Altiris Deployment Solution 6.9 SP1 MP1 (Maintenance Pack 1)

What issues have been fixed in Altiris Deployment Solution 6.9 SP1 MP1 (Maintenance Pack 1)?

---

Resolution

The DS 6.9 SP1 MP1 (Maintenance Pack 1) addresses the component issues noted below:

Altiris Client Service (AClient.exe)

The current build of AClient is 6.9.366. It is a cumulative build that includes fixes from all previous builds.

Description	Fixed in Build	Article ID
AClient JPN, FRN, DEU, and CHS localization issue.	6.9.359	44291

Altiris eXpress Server (AXengine.exe)

The current build of AXengine is 6.9.365. It is a cumulative build that includes fixes from all previous builds.

Description	Fixed in Build	Article ID
MMB S3 Bladeservers not listed in Deployment Solution console	6.9.361	44804

ASDK for DS

The current build of the ASDK for DS is 6.9.365. It is a cumulative build that includes fixes from all previous builds.

Description	Fixed in Build	Article ID
DNS settings are not reflected on the console using a programmatically created Reconfigure job	6.9.361	44455
Authentication failing using ASDK methods like DeleteComputer() after installing DS 6.9 SP1	6.9.363	44253
''Task_Return_Codes_Table'' dataset is ignored in API calls	6.9.364	41438
CreateJob error in Administrator SDK 1.4, "Error Value cannot be null" when job have Condition set	6.9.364	40878
"Value cannot be null..." when DS security is disabled and code does not include DSCredentialsHeaderValue.	6.9.365	44650
Method failed. Exception: Permission Denied: Deployment Server Role-Based Security is enabled.	6.9.365	44649

Boot Disk Creator (bootwiz.exe)

The current build of the boot disk creator is 6.9.365. It is a cumulative build that includes fixes from all previous builds.

Description	Fixed in Build	Article ID
Boot Disk Creator unable to add drivers to WinPE using the Have Disk button	6.9.357	44108

DAgent

The current build of the DAgent Default Component is 6.9.366. It is a cumulative build that includes fixes from all previous builds.

Description	Fixed in Build	Article ID
Copy File task using UNC path fails with “The network path was not found.”	6.9.356	44031
DAgent does not retain WINS IP address after post config	6.9.361	44811
Duplicate SPN error when user tries to login to the machine with domain user	6.9.361	44807
DAgent in WinPE occasionally fails to connect to Deployment Server	6.9.366	44898
DAgent can hang if an exception is thrown during startup	6.9.366	44899

Data Manager

The current build of Data Manager is 6.9.365. It is a cumulative build that includes fixes from all previous builds.

Description	Fixed in Build	Article ID
Exception may be thrown in Axengine if the Web Console is installed	6.9.361	44109

Deployment Server Console (eXpress.exe)

The current build of the Deployment Server Console is 6.9.365. It is a cumulative build that includes fixes from all previous builds.

Description	Fixed in Build	Article ID
Cannot schedule jobs using Active Directory group authentication.	6.9.361	44235
Error "##wc_last_effective_rights" is displayed when multiple consoles are open	6.9.361	44220

PXE

The current build of PXE is 6.9.365. It is a cumulative build that includes fixes from all previous builds.

Description	Fixed in Build	Article ID
PXE Server fails to send path to pxeboot.bdc when clients boot to WinPE causing ‘Windows failed to start’ error	6.9.362	44281

To apply the maintenance pack do the following:

1) Download the maintenance pack and save to a directory on the Deployment Server.
2) Execute the file and follow the prompts.  
Notes:

- All affected files are backed up.  An uninstall is added to Add/Remove programs in the Control Panel.

- Fixes are applied for installed components ONLY. If, for example, the ASDK is not installed, the ASDK fix will not be applied.  If the ASDK is installed later simply rerun the maintenance pack and the file(s) will be updated.
- The maintenance pack can be installed silently by using the /S switch.

-  In order for the maintenance pack to resolve the PXE and Webconsole issues documented above it is necessary to run the maintenance pack on all remote PXE/Webconsole servers. 

This can be done by following the steps below:

1) Install Aclient/Dagent on all remote PXE/Webconsole servers
2) Create a Distribute Software job. Use "DS_69_SP1_MP1.exe" with the /S switch.
3) Assign the job to the remote PXE/Webconsole servers
4) The maintenance pack will update the remote PXE/Webconsole servers
5) Remove Aclient/Dagent on all remote PXE/Webconsole) server

Patch Management Upgrade Validator

This tool examines the Notification Server database to determine if are any issues that require addressing before an upgrade can occur. In "Analyze" mode, the tool makes no attempt to remediate issues and makes no modifications to the database.

The tool restricts its reporting to the internal state of the Notification Server and Patch Management solution. The results do not contain any information identifying vulnerabilities in individual machines or groups of machines.

Download the latest Validator tool HERE.

It's safe for PM 6.1 and 6.2 to be used and fix any reported errors

How to view codebases returned to the Altiris Agent through getpackageinfo.aspx request

Answer

When the Altiris Agent is required to download a package it will request the appropriate codebases from the Notification Server through getpackageinfo.aspx. The information returned from getpackageinfo.aspx is ultimately stored as the package.xml on the client computer under 'Program Files\Altiris\Altiris Agent\Software Delivery\<package GUID>'.

For example, a client computer will show the following in the logs during the getpackageinfo.aspx request (when trace logging is enabled on the client computer):

Date: Nov 08 14:23:41:011
Source: AeXNetworkTransport
Description: GET:
url=http://ns-03/Altiris/NS/Agent/GetPackageInfo.aspx?xml=<request resource="{89782D60-FFA1-487A-B4BA-38E909ABB6DF}" version="1" type="codebases" compress="1" totalTime="0">
<packages>
<package guid="{8661D7F2-039B-4418-9A0A-70A9C7445F9C}"/>
</packages>
<addresses>
<address ip="192.168.0.104"/>
</addresses>
</request>

The IIS logs on the server record the following:

2005-11-08 21:23:41 192.168.0.104 GET /Altiris/NS/Agent/GetPackageInfo.aspx xml=%3Crequest%20resource=%22%7B89782D60-FFA1-487A-B4BA-38E909ABB6DF%7D%22%20version=%221%22%20type=%22codebases%22%20compress=%221%22%20totalTime=%220%22%3E%0A%3Cpackages%3E%0A%09%3Cpackage%20guid=%22%7B8661D7F2-039B-4418-9A0A-70A9C7445F9C%7D%22%2F%3E%0A%3C%2Fpackages%3E%0A%3Caddresses%3E%0A%09%3Caddress%20ip=%22192.168.0.104%22%2F%3E%0A%3C%2Faddresses%3E%0A%3C%2Frequest%3E%0A 80 - 192.168.0.104 - 200 0 0

To view the codebases in your browser, take the IIS log entry and make the following changes:

1. Replace the space between getpackageinfo.aspx and XML with a question mark.
2. Remove the section referring to compress=%221%22 (highlighted in red below).
3. Complete the URL by adding 'http://server_name' at the beginning of the line.

Before:

/Altiris/NS/Agent/GetPackageInfo.aspx xml=%3Crequest%20resource=%22%7B89782D60-FFA1-487A-B4BA-38E909ABB6DF%7D%22%20version=%221%22%20type=%22codebases%22%20compress=%221%22%20totalTime=%220%22%3E%0A%3Cpackages%3E%0A%09%3Cpackage%20guid=%22%7B8661D7F2-039B-4418-9A0A-70A9C7445F9C%7D%22%2F%3E%0A%3C%2Fpackages%3E%0A%3Caddresses%3E%0A%09%3Caddress%20ip=%22192.168.0.104%22%2F%3E%0A%3C%2Faddresses%3E%0A%3C%2Frequest%3E%0A

After:

http://server_name/Altiris/NS/Agent/GetPackageInfo.aspx?xml=%3Crequest%20resource=%22%7B89782D60-FFA1-487A-B4BA-38E909ABB6DF%7D%22%20version=%221%22%20type=%22codebases%22%20%20totalTime=%220%22%3E%0A%3Cpackages%3E%0A%09%3Cpackage%20guid=%22%7B8661D7F2-039B-4418-9A0A-70A9C7445F9C%7D%22%2F%3E%0A%3C%2Fpackages%3E%0A%3Caddresses%3E%0A%09%3Caddress%20ip=%22192.168.0.104%22%2F%3E%0A%3C%2Faddresses%3E%0A%3C%2Frequest%3E%0A

Another solution from AKB#1070 (modify IP address and Package Guid as needed):

http://<notification server>/ALTIRIS/NS/Agent/GetPackageInfo.aspx?xml=<request resource="{1675E076-73CA-4CDD-BAD8-7130435F447E}" version="1" type="codebases"><packages><package guid="{01B54EB5-3679-4C73-9E10-E169D5A5EC59}"/></packages><addresses><address ip="10.50.104.82"/></addresses></request>

DAgent synchronizes the system clock when the option is not enabled

Problem/Symptoms

Even when the option to synchronize time with the Deployment Server is not checked, the DAgent will still synchronize time with the Deployment Server.

