A1'
AND Name LIKE 'DS Server %'
DELETE FROM DSObjectMap
DELETE FROM CollectionIncludeResource
WHERE CollectionGuid NOT IN (SELECT Guid FROM Item)
DELETE FROM ItemReference
WHERE ParentItemGuid NOT IN (SELECT Guid FROM Item)
AND ParentItemGuid != '00000000-0000-0000-0000-000000000000'
DELETE FROM ItemReference
WHERE ChildItemGuid NOT IN (SELECT Guid FROM Item)
*****End Query*****


Step 2, run this script against the eXpress database(s) and then allow the Deployment Server resynchronization to occur at least twice.

*****Begin Query*****
/*Update the changeitem information to tell
Notification Server to delete all information
about this Deployment Server during the
next synchronization*/
UPDATE changeitems
SET _nslastsent = NULL
UPDATE changeitems
SET [change type] = 'deleted'
UPDATE changeitems
SET ns_guid = NULL
UPDATE changeitems
SET [change date] = getdate()
UPDATE event_schedule
SET _nslastsent = NULL
UPDATE history
SET _nslastsent = NULL
INSERT changeitems
SELECT c.computer_id, 'computer', 'deleted', getdate(), c.computer_name, c.domain_name, c.ns_guid, null
FROM computer c
WHERE c.computer_id NOT IN (select id FROM changeitems)
GO

/*Create a trigger that will run once after the
first synchronization completes and recreates the
changeitem table to ensure that only accurate
data is sent to the Notification Server on the
second synchronization*/
CREATE TRIGGER temp_reload_changeitems ON [dbo].[changeitems]
FOR INSERT, UPDATE, DELETE
AS
BEGIN
/*Only run this query if the Deployment Server Agent synchronization has completed and the trigger isn't already running*/
IF NOT EXISTS (SELECT id FROM changeitems WHERE _nslastsent IS NULL) AND EXISTS (SELECT id FROM changeitems)
BEGIN
/*Wipe out the changeitems table so it can be recreated*/
DELETE FROM changeitems
/*Insert Computer Group information*/
INSERT changeitems
SELECT g.group_id, 'computer_group', 'inserted', GETDATE(), NULL, NULL, NULL, NULL
FROM computer_group g
/*Insert Event Folder information*/
INSERT changeitems
SELECT f.folder_id, 'event_folder', 'inserted', GETDATE(), NULL, NULL, NULL, NULL
FROM event_folder f
/*Insert Event information*/
INSERT changeitems
SELECT e.event_id, 'event', 'inserted', GETDATE(), NULL, NULL, NULL, NULL
FROM event e
UPDATE computer
SET _nslastsent = NULL
UPDATE computer
SET ns_guid = NULL
UPDATE event_schedule
SET _nslastsent = NULL
UPDATE history
SET _nslastsent = NULL
/*Self destruct this trigger so it is only run once*/
DROP TRIGGER temp_reload_changeitems
END
END
GO

Howto Fix : Unable to get the config xml for the specified item

Question:

What is the cause of the a.log error "Unable to get the config xml for the specified item <guid>," and how can it be resolved?

Answer:

This error is generally caused when a NS tree object is orphaned in the database.

The steps to clean up the "unable to get the config xml for the specified item <guid>" message from your logs are as follows:

     1. Run the following script: nscript.exe deleteanitem.cs <GUID>. The deleteanitem.cs file is attached to the end of this article. This script deletes the orphaned object. Always validate the GUID before removing it. This can be done by the following steps:
          a. Open SQL Query Analyzer.
          b. Make sure that you select the correct database, i.e. Altiris.
          c. Type the following:  select * from vitem where guid like '<GUID>'

If it does not show, then go ahead and complete step 1.

Note: The nscript.exe file is found in ...\program files\altiris\notification server\bin.

     2. If the script in step 1 does not remove the NS tree object, then there is likely an association that needs to be removed. This can be done with the following script:
     delete from ItemReference where hint = 'policyappliestocollection' and ParentItemGuid = <GUID>

How to do a clean reinstall of PXE 6.5

Question


How do I reinstall my PXE Manager and PXE server cleanly so that nothing is carried over from the previous installation?



