IT Management Suite

Just wondering if anyone can help me figure out why my Software Management Plug-in won't install on client machines all of a sudden. The logs below are from a computer that received the software delivery, then I ran it from the agent. Whether I manually kick it off or it tries to start on its own, it always returns the 1619 error meaning there's something wrong with the MSI package. When I check the package and tasks properties (see image) it shows that it's trying to run the install from a shared drive on the server, and when I open a Run prompt and enter this location the MSI starts to insall without a problem. Are there logs on the server I can look through that might explain this behavior further?

 

<event date='11/04/2015 11:04:15.9900000 -05:00' severity='4' hostName='TRAIN01W7' source='PackageDownload' module='AeXPackageDelivery.dll' process='AeXNSAgent.exe' pid='4240' thread='1892' tickCount='39753282' >
  <![CDATA[Download package sources from: https://altiris.domain.com:443/Altiris/NS/Agent/GetPackageInfo.aspx?xml=<request resource="{AD607289-3578-4321-8868-C54577894D66}" version="1" type="codebases" compress="1" totalTime="0" totalFailureTime="0">
<packages>
    <package guid="{8FB2FE3A-1860-4081-8B92-DAD862F39D71}"/>
</packages>
<addresses>
    <address ip="147.55.1.73"/>
</addresses>
</request>
]]>
</event>
<event date='11/04/2015 11:04:16.1050000 -05:00' severity='4' hostName='TRAIN01W7' source='PackageDelivery' module='AeXPackageDelivery.dll' process='AeXNSAgent.exe' pid='4240' thread='1892' tickCount='39753391' >
  <![CDATA[End download for package: Software Management Plug-in Package (64-bit) {8FB2FE3A-1860-4081-8B92-DAD862F39D71}. Status: invalid]]>
</event>
<event date='11/04/2015 11:04:16.1050000 -05:00' severity='4' hostName='TRAIN01W7' source='SWDAgent' module='smfagent.dll' process='AeXNSAgent.exe' pid='4240' thread='1892' tickCount='39753391' >
  <![CDATA[End download for package: {8FB2FE3A-1860-4081-8B92-DAD862F39D71}.]]>
</event>
<event date='11/04/2015 11:04:23.3900000 -05:00' severity='4' hostName='TRAIN01W7' source='SWDAgent' module='smfagent.dll' process='AeXNSAgent.exe' pid='4240' thread='4568' tickCount='39760676' >
  <![CDATA[Add SWD task Copy of Software Management Solution Plug-in Install {DA05AAC9-7011-41E5-8862-F491E4A77523} to run queue]]>
</event>
<event date='11/04/2015 11:04:23.8100000 -05:00' severity='4' hostName='TRAIN01W7' source='ProgramExec' module='smfagent.dll' process='AeXNSAgent.exe' pid='4240' thread='6756' tickCount='39761129' >
  <![CDATA[Starting SWD task: 'Copy of Software Management Solution Plug-in Install' command line='cmd.exe /c "(for /f "tokens=3-6" %i in ('reg.exe query "HKLM\Software\Altiris\Altiris Agent\Plugin Objects\Agents\SoftwareManagementSolution_Agent" /v UninstallString') DO (if "%i"=="msiexec.exe" (%i %j %k %l Reboot=ReallySuppress))) & msiexec.exe /i SoftwareManagementSolution_Plugin_x64.msi ALLUSERS=1 /qn Reboot=ReallySuppress"']]>
</event>
<event date='11/04/2015 11:04:24.2500000 -05:00' severity='4' hostName='TRAIN01W7' source='ProgramExec' module='smfagent.dll' process='AeXNSAgent.exe' pid='4240' thread='6756' tickCount='39761534' >
  <![CDATA[Program 'Copy of Software Management Solution Plug-in Install' completed. Exit code=1619]]>
</event>