In WinPE 2.1 automation, the DAgent sets the hardware clock to a time that is not synchronized with the Deployment Server.

---

Cause

The cause is currently being investigated by Symantec

---

Resolution

A resolution is currently being investigated.  A possible workaround until this is resolved is to use AClient instead of DAgent.

How to preform a hard disk wipe using the Ghost utility called GDisk.

When reallocating hardware from one person to another, it is often important to ensure that none of the old data from the hard disk can be retrieved, even after deploying a new imaging to the computer.

The GDisk utility (one of the Ghost tools shipped with Deployment Solution 6.9 SP1) is a multipurpose disk management utility that includes a secure disk wiping feature. GDisk’s secure disk wiping feature wipes data according to the U.S. Department of Defense (DoD) 5220.22-M standard. According to this standard, the following group of operations is performed six times:

• All addressable locations on the hard disk are overwritten with 0x35.

• All addressable locations on the hard disk are overwritten with 0xCA.

• All addressable locations on the hard disk are overwritten with a pseudorandom character.

• All addressable locations on the hard disk are verified in hardware using the Verify Sectors command to the disk.

Running GDisk to Securely Wipe a Disk

GDisk can be run from a DOS (GDisk.exe), WinPE (GDisk32.exe or GDisk64.exe), or Linux (Gdisk) pre-boot operating system using the following syntax:

gdisk disk /diskwipe /dodwipe

The following table explains the GDisk command-line elements.

Element	Description
gdisk	The Gdisk executable used, such as GDisk.exe (for DOS) or GDisk32.exe (for WinPE).
disk	The physical disk to be wiped. Replace disk with a number between 1 and 128.
/diskwipe	Instructs GDisk to perform a disk wipe.
/dodwipe	Instructs GDisk to perform the required wipes meeting the DoD standards.

Example: gdisk.exe 1 /diskwipe /dodwipe

This command runs the DOS version of GDisk and wipes the first drive using the DoD standards.

Sample Symantec wipe disk jobs ships with Deployment Solution and can be found in the Samples job folder.

How to discover missing drivers for DeployAnywhere.

To determine if your DeployAnywhere database has the drivers needed for a particular computer, start the computer in question using WinPE and run the following DeployAnywhere command:

ghdplyAw32.exe /target=c:\Windows /ddb=DriversDB /eval

If a mass storage or NIC driver is missing, a list of the missing drivers is displayed on the screen and are also stored in a text file named ghDplyAw.txt.

This discovery process can be automated using a Deployment Run Script task (configured for WinPE) using the following in a Deployment Run Script task:

cd \Ghost

ghdplyAw32.exe /target=c:\Windows /ddb=\DriversDB /eval

Important: The previous task only works if the SmeUtil.sys driver is in the \Windows\System32\Drivers folder of WinPE. This driver is found in the Ghost folder in your Deployment Share. It can be added to the WinPE automation during the creation or editing process by right-clicking the Drivers folder and selecting

Add File.

As an alternative, the SmeUtil.sys driver can be copied by adding the following command to your run script task:

Copy %ALTIRIS_SHARE%\Ghost\SmeUtil.sys %SystemRoot%\

System32\Drivers

Download Snapshot failed: HTTP error: 404 Not Found (-2147209951) when attempting to download packages

Problem/Symptoms

When attempting to download a package through an IIS-enabled Package server, the following error messages are seen in the Altiris Logs:
Priority: 1
Date: 9/18/2008 2:03:18 PM
Tick Count: 26759250
Host Name: ------
Process: AeXNSAgent.exe (4744)
Thread ID: 1648
Module: AexPackageDelivery.dll
Source: PackageDownload
Description: Download Snapshot failed: HTTP error: 404 Not Found (-2147209951)

and

Priority: 1
Date: 9/18/2008 2:03:18 PM
Tick Count: 26759250
Host Name: ------
Process: AeXNSAgent.exe (4744)
Thread ID: 1648
Module: AexPackageDelivery.dll
Source: PackageDelivery
Description: Error while downloading package: HTTP error: 404 Not Found (-2147209951)

---

Environment

Notification Server 6.0 SP3 R7

IIS-enabled Package Server

---

Cause

In This case, the client computers were unable to generate their package snapshots becuase Active Server Pages were not enabled in IIS on the package server.

---

Resolution

To resolve this, we:

1) Checked the snapshot file in the GUID Folder on the Client and found that it was unable to generate a snapshot.

2) We checked the IIS logs on the Package Server, and found that the client was receiving 404 errors when it was attempting to generate its snapshot.

3) We Enabled Active Server Pages in the IIS Manager on the Package Server, and the client was then able to generate its snapshots. This is found in the IIS Manager under 'Web Service Extensions' in the main menu tree.

Altiris licensing technical FAQ

Applies To

• Inventory for Windows 6.0, 6.1
• Notification Server 6.0
• Patch Management 6.1, 6.2
• Software Delivery

---

Question

How does Altiris licensing work for Notification Server based products?

---

Answer

Overview

This article discusses licensing for each of the Altiris Notification Server based solutions:

• How a license is consumed.
• What happens when the license count is exceeded.
• What happens when a time limited (demo/install) license expires.
• What happens when the Automatic Upgrade Protection (AUP) expires.
• How to recover a solution license (retirement vs. deletion).
• Anomalies in expected functionality.

Inventory Solution for Windows

• License consumption—A license is consumed after the Notification Server has received the first posted software inventory data from a managed computer. A license is not consumed from the existence of the inventory solution agent on a managed computer. A license is not consumed by the "basic inventory" function of the Altiris Agent.
• License count exceeded—Inventory from licensed nodes will continue to be processed. Incoming inventory data from unlicensed nodes is discarded.
• License expiration (only applicable to Trial or otherwise temporary licenses)—Agent rollouts will still occur without a problem. All new incoming inventory data is discarded. Inventory reports will throw a license error.
• AUP expiration—All functions will continue normally. However, if newer versions of the solution are installed, they will not function.
• License recovery—As of Inventory Solution 6.1 SP2, setting the status of the computer to anything but Active will release a license.  In prior versions, only Retired, Return to Lessor, and Disposed computers will free up a license. Deletion of the computer resource record will also release a license.
  NOTE:  Inventory Solution specific data on Retired, Return to Lessor and Disposed computers will be purged as part of a background process that runs each night.

Software Delivery Solution for Windows

• License consumption—A license is consumed the first time a managed computer requests a software delivery task. The prerequisites for this event would be the assignment (via the Notification Server console) of a software delivery task to a managed node that has the Software Delivery Solution agent installed. A license is not consumed from the existence of the Software Delivery Solution agent and/or the Task Synchronization agent on a managed computer.
• License count exceeded—All agents that attempt to obtain Software Delivery Tasks beyond the allowed node count will stop receiving the task details in their client policy files.
• License expiration (only applicable to Trial or otherwise temporary licenses)—Agent rollouts will still occur without a problem. Software Delivery jobs will be no longer be advertised to clients, including newer schedules for existing tasks.
• AUP expiration—All functions will continue normally. However, if newer versions of the solution are installed, they will not function.
• License recovery—Retired computers will not release a license.
  • Computers can be deleted to release a license
  • For unmanaged computers, the event deletion in Data Purging for Software Delivery can be used to clear out old records and free up licenses. This will not work for systems actively using Software Delivery Solution.