--------------------------------------------------------------------------------

Answer


Sometimes, due to certain environment issues, a PXE server can install incorrectly and become corrupted because of some other environment change. This can create the need to do a clean reinstall of PXE. The following steps explain a detailed process of uninstalling and reinstalling PXE without keeping anything from the previous installation.

If you reinstall PXE using this method you will lose all PXE boot menu configurations and options. These will need to be recreated after installing PXE in this way. All jobs created in the Deployment Server console and images captured from client machines will be unaffected.

If you want to keep your PXE menu options from your previous installation you will need to back up your PXE boot menu. The following linked article explains how to migrate a PXE boot menu from one server to another. These steps can also be used to backup and restore the PXE boot menu after reinstallation.

Browse to the following path on your Deployment Server:
C:\Program Files\Altiris\eXpress\Deployment Server\PXE\MMAccessKey.ini
Copy this file into another directory outside of the PXE folder and keep it as a backup. This exact file will be needed after the uninstall of PXE. If this file is lost you will need to reinstall the entire Deployment Server to recreate the file.
Go to Add or Remove Programs in the Windows console panel and uninstall the following two components:
Altiris PXE Manager
Altiris PXE Server
Delete the following folder and all files in that folder:
C:\Program Files\Altiris\eXpress\Deployment Server\PXE
Do a search on your Deployment Server (search the entire computer, all drives) for "PXE*.*". Delete any files and folders that appear to contain an installation of a PXE Server. Be carefull not to delete any of the PXE installation files normally contained in the DSSetup directory. Mainly you want to make sure that no previous PXE installations from a different version exist, or are installed to a different drive or another folder on your system. Also do a search on your entire computer for "CDSA*" and delete any occurrences of that term.
Recreate the PXE folder under the Deployment Server folder (the same folder that was deleted in step 3). This folder should not contain any files at this point.
Copy the MMAccessKey.ini file back into the PXE folder created in step 5.
Reinstall the PXE Manager by running PXEMgr.exe from the DSSetup folder. Go through the wizard entering all of the information that it requests. When the wizard asks for a username, make sure if you are using a local machine account that you put the machine name in the username (that is, if the DS computer name was "AltirisDS" and the username was "Administrator" you would enter "AltirisDS\Administrator"). If you do not have the DSSetup folder (because it was deleted after installing Deployment Server), you will need to recreate that folder by running the Deployment Server installer file and selecting "Extract Only".
Reinstall the PXE Server by running PXE.exe from the DSSetup folder. Go through the installation wizard of that component entering in all requested information.
Verify that all PXE services are running. If they are not running, try to start them and note any error message that it gives, or the event log entries that show the error. If all services are running correctly open the PXE Configuration Utility to verify that PXE is working correctly.

Automaticlly Merge Duplicates

How do I automatically merge all duplicate computers found in the Merge Computers report-utility?

