Client Management Suite

Hi I am migrating from NS 6.0 to NS7.1 I have created a script as below which works if I push it through DS6.9, I need to run this through group policy also for new machines or to catch any that may have failed from DS, for some reason through Group Policy the script appears to break after the copy of the file, sometimes it does uninstall the old agent but never installs the new. As mentioned it always works through the DS.

I'm new to scripting so not sure if I've missed something or it needs to be different for group policy, I have also tried breaking it into 2 scripts 1st to uninstall and then 2nd to install, this also works in DS but fails in GP.

I have tried using the AeXNSCInstSvc.msi but this always fails - says package is not valid or wants to remove first - which I can't do silently

Script Below:

Option Explicit
on error resume next
Dim WSHShell
Dim RegKey
Dim nsver
Dim nsverx86
Dim FSO
Dim wshEnvironment
Dim strRunProgram

Set WSHShell = CreateObject("WScript.Shell")
Set wshEnvironment = wshShell.Environment("System")
Set fso = CreateObject("scripting.filesystemobject")

RegKey = "HKEY_LOCAL_MACHINE\SOFTWARE\ALTIRIS\ALTIRIS AGENT\"
nsver = WSHShell.RegRead(RegKey & "Version")

RegKey = "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ALTIRIS\ALTIRIS AGENT\"
nsverx86 = WSHShell.RegRead(RegKey & "Version")

If not nsver = "7.1.8280.15280" Or Not nsverx86 = "7.1.8280.15280" Then
FSO.CopyFile "\\www.myserver.com\NS Client Package$\AeXNSC.exe", "c:\"

'Stop Altiris Service
strServiceName = "AeXNSClient"
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery("Select * from Win32_Service Where Name ='" & strServiceName & "'")
For Each objService in colListOfServices
objService.StopService()
Next

If fso.fileExists( "c:\program files\altiris\altiris agent\aexnsagent.exe") Then
WSHShell.Run ("""C:\Program Files\Altiris\Altiris Agent\aexagentutil.exe"" /uninstallagents /clean"),,True
If fso.fileExists( "c:\program files (x86)\altiris\altiris agent\aexnsagent.exe") Then
WSHshell.Run ("""C:\Program Files (x86)\Altiris\Altiris Agent\aexagentutil.exe"" /uninstallagents /clean"),,True
WSHShell.Run ("""c:\AeXNSC.exe"" -s -a ns=www.myserver.com nsweb=http://www.myserver.com/altiris NOSTARTMENU /s"),,True
End If
End If

End If

If not fso.fileExists( "c:\program files\altiris\altiris agent\AeXNSAgent.exe") Then
If not fso.fileExists( "c:\program files (x86\altiris\altiris agent\AeXNSAgent.exe") Then
FSO.CopyFile "\\www.myserver.com\NS Client Package$\AeXNSC.exe", "c:\"
'FSO.CopyFile WSHShell.CurrentDirectory & "AeXNSC.exe", "c:\"
WSHShell.Run ("""c:\AeXNSC.exe"" -s -a ns=www.myserver.com nsweb=http://www.myserver.com/altiris NOSTARTMENU /s"),,True
End If
End If

Hallo cathossie

There can be more than one thing wrong here, and to be honest from my end at this point it would be guesswork.

But, you say that when you deploy this script with your DS 6.9, i think it is safe to assume that your script does in fact work.

Now let's get into a bit troubleshooting here ;)
I would start off by downloading psexec.exe from http://live.sysinternals.com/psexec.exe and then i would logon to a test computer.
Here i would start cmd in admin mode, and then i would run the command "psexec.exe -s -i cmd", this starts a new cmd.exe which runs in Local system mode.

I am now assuming that you run your vbscript as a "startup script" in a GPO, and this GPO runs under these priviledges.
Next, i would comment out the "'on error resume next", so that you see your error, otherwise you won't see much.
Then i would execute the script using, cscript "name.vbs".

