I'm just curious, but when you say that you're getting an access denied error, are you seeing that in the Altiris Agent log?  If so, what's the full URL being listed?  The reason I ask is that I've had problem with setting the URL with aexnsc.exe and have had to use AeXSWDInstSvc.exe instead.

That command would look like:
AeXSWDInstSvc.exe -u "https://nsserver.yourdomain.com/Altiris/NS/NSCap/Bin/Win32/X86/NS Client Package/aexnsc.exe" -s nsserver.yourdomain.com.chchealth.net -w https://nsserver.yourdomain.com/Altiris -nostartmenu

I couldn't find anything about SSL installations, but found what jessek was talking about in the knowledge base for your reference:

https://kb.altiris.com/display/1n/kb/article.asp?a...

Let us know if you've already tried this, and whether or not you got it to work.

Jessek,
The url listed in the logs is correct.  Thank you for the command line option using AeXSWDInstSvc.exe.

Matt,
Thanks for pointing me directly to the article.

I think I have figured out the issue.  I have to wait till after our 4 am maint. window tonight to find out for sure, but I found this article:  www.altirigos.com/vbulletin/notification-server/8079-agent-installs-no-guid.html  which directly listed the 401 error I was receiving.  I did have the IUSR_ account in the guests local group and this might be most of my issue.  I will try the command line installs again tomorrow after a server reboot and will see if this fixes my issue.

Thank you both for your help.

Marco 

Nope,
We removed the account, this caused everyone to be logged in under the service account when logged into the NS Console.  Restarted IIS, still the same.  Put the account back in, restarted IIS and everything went back to normal.

I don't know if this could be part of your issue, but since there aren't full details in the thread it seems reasonable to check.

For SSL to work with the NS agent, the 'computer' account must have a certificate which allows access to the NS server.  This means either you purchase a certificate from one of the public certificate authorities (in which case the matching certificate is already on the client machine) or if you generate your own certificate for the server, you have to distribute/install a matching certificate to the computers certificate store (not the users store).   See this KB article for details -  https://kb.altiris.com/article.asp?article=28283&p=1 or this article for more details https://kb.altiris.com/article.asp?article=39592&p=1.

Did installing a certificate like BBishop suggested help?

BBishop & Matt
I have not had a chance to troubleshoot the issue further.  I am starting to work nights, so I should start having plenty of time to work on this.  We had a consultant come out and re-deploy our Altiris setup back in January.  We started with SSL enabled from the beginning.  Our system did not use SSL previously and deploying the Altiris Agent was easy.  We are now required to use SSL, as well as some other settings, and things are a little hosed.  Thank you for the articles.  I will post anything I figure out here.

Thanks again.

Marco