Author: 1116

Question:
How do I automatically merge all duplicate computers found in the Merge Computers report-utility (located under the Configuration Tab > Server Settings > Notification Server Settings > Merge Computers > Merge computers with duplicate names)?
Answer:
The following script will automatically merge all resouces found in the above mentioned report: DECLARE @MergeName nvarchar(400)DECLARE @MergeDomain nvarchar(400)DECLARE @FromGuid uniqueidentifierDECLARE @ToGuid uniqueidentifier DECLARE @PrimaryResource UNIQUEIDENTIFIER PRINT 'The following script will automatically merge resources as per the ''Merge computers with duplicate names'' report.'PRINT 'The merge automatically chooses the resource that has the most recent update.' DECLARE merge_cursor CURSOR FOR SELECT Ident.[Name], Ident.[Domain] FROM Inv_AeX_AC_Identification Ident INNER JOIN ( SELECT Ident1.[_ResourceGuid], Ident1.[Name], Ident1.[Domain] FROM Inv_AeX_AC_Identification Ident1 INNER JOIN Inv_AeX_AC_Identification Ident2 ON Ident2.[Name] = Ident1.[Name] AND Ident2.[Domain] = Ident1.[Domain] AND Ident2.[_id] != Ident1.[_id] INNER JOIN vComputerResource Ident3 ON Ident1.[_ResourceGuid] = Ident3.[Guid] GROUP BY Ident1.[_ResourceGuid], Ident1.[Name], Ident1.[Domain] ) udr ON Ident.[_ResourceGuid] = udr.[_ResourceGuid] GROUP BY Ident.[Name], Ident.[Domain] OPEN merge_cursor FETCH NEXT FROM merge_cursorINTO @MergeName, @MergeDomain WHILE @@FETCH_STATUS = 0BEGIN PRINT 'Merging ' + @MergeName + '.' + @MergeDomain CREATE TABLE #DUPLICATE_NAME (Resource UNIQUEIDENTIFIER, [Primary] BIT, [Name] NVARCHAR(64), [Domain] NVARCHAR(64), LastUpdated DATETIME, [OS Name] NVARCHAR(64)) INSERT INTO #DUPLICATE_NAME SELECT ident1.[_ResourceGuid] AS [Resource], CAST (0 AS BIT) AS [Primary], ident1.[Name], ident1.[Domain], md.[ModifiedDate] AS [LastUpdated], ident1.[OS Name] FROM Inv_AeX_AC_Identification ident1 JOIN ( SELECT ident2.[Name], ident2.[Domain] FROM Inv_AeX_AC_Identification ident2 GROUP BY ident2.[Name], ident2.[Domain] HAVING COUNT (ident2.[Name]) > 1 AND ident2.[Name] = @MergeName AND ident2.[Domain] = @MergeDomain ) dr ON ident1.[Name] = dr.[Name] and ident1.[Domain] = dr.[Domain] LEFT OUTER JOIN ( SELECT DISTINCT rus.[ResourceGuid], rus.[ModifiedDate] FROM ResourceUpdateSummary rus JOIN ( SELECT rus2.[ResourceGuid], MAX( rus2.[ModifiedDate] ) AS ModifiedDate FROM ResourceUpdateSummary rus2 GROUP BY rus2.[ResourceGuid] ) td ON td.ResourceGuid = rus.ResourceGuid AND td.ModifiedDate = rus.ModifiedDate ) md ON ident1.[_ResourceGuid] = md.[ResourceGuid] SELECT TOP 1 @PrimaryResource = Resource FROM #DUPLICATE_NAME ORDER BY [LastUpdated] DESC UPDATE #DUPLICATE_NAME SET [Primary]=1 WHERE Resource = @PrimaryResource /*SELECT * FROM #DUPLICATE_NAME ORDER BY [LastUpdated] DESC*/
SELECT TOP 1 @ToGuid = Resource FROM #DUPLICATE_NAME where Name = @MergeName and Domain = @MergeDomain and [Primary] = '1' SELECT TOP 1 @FromGuid = Resource FROM #DUPLICATE_NAME where Name = @MergeName and Domain = @MergeDomain and [Primary] = '0' DROP TABLE #DUPLICATE_NAME exec spResourceMerge @FromGuid,@ToGuid FETCH NEXT FROM merge_cursor INTO @MergeName, @MergeDomain END

Enable Bulletins

Enable A lot of Bulletins

Body: 1. Introduction
This script will enable patch bulletins depending on the command line parameters entered, and create a software update task for each. Length of time to enable a bulletin will depend on how many files need to be downloaded within each bulletin.
2. General Instructions
a. Place the following files is in C:\Program Files\Altiris\Notification Server\bin.
i. Nscript.exe (in there by default)
ii. Nscript.exe.config (in there by default)
iii. Nscript.nrf
iv. EnableBulletins.cs
v. .txt file with a list of bulletins to be enabled (if applicable)
3. To Enable Specific bulletins **See Note 1
a. Create a .txt file (like SampleBulletinList.txt) and create a list of bulletins to be enabled.
b. From a command prompt run "NScript.exe EnableBulletins.cs YourTextFile.txt" ** See Note 2
4. To Enable All Bulletins with a Specific Security Rating
a. From a command prompt run "NScript.exe EnableBulletins.cs critical" ** See Note 3
5. To Enable All Bulletins
a. From a command prompt run "NScript.exe EnableBulletins.cs"


The script file can be obtained by a simple mail

Gauge Summaries dashboard Error

When running the Gauge Summaries dashboard from a workstation with Dutch regional settings the following error occurs;
Error when node clicked: Unable to load the specified item (GUID:{4d343f01-5f63-4b37-a022-1c2e50f109a9})

It seems that this dashboard is using the regional settings on the workstation (which is dd–mm–yyyy),
probably Altiris expects the US regional settings mm/dd/yyyy.

