Hi 

We have just installed ITMS 7.5. The NS server is in Hongkong and we have installed 2 site server in two different country. Package is downloading on package server but task server showing blank. It is not registered.

HI,

Please check SMA logs on a computer that cannot register on Task Server. Logs should contain lines like "attempting to register on task server SERVER_NAME" (you may clean-up logs to reduce the amount of log messages and then press "reset agent" button to initiate re-registration process).

Verify client can ping SERVER_NAME.

Also, check state of services: "Altiris Client Task Data Loader" and "Altiris Object Host Service" -- both should be started on NS and on site-servers.

Check NS log for errors or warnings from Atrshost.exe and CtDalaLoader.exe modules.

Thank you,

Alex.

Hi Alex

We have check everything it is fine.............but still not communicating

If possible, please share the logs from the clients that cannot register to TS.

Thank you,

Alex.

I had that issue. We had CMS 7.1 and upgraded to 7.5. The task servers and clients showed not registered. Support assisted in finding a solution: 

Solution:

Set Enable 32bit Applications to False on Default App Pool

In IIS select Application Pools

Select Default App Pool - Right Click - select advanced Settings

Set Enable 32-bit Applications to "False"

Cmd prompt: iisreset

Solution Page: http://www.symantec.com/business/support/index?page=content&id=TECH213037

Hope this helps

Ken

Hi Alex

Find attach logs of client system.

Attachment(s)

logs_15.rar   59 KB 1 version

logs_16.rar   59 KB 1 version

On attempt to register client task agent with task server, it fails due ssl handshake error.

<event date='03/18/2014 17:09:56.7930000 +05:30' severity='1' hostName='INMUBSSC0277' source='MsCryptoSslDataTransformerImpl' module='AeXNetComms.dll' process='AeXNSAgent.exe' pid='5224' thread='6064' tickCount='23502187' >
  <![CDATA[Failed to perform client handshake, error: The Local Security Authority cannot be contacted (0x80090304)]]>

Please, make sure that certificate is correct in "Trusted Root Certification Authorities Certificate Store".

Try to open this URL via browser on this computer, where client task agent unable to register ⇒

https://apinmubsscutl01.resourcesindia.com/   you will see whether there certificate error occur or not.

Hi Igor

Ya the URL is not is not opening it giving message

Internet Explorer cannot display the webpage

Hi,

Please ensure Task Servers has the same version as Symantec Management Agent - server with version 7.5.1670 won't be able to handle SMA agent with version 7.5.1670.11. You need to check version of "Altiris Client Task Server Agent" plugin on SMA Settings screen.

If versions are different, then you will need to upgrade Task Server. Open NS Console - Setings - Notification Server - Site Server Settings. Expand Site Management - Settings - Task Service - Advanced. There are two upgrade policies for the Task Servers - enable appropriate one and ensure upgrade will pass on a site-server side.

Thank you,

Alex.

Hi, CBZ9104:

Make sure the task server plugin is correctly installed on the Task Server. We had several issues because some plugins were not properly installed on our Task Servers

Hi

Now we have 3 site server in 3 different countries. What will be the constrained and unconstrained settings I have to do in console.

Currently all are uncheck

If each contry is its own site, then all package services need to be unconstrained, as constraned package services can only download from unconstrained package services within the same site.

Hi SK

You mean all are uncheck.......

The setting for "constraned" has nothing to do with agent registration to task servers, only only controls where the package servers retrieve their source files. 

As SK commented, the only time you need to consider this setting is when you have more than one PS per site. 

Hi CBZ9104,

If possible, may you share logs from the site-server also?

That OS you use for the site-server?

Thank you,

Alex.

Hi all

Just now we have removed site server of India location and my client are able to get task server now.

So now I am uninstalling site server and task server completely from India site server and reinstalling after that lets see what will happend.

Hi All

It is observe that agent and all the plug ins installed successfully but while installing task service it the servrer not getting package to install task server. I have check only to download history for Task Service Install (x64) showing blank

I have installed manually Task service install(x64) but still task server not showing.

