HomeDeployExpert for Symantec 7.1Printer Friendly Version

DeployExpert for Symantec 7.1

This Knowledge Book contains information about common errors and problems encountered using DeployExpert for Symantec Deployment Solution 7.1

1. Installation/Uninstallation

1.1. DeployExpert Pre-Requisites

The following are required to implement DeployExpert successfully in an environment.
  • Symantec Management Platform 7.1 SP1 or SP2
  • Deployment Solution 7.1
  • Inventory Solution 7.1
  • Direct Access to the server (through RDP or other remote control is fine)
  • PXE or Automation Folder configured and working
  • Relevant SMP App Identity account credentials access
  • A service account setup that can be used to run Altrinsic services and communicate with the database.
  • A DB Creator account to create a DX Database OR a pre-created empty database for DX to use, with a DB owner service account that can be used during installation.
  • MS SQL Microsoft SQL Server 2005 or 2008
  • The clients require Inventory Solution Plug-in and Deployment Solution Plug-In to be installed in the Symantec Management Agent
  • If there are task servers in the environment, they should be configured with the Site Server Deployment Components Plug-in

1.2. Installing a Remote DX Console

Description:  Install a remote DX Console on an additional system, after DeployExpert has been initially installed.

Environment: SMP 7.1

DX version: 2.x, 3.0

Process:

To install a Remote DX Install, you must first fully configure the DX Server.  For instructions how to initially install DX, please see the related KB articles, or refer to the DeployExpert Installation and Configuration Guide.

Once DX is installed on a server and connected to a Symantec server, then you can setup additional remote DX consoles.  You can do this by running the full DeployExpert.exe installer used to setup DX.  At the components chooser, only select the DX Console component.  The installer will then prompt you for the Kernel and Logger hosts.  By default, these will say localhost, but for a remote console you must enter the full resolvable server name in this box, and verify that the chosen ports are usable from the system and are opened on the server.  The "Check Port" can verify this for you.

You will also be prompted to enter SQL credentials for this connection and to choose the DXE database from a drop-down list.

Once installed, you can open the DX Console the same way as you would from the server.  When a remote console opens, it does require a username and password.  The account you login with has to be an account that has already been granted Console Login rights from the DX Credentials interface.

1.3. Adding a New License

Description:  Adding a new license from a renewal of Maintenance and Support or adding additional licenses.


Environment: SMP 7.1


DX version:1.x, 2.x, 3.0


Process:


To activate a new license, select "Add New License" from the Actions pane.  Browse for the provided license file to add the new license.  The License interface will reflect the new information after refreshing.

1.4. Trial License Restrictions

Description:

Restrictions imposed on a Trial License in DeployExpert

 

When DX is installed in Trial mode, it is given a 30 day license to use the product.  All functionality is enabled, but the product is limited to bringing in 20 systems only.  After discovering 20 inventoried systems, no further systems will be brought into the Platform Analysis interface of DX.  There is no way to choose which 20 systems will be selected.

 

After 30 days, the trial will expire and the product will no longer run.

1.5. Upgrading DX

Description:  Upgrading to the newest version of DX from an older version

 

Environment:  SMP 7.1

 

DX version: 2.x, 3.0

 

Process:

To Upgrade DX to a newer version, begin by downloading the newest version from the Altrinsic Solutions website. Login or register for a new account and select "Download DX for Symantec SMP." Once downloaded, extract the files locally to the DX server and run the "DeployExpert.exe." Do not uninstall the old version of  DeployExpert. The installer will detect the older version of DeployExpert and present a wizard.  Press Next.  To properly install, DX requires a restart of the Altiris Core services.  Click "Next" again.  

If your installation of DX is eligible and ready for upgrade, select "Upgrade." This will begin the wizards for each  component, but will not prompt for configuration installation. Once all installed component wizards complete, the upgrade is complete.

To be eligible for an upgrade of DeployExpert, two criteria must be met. First, the Auto-Update Protection date from the active license must be a future date. Second, a current functioning installation of DX must currently be installed on the server for the upgrade to proceed.