Workaround:
A not acceptable workaround is to set the regional settings on the workstation to US.
(Not acceptable, because all other programs/reports/E-mail also appear with the US date.)

Special Tokens

%#!computer@model_num%

which means, look in the Express database for the DS we're connected to, read the computer table, and grab model_num for the machine who's id is %ID%

This is just a number though and it's not necessarily what you want.

If you want to know like, "Latitude D600" or something similar

use

%#!computer@prod_name%

Just be careful, because prod name always has a space in it, and if you're comparing two strings in DOS, like this

SET model=%#!computer@prod_name%

IF "%model%"=="Latitude D600" goto D600

IF "%model%"=="Latitude D610" goto D610

it'll jump to D600 every time, because it only compares the first word before the space. To get around this, I have created a custom view in SQL of the computer table the changes the spaces into _ so then I get "Latitude_D600" back, which works beautifully.

See also Nice forum article

Point Clients to another NS Server

What you need to do is run AeXAgentUtil.exe in the following format...

AeXAgentUtil.exe /server:NSServerName

If you own deployment server, you can make a job and deploy it.

Creating special groups in Inventory Solution for Windows 6.1

Question:

How do I create special groups in Inventory Solution for Windows 6.1? I cannot see the tables or data classes for my new special group.

Answer:

Inventory for Windows 6.1 no longer creates data class and database tables for special groups. To get them created, follow the following steps:

     1. Create the special group in the auditpls.ini file using aexapedit. Create and enter a GUID. You will need a tool such as guidgen.exe for this, since Altiris does not supply GUIDs for new special groups. There are also GUID Generators on the Web. To find them, search for "GUID Generator" on a Web search engine.
     2. Create a copy of “specialgroup.config" and name it <new special group>.config. The specialgroup.config file is found in C:\Program Files\Altiris\Inventory\Config.
     3. Modify the new <new special group>.config file by changing the “XXXXXX-XXX” GUID string to the special group GUID used in the auditpls.ini file.
     4. Change the <name=…> tag values to the name of your auditpls.ini special group name. There are possibly eight or more occurrences that will need changing. The auditpls.ini special group name and the new config file names must match.
     5. Update the inventorysolution.config file with the name of the <new special group>.config file. It should be surrounded by these tags: <items source="New_SW_Group_Name.config"></items>. There is an example in the specialgroup.config file.
     6. Run C:\Program Files\Altiris\Notification Server\bin\aexconfig.exe as shown: aexconfig /configure “C:\Program Files\Altiris\Inventory\Config\InventorySolution.config”. If using the full path, the double quotes are required. This should take about one minute. If it only takes a second or two, the config did not complete. To find out if AeXConfig was successful, open the LogViewer before executing the command. You will then see the whole process in real time. If you have configured your <special group>.config files or the inventorysolution.config file incorrectly relating to your special groups, then you will see error messages associated with those special groups.

Once aexconfig is run, the tables should appear in the database. If the config files are setup correctly and inventory is being captured as expected, the information will appear in those tables after the next inventory run. If the data does not appear, ensure that the inventory can capture the data and that the config files were created and modified properly. All of the points-of-failure from previous versions of inventory still apply: file mode vs. package mode, exclusions, overrides, etc. Be sure to check those as well as the modifications of the config files.

Note: When creating names for special groups, it is helpful but not required, that they begin with “AeX SW.” This provides for better grouping of tables in the database and of data classes in the NS Console’s resource view.

Site Maintenance

The Site Maintenance page is used to assign subnets to sites in order to maximize the effectiveness of Package Servers. Package Servers are automatically assigned to sites by virtue of their subnets.