Patch Management Solution for Windows

• License consumption—A license is reserved the first time a managed node posts the results of an inventory rule scan to the Notification Server or requests a software update package. A license is not consumed from the existence of the Software Update, Inventory Rule, and/or the Package agent on a managed computer.
• License count exceeded—All agents will stop receiving new software update policies. The Notification Server will refuse to download new (the pmimport.cab file) patch management data from the Altiris Web site. Newly posted Inventory Rule scanning data will be silently discarded by the Notification Server.
• License expiration (only applicable to Trial or otherwise temporary licenses)—Software Update Agent rollouts will still occur without a problem. Inventory Rule scanning and Software update tasks will be no longer be advertised to clients, including newer schedules for existing tasks. The Notification Server will refuse to download new (the pmimport.cab file) Patch Management data from the Altiris Web site.
• AUP expiration—Pre-existing software bulletins will be available for enablement and deployment of their related software updates. The Notification Server will no longer be able to download updated versions of the PMImport.cab file. Software update policies and inventory rule scans will continue to function. However, it will not be possible to obtain updates for new bulletins and their corresponding inventory rules due to the inability to update the pmimport.cab. If a newer version of the solution is installed, it will not function.
• License recovery—Retired computers will not release a license. Computers must be deleted to release a license.

Notification Server 6.0 SP3 R9 Release Notes

Release Notes for Altiris® Notification Server™ 6.0 SP3 R9

Installation and Configuration

Fixes in this Release

Known Issues

Additional Documentation

Installation and Configuration

Rollup 9 (R9) for Notification Server 6.0 is a rollup of fixes to the core product since the release of Service Pack 3. It includes R1 (KB22690), R2 (KB23784), R3 (KB25133), R4 (KB27859), R5 (KB31946), R6 (KB34317), R7(KB35803), and R8(KB39159)

Note: We do not recommend uninstalling R9 as it contains essential fixes. If you experience problems after the installation, please contact Altiris Support Services at www.altiris.com/Support.

Prerequisite Software

Notification Server 6.0 SP3 (build 6.0.6074)

Installing Rollup 9 (R9) for Notification Server 6.0 SP3

Download Altiris_NS_6_0_SP3_KB39160.exe from the following location:

http://www.solutionsam.com/solutions/6_0/Altiris_NS_6_0_SP3_KB39160.exe

Run Altiris_NS_6_0_SP3_39160.exe on the Notification Server.

Note: R9 includes an updated version of the Altiris Agent. After installing R9 onto the Notification Server, the Altiris Agent package will be updated. The upgrade policy is located in the Configuration tab of the Altiris Console under Configuration > Altiris Agent > Altiris Agent Rollout.

Fixes in this Release

The following issues were resolved in this release. For additional information regarding a fixed issue, click on the Article ID link.

Fixed Issues

https://kb.altiris.com/article.asp?article=39160&p=1

Known Issues

• If Helpdesk Solution is installed on the Notification Server, install R9, then go to KB43862 and follow the additional steps in the resolution section of that article.
• If IT Analytics is installed on the same computer as the Notification Server, wait to install R9 until after a new release of IT Analytics. R9 causes the current version of IT Analytics to stop working correctly. See article 40366.
• "PackageDownload Download Snapshot failed: Failed to create NS Client component. Error number: 46. Error description: Permission denied". See article 1751 for the workaround.

If a Package is deleted on the server and clients still have the packages, the events generated from the packages will cause ItemNotFoundException errors.

Question

If a Package is deleted on the Notification Server and clients still have the packages, the events generated from the packages will cause ItemNotFoundException errors.

Answer

The default setting for deletion for all SWD packages on the local client machine is 7 days.  If the Package is deleted on the server and clients still have the packages, the events generated from the packages will cause ItemNotFoundException errors.

The 7 days begins from the time the client no longer sees the package in the Client Configuration XML sent from the server.

As such, this is the best practices for retiring/deleting packages:
1. Disable all tasks associated with the package (if a task is enabled, and a client has that task, the 7 days will not start until that task is gone or removed).
2. Tasks can be deleted very quickly since an updated Client policy XML will stop any events for that task from being generated.
3. 7 days after the tasks were disabled/deleted, delete the package.

How to use Ghost 'Hot Imaging' to create images while the computer is running

Question

How do you use Ghost "Hot Imaging" to create an image while the computer is running?

Hot imaging is the ability to create an image of a computer while the computer is running the production operating system. For example, with Ghost hot imaging, you can create an image of Windows XP while you are logged on and using Windows XP.

While the image is being created, you can continue to work in the production operating system, but any file changes made after the imaging process is started, will not be captured in the image.

---

Answer

Hot images are created by running Ghost in the production operating system. This can be accomplished from a command prompt or from a Deployment Server Run Script task.

(Important: When using the hot imaging feature of Ghost, you cannot save the image being created to the same partition that is being captured in the image. Hot Imaging has been disabled for all Server operating systems.)

Sample Deployment Run Script Task:

REM Map a drive

net use z: \\Provo\express

REM Run Ghost to capture image

Z:\Ghost\Ghost32.exe -clone,MODE=create,SRC=1,DST=Z:%COMPNAME%.gho -sure

Important: The only spaces in the preceding script are located before a dash. Do not put spaces after the commas.

The following information explains the command-line switches used in the sample script:

Command or Switch	Description
Z:\Ghost\Ghost32.exe	The path and name of the Ghost program being used.
-clone, MODE=create,SRC=1,	Create an image of drive 1.
DST=Z: COMPNAME%.gho	Create the image on the Z: drive. The variable of %COMPNAME% will be replaced with the name of the computer being imaged. The path used to store the image cannot be the same partition that is being captured.
-sure	Eliminates the need to manually confirm the creation of the image.

(Important: Configure the task to run in the production environment using the Security Context of either Specific user or Run script in console user session. The account used, must have rights to create the image on the destination server.)

Deployment Solution 6.9 SP1 uncompressed WinPE preboot images

Question

What do I need to know about using uncompressed WinPE preboot images in Deployment Solution™ 6.9 SP1?

Answer

In some cases, choosing the option in the Boot Disk Creator to create an uncompressed WinPE preboot image produces a preboot image that does not connect to the Deployment server and does not perform jobs.
The default option is to create a compressed WinPE preboot image. You must explicitly select that you want to create an uncompressed WinPE boot image. If you manually changed this option to produce an uncompressed image and if that image boots into WinPE but does not connect or respond to the Deployment server, use the compressed option instead.

When upgrading to DS6.9SP1 then check if the compression is selected when (re)creating the WINPE. Maybe it would be a good idea to recreate you (old) WINPE boot file.

Thx David and Stephane

Fix Available: Cannot schedule jobs using Active Directory group authentication on Deployment Solution 6.9 SP1

Problem/Symptoms

Active Directory (AD) users that are imported into the Deployment Server database via Active Directory Groups do not have rights to schedule jobs.

Steps to reproduce:

1. Add an AD group to Deployment Solution.  Assign the group the 'Administrator' right to the console.  
2. Do not add the specific AD user.
3. Login as a user that from the AD Group.
4. Attempt to schedule a job.
5. The right to schedule a job is not available.

Note: If the 'Evaluate Rights' button is viewed the rights for the specific AD group will evaluate successfully (as though they have the rights).

---

Resolution

Symantec has created a hotfix to resolve this issue.  Follow the steps below to install the fix:

1) Shutdown all Deployment Server consoles.
2) Stop the 'Altiris Express Server' service.
3) In the Deployment Server directory (E.g. C:\Program Files\Altiris\eXpress\Deployment Server) rename express.exe to express.lic.
4) Download the updated 'Express.exe' to the the Deployment Server directory.
5) Open the 'Product Licensing Utility' and use 'express.lic' from the Deployment Server directory to license the new  express.exe file.
6) Start the 'Altiris Express Server' service.

Note: The express.exe included in this KB is the same express.exe used in KB 44220.

Deployment Solution 6.9 SP1 supported platforms and system requirements

Question
What platforms are supported by Deployment Solution 6.9 SP1?

More info on the supported platforms can be found here

DS 6.9 SP1 features

Introduction

Deployment Solution 6.9 SP1 software helps reduce the cost of deploying and managing servers, desktops, notebooks, and thin clients from a centralized location in your environment. It's an easy-to-use, automated deployment solution that offers OS deployment, configuration, PC personality migration, and software deployment across different hardware platforms and OS types. In SP1, we added support for Microsoft Windows Vista and Windows Server 2008, including running 32-bit applications on 64-bit platforms (WoW support).

