I'm curious as to what others are doing as well since we are fixing to upgrade this summer.

Are you requiring the user to approve the connection?

There is supposably a Hotfix for this.  I applied it so I would be able to install software without the user logged in but now I can't Remote Control any computer, so this may cause more problems then it fixes.

I have not found a solution to the standard DS remote.  However, if you install ultravnc with the windows vista addons.  It always you to remote the logon screen.

Hey,

We use the Altiris DS remote control a fair bit. We are not going to add UltraVNC as it requires full scale deployment and testing.

The end user does not need to approve the connection. We just need to remote control a computer with the Windows 7 logon screen using Altiris DS remote control.

Regards,

Mark

Has anyone found a fix/workaround for this?  We are running DS 6.9 SP3 build 436 and this continues to impede our Windows 7 deployment progress.

-Jon

We too are on DS6.9 sp3 437 and are having the same issue with Windows 7.  Remote Control works fine when a user is logged in, but for some reason you can't remote control when the computer is at the crt+alt+del screen, if you do a lot of remote management you'll know how important this is.  I've thought in the past that UAC could be playing a role in the problem, but I've disable it with out any effect.  I'm planning a DS 7.1 upgrade soon, but am worried that it might not fix the problem... does anyone know if 7.1 has this fixed?

Thanks,

DS 6.9 SP4 hasn't fixed it, apparently Symantec wants that way. am very disappointed as we rely heavily on remote control feature 

We've hit the same problem and I found the reason but no solution in AKB article 44844

our workaround is if someone is logged in use DS Remote Control. if no-one is logged in use Remote Desktop. Both options are availabe from DS.

The above KB article states specifically that DS6.9 works by design.  I guess this is their way to make DS7.x into a cash cow for all of us who have gotten used to using their software.

Not only can I not remote into a machine that is not logged on, but when UAC prompts occur, I have to be on the phone with users and tell them what to click while I still see the static image that was showing just before the prompt.  Not only that, once a program runs in administrative context or if I run a program as another user (like myself since basic users can't install software), I can only see the windows and cannot interact with the system until that program terminates.  I hope someone out there finds a workaround or symantec provides an update or else my budget is going to disappear from symantec licensing costs...

Thanks all for the suggestions!

I just spoke with an Altiris Technical Support Rep. He stated this issue is known, for one, and no workaround will ever be provided. This issue is upon MS. He also stated UAC cannot be disabled as you could in Vista and only the notifications can. However I find that part to be untrue since there is an abundant of information as to how on the internet.

I'm dissappointed and angry at symantec since I just forked over $$$ to renew the licesne for something they said would work with Windows 7. Although we have another software here that IS able to remote while user is logged off. So there is a way... it's just a matter if Symantec wants to do it. Other than that I have no problems deploying software logged on or off.

DS Remote Control seems to depend on dagentui, which runs with the same privs as the logged in user.  I think it works better if you allow the altiris dagent service to interact with the desktop.   I can remote control using the microsoft remote desktop.  I have to check 'allow connections from computers running any version of remote desktop (less secure) in the Remote tab, and open the firewall.

I too find this a pain. I think the problem here was that Symantec didn't ever intend to provide remote control functionality as part of the DAgent -PC Anywhere was chosen long ago to be the remote control agent of choice. By popular demand, this feature was rolled back into the DAgent, and yep, it's a shame it doesn't work properly.

Technically, it obviously can be made to work, so the issue is probably that it can't easily be made to work within the current agent code.

If sales told you that this would work,  I would take this issue back to them directly. Its understandable that sales missed this gotcha, as Windows 7 is supported, but they should not assume a full cross-over in manageability.

But to summarise, as things stand, when the user is logged in use DS remote control code, and when they aren't remote desktop. Altiris KB 52496 is the one to subscribe to on this matter.

When calling support did they give you a time frame of when this would be fixed?

I actually was able to control 3 different Win 7 boxes. We use DS 6.9.  Generally ( I say that as it is a challenge to duplicate ) but GENERALLY..

Removed the Altiris directory from the c:\pgm files\Altiris folder -  (leaving the DAgent folder - yes use DAgent)

Ran "netsh firewall set opmode disable" - (disables the firewall)
      (Note - te restore "netsh firewall set opmode disable)
Checkmarked the  Production agent setting "Allow this computer to be Remote Controlled"
Enabled Logging - set path for *.LOG file to C:\
Rebooted
Logged-in as me
Was able to Remote Control 3 machines ! - Persistent ? I need to do more testing.