I think the plug-ins should be installed by "SYSTEM" and come from a C:\program files\altiris... directory. Someone seems to have somehow edited the built in agent package. "dsilva" I'm looking at you :-)

The package in these logs is actually a copy of the original Software Management Plug-In agent package, but I haven't edited it in anyway. I've since switched back to the original policy and still have these issues. If you're referring to the image attached the BMIC\dsilva is actually the "Logged on user" column and SYSTEM is under the "Run with rights" column. My Software Update Plug-In install has been working fine so I scheduled a push of the Update and Management plug-ins on a computer that had neither and the log for installing the Update plug-in seemed a lot more simple:

<event date='11/04/2015 16:30:04.2410000 -05:00' severity='4' hostName='CLAIMS1W7' source='ProgramExec' module='smfagent.dll' process='AeXNSAgent.exe' pid='6740' thread='8184' tickCount='536485659' >
  <![CDATA[Starting SWD task: 'Software Update Plug-in Install' command line='MsiExec.exe /qn REBOOT=ReallySuppress /i Altiris_PatchMgmtAgent_Win64_7_6.msi']]>
</event>

As I stated above I haven't edited the built in agent package (not to my knowledge anyway). Should I start looking closer at the built in agent package for clues?

Hi,

You enabled "Run from the server if bandwidth is above" option in Targeted Agent Settings in Downalod tab.

But you don't specified ACC(Agent Connectivity Credential) in Global Agent Settings in Authentication tab.

The Agent Connectivity Credential is the accountname and password that is used by the Symantec Management Agent when it needs to connect to a secured resource. Furthermore, it is the credential that is used by the Package Server Agent to add file-based security to downloaded package files, if so configured.

Note: Using the application credentials as the Agent Connectivity Credential that is passed to the Symantec Management Agent creates a potential security risk. For better security, Symantec recommends to specify credentials of a low-privileged user.

I thought the ACC might have been my problem a couple of days ago so I went ahead and set one up

Before this though ACC was set to use the application credentials with "Run from server if bandwidth is above" still set and I didn't experience any problems.

This is the Run History from a computer that has had consistent failures since Monday when I started seeing this.

Something I've been noticing is that the Source of the install changes from computer to computer; for example the first two attempts that ran on 11/2/2015 were the actual path of the MSI, and then it switched to using a shared location.

This is Run History from a laptop.

The targeted agent settings for our laptops do not have the "Run from the server if bandwidth is above" option checked off, yet it seems like this one was trying to do just that.

You can see in the second Run History image that the agent attempted to install from the shared location, and then switched to running the install from a local location. Running from the local location caused the run to complete successfully.

Any thoughts?

 

Does this user(ACCuser) have access to execute in shared location on Notification Server or on Package Servers?

Switching between package servers is normal, if one site covered by more than one package servers.

Maybe your Laptop computer appeared in multiple targeted policies? In "All Desktop Computers.." for example

 

Regards,

Dmitri

ACCUser is an admin on the server; we're a small company with approximately 300 computers so there's just the one NS and the Package Service which runs on the NS.

You were correct about the laptop, the targeted agent settings were applied to this particular group of laptops by mistake.

So if the desktop experiencing multiple failures since Monday and this laptop are part of the same targeted agent setting, why would the Laptop switch to installing from a local path, but the desktop just continue to try a run from shared location on the server?

"Run from the server if bandwidth is above" setting overwrites the "Run from the server if bandwidth is above" setting if they have same value in dropdown menu.

Also for Laptops you have second targeted settings then why laptop switched to second settings after that agent downloaded and run the package locally.

Answering on your question about why the actual path of the MSI switched to using a shared location, it's because package comes to the package server and Notification Server have started to share its via Package Server share location.

 

I logged a ticket with support. Apparently there's a known issue between the "Run from server if bandwidth is above" and the Patch Assessment Scan which is what was causes most of my problems. I've since changed my targeted agent settings to "Download the package."