The following are features of this release BUT still in BETA so not confirmed:

• Enhanced Vista 2008 management
• Updated WinPE installers
• Added that Deployment Solution now runs on Windows 2008 servers
• Added support for 64-bit servers (Wow 64)
• Added support for disabling and enabling NICs (network interface card)
• Added SQL 2008 support
• Added that DAgent now supports remote control
• Added that DAgent is now the default agent for Windows clients
• Added support for UNC imaging
• Added a sample job for upgrading AClient to DAgent
• Enhanced rip and replace to specify the jobs that are replayed
• Enhanced user rights
  • View only the computers and jobs that you have the rights to manage
  • Limit access to master return codes

How to check the status (active, retired , etc) of a machine?

1. You change/view the status of a computer under Altiris Console, click the Resources tab > Resources > Defaults.

2. Import the attached report into the reports tab or create your own using SQL like the following. that can help to identify retired machines.
Run it against Altiris database. ( replace 'retired' to the status you want to check).

SELECT     i1.Name AS Asset, rt.Name AS [resource type], i2.Name AS
Status, i1.Guid
FROM         ResourceAssociation ra INNER JOIN
                      Item i1 ON i1.Guid = ra.ParentResourceGuid INNER
JOIN
                      Item i2 ON i2.Guid = ra.ChildResourceGuid INNER
JOIN
                      ItemResource ir ON ra.ParentResourceGuid = ir.Guid
INNER JOIN
                      ResourceType rt ON rt.Guid = ir.ResourceTypeGuid
WHERE     (ra.ResourceAssociationTypeGuid =
'3028166F-C0D6-41D8-9CB7-F64852E0FD01') AND (i2.Name LIKE 'retired')

After running AD Import, new computers don't appear under active collections or OU collections

Problem/Symptoms

AD Import is not importing all computers. Some computers were added about four or five weeks ago in the Network.
The Altiris Agent was installed on the new computers. Then, those new computers were added in the AD domain.
AD Import (Full Import) is run but the new computers are not being imported into Notification Server via AD Import.

The Altiris Log Viewer does show that the AD Import found those computers when Trace was enabled in the Log Viewer.
However, these computers are not being populated into the OUs collections or All Computers collection.

---

Environment

Notification Server 6.0.6074 SP3 + R*
Active Directory Connector 6.1.842
AD Connector Hotfix 3 (KB34704)

---

Cause

Verified the status for those machines. The computer names were used in the past and then retired. These client machines were built over the last few months but the names were previously used sometime last year then decommissioned.  Their Purging maintenance is set to 1 month and to Retire only.
The computer names are being re-used.  The GUID is then created based on the name and domain so they are the same as the previous retired computer names.

---

Resolution

Find the computer in a report or in the Altiris Console by clicking the Resources tab > Resources > Defaults.
Right-click the row the computer is listed on, click Set Asset Status, and select the wanted status. (In this case it was changed from "Retired" to "Active".)

As well, you can create your own report to identify what computers are set to Retired. See Article ID: 24473 "How to check the status (active, retired , etc) of a machine?" as example.

Beta II CMS Installation Error on PCANYWhere

Error 1603 on PCAnyWhere during installation of Beta Refresh II

You need to do 2 things

1) create a Group Policy when on a domain or a Local Policy on a standalone:

Computer Configuration > Windows Settings > Security Settings > Software Restriction Policies (if there isn't one, create one), Right Pane, Double-click Enforcement, change bottom radio button to All users except local administrators

2) Run then MS KB 925336

If you are NOT on a Domain and use Local Policy then this is the regkey to check:

Open HKLM\Software\Policies\Microsoft\windows\safer\codeidentifiers and see if there is a DWord entry called "PolicyScope". If it's not there, create it, and set the value to 1.

Thx to Beta Forum thread : Beta Forum

HP SoftPaq Download Manager

HP SoftPaq Download Manager provides a simple, powerful way to download software updates for the HP client PC models in your environment. HP SDM can significantly reduce the amount of time it takes to locate and download updates. SoftPaqs can be downloaded in as few as three easy steps from a single user interface after initial setup.
Easy to use
Locating files is a snap using HP SoftPaq Download Manager. Simply select the desired models, operating systems and languages, then click Find Available SoftPaqs. All available softpaqs matching the selected criteria will be displayed in a friendly interface. Next, check the updates you wish to download, then click the Download button.

Download here : HP Download Manager

Collections cannot be deleted because Notification Server believes they are being referenced by an item

---

Collections cannot be deleted because the Notification Server believes that they are being referenced by at least one item; however, when the dependency page is opened there are no items listed.

---

Cause

The collections were being referenced by orphaned polices. These items were not being displayed in the dependency page, as they were not visible within the Altiris Console even though they did not have the hidden attribute assigned to them.

---

Resolution

1. Enter the collection guid into following query, as it will find all ParentItemGuid's associated with that collection.
   SELECT ParentItemGuid FROM ItemReference WHERE ChildItemGuid = 'CollectionGuid'
2. Enter all ParentItemGuid's (normally just two) into the following query, as this will tell you their names and descriptions. One should be a folder and the other a policy.
   SELECT [Guid],[Name],[Description] FROM Item WHERE [Guid] IN ('parentitemguid',parentitemguid')
3. Grab the GUID of the policy and use it with the findtreeitem.exe (attached) as this will tell you where in the console that item can be found. These orphan items will most likely not be visible in the console when you check, confirming that you can delete them.
4. Enter policy GUID into delete script creation query and run it.
5. Copy the created delete script to new window and run it.
6. Run the creation query again. If it returns a "delete from" row, then perform step 5 again, and then step 6. If no "delete from" row is displayed, the item has been deleted and you should be able to delete the collection now.

The Inventory Office reports do not include Office 2007

Some reports need to be updated to include Office 2007. These reports were found in the console at Reports\Assets and Inventory\Inventory\Windows\Software/Applications\Microsoft Applications.

The reports are

• Computers with MS Office 97_2000_XP_2003 by Domain
• Computers with Multiple Installations of MS Office
• Count of Microsoft Office Products Installed
• Count of MS Office 97_2000_XP_2003 Components

You can download a zip file from this link, unzip and import them into your Notification Server. They have a new GUID so they will not replace your existing ones.

Using WinPE 2.1 with VMWare virtual machines

You must use Intel E1000 network card emulation instead of AMD pcnet network card emulation. See http://juice.altiris.com/tip/2919/tweaking-vmware-work-winpe-2x-and-microsoft-vista for instructions.
Excerpts from the link:

The following works for VMware WorkStation 5.5 and 6.0 and VMware Server 1.0+. By make the following alterations, WinPE 2.x will work seamlessly with network drivers.

1. Make sure VMware is not running. Stop any virtual machines running and close VMware.
2. Browse to the Virtual machine files and open the .vmx file with your favorite text editor.
3. Add the following to the <Path to VM> .vmx file:
   ethernet0.virtualDev = "e1000"

   This is right after the ethernet0.present = "TRUE".

4. Save the changes.
5. Start your virtual machine.

Virtual machines with installed operating systems such as Microsoft Windows Vista or Microsoft Windows XP might have an issue with the drivers after this change. Change the network drivers and point to c:\windows\system32 for the drivers. Or download the latest e1000(Intel) driver.

Nice site on packaging with tips and trics

Link to site

How can I disable Simple File Sharing centrally?

Question
How can I disable the Simple File Sharing setting centrally, rather than having to go to each client?

Answer
If the clients are part of a Windows* domain, you can apply a Group Policy to the clients that need to have this setting disabled.
To configure the Group Policy to disable this setting, browse to the following in the Group Policy Editor on a domain controller:
Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Sharing and security model for local accounts
Set this policy to Classic - local users authenticate as themselves.
When this policy applies to the client, it sets the following registry key to 0:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\forceguest

What is the Altiris Agent Bootstrap Program?

What is the Altiris Agent Bootstrap Program? How does it work?

How does it use AeXSWDInstSvc (Altiris Agent Installation Program)?
Answer


Note: This information can be found in the Notification Server 6.0 SP3 Reference Guide pages 19–20.


