Video Screencast Help

Leveraging a Software Portal to Improve End-user Productivity in 7.0

Created: 04 Mar 2009 | 12 comments
Language Translations
Joel Smith's picture
+21 21 Votes
Login to vote

Learn how end users can take application management into their own hands using the new and improved Software Portal included in Altiris Client Management Suite 7.0. With the ability to tie into the Software Management Framework, the portal is more configurable and versatile in serving your end user's software needs.

Note: This article covers information presented at ManageFusion Las Vegas 2009


The Software Portal in Software Management Solution 7.0 allows End-users access to initiate installs or make requests for software from a user-friendly interface. This allows users to:

  • Install required software without IT interaction
  • Request software for those applications where limited licensing exists
  • See what software is recommended for them
  • Request Software not listed within the Software Portal
  • Request a Managed Delivery for application state management
  • Request software for any system they log onto

In this article I'll cover the following topics:

  1. Introduction to the Portal
    1. Improvements over the 6.x Software Portal
    2. The Portal Interface
  2. Configuring the Software Portal
    1. Software Portal Agent
    2. Software Portal Settings
    3. Administrator Portal
  3. Software Components and Managed Deliveries
    1. Software Components
    2. Managed Deliveries
  4. Publishing to the Software Portal
    1. Adding a user or group to the Software Portal
    2. Managing Groups for targeted Publishing
  5. Software Publishing Security
    1. Scope Security
Introduction to the Portal

What is the Software Portal? For those familiar with the Software Delivery 6.x Software Portal, what improvements have been made? What does the Software Portal look like and how does it operate?

What is the Software Portal?

The Software Portal is a web-driven interface End-users within the environment can automatically install software or request software. The portal is tied to a user's Domain User, showing only what software is available based on security assignments to that user and the groups they belong to. This allows administrators to control what users can install from the portal, all configured at the back end. For that software that requires tight control, the portal also provides the option to show software available by request. The request can then be answered by an administrator as approved of denied.

Improvements over the 6.x Software Portal

The 6.x Software Portal had limitations. The Portal was by far the top mechanism for feature requests submitted by administrators and users. This list details the improvements made in Software Management Solution 7.0:

  • Ajax controls to bypass the need to install an ActiveX for the Software Portal to function.
  • The ability to request unlisted software with a convenient informational interface.
  • Software recommended for the user will automatically appear in the portal based off that user's Domain User account.
  • Faster load times for environments with greater amounts of software available in the portal.
  • A streamlined redesigned interface.
  • Ability to customize certain features of the Portal, including adding a company logo.

Software Portal Interface

The Portal provides an intuitive interface. See this screenshot for an example of the Software Portal:

The software already listed when first loading the portal is considered Recommended for the user. Note the following concerning the controls of the Portal:

  1. The list under the Request Software section can be multi-selected using Shift and Ctrl.
  2. Click Request Software to request the selected software from the list below. The following window will appear:

    NOTE: If a listed entry does not contain a command-line, the following message is displayed:
    You cannot request this software now. Contact your administrator.

  3. The Request Unlisted Software provides an interface for users to make an informational request for software not listed in the Software Portal. The form includes a Date required setting as shown in this screenshot:
  4. There are two view options:
    1. Recommended Software (Default)
    2. Show All Software - Use the button that toggles between Show All and Show Recommended to switch the view.
  5. The Request status section will list any software that has been requested and its request status.
  6. The User Profile section appears whenever a user first accesses the Software Portal and all required fields must be entered before the Save changes button can be pressed. Once saved it moves to the Home page. See this screenshot for an example:
  7. If the logged on user is an Administrator, another option shows up next to Home and User Profile: Manage. This allows Administrators to service Software Portal Requests that they are in charge of addressing.

    NOTE: This is the same as the Administrator Portal covered in the Configuring the Software Portal section.

Configuring the Software Portal

To use the Portal you need to have the Altiris Agent and the Software Portal Agent. You also need to have the Software Portal Settings correctly configured for you environment. Use the following two procedures to setup the Software Portal for general use.