This will start off your scirpt and then you hopefully can see a bit more.

secondly:

If fso.fileExists( "c:\program files\altiris\altiris agent\aexnsagent.exe") Then
   WSHShell.Run ("""C:\Program Files\Altiris\Altiris Agent\aexagentutil.exe"" /uninstallagents /clean"),,True
   If fso.fileExists( "c:\program files (x86)\altiris\altiris agent\aexnsagent.exe") Then
     WSHshell.Run ("""C:\Program Files (x86)\Altiris\Altiris Agent\aexagentutil.exe"" /uninstallagents /clean"),,True
     WSHShell.Run ("""c:\AeXNSC.exe"" -s -a ns=www.myserver.com nsweb=http://www.myserver.com/altiris NOSTARTMENU /s"),,True
   End If
End If

I think this passage here would work perfectly if it hits something under "c:\program files\altiris\altiris agent\aexnsagent.exe" but if there is nothing in this library it won't do anything, it will not try to see if there is anything under:
"c:\program files (x86)\altiris\altiris agent\aexnsagent.exe"

instead i think i would do this:
If fso.fileExists( "c:\program files\altiris\altiris agent\aexnsagent.exe") Then
   WSHShell.Run ("""C:\Program Files\Altiris\Altiris Agent\aexagentutil.exe"" /uninstallagents /clean"),,True
end if
If fso.fileExists( "c:\program files (x86)\altiris\altiris agent\aexnsagent.exe") Then
   WSHshell.Run ("""C:\Program Files (x86)\Altiris\Altiris Agent\aexagentutil.exe"" /uninstallagents /clean"),,True
end if
WSHShell.Run ("""c:\AeXNSC.exe"" -s -a ns=www.myserver.com nsweb=http://www.myserver.com/altiris NOSTARTMENU /s"),,True

The last part i am not sure if you really need, because if the above code works, it should be installed and therefore not needed to check on, i fully understand that you probably put it there to be damn sure, but for now i would take it out.

Kind Regards
Morten Leth

Hey

I hope it's okay i took the time to create how i see your script, and how i think it should be.

I don't know if you know this, but "Option explicit" means that you need to declare all your variables.
i just did it with the ones that i know you will have problems with, you might need also to declare, colListOfServices and objService.
But run the script, and if it says they haven't been declared, simply write it in the "Dim" section.

I have sectioned your declarations in 2, strings and objects, really it doesn't mean anything how you do it, but it's a bit easier to see.
Also it's good practice to call your variables either, obj (for objects) and str (for strings), but again, if you can decifer your code, it doesn't really matter. (an example of this could be, strNsVer and strNsVerx86 and strRegkey, all of these are strings.)

Hey there :P

Sorry for spamming here, but there is one more thing i came to think of.
Everytime you would execute this script, it would end up installing the agent, this is probably not what you want.

It can be prevented easily though :)

Hi Morten, thanks for this, I did change my script to the above, same thing works great through the DS. but stops working in group policy (or rather doesn't every install new agent)

WSHShell.Run ("""c:\AeXNSC.exe"" -s -a ns=www.myserver.com nsweb=http://www.myserver.com/altiris NOSTARTMENU /s"),,True

Hey cathossie

Hmm, could you try the following instead.

WSHShell.Run (chr(34) & "c:\AeXNSC.exe" & chr(34) & " -s -a ns=www.myserver.com nsweb=http://www.myserver.com/altiris NOSTARTMENU /s"),,True

this would directly translate into running this command:

"c:\AeXNSC.exe" -s -a ns=www.myserver.com nsweb=http://www.myserver.com/altiris NOSTARTMENU /s

In the DS are you running it as local system?

the only thing i changed this time is your """ brackets, they have been changed into chr(34) which is the character set for ".

Also, try running it via psexec, does that work? - that way we are 100% sure it's not related to security.

/Morten

Hi Morton tried both of the above, works through DS, doesn't install new agent through group policy. I am installing as system account in DS.

Thanks again, I'm tearing my hair out, I've never had any issues with scripts in group policy before.

Cat

Just noticed... you have () in your commandline, it's not allways that works like it should, also you should try using cmd as engine instead ;) - you would see the error if you removed the On error resume next

WshShell.Run "cmd /c c:\aexnsc.exe -s -a ns=www.myserver.com nsweb=http://www.myserver.com/altiris NOSTARTMENU /s",0,true

EDITED (group policy is the way to go....)

Hey cathossie

Actually i think your right in your assumption regarding Group Policy.

I have just tried running the script in a lab environment, and the script here works like it should (as you figured).