When the Altiris Agent is installed using a Push or Pull installation, a small (approximately 100 KB) bootstrap program is used. This program, the Altiris Agent Bootstrap program, downloads a larger (approximately 4.5 MB) program, the Altiris Agent installation program, that actually performs the Altiris Agent installation. The Altiris Agent Bootstrap program gets sent to all managed computers at the same time to prevent an overload of the network. The Altiris Agent Bootstrap program then handles the network throughput (starting and stopping), until it downloads the Altiris Agent installation program to the managed computer.Because the Altiris Agent Bootstrap program controls how fast the Altiris Agent installation program gets downloaded to the managed computer, it can reliably download the Altiris Agent on remote computers or managed computers with poor connections.The following steps show the installation process during an Altiris Agent installation using a Push or Pull installation:
The Altiris Agent Bootstrap program (AeXSWDInstSvc.exe) is downloaded to the managed computer (either by Push or by Pull). This program is quite small (approximately 100 KB) and can be sent quickly even over a slow line. Because the Altiris Agent Bootstrap program is an NT service, it runs as soon as it is downloaded. Note: The Altiris Agent Bootstrap program creates a log file, AeXSWDInstSvc.log, in the operating system directory. This log file records the process of downloading the Altiris Agent installation program and installing it. It displays "Sending 'Remote Install Finished: Success' message to Notification Server" when the process of downloading and installing the Altiris Agent installation program is complete. Some messages recorded in this log file are sent back to the Notification Server and logged in the Notification Database.
The Altiris Agent bootstrap program downloads the Altiris Agent installation program (AeXNSC.exe) from the Notification Server. It has the ability to stop and start again until the Altiris Agent installation program is downloaded completely.
The Altiris Agent bootstrap program runs the Altiris Agent installation program.
The Altiris Agent installation program installs the Altiris Agent onto the computer.Note: The Altiris Agent installation program adds itself to the registry run key so that, if the computer is rebooted, it will run when a user logs on.
When the installation is complete, you will see an Altiris Agent icon in the system tray of the managed computer, if you selected that option. Note: During the installation process, status messages are sent back to the Notification Server. There is a chance that one or more of these messages can end up in a Bad event directory on the Notification Server and not be processed into the Notification Data base. However, the Altiris Agent installation could still be successful.
Note: From the time you start a Push or Pull installation, it can take several minutes before the Altiris Agent icon appears in the system tray. This is because the Altiris Agent Bootstrap program is downloaded, then the Altiris Agent Bootstrap program downloads the Altiris Agent installation package, then the Altiris Agent installation package installs the Altiris Agent on the computer. Depending on the network traffic, this process can take some time. Note: There is an MSI program available, AeXNSCInstSvc.msi, that also installs the Altiris Client Installation Service. This service downloads the Altiris Agent installation program from the Notification Server and installs it on the managed computer. The only parameter that AeXNSCInstSvc.msi takes is [NS=NSName.domain .com], where NSName is the name of your Notification Server and domain is the domain that your Notification Server is on. This MSI supports the elevated privilege install.
These are the commands that can be used as additional parameters for the AeXSWDInstSvc (Altiris Agent Installation Service):
AeXSWDInstSvc

[-u URL] [-s server_name] [-w URL] [-d path] [-c chunk_size] [-p pause_interval] [-exe] [-checkonly] [-notrayicon] [-nostartmenu] [-preconfig] [-?] [-h]


AeXSWDInstSvc Parameters
u URL URL to download the Altiris Agent setup program from. This is an HTTP site. This argument is required.
s server_name Name of the Notification Server that the Altiris Agent will report to (without leading \\). This argument is required.
w URL
URL that the Altiris Agent will use to report to the server. This argument is required.
d path
Destination path the Altiris Agent will be installed to.
c chunk_size
Size (in bytes) of data to download each time. If omitted, 1 KB is used.
p pause_interval
Time (in ms) between downloading each chunk. If omitted, 25 ms is used.
exe
Forces the program to run as an .exe under Windows NT/2000/XP/ 2003, ignoring any service registration to this .exe. This option has no effect under Windows 95, 98, 98 SE, or Me.
checkonly
Forces the program to check the Altiris Agent minimum requirements are met. Details are displayed on screen.
notrayicon
Specifies that the Altiris Agent will not show the tray icon on initialstartup. This will be overridden by the Altiris Agent Settings policies as soon as they are downloaded.
nostartmenu
Specifies that no start menu item will be installed for the Altiris Agent.
preconfig
If specified, the program and the Altiris Agent will use the existing client proxy configuration. If omitted, both will attempt to connect to the Notification Server directly.
? or h
Shows the usage dialog.

Installing the NS Agent on Ubuntu Linux

By Jonathan Jesse

While Ubuntu is not a supported operating system by Altiris, the NS Agent can still be installed and Inventory can function correctly. Since Ubuntu does not use the RPM format for maintaining packages, software inventory will not be as complete as when run on a supported build of Linux. These instructions were written for Kubuntu 7.10, the latest version, but can be easily adopted for Ubuntu or any other supported version.
The first thing we need to do is to make sure we can ping the Notification Server. From the terminal, verify through ping, connectivity to the Notification Server. Once we can ping the server we will need to make sure the correct tools are installed. There is an RPM (Red Hat Package Manager) tool for Ubuntu that is not installed by default. From the terminal, type "sudo apt-get install RPM" and type in the administrator password, as the screen shot shows.

Click to view.
Select Y to install the packages.
The NS Agent cannot be pushed to Ubuntu for two reasons: 1. There is no root user enabled by default 2. SSH is not enabled by default. If we wanted to push to Ubuntu there are many changes to make, so we will do a pull install. Open up your web browser, if you are using Kubuntu it will be Konqueror, and navigate to the Altiris Unix/Linux Agent Download page which is found at http://SERVERNAME/UnixAgent/AltirisUnixAgentDownload.aspx?Id=56 which will look like the following:

Click to view.
Downloading and Installing
Follow these steps to download and execute the file for setup:
Click on the link to download the aex-bootstrap.gz file
Save it to the correct location (For this example it is saved in /home/USERNAME/
Open up a terminal session and navigate to the saved directory
Unzip the file by typing the command: gunzip aex-bootstrap.gz
Type the following command to change the file to allow execution: chmod u+x aex-bootstrap
Execute the aex-bootstrap utility by typing the following command: sudo ./aex-bootstrap http://SERVERNAME

Deployment Solution 6.9 supported platforms and system requirements

The Following KB descibes the supported platform for DS69.
Link

Adding mass storage drivers for Windows PE

Question
How do I add mass storage drivers for Windows PE?


Answer
This applies to Deployment Solution 6.5 SP1 and older only. For Deployment Solution 6.8 code, skip to the bottom.
Download the attached MassStorage.zip file and uncompress. There should be nine files in this .zip file. (https://kb-secure.altiris.com/article.asp?article=20566&p=2)
If in PXE, choose your WinPE boot option and then click Edit. This will load the Menu Item properties.
Click on Edit Boot Image.
You'll find yourself on Step 8 of 11: Edit Configuration.
Drill down on the menu option to %systemroot%\system32.
Create a new folder called diskdrivers.
Under diskdrivers, create another new folder called storage.
Right-click on the storage folder and click Add File.
Add the nine files from extracted MassStorage.zip file
If you're in the Boot Disk Creator then you should simply be able to follow steps starting at step 5.
It may be necessary to modify the txtsetup.oem file within the driver. You can open this file with Notepad*. You'll notice that there is a [Defaults] section that looks like this:
[Defaults]scsi = iaAHCI_ICH6R
The SCSI value is what you may need to change. If you have the ability to load the computer to its operating system, you can check in the Device Manager for your specific controller type.
Here are the instructions on how to do this:
On the Start menu:
For Windows 2000, select Settings and then select Control Panel.
For Windows XP or later operating systems, select Control Panel.
Open the System applet (you may first have to select Switch to Classic View).
Select the Hardware tab.
Select the Device Manager button.
From the Device Manager, look for an entry named "SCSI and RAID Controllers." If this entry is present, expand it and look for one of the following controllers:
Intel(R) 82801GR SATA RAID Controller: If this controller is present, the system is an ICH7R system in RAID mode and no further action is required.
Intel(R) 82801GH SATA RAID Controller: If this controller is present, the system is an ICH7DH system in RAID mode and no further action is required.
Intel(R) 82801FR SATA RAID Controller: If this controller is present, the system is an ICH6R system in RAID mode and no further action is required.
Intel(R) 82801ER SATA RAID Controller: If this controller is present, the system is an ICH5R system in RAID mode and no further action is required.
If none of the controllers above are shown, then the system is not running in RAID mode and you should continue on to step 6.
From the Device Manager, look for an entry named "IDE ATA/ATAPI controllers." If this entry is present, expand it and look for one of the following controllers:
Intel(R) 82801GBM SATA AHCI Controller: If this controller is present, the system is an ICH7M system in AHCI mode and no further action is required.
Intel(R) 82801GR SATA AHCI Controller: If this controller is present, the system is an ICH7R system in AHCI mode and no further action is required.
Intel(R) 82801GH SATA AHCI Controller: If this controller is present, the system is an ICH7DH system in AHCI mode and no further action is required.
Intel(R) 82801FBM SATA AHCI Controller: If this controller is present, the system is an ICH6M system in AHCI mode and no further action is required.
Intel(R) 82801FR SATA AHCI Controller: If this controller is present, the system is an ICH6R system in AHCI mode and no further action is required.
If this controller is not present, then your system is not in AHCI mode. No other modes are supported by the Intel Matrix Storage Manager software and you should continue on to step 7.
Your system does not appear to be running in RAID or AHCI mode. If you feel that your system is running in RAID or AHCI mode and you do not see any of the controllers listed above, you may choose to contact your system manufacturer or place of purchase for assistance.The attached driver file has shown promise in working with several laptops and WinPE. You're welcome to use this driver as is or modify the TXTSetup.OEM so that the driver needed is on top.
For information on how to add new drivers into WinPE through the Boot Disk Creator, see article 19067.
For Deployment Solution 6.8 build 206, 282, and 378, follow these steps for adding a mass storage device driver:
When creating a new configuration for WinPE, you eventually get to the point where you have to choose a NIC driver. At this point in the build process, you can actually add Mass Storage Device Drivers.
Click on Have Disk.
When this loads, click on Browse.
When the Browse box loads, click on the Files of type drop-down and choose file type (*.oem.).
You can then browse to your txtsetup.oem file associated to your mass storage device and add the driver. The driver will be added correctly and no further modifications are needed.