Software Portal Agent

Unlike other Altiris Agent Plug-ins, the Software Portal install is configured outside of the Plug-in area. The options for where the Software Portal Links are seen on managed systems are selected at the time of the deployment of the Portal Agent. Follow these steps to configure the links and rollout the Software Portal Agent:

  1. In the Symantec Management Console, browse to Settings > All Settings > and browse down through Software > Software Portal Settings > and select Software Portal Agent Installation.
  2. Check the options under "Configure Links" for where you want the Software Portal link to appear, from the choices:
    • Show link for Software Portal on Desktop
    • Show link for Software Portal in Start Menu
    • Show link for Software Portal in Altiris Agent's context menu
  3. By default no Targets are selected. It is recommended to roll this out to all Managed systems. One intelligent method is detailed here:
    1. Under the Select Destination section, click Apply to and choose Computers.
    2. Click the Add rule button on the resulting window.
    3. Next the THEN:, choose exclude computers not in from the first dropdown.
    4. Select Filter from the second dropdown.
    5. Type 'All Windows Computers with Software' into the field, and click the dropdown.
    6. Select the option 'All Windows Computers with Software Management Solution Agent Installed'.
    7. In the window below you'll see the matching computers.
    8. Click OK and the selection will be saved.
  4. Apply a Schedule to roll this out. See this screenshot for an example:
  5. Click Save changes to finish

Software Portal Settings

The Software Portal settings provide some important features. Control how many software objects can be requested at any one time, and customize the Software Portal UI. Access these in the Symantec Management Console, browse to Settings > All Settings > and browse down through Software > Software Portal Settings > and select Software Portal Settings.

Under Flow Settings you'll see the option: Maximum number of open requests per user: [3]. Three is the default, but this can be changed to meet the requirements of your environment.

Under the UI Settings section you are given the options to brand the Software Portal. Copy a company logo to the Notification Server, and then use the Browse button to select that icon. This will brand the Software Portal with your unique logo. You are also provided a field to type in the company name which will be prominently displayed in the Software Portal.

Administrator Portal

This allows Administrators to service Software Portal Request that require approval. When the interface is loaded, the user who accessed it will see outstanding requests listed. See this screenshot for an example:

Recall that this same interface is available by having the same administrator access the Software Portal and click on the Manage tab. To service a request, follow these steps:

  1. In the Symantec Management Console browse under Settings > All Settings > Software > Software portal Settings, and select Administrator Portal.
  2. Use the filtering options if needed to change what is shown in the Portal.
  3. Under the Requested Software field select the request you wish to fulfill.
  4. Click Edit if you wish to add a comment or review the Request History, as shown in this screenshot:
  5. Set a status by using the Edit function detailed above, or by selecting the request in the Portal grid and using the Change Status bar to set the status.
  6. A dialog will appear with the option to put in comments for the action selected. Click OK to initiate the given action.

This raises the question: How does a user request know what Administrator the request should be routed to? This is configured in the User Profile for an administrator. Unlike normal users, administrators have an additional section labeled Add Users: where administrators can add any users that report to them, as shown:

This isn't simply an employee-manager relationship, but specifically relates to what users need your approval for deployment Software.

Software Components and Managed Deliveries

The two basic object types that can be published to the portal are Software Components and Managed Deliveries. These two items are different and it's important to understand the difference between the two.

Software Components

Software components are one of three types of software management, namely:

  1. Software Release - A Software release normally represents the base or regular install for an application.
  2. Service Pack - A Service Pack typically provides major updates to a Software Release.
  3. Software Update - A Software Update is usually a single point-fix or feature correction for a Software Release.

The following information applies to all types of Software Components:

Software Components can contain multiple packages and command-lines. If a component has more than one command-line, one of the command-lines needs to be set as the default in order for this software component to be a valid request. See this screenshot for an illustration for this:

Most Command types in the Command Line configuration allows the option to be checked. However for migrated packages from 6.x promoted to Software components in 7.0 the default option is Custom. Administrators can also set this type for command-lines that don't explicitly meet the labels available as install or uninstall, etc. Custom does not allow publishing to the software portal unless the command line is the only one available in the Software Resource.

The message you receive if more than one command-line exists and none of them are default is:
You cannot request this software now. Contact your administrator.

Rules only apply to Managed Delivery Jobs so any Rules defined under the Rule tab of a Software Component, regardless of the type, is not used. If you wish to use the Rules, create a Managed Delivery Job that utilizes the Software Component.