Now - this is a real touchy thing and I have yet to find out exactly what works - other than trying the above on three boxes and randomly is DOES work on Windows 7.  Our DS is 6.9, Our Agent is 6.9.453

I think the problem is when you run something as System in Windows 7, there's a new security feature that puts it in a different window called 'Session 0'.  Just try it running 'cmd' through dagent in the console.  You'll be prompted to switch to a new window on the client machine.

Hi - listen, I'd like to try your suggestion but I ma not quite sure what you meant "Just try it running cmd through dagent in the console" -
Do you mean that when in the Deployment Server Console, choose a machine running DAgent then  R Click on the PC, then select "execute" from the menu and then cmd  ?

Say, check this out.... Open Task Manager, choose the Processes tab then look for the DAgentui.exe....  What user name is it running under....???    It runs under the logged-in user so if that user is "tied down security or if Group Policies  "tie him down"   -  guess what?  You might not be able to Remote Control !!!  That ended up being the problem here.

What I am still scratching my head at is this.... why, after running  netsh firewall set opmode disable, could I remote control the client ?

I have the same problem with DS 6.9 SP4. If the Windows 7 PC is logged in I can remote control it with the Dagent fine (however cannot send Ctrl+Alt+Del) but if the PC is not logged in I cannot remote control. If this is in fact by design then it is a VERY poor design for cooporate PC's. Many times our techs need to work on PC's when the employees are gone. We have 25 different locations and we depend on the remote control very much. There has got to be a work around! I called Symantec for support on this issue and got the same responses listed above that there would be no fix. They said that NS 7 would work because it used PCAnywhere. But said that there was no upgrade path from DS 6.9 and sounded very discouraging about changing. We currently pay for Microsoft's SCCM with our education funds anyway but prefer Symantec because we have used Altiris for many years and are moving to their antivirus solution. Also I still use Rips. They work very well for me and I am very familiar with them and cleaning them up. However Rips no longer work with Windows 7 either sooooo. I am not sure what to do. Too many choices and from the sound of it none of them are very good any more. Wow looks as though things are going down hill instead of up. Any suggestions?

First off, I've been using Altiris since version 3 came out 9-10 years ago.  And DS 6.9 rocks!

To lose this functionality for windows 7 machines is a tragidy.  Instead of pulling support from an older product and focus on a new one that will continue to support new versions of software and OS's, they shouldn've have continued to increase support and flexibility for Deployment Solutions(Not Web based and tied into every other program they make).  I will hang on to DS 6.9 for as long as I can, and as windows 7 will be around for many years, I would like some additional support for it.  So make a fix for it already.  I tested NS 7 for a few months to evaluate it as a replacement for DS 6.9, and I didn't like it one bit.  I didn't like the web interface, it was slow, forces you to use(and purchase) PC anywhere.  And this early developed version of it has so many bugs and issue.  WHY DID YOU TRY TO FIX SOMTHING THAT WASN'T BROKEN!  It was nice to have it tied in to Active Directory and to have a folder structure for the jobs and computers, but after three months of playing and fixing and calls to tech support, I removed the server from our virtual array never to be seen again.  To bad Symantec didn't ask us, it's customers, what we wanted.  If anyone knows of any software similar to Deployment server 6.9, I'm interested in looking at it.

  At the moment am under tremendous pressure from  management to roll out Windows 7 which am halting because of the remote control issues with DS. I find DS 6.9 very convenient,stable and easy to use,we use DS to manage 3500 nodes,I've tried CMS, but I didn't like it, it looks like we are heading towards SCCM.

We have found that with our DS, using build 437, we can remote to windows 7 clients with the Dagent installed, only so long as we have the view options dropped down to "8 Bpp (256 Colours)" or lower. The highest colour option presents a white screen, although to the remote PC the mouse and keyboard does work and will effect a/ the user if logged on.

Hi,

we provide our customers with a box version of pcAnywhere which should be free as long as you renew your AUP. Integration of pcAnywhere into the DS6.x environment works pretty well and is described in the kb. We got no RC issues with pcAnywhere so far.

If you want, i can describe the required steps more detailed when I am back in the office.

Next week, Iám off for vacation ;).. 

In general:

We are currently using both Versions of DS, 7.1 and 6.9 SP4 in our own envirnment.