AD imported computers not being removed by Directory Synchronization

Several old computers that no longer exist inside Active Directory are still showing up in the All Windows NT/2000/XP/2003/Vista without the Altiris agent installed collection even though the Discovery Synchronization Schedule is enabled. Resource Manager shows that both the OU Membership and the Global Active Directory Details data classes have been populated. These fields only exist if the computer was discovered by an AD import rule.
No errors are showing up in the Notification Server logs during the synchronization or during the imports.
Cause
The computer's guid is no longer listed in the Inv_Import_Rule_Imported_Items table that is used by the Directory Synchronization to determine which unmanaged computers need to be purged.
Resolution
The following SQL query will show which resources (Computer or Virtual Machine) no longer have entries in the Inv_Import_Rule_Imported_Items table, but have the OU Membership & Global Active Directory Details dataclasses.
SELECT vr.Name, rt.Name AS 'Resource Type', vr.guidFROM vResourceEx vrJOIN Inv_OU_Membership ou ON ou._ResourceGuid = vr.guidLEFT JOIN Inv_Import_Rule_Imported_Items ii ON ii._ResourceGuid = vr.guidJOIN ResourceType rt ON rt.guid = vr.ResourceTypeGuidWHERE vr.IsManaged = 0AND ii._ResourceGuid IS NULLAND vr.ResourceTypeGuid IN ('493435F7-3B17-4C4C-B07F-C23E7AB7781F', '2C3CB3BB-FEE9-48DF-804F-90856198B600')
This query can be used to create a report or collection.
To find out more information about which process (Purge Maintenance or Directory Synchronization) will be used to remove a computer from the Notification Server see article 34954

Purging Unmanaged (retired) computers

Purging Maintenace only deletes resources which are managed, so how do you automatically purge machines which are not managed?
You can find more info on https://kb.altiris.com/article.asp?article=38550&p=1

issue with 29/02/2008

KNOWN ISSUE: Viewing Software Delivery Tasks displays a System.ArgumentOutOfRangeException error
Note: If you are experiencing this particular known issue and wish to be notified of changes in the status of this issue, please subscribe to the article by clicking to the right of this article. As the status of this request is updated, subscribers will be notified of any changes and decisions that are made.
Problem/Symptoms
When attempting to view Software Delivery Tasks in the NS Console, the following error is displayed in the console:
System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values.Parameter name: Year, Month, and Day parameters describe an unrepresentable DateTime. at System.DateTime.DateToTicks(Int32 year, Int32 month, Int32 day) at Altiris.NS.SoftwareDelivery.UI.advGeneral.LoadAdvertisement() at Altiris.NS.SoftwareDelivery.UI.advGeneral.Page_PreRender(Object sender, EventArgs e) at System.Web.UI.Control.OnPreRender(EventArgs e) at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Control.PreRenderRecursiveInternal() at System.Web.UI.Page.ProcessRequestMain()
The date today is February 29 2008, which is a leap year.
Cause
This issue may appear when it is a leap year as the default removal date is calculated by adding a year on to today's date -- for example, if today is February 29 2008, the default removal date is calculated to be February 29 2009 which does not exist.
This is a problem in the Altiris.NS.SoftwareDelivery.UI.dll.
Resolution
The following hot fix only installs on version 6.1.1058 SP3:
Hotfix Altiris_SoftwareDelivery_6_1_SP3_KB40682.exe is available for this issue and can be found at:
http://www.solutionsam.com/solutions/Hotfixes/Altiris_SoftwareDelivery_6_1_SP3_KB40682.exeInstallation Steps:Run Altiris_SoftwareDelivery_6_1_SP3_ KB40682.exe to install the Software Delivery Solution KB40682.Uninstall Steps:From Add/Remove Programs: Click the Remove button in the Add/Remove Programs dialog box to uninstall Altiris_SoftwareDelivery_6_1_SP3_ KB40682.KB40682 supersedes the KB35826 and KB37620. Installing the KB35826 after installation of this KB40682 will overwrite the prior DLL version to be stored in the Software delivery / bin folder.
For other versions of SWD, the following work around should be employed:

As a workaround, the customers could define valid expiry dates for all of the SWD tasks that they wish to view/edit in the NS Console by exporting and editing the XML definition of the SWD task and reimporting it.

They need to look for:



And change it to something like:



If the before attribute is present and the date valid, then the task will open successfully.
NOTE: On the task, do NOT make the availability date for today as you will run into this bug again

Agent security vulnerability corrected

The agent security vulnerability is covered in R7 : https://kb.altiris.com/article.asp?article=35803&p=1

The vulnerability from Symantec : http://securityresponse.symantec.com/avcenter/security/Content/2008.02.06.html

Release Notes for Altiris® Notification Server™ 6.0 SP3 R7

Rollup 7 (R7) for Notification Server 6.0 is a rollup of fixes to the core product since the release of Service Pack 3. It includes R1 (KB22690), R2 (KB23784), R3 (KB25133), R4 (KB27859), R5 (KB31946), and R6 (KB34317)

This release covers Agent security vulnerability corrected http://securityresponse.symantec.com/avcenter/security/Content/2008.02.06.html

Read more : https://kb.altiris.com/article.asp?article=35803&p=1

Automated Installation Kit (AIK) for Windows Vista SP1 and Windows Server 2008

The Windows Automated Installation Kit (Windows AIK) is designed to help corporate IT professionals customize and deploy the Windows Vista and Windows Server 2008 family of operation systems.

This you need for DS 6.9

vLite 1.1.1

Here is the quick fix for the specific issue regarding SP1 MS preintegrated installation modification when running vLite from Windows XP. Some users reported a Registry Load error popup at the last vLite step in that scenario.If you are running vLite from Windows Vista then this update isn't crucial but still recommended. Thank you for the prompt reaction before the preintegrated SP1 goes public.

vLite is a tool for customizing the Windows Vista installation before actually installing it.Main features are:
hotfix, language pack and driver integration
component removal
unattended setup
tweaks
split/merge Vista installation CDs
create ISO and burn bootable CD/DVD Windows Vista from Microsoft takes a lot of resources, we all know that. vLite provides you with an easy removal of the unwanted components in order to make Vista run faster and to your liking.This tool doesn't use any kind of hacking, all files and registry entries are protected as they would be if you install the unedited version only with the changes you select.It configures the installation directly before the installation, meaning you'll have to remake the ISO and reinstall it. This method is much cleaner, not to mention easier and more logical than doing it after installation on every reinstall.