Managed Deliveries

Unlike a Software Component, a Managed Delivery represents a set of rules for actively managing software. Rules configured in Software Component apply to software components selected to be part of the Managed Delivery Job. Managed Deliveries are like Sequential Tasks, only much more powerful and intelligent, whereas Sequential Tasks offered little or no intelligence when deployment Software.

Managed Tasks are access in the Symantec Management Console under Manage > Policies > Software > Managed Software Delivery. See this screenshot for an example:

It is recommended to test a Managed Delivery before you publish it to the Software Portal. Because of the potential complexities involved, untested Managed Deliveries may show up correctly on the Portal but fail to function due to configuration issues.

Unlike Software Components, Managed Deliveries are not a one-time Task rollout. Once requested, the Managed Delivery Job/Policy will reside locally on the computer, ensuring that the software being managed to installed correctly. Note the following about typical Managed Deliveries:

  • If the managed software is uninstalled later, a validation rule will invoke a reinstall task
  • If the managed software becomes corrupt, a validation rule will invoke a repair on the software
  • More than one piece of software can be included in a Managed Delivery, for example:
    • Microsoft Office 2007 Professional - Software Release
    • Microsoft Office 2007 SP1 - Service Pack
    • Additional Updates - Software Update
Publishing to the Software Portal

To publish software to the Software Portal, you need to work with Portal Security. As previously explained what shows in a user's Software Portal based solely on their account. Below find how to publish software, whether components or Managed Deliveries, to the Portal, and examine some best practices for how to use Groups to manage your Software Portal.

Adding a single user or group to the Software Portal

The following process illustrates how to add a user or group to the Software Portal:

  1. In the Symantec Management Console browse in Manage > Software > Software Catalog > Deliverable Software.
  2. Select the Software Resource in question (whether a Software Release, Software Update, or Service Pack) and click the edit icon.
  3. In the resulting window, click on the Software Publishing tab.
  4. Check the option Publish to the Software Portal.
  5. It is recommended to update the Software Name field to something users will be able to understand. Also use the Description field to expound on what the software does. See this screenshot for an example:
  6. Click the Add User icon.
  7. Enter search criteria. Note that this can be either groups or users.
  8. Click Search and select the desired user or group from the list.
  9. Click OK to save the selection.
  10. Highlight the new user or group and configure the settings to the right.
    1. Select Approved or Requires Approval.
    2. Check the Recommended option if you want this software to show up listed in the portal when the user or users in the group access the Portal.

      NOTE: Overuse of this option will affect the load time of the Portal and render its usefulness ineffective.

    3. See more details under Scope Security.
  11. Click Save Changes to finish.

Managing Groups for Targeted Publishing

Configuring each End-user would be extremely time-consuming. Normally only specific individuals such as executive management or IT administrators may require specific entries. Otherwise local or domain-level security groups can be utilized to simplify the configuration of the Software Portal. When a user accesses the portal, all of that user's security contexts are passed to the NS for processing, including any groups they belong to. For proper maintenance, note the following:

  • AD Organization required to be updated and current
  • Correct assignments of auxiliary groups that may be granted access to Software
  • Removal of users when switching organizations or leaving the company to remove access to company licensed software

To illustrate this point please reference the following table:

Software Portal Configuration ----> Approved and Recommended Approved, Not Recommended Not Recommended, Requires Approval
Active Directory Group Organization
IT_Administrators Information Technology  
  Microsoft Office Yahoo Messenger None for Administrators
  Microsoft Visio Marketing Management App  
  Microsoft SQL Server Adobe Photoshop  
  Company-branded IE 7 Sales Tracking Application  
  Symantec Endpoint Protection    
  Microsoft Messenger    
  Helpdesk Application Console    
  Snag-It Software    
  Ad Aware    
  Cisco VPN Client    
  Adobe Acrobat Reader    
All_Marketing Global Marketing  
  Microsoft Office Yahoo Messenger Microsoft SQL Server
  Microsoft Visio   Sales Tracking Application
  Company-branded IE 7   Helpdesk Application Console
  Symantec Endpoint Protection    
  Microsoft Messenger    
  Snag-It Software    
  Ad Aware    
  Cisco VPN Client    
  Adobe Acrobat Reader    
  Adobe Photoshop    
  Marketing Management App    
All_Sales World-wide Sales  
  Microsoft Office Yahoo Messenger Microsoft Visio
  Company-branded IE 7 Snag-It Software Adobe Photoshop
  Symantec Endpoint Protection   Marketing Management App
  Microsoft Messenger   Helpdesk Application Console
  Ad Aware   Microsoft SQL Server
  Cisco VPN Client    
  Adobe Acrobat Reader    
  Sales Tracking Application    
All_Support Enterprise Support  
  Microsoft Office Yahoo Messenger Adobe Photoshop
  Company-branded IE 7   Microsoft Visio
  Symantec Endpoint Protection   Marketing Management App
  Microsoft Messenger   Sales Tracking Application
  Helpdesk Application Console    
  Ad Aware    
  Cisco VPN Client    
  Adobe Acrobat Reader    
  Microsoft SQL Server    

