KNOWN ISSUE: Altiris Agent is stopped when the Local Security agent is installed

Article:TECH42357

Created: 2009-06-22

Updated: 2009-08-25

Article URL http://www.symantec.com/docs/TECH42357

NOTE: If you are experiencing this particular known issue, we recommend that you to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.

Article Type
Technical Solution

Languages

Show all

Problem

After installing the Local Security Agent on a managed system, the Altiris Agent appears to keep getting killed shortly after starting up. Uninstalling the Local Security Agent appears to resolve the issue.

The following warning is found in the agent logs each time the agent dies.
Priority: 2
Date: 5/18/2009 2:33:11 PM
Tick Count: 1587369984
Host Name: AGENT1
Process: AeXNSAgent.exe (4300)
Thread ID: 984
Module: AeXNSAgent.exe
Source: Altiris Agent
Description: Unexpected exit C0000005

Which for the same thread is always just preceded by either the following information/trace log examples below.

Priority: 4
Date: 5/18/2009 2:33:11 PM
Tick Count: 1587369984
Host Name: AGENT1
Process: AeXNSAgent.exe (4300)
Thread ID: 984
Module: AltirisResourceDiscoveryAgent.dll
Source: ResourceDiscoveryAgent
Description: Setting wakeup time to 0 ms (5/18/2009 2:33:11 PM)

Priority: 8
Date: 5/18/2009 2:33:09 PM
Tick Count: 1587368299
Host Name: AGENT1
Process: AeXNSAgent.exe (4300)
Thread ID: 984
Module: AltirisLSSAgent.dll
Source: CCOMApplicationEvent::BuildCOMApplicationPolicyInventory
Description: Generating the list of COM+ Applications.

Environment

Local Security Solution 6.2

Cause

Either during the inventory or resource discovery of COM applications a security exception is hit that causes the Altiris agent to stop.

Either the Inventory process fails because the COM applications are not available or the discovery process trys to collect additional information for the COMs (from the list of COM GUIDs collected by the inventory process), but hits an unexpected security restriction. Either of these exeptions cause the Altiris Service to get restarted.

Solution

Symantec is aware of this issue and is taking steps to resolve the issue. Please subscribe to this KB to be notified as new information or a fix for this issue is available.

At present the only work around to this issue is to disable the COM and DCOM inventory and discovery processes. This will remove the ability to collect security data on all COM and DCOM component/applications which is used with the Altiris Task Server to be able to reconfigure these security settings from the Altiris server. The ability to collect and configure Local Security users and groups is not compromised by disabling the COM and DCOM discovery agents.

To disable the COM and DCOM discovery agents and remove any pending discovery of these GUIDs, please follow the following steps.

Goto - Configuration > Solution Settings > Security Management > Local Security -> Windows > Local Security Agent Configuration
Disable "COM+\DCOM Inventory Policy"
Goto - Configuration > Solution Settings -> Security Management -> Maintenance -> Resource Discovery Agents
Export (individually) each of the Resource Discovery Agents (as a backup)
Delete "COM Application Agent Discoverer" and "DCOM Agent Discoverer"
Run the following SQL code to remove any pending COM and DCOM discoveries:
- DELETE FROM ResourceDiscoveryPending WHERE ResourceDiscovererGuid IN ('4177ddca-ec28-472e-8b1e-c609cf18c675','6b11046e-f560-4359-8993-b256abb831ab')
- DELETE FROM ResourceDiscoveryPendingAgent WHERE ResourceDiscovererGuid IN ('4177ddca-ec28-472e-8b1e-c609cf18c675','6b11046e-f560-4359-8993-b256abb831ab')

Supplemental Materials

Source	DEFECT
Value	OEM 47768
Description	Logged in OEM (Altiris - Partner Product) database

Legacy ID

47768