KNOWN ISSUE: Deployment Server Win32 console security does not properly pass through authenticate users from AD groups

KNOWN ISSUE: Deployment Server Win32 console security does not properly pass through authenticate users from AD groups

Problem/Symptoms

When the Deployment Server Win32 console security is enabled with imported AD group, and a user attempts to log into the console (using AD pass through authentication), they are prompted for credentials. If they do not enter the credentials it will open the console with no security rights. If they do enter in their proper credentials it opens the console with all security rights that the user should have. It also creates a new security user in the Deployment Solution console security instead of just using the group membership.

There are multiple types of environments that can cause this behavior. The following are 3 different known scenarios that exhibit this behavior:

Scenario 1

1. AD environment is set up as follows: There are two domain controllers, "parent.com", and "child.parent.com" which is a child domain of "parent.com".
2. A security group is added to "child.parent.com" domain called "Console Users".
3. A domain user is created called "Altiris" and is added to the "Console Users" group.
4. Deployment Solution 6.8 SP2 build 378 is installed with all default options.
5. Console security is enabled, and the "Console Users" AD group is given full administrative rights to the Deployment Solution console.
6. Log onto a computer that has a Win32 console installed using the account AD "Altiris" from the "child.parent.com" domain.
7. Notice how the console security prompts for the username and password. Enter that information and continue.
8. From the console select Tools > Security and notice how that user ("Altiris@child.parent.com") is now listed as a security user even though it was never added directly, but only through AD group membership.

Scenario 2

1. AD environment is set up as follows: There is one domain controller, "company.com", which was given a NETBIOS name of "MYCOMPANY" (which is different than the UPN domain name).
2. A security group is added to "company.com" domain called "Console Users".
3. A domain user is created called "Altiris" and is added to the "Console Users" group.
4. Deployment Solution 6.8 SP2 build 378 is installed with all default options.
5. Console security is enabled, and the "Console Users" AD group is given full administrative rights to the Deployment Solution console.
6. Log onto a computer that has a Win32 console installed using the account AD "Altiris" from the "company.com" domain.
7. Notice how the console security prompts for the username and password. Enter that information and continue.

Scenario 3

1. AD environment is set up as follows: There is one domain controllers, "company.com", which is set up with default settings (where the NETBIOS name is "COMPANY" which is default).
2. A security group is added to "company.com" domain called "Console Users".
3. The domain user "Administrator" is added to the "Console Users" group.
4. The domain user account of "Administrator" does not have the UPN name. Other accounts on the domain controller also might not have a UPN name, but have a SAM name. 
5. Deployment Solution 6.8 SP2 build 378 is installed with all default options.
6. Console security is enabled, and the "Console Users" AD group is given full administrative rights to the Deployment Solution console.
7. Log onto a computer that has a Win32 console installed using the account AD "Administrator" from the "company.com" domain.
8. Notice how the console security prompts for the username and password. Enter that information and continue.
9. From the console select Tools > Security and notice how that user ("Administrator@") is now listed as a security user even though it was never added directly, but only through AD group membership.

Cause

The original express.exe from DS SP2 build 378 was incorrectly caching the NETBIOS domain name in the database. Because the users were cached incorrectly they were not being identified by Active Directory.

Resolution

Solution:

1) Backup Express database and express.exe: Backup the database - usually named 'express' - before making any changes.  Make a copy of express.exe.
2) Remove improperly cached users:  Users who have attempted to login to the Deployment Console with security enabled prior to this fix will have users incorrectly cached in the database.  These users must be removed from the securityuser table. To remove these users run the following query against the SQL server:

DELETE FROM securityuser WHERE ad_user = 1 AND user_guid = ''
3)  Replace Express.exe:  Replace the original express.exe included in SP2 with the express.exe attached to this knowledgebase article. 
4) Appy License to Express.exe:  Open the license tool under your Deployment Server program files directory. (License.exe) Run the tool to license the express.exe with all applicable licenses.

Note 1:  This executable has been through the official Symantec Hotfix process and is supported by Symantec Support Services.

Note 2:  No services need to be stopped to affect this change. Only verify that console users have closed any remote sessions to the console. For locally installed consoles, this exe will need to be deployed via DS or NS once licensed.

Note 3: Changes made to express.exe in KB 38727 are also included in the express.exe attached to this KB.

What is the best way to replicate the Altiris Solutionsam web site?

Question
Our NS Servers don't have internet access. What is the easiest way to replicate the contents at SolutionSam to a local directory and keep it current without having to manually down the solutions?
Answer
Solutions are only maintained on www.SolutionSam.com/solutions/6_0. Some customers utilize a shareware product called HTTrack.. HTTrack can be used to mirror the SolutionSam site to a common local directory. It will update any changes made on www.SolutionSam.com/solutions/6_0 to the local directory automatically.http://www.httrack.com/

Scripts used to manage collections

Question
How can I find the following information about collections on a Notification Server?
The total number of dynamic and static collections.
A list of the dynamic and static collections by name.
A list of collections that have not been updated in over 7 days.
A list of collections that do not have any policies linked to them.
Answer
Displays Collections that Do not Have Policies Applied
select name [Collections without assigned policies] from vcollection where guid not in (select childitemguid from itemreference where hint like 'policyappliestocollection') and classguid like 'B8B666E1-FED3-4482-8D5A-0895658317B2' and attributes & 1 <> 1order by name asc
Collections not Updated in the Last Week

• select i.name [Collection Name], c.lastupdated [Date Last Updated], i.classguidfrom item i join collection c on i.guid = c.guid where c.lastupdated <> 1order by i.name asc

Displays Static Collection Names

• select Name [Static Collections] from item where classguid like 'B8B666E1-FED3-4482-8D5A-0895658317B2'and state like '%true%'and attributes & 1 <> 1order by name asc

Displays Dynamic Collection Names

• select Name [Dynamic Collections] from item where classguid like 'B8B666E1-FED3-4482-8D5A-0895658317B2'and state like '%false%'and attributes & 1 <> 1order by name asc

Displays a Static Collection Count

• select count(*) as name from item where classguid like 'B8B666E1-FED3-4482-8D5A-0895658317B2'and state like '%true%'and attributes & 1 <> 1

Displays a Dynamic Collection Count

• select count(*) as name from item where classguid like 'B8B666E1-FED3-4482-8D5A-0895658317B2'and state like '%false%'and attributes & 1 <> 1

Excluding/Controlling what Client MAC is reported to the DS Server

Problem/Symptoms
Many computers have multiple NICs, which can cause problems in Deployment Solution. For instance, a computer may only have one NIC connected, and Deployment Solution may report on the second NIC with no IP address, thus showing a missing IP address in the console. Clustered computers may have a single assigned MAC given to multiple computers, again causing problems within Deployment Solution if the incorrect MAC is tracked.Computers reporting multiple NICs may also encounter Deployment Server licensing issues when each NIC is assigned a separate license.
Cause
Because DS tracks a computer based only on a single NIC/MAC address, sometimes human intervention is necessary to prevent conflicts or incorrect data.
Resolution
A CustomData.ini file can be created to exclude NICs or MACs so that DS will only track the remaining NIC/MAC option. This file is created by duplicating the Dynamic.ini file, and renaming the duplicate to CustomData.ini. This can either be performed on the client computer directly, or on the server and then sent out with a job to the client computers.
First, be sure there is a [Filters] section in this file.
Since DS combines the contents of both the Dynamic.ini and CustomData.ini files, the CustomData.ini file does not need to have all the same information as the Dynamic.ini. However, for this exercise, at least the [Filters] section is required.
In this section, a line may be modified (or created) with "FilteredAdapterNameList" to include custom/unique types of adapters which should be excluded or ignored by DS (such as dial-up adapters, or WiFi adapters). The line should look something like this:

• FilteredAdapterNameList=Dial-Up Adapter,VPN,PPP Adapter

Alternatively, a "FilteredMACAddresses" line may be used to exclude certain the MAC addresses on adapters that may be otherwise legitimate. This would be the case for duplicate NICs, such as having two identical Intel NICs, where the above option would end up excluding both. This line is used to exclude specific MAC addresses, rather than a type of connection. This line should look something like this:

• FilteredMACAddresses=CCCCCCCCCCCC,FFFFFF000000,00038A000011

Finally, for those who may need it, there is one other way to filter, and that is based on user. By default, we already exclude one user, but you may add others.
The FilteredUserNames line looks like this (additional entries, as with the above options, should be seperated by commas):

• FilteredUsernames=SMSCliSvcAcct&,IWAM_

Currently, users are required to manually create a CustomData.ini file from a copy of the Dynamic.ini file and enter the MAC addresses of NIC cards that users do not want to register with Deployment Server.