How are you running your script in group policy?
Is your script a startup script? - and have you copied the script to the policy folder or are you running it via \\Domainname.int\netlogon\script.vbs?

/Morten

Hey Cat

If your using windows 7 try looking in the eventlog under:

"Applications and services logs" -> Microsoft -> Windows -> Operations -> and the logs here.

This shows which group policies which gets applied and which does not.
also group doing an "rsop.msc" under admin priviledges.

/Morten

Hey Cat

I think you should take a look at:
C:\Users\Public\Documents\Altiris\Altiris Agent\InstallLogs

This is the logfile for the installation (i just tried creating a startup script in a GPO, and i haven't gotten this function just yet.

/Morten

Wow Morten it does look like this could be the problem, as you know in the script I copy the file to c: drive and install from there, not being a group policy guru myself - would you know how I get it to run the command as administrator.

BTW: I'm not at work now as it is late where I am, so will do further investigating in the morning. 

thanks for this info I didn't know this logfile even existed!!!

Cat

2012-07-18 21:09:32: ==========================
2012-07-18 21:09:32: AeXInstallPreCheck started
2012-07-18 21:09:32: Symbolic link between 64 and 32 bit registry views either created or not required.
2012-07-18 21:09:32: Current dir: C:\windows\TEMP\apt19
2012-07-18 21:09:32: AeXInstallPreCheck Finished
2012-07-18 21:09:32: ===========================
2012-07-18 21:09:32:
2012-07-18 21:09:32: Passing control to AeXNSAgent
2012-07-18 21:09:32: InstallPrecheck: target platform: x64
2012-07-18 21:09:32: Command line: AeXNSAgentInst.exe -s -a ns=myserver.com nsweb=http://myserver.com/altiris NOSTARTMENU /s
2012-07-18 21:09:33: ===============================
2012-07-18 21:09:33: Core Agent Installation started
2012-07-18 21:09:33: User must have admin rights to install the core agent. Exiting.
2012-07-18 21:09:33: Core Agent Installation Ended 
2012-07-18 21:09:33: ===============================

Yeah... excactly what i figured...
I have setup a test environment here where i get the same "error" as you see right there, i have tried extracting the content of aexnsc.exe from "C:\windows\TEMP\apt19" (your location), and running AexNSAgent.exe with those parameters, the same problem arises.

Really i don't get why this is, the startup script runs with local system priviliedges, and it should be sufficient, but for some reason, this does not seem to be the case.

I still am looking into a solution here, it's right under our noses i am sure.

/morten

Hi, try this script (found it here on connect)

https://www-secure.symantec.com/connect/blogs/sample-script-deploy-agent-startup-machine

It works for me with slight, modifications to my environment

Also, in Windows 7 make sure UAC is disabled and try to copy files to C:\NS_Agent_v7\, as Windows 7 does not like files getting copying to the root of C:\

Hey Cat

Well, actually it's not that hard, when you know what to do :P
The reason it does not work is that the local system account it runs under is a limited local system account, which does not as you might have seen run with admins rights.

If you copy down psexec.exe with your AeXNSC (i would probably use c:\windows\temp as the location), you can run the following command and get your agent installed.

wshShell.Run "cmd /c c:\windows\temp\psexec.exe /accepteula -s c:\aexnsc.exe -s -a ns=www.myserver.com nsweb=http://www.myserver.com/altiris NOSTARTMENU /s",0,true

Kind Regards
Morten Leth

This "problem" is in fact related to the UAC, but i must admit that disabling it entirely simply for the purpose to install the agent, seems a bit extreme to me. :)

The reason is the UAC, but we can get around it with the psexec /accepteula -s parameter.

I would agree to don't use the root of the c:\ drive as the installation source, because i as you have seen weird things happen :) - but in this case he got the file copied.

Kind Regards
Morten Leth - over and out ;)

Thanks Morten, I am only using the aexnsc file as when I do a clean uninstall of the old agent the NS7.1 MSI is broken I found the below NOTE in a forum.

Am I doing the correct process with moving from the old NS6 to new 7.1 - we wanted to start off clean and it is important we can install through group policy as well as the DS.

To be honest i would not worry much about this...

You get your client installed afterwards, and it will function just like it should, you can allways install the agent one more time if you use AeXNSC, therefore it obseletes the need for using the MSI for reinstalling.