Under normal operating conditions (for example, sites defined) a Package Server will only service Altiris Agents that exist within the same sites.

Note: If no sites are defined, then all Package Servers are available to service all Altiris Agents (not desirable) and the following occurs:

The Notification Server stores a mapping of Package Servers to subnets.
The Notification Server first tries to find any Package Servers on the same subnet(s) as the requesting machine. If any are found these codebases are returned.
If there are no Package Server codebases from Package Servers in the same subnet all Package Server codebases are returned.
If there are no Package Server codebases the NS codebases are returned.

To download packages ensure your Package Servers are assigned to sites either by assigning their subnets to sites or by allowing the Connector for Active Directory do it for you

Note: Under normal working conditions, Altiris Agents will only download packages from Package Servers that exist in the same site(s) as the Altiris Agent.

Sites are used to limit the Package Servers that an agent should use by virtue of subnet grouping. This generally limits them by proximity. Ultimately, once the list of candidate Package Servers is returned to the Altiris Agent, the Altiris Agent makes the choice based on speed and bandwidth.

The information on the Site Maintenance page is automatically populated if you have the Connector for Active Directory installed. This page allows you to supplement the Connector for Active Directory, if you have it installed. If not, if you use Package Servers, you must use this page to add sites and assign subnets to them so that your Package Servers function correctly.

If you have the Connector for Active Directory installed, Active Directory is the source of truth and overrides any subnets and sites that conflict with it. For example, if you assign subnets to sites on your own, and they conflict with what is in Active Directory, the Active Directory information is used.

The Sites tab, Subnets tab, and Package Servers tab views on this page give you three views of the same data and the Advanced tab shows scheduling options.

Sites Tab View

This tab view helps you see sites that are created and lets you create and edit sites.

Item	Description
Name	The name of the site.
No of Subnets	The number of subnets that have been associated with the site.
No. of Package Servers	The number of Package Servers that are in the site.

Note: The numbers in the "No. of Subnets" and "No. of Package Servers" columns provide links that take you to reports that give you specific information on the subnets or Package Servers respectively.

Disable Multicast

If you are running a silent install of the aclient and you want to use the second transport option of connecting directly to a server rather than multicast include the following line in the inp file:

TransportUse=1

Setting it to 0 will use multicasting.

They should update documentation.

Its also in the registry if you already have it deployed and are using multicasting and want to change it:

HKLM\software\altiris\client service "USEMCast" =0|1 make the change then restart the Altiris Client Service.

Disable HTTP or UNC download on PS

Package Server root

• [HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent\Package server]

Value Type Default Description

EnableUNC DWORD 1 Package server will publish UNC codebases.

EnableWeb DWORD 1 Package server will publish HTTP/HTTPS codebases.

Troubleshooting the Process of an Altiris Agent Push in NS 6.0

Question:

What are the steps to troubleshoot a failed Altiris Agent Push in NS 6.0?

Answer:

The following outlines the process used for an Altiris Agent push, and possible causes for points of failure.  When the point of failure has been determined, usually the problem will be apparent either by a log entry or by the location of that failure.

1.  Configuration of the Altiris Agent Push
     a.View the Installation Settings in order to determine how the push is configured, located in the Altiris Agent push page by clicking the “Installation Settings” button.
     b. If the client uses a proxy server, check the option “Use Proxy”.
     c. Note the field “Use different Notification Server” and make sure the configuration is correct (or unchecked).
     d. *The credential fields are key to the Altiris Agent push.  If no credentials are chosen, it will use the account specified as the Application Identity/Application Credentials.  If pushing the Agent in a multi-Domain or Workgroup environment, the account used for the push must have local Administrator privileges on the machine(s) being pushing to.

2.  Initiating the Push
     a. A push can be done to one or more machines at one time.  Use the “Install Altiris Agent” to initiate the push.  
     b. The status section on the Agent push page can be useful.  Keep this in mind when walking through the items of a Push installation.