Note the following when viewing this table:

  • The AD Groups can be added as objects under the Software Publishing tab and assigned rights.
  • The right three columns represent the Portal Configuration. The following configurations are possible:
    • Approved, Recommended
    • Requires Approval, Recommended
    • Approved, Not Recommended
    • Requires Approval, Recommended
  • In the above scenario the configuration Requires Approval, Recommended is not used as I thought why make software recommended if it requires approval?
  • The Software Listed is for example purposes only.

By using the AD Groups listed on the left for assigning rights to the Software Components or Managed Deliveries, all individual users within that group will have the access granted to the group.

Software Publishing Security

When a user accesses the Software Portal, the system they are logged onto does not directly drive what software shows up in the portal. The exception is the Portal will filter based on basic OS type between Windows and Macintosh. Otherwise the physical system is not presented to the NS when the Portal is loaded. It's the user's Domain account that drives what software shows up on the portal, what software can be installed automatically, and what software requires approval.

Scope Security

When the portal loads, the user's SID is transmitted to the Notification Server. The NS will enumerate through all available Software Components and Managed Deliveries to see what objects the user has rights for, and what software is recommended for him or her. The two available options are shown to the side of the security dialog in this screenshot:

By selecting either Approved or Requires Approval a scope-based security item is created for that user with the selected permission. This fits into the natural Symantec Management Platform security. Things to note:

  1. Adding many single users can cause performance issues when security functions are called across the Notification Server as each user will require a security account within NS.
  2. Managing Groups instead of users will not only increase the effectiveness of administration, but lighten the load on any Security related function.
  3. An entry for Approved will override an entry for Requires Approval. Thus if a user is given specific rights to request software requiring approval, but that user also resides in a group that provides software already approved, the user will default to Approved when accessing the Software Portal.

By utilizing the Software Portal, IT Administrators can put the power to obtain required, recommended, or available software to the users with an easy interface accessible from any system on the network. This not only saves time and money for IT, but allows users to get the software they need faster, also saving money and time by giving users the tools they need to fulfill their responsibilities.

Comments 12 CommentsJump to latest comment

jjesse's picture

Thanks Joel, great job as always.   What do you do with all your points?  You oging on a Cruise or something big?

Jonathan Jesse

Architect -- Data Security & Privacy

ITS Partners

Login to vote
Joel Smith's picture

I'm glad you found the article useful.  I'll be working to release a number of article surrounding the new platform 7 as we move forward; after ManageFusion, anyway...

I've thought about the cruise, but I usually have something I want on Amazon, so that's where my points usually go :-)

Joel Smith
Symantec Services Group (SSE)
Sr. Principal Support Engineer

Login to vote
tkukuryk's picture

Cheers mate. I`m Getting started wih NS 7 your article will help a lot.

Login to vote
akolendo's picture

document you wrote is nice ..but going thru your doc doenst gurantee software portal least in my case...anyway. i would like to ask one simple question:

what triggers software installation?? i have a user who has opened his software portal page and sees a few approved/recommended software packages (which were used by swd already) he clicks on them and nothing happens ???? whats wrong??

Login to vote
Joel Smith's picture


When I created this article all functionality was validated.  If software is not coming down as expected likely there is an issue that requires investigation.  Please contact Symantec Support so we may troubleshoot the issue to find out why the requests are not making it down to the target systems.