You can't use the msi anyways because as far as i know it does not uninstall the current agent.

Kind Regards
Morten Leth

Hi Morten

I have one of my colleagues looking at this now, he has more experience with scripting and group policy - he also gets the same issues and at this stage it looks like we may need to go to using the MSI without uninstalling the old agent

I'll keep you posted as to how we go.

Thanks, again Cat

Hey Cat

The reason you get the error, is lack of privileges.
While it may seem strange, that you have a "Local System account", that is supposed to have all the privileges in the world, it is limited by the UAC.

The only way you can get arround this "issue" as how i see it, is to run the command using psexec.

When you run "psexec.exe -s" you run your command in elevated mode, that's why you actually get to install it ;)

I tested this yesterday using your script, and the script does work, if you use psexec -s to install it, i don't think it's your scripting capabilities which is insuffiecient here ;)

Kind Regards
Morten Leth

Hey Morten I'll give the psexec a go monday but that has other issues as our antivirus disables it (I can override this for testing). We do have UAC turned off in our environment as default as we have issues with some packages not installing with it turned on.

The same script also fails on windows xp in group policy and it doesn't have UAC!!! It's been frustrating.

cat

Hi Morten after so many trials, I have decided to try and uninstall and reinstall through DS, I will have the following group policy that will either upgrade the agent - not uninstall and/or install if not found. Thanks for all your help, I could not try the psexec as the antivirus became an issue.

Hopefully we catch the uninstall mostly through DS the group policy is to catch any we've missed or any new computers that have hit the network.

Thanks again, Cat

Set WSHShell = CreateObject("WScript.Shell")
Set wshEnvironment = wshShell.Environment("System")
Set objFSO = CreateObject("scripting.filesystemobject")

On Error Resume Next
nsver = WSHShell.RegRead("HKLM\SOFTWARE\Altiris\Altiris Agent\Version")
nsverx86 = WSHShell.RegRead("HKLM\SOFTWARE\WOW6432Node\Altiris\Altiris Agent\Version")

If not nsver = "7.1.8280.15280" Or nsverx86 = "6.0.0.2383" Then
  
 objFSO.CopyFile "AeXNSCInstSvc4.msi", "c:\AeXNSCInstSvc4.msi",True
 
Else
 'MsgBox "installed"
 wscript.Quit
end If

'Stop Altiris Service
strServiceName = "AeXNSClient"
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery("Select * from Win32_Service Where Name ='" & strServiceName & "'")
For Each objService in colListOfServices
  objService.StopService()
Next

'Stop Carbon Copy Service
strServiceName = "CarbonCopy32"
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery("Select * from Win32_Service Where Name ='" & strServiceName & "'")
For Each objService in colListOfServices
    objService.StopService()
Next

On Error goto 0

WSHShell.Run ("c:\windows\system32\msiexec.exe /i c:\AeXNSCInstSvc4.msi NS=myserver.com REINSTALLMODE=vomus REBOOT=ReallySuppress /qn"),0,True

Hey Cat

Well, that's a pity, but it's a good thing you at least found out why things are the way they are. :)

Kind Regards
Morten Leth

Btw. cat

You could also try out a different approach, depending on how things look.
You could setup all your NS6 agents to talk with your new 7.1 installation, and then run an Upgrade agent installation from you NS 7.1, that way you at least hit your machines.

I don't know if it's an option in your environment, but it's just one of the other ways of doing things. - and that way you don't need to think about rights, cause that works just like it should. ;)

Kind Regards
Morten Leth

Hey Morten good point and I am going to do the pointer from the NS6 to NS7 but will wait a few weeks down the track, we really want to try to start out with a fresh install of the new agent with nothing hanging around from the old, but know this will not be possilble in all cases.

I'm feeling a little more confident now - at least there are number of ways to get it out there.

Thanks, Cat

Hi Cat

Have you gotten the answers you needed out of the question, or do you have more question?
if you have gotten the answers it might be a good idea to mark your solution, as the solution, either that being the ones you have created yourself, or the ones i have contributed with. :)

It's just good courtesy to do this so that if people search the forum, they perhaps find solutions themselves on their questions, without the need to ask it.

Kind Regards
Morten Leth :) - have a great day.