3.  Installer Service – AexSWDInstSvc.exe
     a. The actual install package for the Altiris Agent does not get pushed to the client machine.  The installer service, named AeXSWDInstSvc.exe, is pushed to the client machine.
     b. The user account specified on the push page settings, or the Application Identity if no account is supplied, is the account that attempts to access the \\machinename\admin$ share on the destination machine.
    c. As soon as the Installer Service reaches the client machine, it begins to log information into the log file AeXSWDInstSvc.log, located at C:\<Windir>\System32.  The EXE resides in the Admin$ share (generally the %windir%).
    d. It will register the EXE as a service.  This service has limited ability for throttling and check-point recovery when downloading the Agent install Package.  If a machine is rebooted before it has successfully downloaded the install package, the service will use check-point recovery to pick up where the download was terminated.
    e. If a push fails, and this log does not exist, then the Installer Service did not reach the client machine.  Troubleshoot access rights being used for the push, and look at the status in the Altiris Agent push page. If the log does exist, review the details.
    f. The installer service will download the actual install package, named AeXNSC.exe.
    g. Next it executes the install package.
    h. Once the install package is executed, the AeXSWDInstSvc.exe removes itself as a Service.
    i. Lastly, it removes itself (EXE) from %windir%.

4. Agent Install Package – AeXNSC.exe
     a. If the Installer Service fails to download the AeXNSC.exe file, it will be reflected in the AeXSWDInstSvc.log file.  Look for authentication or HTTP request errors.
     b. If the Installer Service fails to execute the downloaded file, it will also be reflected in the AeXSWDInstSvc.log file.  Look for execution errors.
     c. If the Install Package is downloaded successfully and executed, it will begin to write to the file AeXNSC.log, located at C:\<Windir>\System32.
     d. Any problems with the Package install will be logged in the AeXNSC.log file.
     e. When the installation is complete, the agent service will be started, and the Agent will begin logging information into the agent.log and subsequent log files.

5. Communication back to the Server – Agent installed
     a. It is possible that while a push it successful, the Agent Communication is unsuccessful.  This may result in an erroneous status on the Altiris Agent push page.

Adding other Antivirus in inventory

If you'd like to utilize the built-in report on AntiVirus, you simply need to add the Norton 10.0.1 filename or product name or internal name, etc to the Special Group defined in the SW scan.

Use the AeXAPedit.exe to do this.
NSCap\bin\win32\x86\ AeXAPedit.exe

Run AexAPedit.exe and open the auditpls.ini file located in the Inventory Solution folder.
NSCap\bin\win32\x86\Inventory Solution

Select the Special Groups Tab. Select the AntiVirus Special Group. Notice it already has some internal filenames and product names in there. You can look through your Audit Detail reports to find this information for Norton 10.0.1. OR right click on one of the files that's on all your Norton 10.0.1 clients, and look at the internal name or filename or product name or manufacturer name, etc. This is the unique header info you need to put in the AntiVirus special group.

Add to the special group, save the auditpls.ini and close the AeXAPedit.exe program.

Force Policy Update script for usage with DS

The following VB Script can be used with an existing AClient to force the Altiris NS Agent to wake up and check for any new configuration / policy updates. This is not an issue with NS 6 since it can now do that, but for everyone with 5.5, this is still valuable.

 

 'vbscript

Option Explicit

 

' Declare variables

Dim Client

 

' Create the NS Client object

Set Client = CreateObject("Altiris.AeXNSClient")

 

' Ask the client's policy manager to refresh the configuration

Client.ClientPolicyMgr.Refresh

 

' Clean up

Set Client = Nothing

Permissions on NS client Registry

This is now a well known issue guys.

If you ever have any problems on a computer regarding the registry check first that you are not running the AClient version 6.1.393 or 394 as it has a defect (changing permission on some of the Altiris registry keys).

How to install Deployment Server on Microsoft Cluster Server.

How to install Deployment Server on Microsoft Cluster Server.
Article #: AKB7197
Author: 3108
Date: 3/11/2005 9:19:28 AM

--------------------------------------------------------------------------------

Question:
How to install Deployment Server on Microsoft Cluster Server?
Answer:
1. There must be two servers clustered and working.

2. Install the enterprise version of SQL from the primary node onto the virtual server. SQL will not let you install onto the virtual server that Microsoft Cluster Service created so you have to make a new virtual server. To run the Deployment Server (DS) on a cluster, a cluster virtual IP needs to be established.