Joel Smith
Symantec Services Group (SSE)
Sr. Principal Support Engineer

Login to vote
mickwearn's picture

Hi Joel, What a great article.. We are loving the new software portal.. but one question you might know..

We would like to be able to disable or remove the option for users to 'Request unlisted Software'

At the moment we are in pilot phase and a problem we are finding is the users are requesting software that is not on the software portal list, and this request just sits with out any notification in the Administrators portal.

Do you know of any way to disable this button, or to trigger an email alert to someone so they know its there.


Mick Wearn

Login to vote
Joel Smith's picture


There isn't a way to disable this option, though we do have a feature request for it.
As far as notification, Software Management doesn't have a built-in way, but Notification Server has Automation Policies that will do it. To see where these are located, browse under Manage > Policies > and select "Automation Policies" in the tree.
Interestingly enough there is a policy template called "Software Portal".
I haven't played with these types of Policies, but know it can be done. Check what information is available on Automation Policies here on Connect, in the documentation, and within the Altiris Knowledgebase.
Hope this helps!
Joel Smith

Joel Smith
Symantec Services Group (SSE)
Sr. Principal Support Engineer

Login to vote
mickwearn's picture

A way to disable/remove the 'request unlisted software' option
As our requests for unlisted software were starting to get out of control we had to find someway of re-directing the requests to the service centre for action, as mentioned above there is no option to remove or disable the button, But you can however change the text in the window which opens after the user clicks the ‘request unlisted software’ button.

To do this edit the file ManualRequestConfirmation.aspx  located here .\Altiris\SoftwareManagementSolution\SoftwarePortal\Web\UserPortal
This is an example of how my file looks.

Don't forget to make a copy/back up of your file before you edit it.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" ""> <html xmlns=""> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Untitled Document</title> <style type="text/css"> <!-- .style1 {font-family: Arial, Helvetica, sans-serif} body { background-color: #FFFFFF; } --> </style> </head>

Now the end user is prompted to contact the IT Service Centre.

Might be useful to someone, it was to us.

Mick Wearn.

Login to vote
Joel Smith's picture

mickwearn, thanks for the great info! This can help avoid unnecessary overhead.
As a note of caution, if you're going to edit an ASPX file, it is essential to keep the correct formatting when saving. It is recommended to use a multi-format editor, such as Crimson Editor or Notepad++.

As Mick indicated, back up the file before hand, just in case!



Joel Smith
Symantec Services Group (SSE)
Sr. Principal Support Engineer

Login to vote
Gibson99's picture

Thanks for the suggestion.  I have modified our aspx file for an unlisted request to now have a big bold set of text telling people to reconsider (does win7 do what you want to do natively?  you don't really need winzip anymore!)  and to SHOW ALL and SEARCH and then maybe call the help desk.  i also had it collapse the two text entry areas so that they aren't so obvious.  i tried to hide the OK button, but it really didn't like that, so i had no choice but to leave it there.  Regardless, this is much better than what we had before.  Thanks again!

If a Connect post helped you out, be sure to click "Mark As Solution" or the "Thumbs Up" button to let other users know about it.

Login to vote
Gibson99's picture
I have since completely scrapped the original ASPX file contents except for the first 2 lines of the header, and rewrote it with plain jane HTML to completely eliminate all buttons, input fields, and anything even remotely related the console.  Now, it just has a big header that says this functionality has been disabled, and in smaller text below, it says to call the help desk.  No, it's not as "pretty" but now we don't get unlisted requests anymore - only valid ones made the correct way.  
Here's the code if anyone wants it.  You could always use font  and/or color tags to dress it up and make it look nicer, but i have better things to do with my time.  :)
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "">

<html xmlns="">




<h2>This functionality has been disabled.</h2>

<p>Have you tried clicking <b>Show All</b> and using the <i>Search</i> function?<br/>

If you require further assistance, please contact the help desk at (phone number).</p>



If a Connect post helped you out, be sure to click "Mark As Solution" or the "Thumbs Up" button to let other users know about it.

Login to vote
Deutsche Fragen's picture

I need to find out how to delete items users have requested in the software portal.

W have users who request the insorrect software over and over again and we need to get rid of the list that sits in the software protal.

Thank you,

Ika Turner

Login to vote