Inventory Tasks not running on clients

Problem/Symptoms
A large number of clients are not running inventory. The express\inventory folder isn't getting created. Basis inventory is running successfully as are many software delivery tasks.These Inventory tasks are queued but never start.
Environment
Notification Server 6.0 SP3 R2 Inventory Solution 6.1 SP1
Cause
The inventory tasks' priority was changed from Normal to Low in order to give higher priority to Software Delivery tasks. However, because of problems with clients getting the packages to some of these Software Delivery tasks, they never complete. Because the higher priority tasks never completed, the lower priority items could never start.
Resolution
You have the option of resetting the priority of the inventory tasks back to "Normal" so that their priority level is at least equal to the priority of the Software Delivery tasks. The root cause of package downloads failing also needs to be resolved.

How do I modify AeXMachInv.exe to properly report my processor?

Question
How do I modify AeXMachInv.exe to properly report my processor? Inventory Solution incorrectly identifies my processor as "Intel Compatible".
Answer
The following process can be used to update the ProcessorDesc.ini file to include identification for a processor being labeled "Intel Compatible". This process is provided "as is" and contains no guarantees.
This process requires dbgview.exe, a debug utility from Microsoft, located here: http://technet.microsoft.com/en-us/sysinternals/bb896647.aspx.
After extracting the utility, launch it so the debug capture window is shown.
Go to Start > Run, type cmd, and click OK.
Browse to the following location: C:\Program Files\Altiris\Altiris Agent\Software Delivery\{01B54EB5-3679-4C73-9E10-E169D5A5EC59}\cache
Type the following Command line and press Enter: AeXMachInv.exe /norbin
The debug window will fill with trace information.
When the launch is complete, search within the trace elements for the word "family". There will be a series of numbers similar to the ones shown in the ProcessorDesc.ini file.
For example:
00 1111 0001 Intel Pentium 4 processor
00 1111 0010 Intel Pentium 4 processor Special
00 1111 0011 0100 Intel Pentium 4 processor

Check against the contents of the ProcessorDesc.ini file to see if the number sequence is already contained therein. The file is contained under \\NotificationServer\NSCap\Bin\Win32\X86\Inventory Solution\.
If it is not, add the number sequence followed by the name of the processor (that is, Intel Pentium M Mobile Processor or AMD Athlon). What you list here is what will be used for the identity of that processor. Note: You should add the sequence and identifier under the proper category (Intel's the first section, AMD the second, and so on).
Save the file. Once saved, you can manually update the Distribution Point for the package so the changes in the file are detected and the file is updated on the target client computers, or wait for it to automatically update. The next time Inventory runs, the new entry will be used using the identifier provided.

Active Directory Synchronization doesn't appear to be working 6.1

Problem/Symptoms
Computers that are deleted from Active Directory are not being deleting from the Notification Server database.
Cause
There can be several reasons that computers may not be deleted from the Notification Server database after being removed from Active Directory.
If the computer is set to a status other than Active, it will not be removed.
If the Import Rule that the computer was deleted with no longer exists, the computer will not be removed.
If the computer was never imported by the Microsoft Active Directory Component, it will not be removed.
If the computer shows that it has been deleted in the ItemResource table.
Directory Synchronization does not remove computers that are managed; it lets Purge Maintenance take care of those computers.
Resolution
Run the following SQL to determine the reason that the computers are not being deleted then do the appropriate action to correct it.

Select i.guid, i.name as 'Computer Name', 'Reason' = Case When ra.ResourceAssociationTypeGuid = '3028166F-C0D6-41D8-9CB7-F64852E0FD01'and childresourceguid not like '0A0203A5-D2B6-49F1-A53B-5EC31A89437C'Then 'Computer is not active'When i.guid in(select ii._resourceguidfrom inv_import_rule_imported_items iijoin item i on i.guid = ii._resourceguidwhere _resourceguid not in(select _resourceguidfrom inv_import_rule_imported_itemswhere importruleguid in(select guidfrom itemwhere classguid = 'B2378265-2779-49E6-998D-8BE620B3D9D9'))and i.classguid = '539626D8-A35A-47EB-8B4A-64D3DA110D01') Then 'Import Rule no longer exists' When i.guid not in (select i.guid from item i join inv_import_rule_imported_items ii on ii._resourceguid = i.guid Where i.classguid = '539626D8-A35A-47EB-8B4A-64D3DA110D01') Then 'Computer does not have import information (Generaly means it was not imported)' When i.guid in (select guid from itemresource where deleted = 1) Then 'The resource shows that it has been deleted in the ItemResource table' When i.guid in (Select guid from vcomputer Where ismanaged = 1) Then 'Directory Synchronization does not remove machines that are managed it lets Purge Maintenance take care of those computers.' Else 'This computer WILL be deleted when removed from Active Directory' end from vitem i left join resourceassociation ra on ra.parentresourceguid = i.guid where i.classguid like '539626D8-A35A-47EB-8B4A-64D3DA110D01' order by 'reason'

The resolution will depend on the cause. A report (you can find ite here) can be imported to help simpify the process.
If the computer is set to a status other than Active, it will not be removed. Find the computer in a report or collection and change the status back to Active or Delete it.
If the Import Rule that the computer was deleted with no longer exists, the computer will not be removed. Run the resolution in article 1815 to associate the computer with a current rule or delete it from the report.
If the computer was never imported by the Microsoft Active Directory Component, it will not be removed. Wait for Purge Maintenance or manually delete the computer.
If the computer shows that it has been deleted in the ItemResource table. Manually delete the computer from a report or collection.
Directory Synchronization does not remove computerss that are managed; it lets Purge Maintenance take care of those computers. Wait for Purge Maintenance or manually delete the computers.
If there is a problem with the schedule it may also help to disable and renable the Directory Synchronization task through the Altiris console.
Upgrading to the Microsoft Active Directory Component 6.1.x Resolves this problem if a previous version is currently installed.

Thx Gert

Fixing the Owner of DB Objects

Depending on the way you have your SQL database security set up you may end up with stored procedures and other objects having an owner other than dbo. The typical case of this happening is when running the upgrade with an account that is not an SA on the SQL Server.
If unresolved, this naming issue can give you grief. Here's a way to fix it.
This ownership issue will ultimately end up in causing a lot of errors such as the Deployment Console not opening or certain tasks failing. Basically anything that tries to call the stored procedure will fail because the name is wrong. For example: A stored procedure in the DS database called dbo.del_computer may have its name changed during an upgrade to username.del_computer.


To fix this situation run the following SQL script. Change the USERNAME to whatever the owner is for the objects that need to be changed.DECLARE

@OldOwner sysname,
@NewOwner sysname
SET @OldOwner = 'USERNAME'
SET @NewOwner = 'dbo'
DECLARE CURS CURSOR FOR
SELECT name FROM sysobjects WHERE type = 'p' AND uid = (SELECT uid FROM sysusers WHERE name = ldOwner) AND NOT name LIKE 'dt%' FOR READ ONLY

DECLARE @ProcName sysname
OPEN CURS
FETCH CURS INTO @ProcName
WHILE @@FETCH_STATUS = 0
BEGIN
IF @@VERSION >= 'Microsoft SQL Server 2005'
BEGIN
EXEC('alter schema ' + @NewOwner + ' transfer ' + @OldOwner + '.' + @ProcName)
exec('alter authorization on ' + @NewOwner + '.' + @ProcName + ' to schema owner')
END
ELSE
EXEC('sp_changeobjectowner ''' + @OldOwner + '.' + @ProcName + ''', ''' + @NewOwner + '''')
FETCH CURS INTO @ProcName
END
CLOSE CURS
DEALLOCATE CURS

But this will fix only the Stored Procedures so you need to fix other "types" such as F, V
So run this this querie at least 3 times.

Helpdesk : Customizing The Winuser Console (SP5)

WooHoo! Looks like Helpdesk pro David Falcon spent his holiday break customizing his company's helpdesk. If you've ever wanted to "tune" the forms in your helpdesk or just add your company logo to its pages, read on to follow David's lead at Juice Link