3. Install the DS with the same settings from each cluster node but use the cluster IP address anywhere you enter an IP. From the Primary node in the cluster (the node that owns the storage) install an instance of the DS using the shared storage for the DS database and the Client Access Files. The DS should be installed to the local drive.

4. Fail the cluster over to the Secondary node and do the install the exact same way.

5. With all the files pointing to the exact same location, install the DS to the local drive. When both machines are rebooted, they should both be running the Altiris Express Service in Services Manager.

7. Now open Cluster Manager and create a new Generic Service; name the service the same name as the one running in Services Manager. Make it part of the Cluster Group that all the other services are running in.

8. Now it should be possible to fail over the service and it should start the Altiris Express Service on the inactive node.

Because the DS is not cluster aware, anytime there is an active node transfer it will be as if the axengine died and restarted. That means Aclient will probably become orphaned until it attempts a reconnect.

Windows Installer Exit codes

Here, you can find al lot of exit codes for Windows Installer : Windows Exit codes

Usefull links

MVPS links

Activate the Diagnostics without showing the NSCLient Icon

'vbscript
dim client
set client = CreateObject ( "Altiris.AeXClient" )

dim sessmgr
set sessmgr = client.SessionManager

'Client Diagnostics
sessmgr.ActivateObject ( "{E8B8B9D4-A461-4E19-9F14-B72E5110F631}" )

'Network Diagnostics
sessmgr.ActivateObject ( "{1D588FDC-D1DA-40DD-99F7-D43D161F043E}" )

'Power Management
sessmgr.ActivateObject ( "{2C71C589-25C8-4D5B-8FD2-68B376566601}" )

Ports and Protocls

Want to find out more about the ports and protocols for DS 6.X?

Check out this Altiris White Paper AKB5447

System Tokens

Here you can find the SYSTEM Tokens you can use for DS

DEPWPT120611

Batch file which will reconnect inactive Deployment Agent for Windows

KB Article : AKB5705

 

Question:

Sometimes administrators are not sure why aclient machines are not connected to the deployment server. Often times this is because the user has shut down the service.  What can an administrator do?

Answer:

Run this Sql Query on against the database:
This batch file will need to be modified to stop and then start the service to reconnect the clients that think they are connected but are not actually connected.

Note:  this must be run as a domain administrator to allow proper authentication to restart the aclient service.

Also note the OSQL statement may need to be modified if a remote SQL server exits or use SQL authentication to access the express database.


Example Batch file:

rem This will query the eXpress database for computers that are not connected and for each one will attempt to connect to the computer and start the aclient service.

for /f %%i in ('osql -E -d eXpress -h-1 -Q "set nocount on;select name from computer where computer_id not in (select computer_id from sessions)"') do sc \\%%i start aclient

Change IP Address for PXE

In this White Paper you can find the way to change the IP Address for a PXE Server.

Altiris AKB2401.

Or try this:

Change Altiris Deployment/PXE IP adress.
Stop All Altiris DS services.
Change IP i these Files:
C:\Program Files\Altiris\eXpress\Deployment Server\default.cfg
C:\Program Files\Altiris\eXpress\Deployment Server\PXE\PXE.ini
C:\Program Files\Altiris\eXpress\Deployment Server\aclient.inp
and the %name%\%name%.bdc Files under
C:\Program Files\Altiris\eXpress\Deployment Server\Bootwiz\config\

Start Altiris DS Services.
Change Bootdisks IP
Start DS Console (Not Webconsole)
Open PXE Configurator
Mark The Bootdisk you want to change
Select Make Boot Files
Change The line (set CONIP=-ip192.168.0.1) in autoexec.bat and startnet.bat
Right click on Th Bootdisk an select Make Boot File
Close and Repeat For all Bootdisks

Just an add-on to this excellent article.As I installed PXE Server after changing IP, there were no \PXE\PXE.INI to change in, and the PXE Server Service refused to start after the installation. I sorted it out by changing adress in \PXE\RPC.ini as well. Then PXE.ini gets created automatically, and the service started as it should.