Deployment package server and Deployment Task server also not installing on the same site server but rest of country server it is installing properly.

Hi CBZ9104,

If you have problems with Task Server package download and TS install then it is could be that Task Server setup process from previous install still active and you won't be able to rollout Task Server until it is killed. Please open Windows Task Manager, switch to the Processes tab and look for TaskServerSetup.exe process. If you see it then most probably this is the reason of the problem. Try to restart computer and try roll-out task-server again.

Thank you,

Alex.

You can try to manually download and install TaskServer x64 on your remote Site Server.

Download Task Server Setup x64 package from your SMP Server to your Site Server

Note!: Such manual installation of Task Server on remote Site Server acceptable only if you've already added this server as remote Task Service on your SMP Server but Task Server rollout policy isn't active and shown as expired.

• \\%Address of your SMP Server%\NSCap\bin\Win64\X64\Client Task Management\Server Package\Task ServerSetup_x64.exe.
• Manually execute Task Server installation on remote Site Server ⇒ check result ⇒ If installation will be successfuly completed, make sure that "Altiris Object Host Service" and "Altiris Client Task Data Loader" are running.
• Try to register client task agent on your client computer
• If registration will fails once again, then check client SMA logs ⇒ if there will be SSL handshake errors, then check your Certificates on client computer.

Thanks,

IP.

Hi Igor

We have uninstalled all the package and task service from console, also uninstalled the altiris agent and restart the same. After that we have installed the agent again and this time all the services like, task service agent and deployment agent got installed successfully it will installed from NS side only.

But still it is not taking task server.

And if i remove task and package service from console after uninstalling from agent it will get task server

Did I understand correctly:

1. You have Task Server on NS side. It is works fine.

2. If you install Task Service to remote computer then such Task Server does not work, even if "Altiris Task Server Agent" plugin is shown in SMA properties as installed.

If both is true, may you share logs from the remote task server, which does not work? OS and config details will be also appreciated.

Thanks!

Alex.

Hi,

there is nothing to do, without SMA logs on client side and SMP Server logs. Click "Reset Agent" in SMA on client computer, gather logs and attach them (assume that there will be same problems as shown in previously attached log, where problem is with SSL handshake with Task Server and your SMA client computer)

Question:

• You've uninstalled Task Server and Package Server which were running on SMP Server localy? Or you mean about remote Task Server and Package Server?

Hi All

Finally I reinstalled the server now it working everything fine.

HI Igor

Today again my agnet not getting task server.

Find attach client logs

Attachment(s)

Logs_28.zip   125 KB 1 version

Hi CBZ9104,

If possible, please also attached logs from INBOMSSC0003 computer.

Thank you,

ALex.

Hi Alex

Find attach INBOMSSC003 logs which is site server....

Now again When i remove package and task service client will get task server.

Attachment(s)

INBOMSSC0003.rar   83 KB 1 version

From clients logs:

Last successfull attempt to register to INBOMSSC0003 was at 9:04 AM.

At 9:26 network monitor module of SMA reported what "server down"

Starting from 9:56 any attempt to register to the server fails.

Something has changed with server or network state in this time period.

Thank you,

Alex.

Hi Alex

Thanks a lot

But what should i Chek now...

From INBOMSSC0003 logs: last record from Task Serve component is at 24-Mar-2014 12:30:49 PM: "Task Serve Uninstall still rinning" - seems like Task Server has been uninstalled from the computer.

As I understood, you've just installed the TS back to INBOMSSC0003 and right now client could register to this TS. Was it manual install by launching Task Server msi on INBOMSSC0003 or it was push install from NS Console -> Site Servers page?

Note: while TS was installed onINBOMSSC0003 a lot of warnings like "removed client record for not allowed endpoint" were logged. Please ensure these records are expected, i.e. clients in your environment are in "allowed" state. You may review "Reports -> NS Management -> Registration" reports to have better understanding of client's state.

