Symantec Management Platform (Notification Server)

Background:

• Installing new Altiris 7.1 SP1 implementation
• Have configured the NS on Win2k8 R2 box
• SQL DB on Win2k8 R2 box with SQL 2008
• Have installed Service Desk on Win2k8 R2 box

Issues: 

1) Our environment has another Win2k8 box for the Workflow server to act as a processing offload from the Service Desk server.  Page 61 in this article (

http://www.symantec.com/business/support/index?page=content&id=DOC2150) describes how to setup the clustering etc. I have created a Windows 2008 cluster with Service Desk as 1 node, and Workflow as the other. They each have their own local disks as well as a shared cluster disk.  The document describes how to configure the app components but is that all that is required? What is the shared cluster disk for? Should the installs of Service Desk and Workflow go on the share disk?

In addition, our organization has roughly 300 end users. Does that necessitate a separate Workflow server, or should we simply use a single Service Desk/Worklow machine?

2) I am not able to rollout the agent to other workstations. It appears stuck in 'starting' mode and will not push the agent out. We can also not run a discovery, it too gets stuck in a starting mode.  Without these, I am unsure of how to add Site servers since no available servers appear in the list.

Of course, we have a tight deadline, so any comments/ideas are much appreciated!!

The status shown in the push report page isn't always reliable.  In most cases, the install was actually successful.  Is it stuck at Starting Download or Starting Install?

Do you have additional details on the discovery type you're running, and what the exact status is?

Regarding site servers, it can take some time for them to appear, as it requires basic inventory and a delta resource membership update to occur.  They must also be valid as site servers and have the Symantec Management Agent installed.

If you visit a computer that you tried to push to, have you verified that the agent really wasn't installed? The account used for the push should have administrator rights on the computer being pushed to.

I'd also review these KB's:
http://www.symantec.com/docs/TECH11685
http://www.symantec.com/docs/TECH13407

Do you have any relevant errors in the Altiris Log Viewer on the NS?

I would recommend moving the Workflow/ServiceDesk portion of this question to the Workflow or ServiceDesk forums.  Probably won't get an overwhelming response in this forum.

Thank you for your reply. It is stuck at 'Starting Symantec Management Agent Install Service'.

I've visted the other servers and the agent is not actually installed. I realize I need to get the agent installed first before they will show up in the Site Server list but I'm not sure how to get the Agent pushed successfully. The account I'm using is a domain admin and has full rights to the servers involved.

The initial discovery after install seems to have worked and I see all servers listed in the computers list.  However, when I try to perform another discovery they stick with a status of 'Start Pending' under Network Discoverya and Task Mangement. I'm trying a Ping sweep and an ARP discovery. Same result for both.

Thanks for the KBs, I'll give them a look.

Does the Status Report have additional detail?  If you're dying to set up an agent, you could use the pull method by using the URL specified on the push download page.  By default the URL is http://<servername.domain.com>/Altiris/NS/Agent/AltirisAgentDownload.aspx.

in windows or system32 directories.

If there are none, look in the Altiris log on the server when you try the push.

Do the client servers have the firewall on? That will need holes in it.

Windows Firewall is disabled on all servers involved.

I found that I am able to push the agent out successfully if I disable SSL requirements on the NS. Other than not using a self-signed cert or installing the cert on all member computers, is there any other way around this?

Yes.  One method is not selecting SSL during the install process within SIM.  If you select SSL during the SIM install, you're going to run into everybody expecting SSL.

Several threads, but no KBs that I've found, go through removing SSL if it's no longer desired:
https://www-secure.symantec.com/connect/forums/how-do-i-completely-remove-ssl-smp#comment-5317891

It wouldn't be horrible to start over if you're not very far in the implementation, as this would be cleanest.  I haven't seen a method yet that doesn't leave some SSL remnant for a particular solution.  As you mentioned, you could get a signed cert, but that's not perfect.  Nor is rolling out a self-signed cert using GPO.