In customer environments where the old DS is known we are still rolling out DS 6.9 only (with pcAnywhere integration). It´s hard to satisfy any DS 6.9 Crack with the reduced possibilities of 7.x. You got to learn everything new from scratch and forget all the 6.9 stuff.

All new customers are provided with DS 7.1 and up until now they are quite happy with it.

Regards,

Andre 

see

http://www.symantec.com/docs/TECH127378

Well...

you connect from RDP to remote control a "not logged on" PC,

or you connect using DS to RC a "with user logged in" PC.

But:

For DS 7.1 only customer, this is not a solution, as you can not control a user session.

(that is basically the requirement for remote support).

anybody plan to integrate a VNC client package, can share with us?

Seems we should fix this problem ourself...

As Symantec will not provide any more a remote control for DS, but only start with CMS upper level !!

Remote control is a paid for option in 7.1 DS, so if I am going to have pay extra for something I already have I might as well look at what else is available and bite the bullit and move away from Symantec.

You can't even run the console on Windows 7 with out admin rights, which is really quite bizarre and smacks of poorly written software, something that is the bane of my life.

My experience with them has never been a happy one, problem is they keep buying companies whose products we use and make my life a nightmare.

I buy stuff that makes my life simpler, unfortuantely the way Symantec develop stuff this is not always the case and they are not good on keeping promises either.

Jeremy,

As was mentioned earlier in this thread, if your AUP is current, PC Anywhere is licensed and is what replaced Carbon Copy.  There should be no additional licensing fees, PC Anywhere should be included in your licensing.

Couple of small comments,

If you need to log in, use remote desktop (Also available in the right click context menu) instead, it's faster than DS Remote anyway.

You can disable UAC on Windows 7 with the following Script task

%windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f\

Change the emboldened value to 1 to re-enable UAC

Merge in the following Registry key to enable Remote Desktop (again using an altiris job)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]
"fDenyTSConnections"=dword:00000000

And if you still have problems, Run the following command to turn off the firewall on the target system

Netsh firewall set opmode disable

We use the above on a regular basis to ensure we can remotely control target PC's

While this is about altiris, we find Dameware works wonders for those few systems that do prove to be a pain to get remote access to when using Altiris.

Microsoft remote desktop works for me, and I don't have have to disable UAC, or completely turn off the firewall.

We've tried using PC Anywhere and while it has many new features, it's extremely cumbersome to use. If you have DS6.9 installed, you have to copy/paste the computer's name in PCA QuickConnect, then logon again to remote control the computer. It takes nearly 3 times as long to load up too. Then, with windows 7, every user on every computer gets this error message if PC Anywhere is installed.
http://www.symantec.com/business/support/index?pag...
This is the PCAnywhere version supplied with NS7.0 which has several features missing over what DS 6.9 does (custom return codes for one).

I have no idea why PCAnywhere feels the need to notifiy users that "a host is waiting for a connection" in the first place, but windows 7 doesn't allow services to communicate with users without making a huge production about it.

So I looked into remote assistance built into windows. This works nice for users logged in and even tells them which tech is helping based on logon name (friendly). However, you cannot remote control a computer that isn't logged in just like the DS remote control. That leaves Remote desktop, but I sometimes need to test things as test users and I cannot do remote desktop with these test user without adding them specifically to a list of allowed remote desktop users (quite a pain). Lastly, I'd love to know how to integrate this into the DS and add a new right click->remote option on a computer. I suspect that I cannot and in the end, it's no better than the DS remote control.

IMHO this "design" is a slap in the face to Symantec's small customers.  The lack of a non-web based console in 7.1 and dwindling support for 6.9, combined with essentially forced upgrades has us on a timeline to begin using KACE from Dell.  Completely different product in every way, but if we'd essentially have to start over with a different product in CMS 7.1 (especially with no upgrade path), there's little drawback to changing over.  It's only a matter of time before Altiris is buried for us. 

Hi Cosborne,

I hear you, and your thoughts have indeed echoed my own. I do however highly recommend you look at KACE carefully before making such a change, looking at the pros and cons.

Ask yourself,

1. What functionality do I consider critical from my desktop management product.
2. At what point does my current product become unfit-for-purpose in my environment (see above list).
3. When does the pain of a KACE/Altris 7/Vendor_X migration become worthwhile in terms of the long-term efficiencies/benefits I need?

The answers to the above questions give you a good idea as to what path you should take.

Kind Regards
Ian./