Thank you,

Alex.

Hi Alex

Again I removed only task service from console now again ,my clients getting task........

Please take a look a bitmap below - is this the same state as your site-server INBOMSSC0003 has in NS ?

Ya almost

We able to all service except monitor service... because we only using CMS suite

OK, so you have site serve with three site-services: TS, PS and NBS enabled. And clients could be registered to this site-server - this is good.

I wish to ensue what you will not run into the situation, when unexpected uninstall will remove TS from the site-server. Please perform the next steps:

1. Open NS console -> Settings -> Notification Server -> Resource Membership Update. Press "Policy update schedule", wait until it will be completed. Press "Complete update schedule", wait until it will be completed (could take a while).

2. Connect to site-server computer, open SMA settings and press "Update" button.

In a good case, nothing will happen after such actions.

In a bad case, task server will be uninstalled from the site-server. And I will have to think about steps we will need to perform to resolve the situation.

Thank you,

Alex.

Hi Alex

We have done the Resource membership update and all but still issue remains same.

If we remove task server service from package server it gets registered with task server same happens with vietnam site server. We deploy new site server in vietnam location that server wont registered with task server but when we removed task service from that server it gets registered with near by task server

Hi,

First, If you have all these Task Servers installed and they are running (where you client computer unable to register with)

• Try to manually re-register your client computer with Task Server
• Gather logs from this client computer and attach them

Will be great, if you will provide list, which Site Server hostname related to what country for better understanding of log analyzing.

Optional additional checks just to make sure that infrastructure is OK:

1. Make sure that all your subnets are synchronized and available on "Site Server Management" page, where clients are running and Site Server are running. You can refresh subnets manually to have up-to-date list of all available subnets.

2. Make sure that Site(s) where Site Servers are running, has all appropriate subnets in case if you have Site(s) created in "Site Server Management" page. (If these subnet if added to Site(s), but subnet where client is running isn't added to any Site, then client will not be maintenaned by Site Servers).

3. Make sure is there any "Manually Assigned Agents" set for Site Server or for Site (In case if manual assigment is set, then only these client computers will be maintenaned by this Site - Site Server)

Hi Igor

We have checked all the above things but there is no change.

Currently my site server registered with task server it self fine but location agent not registered with task server.

Find attach sample client machine latest logs

Attachment(s)

agent logs.rar   12 KB 1 version

Hi!

According to log output, Agent says that your Site Servers are down, otherwise client computer unable to establish HTTP connection to these servers:

• Server down: http://inbomssc0003.global.publicisgroupe.net:80:{15A168AD-D78E-45DB-8EE5-7E093891367D}
• Server down: https://inbomssc0003.global.publicisgroupe.net:443:{DB919C53-A17B-4CC8-8335-8786146FDA87}

Also I see that client SMA agent unable to post event due similar network problems between client computer and NS Server:

• PostFile to 'http://hkhkgdutssc0002.global.publicisgroupe.net/Altiris/NS/Agent/PostEvent.aspx?priority=0&source=A1218DF5-B1FC-4590-9ED5-D5FFF75B50F5' failed: HTTP Request Failed: No such host is known. (80072af9)

Ensure that you don't network issues between your client computer with Site Servers and NS Server as well. Try to open their URL in browser on client computer, check nslookup and ping by fqdn.

Thanks,

IP.

HI Igor

Both URL http and https are not opening.

for network issue if we uninstall task service from site server the client communication is working fine. all clients getting registered with available task server which is nearest.

Do you mean that this Task Server which isn't accessible for your client, also isn't accessible for other clients as well? You better troubleshoot this problem why client unable to establish connection via fqdn of your remote Task Server, or check what happening with this Task Server there /IIS.

CTA registers with Task Server, using own settings. Probably you have same default settings for CTA

Hi Igor

Task Server  isn't accessible from my client, also isn't accessible other clients as well.

I have done the default setting of Task agent settings

Hi CBZ9104,

I'm a little bit confused.

Client unable to even ping this Task Server machine and also nslookup it? Or your Task Server machine is firewalled, therefore client computer unable to establish there connection via HTTP/HTTPs, ping it, etc?

Thanks,

IP.

Hi Igor

Its shocking now.....

I format my site server and reinstalled everything.......Just for 2 days site server and all the India location clients registered with server but again 2 days later site server is showing unregistered and all India location clients as well.

And again same If I installed site server and task server on my Windows 7 desktop/latop all India location gets registered and the server too.

Possibly a dumb question, but have you verified the "default website" is running on the Task Server?

Hi All , <u1:p></u1:p>

I am facing similar issue , Upgraded my NS from 7.1  to 7.5 SP1 HF1 and the task server is not getting registered<u1:p></u1:p>

Followed all the troubleshooting steps and tried to reinstall task server <u1:p></u1:p>

Created a case with Symnatec and found that when SSL is enabled the task server cant register to itself. <u1:p></u1:p>

But evevrything was working fine till the upgrade. The task service status is inactive in NS 

Checked all the following connect forum

<u1:p></u1:p>https://www-secure.symantec.com/connect/forums/ns-task-server-installed-inactive-what-happened

https://www-secure.symantec.com/connect/forums/task-server-fails-register

https://www-secure.symantec.com/connect/forums/altiris-task-server-does-not-see-itself-task-server

Still Same issue 

Please Help 

Hi,

Did I understand correctly: 

- You have NS and remote site server with Task server service

- You have upgraded NS to the new version

- SMA on a site server and site server plugin also upgraded

Now, if you open SMA properties on a site server then in "Task Status" tab Task Server name is empty.

If possible, may you share SMA logs from the system where SMA cannot register to TS?

Thank you,

Alex.

Hi Alex , 

- I have NS and multiple Site Server with Taks server service 

- Configured Task service in NS also

- Upgraded NS and site servers and all plugins to new version

- All site servers are working fine except the SMA in my NS 

- Task server is empty and status Not Registered 

Also in NS under site server setting it shows Task service installed and inactive 

Please find the log attached 

Attachment(s)

A_Log.zip   417 KB 1 version

It looks like the main issue is warning "Failed to read Agent storage" that is logged on ATRSHOST service startup. May you check the ATRSHOST ("Altiris Object Host Service") service settings? It should run under the system account to be able to read from secure storage.

Thank you,

Alex.

Thanks Alex for reviewing the logs , 

Already checked the Services and its running under local system account 

We restarted the server and an unusual thing happened now ....

The Task Status Bar is missing from SMA !!! 

The plug ins and services are installed even compared the registry entries with a working site server. Everything looks similar but the Task status bar is missing .

Also the task service status shows installed but inactive 

Thanks 

SVR

Hi SVR,

Task Server cannot work correctly without access to the secure storage. If you restart atrshost service - will warning "Failed to read Agent storage" re-occur in NS log?

As I see, NS log does not contain trace and verbose logging. If possible, may you try the next steps: 

- turn additional logging on (NS log - Options - Log Options, select all checkboxes in "Loggable severities" section).

- stop Symantec Management Agent

- stop Client Task Data Loader service (this action should also stop Atrshost service)

- start SMA

- start Client Task Data Loader, wait until atrshost service will be started and share NS logs.

Probably it will be better to return the severity of logging back to default after these actions.

Missing Task Status tab could indicate Symantec Management Agent also has problems on your NS, but I do not wish to speculate in that direction without reviewing logs with additional traces.

Thank you,

Alex.

One more note: usually, first thing that happens after the problems with TS is manual re-install of task server using TS install package from NSCap. Sometimes wrong package is used for re-install - x86 version instead of x64 version. x64 version of package located in "\Altiris\Notification Server\NSCap\bin\Win64\X64\Client Task Management\Server Package". x86 version of Task Server can be installed to NS, but will not work correctly.

Hi Alex ,

Worked with Support and finally re-installed SMA in NS and everything works fine 

But if SSL is enabled the task server status is not registered in NS 

Is there any know issue or bug with 7.5 SP1 HF1

I performed the same in my Test environment . After enabling SSL in NS, the Agent in NS is not getting registered to task server 

Or do we miss something in the configuration as everything was working fine before Upgrade 

Thanks, 

SVR 

Hi,

"Is there any know issue or bug with 7.5 SP1 HF1" - nope, I do not know about such known issue.

I have tried to enable SSL on my 7.5.SP1 NS using targeted agent settings -> All Site Servers -> Advansed. Just changed server web to https and checked "Install SSL certificate on SMA". Agent was switched to ssl, lost connection to Task Server but regain it after two configuration updates and right now works fine.

It looks like support should create a case for the dev team with all logs and setup details and someone will investigate this problem further.

Thank you,

Alex.

Hi Alex, 

Have you tried enabling SSL in IIS under the website and Altiris 

It works if SSL is enabled in NS under Target agent setting . But as per the documents we should enable SSL under IIS ->Default website/Symantec website 

If we enable it under IIS it is not . 

Any suggestions 

Thanks :)

Work's fine with SSL turned-on for IIS, but I suppose it's a classic case "everything fine in dev environment".. :)

Probably gathering extended logs for review will be most reliable way:

- turn additional logging on (NS log - Options - Log Options, select all checkboxes in "Loggable severities" section).

- restart Symantec Management Agent

- wait until SMA service started + 1 minute

- zip and attach all NS logs

Thank you,

Alex.

Hi Alex , 

After working for hours and hours with the support finally they came to the conclusion that there is issue with the direct upgrade from 7.1 SP1 MP1.1 to 7.5 SP1 

They provided the following article " http://www.symantec.com/business/support/index?page=content&id=TECH211202 " and stated that we are facing the same issue.

ie Using third party trusted SSL certificates and multiple domain info with the SSL certificate .

Less chances for the issue to occur if we had upgraded to 7.5 first and then to SP1 HF1.

We followed the recommended upgrade path and upgraded to new version ! . Still same 

Waiting for their confirmation and New Release ....

Thanks 

SVR

Hi SVR,

I'm sorry for the troubles with our soft.

If this is really a case described in KB211202 then we do not have any real fix but only workaround described in the KB: you need to create specific registry key and add domain name that used in the third-party certificate.

Thank you,

Alex.

We have upgraded from 7.1 to 7.5 and ATRSHOST ("Altiris Object Host Service") is running under System account on SMP server. This causes problems with our Jobs because we need to have access to Database. When we setup service to run under service account we have received this error:

Unable to process session message: size=876, DecryptData failure. Error 5

In that case any agent is not able to register to SMP. Registration to another Task server is ok.

We are using Jobs for triggering scripts and sending emails. Any idea how we can handle this in 7.5?
 

Hi Kada,

In 7.5 Task Server services must run under the system account to have access to secure storage. If I remember correctly, at 7.5.GA in some cases impersonation fails for task server services, and that creates problem with DB access. But this problem was addressed in 7.5.HF2. Which version of 7.5 you have?

Thank you,

Alex.

Hi Alex,

we have 7.5 SP1. What is in secure storage and what is the reason to use it? If we have to run Task service under System we can not use jobs in Altiris and use Windows scheduler to trigger our scripts.

Hi Kada,

the secure storage is a new 7.5 feature of the Symantec Management Agent - all information is stored in an encrypted way and can be accessed only under system account. Since Task Server needs to access secured information it needs to run under System and the service account cannot be changed.

To workaround this issue I would suggest to use "Run script" task type and set the option "Run as" to the user account you need your script to run under.

Will this help to resolve your problem?

Thanks,
Grigory.

Hi Grigory,

thanks for explanation of secure storage.

Regarding workaround, yes this option will resolve our problem. We will change task from Run script on Server to Run script and define service account there.

Thanks a lot for help

Kada