After DX has been upgraded, the Altrinsic Deployment Site Server Components will also need to be upgraded.  In Settings -> All Settings -> Deployment and Migration -> Windows , there is an Upgrade policy for the Altrinsic Deployment Site Server components.  Enable this policy, and verify that the filter is applied to all Task Servers as well as the NS itself.

Once the Task Servers have upgraded this plug-in, the DX jobs will work again.

1.6. Reconfiguring DX

Problem:

The DeployExpert jobs and policies are not accessible from the Symantec Console.  They are either missing completely, or when selected from the Symantec Navigation Tree they will not load in the web console. 

 

Cause:

The DeployExpert program was not properly or fully configured during an installation or upgrade.

 

Environment:

Symantec SMP 7.1

 

Affected Versions:

1.x, 2.0.x

 

Solution:

Re-configure the DX Product in the Symantec Console.  This can be done by using the Symantec utility called "AeXconfig.exe".  For a default Installation of Altiris, this command would be:

C:\program files\altiris\notification server\bin\Aexconfig.exe /configure "C:\program files\altiris\deployexpert (DX)\config\DX.config"

This command would need to be altered if Altiris is installed into a different location, but the AeXconfig.exe should always be in the Notification Server directory, and the DX config files will always be in a folder called DeployExpert (DX) in the root of the Altiris install directory.

The configuration process may take several minutes.

After the configuration process is complete, restart the Altiris Object Host Service and the World Wide Publishing Service.

1.7. Uninstalling DX

Description:  Completely remove DeployExpert components, including all files, all SMP integrated functions, and the DeployExpert database.

 

Environment: SMP 7.1

 

DX version:1.x, 2.x, 3.0

 

Process:

In order to uninstall DeployExpert, first enable the Altrinsic Deployment Site Server Components - Uninstall for all task servers in the environment.  Ensure that the task servers have removed this component before continuing with the DeployExpert uninstallation.

To remove DX, run the DeployExpert.exe installer program that originally installed the solution.  Re-opening the installer will provide the Option to Add/Remove components, Repair, or Uninstall.  To uninstall a single component, select Add/Remove Components and uncheck the component to be removed.

To uninstall all of DX, select uninstall.  There will be a checkbox to remove the DX database or not.  If the database is removed, it is permanent and all DX data will be removed with the solution.  

Once DX is fully uninstalled, all files associated should be gone with the exception of the DX driver repository.  To remove that, simple browse  to the UNC path and remove the driver files.

2. Configuration, Inventory, and Analysis

2.1. Altrinsic DX Kernel Service not starting after Reboot

Problem:

 The Altrinsic DX Kernel service does not automatically start after a reboot.

 

Cause:

This service has attempted to start before its dependencies have started.

 

Environment:

Symantec SMP 7.1, Server 2008 R2

 

Affected Versions:

1.x, 2.0.x

 

Solution:

Open Services on the server, and open the properties for the Altrinsic DX Kernel service.  Change the Startup type from "Automatic" to "Automatic (Delayed Start)".  This will allow the kernel to successfully start after a reboot on Server 2008 R2.

2.2. DX Console prompting for login

Problem:

Opening the DX Console prompts for a username and password before being allowed to continue.

 

Cause:

The DeployExpert Console is either:
1) Not able to reach the DX Kernel Service
2) Installed as a Remote Console 

 

Environment:

Symantec SMP 7.1

 

Affected Versions:

1.x, 2.0.x

 

Solution:

If the DeployExpert Console is being opened as a remotely installed console connecting to a DX Kernel Service on a different server or system, this behavior is intended.  You will need to enter a username and password that has been granted Console Login rights from the DX Credential interface.

 

If the DeployExpert Console is being opened directly on the DX server and is prompting for credentials, then it means that it is not able to reach the DX Kernel Service locally.  Start or Restart the DX Kernel Service to resolve the issue.

2.3. DX Repository/Tools folders losing permissions on Task Servers

Problem:

 The DX Repository and/or Tools folder on Task Servers are continually reverting security permissions to no access for all users.

 

Cause:

 By default, the Symantec package server refresh resets all permissions on package source locations and package target locations, which makes the folders unreadable by clients using the UNC share path.

 

Environment:

Symantec SMP 7.1

 

Affected Versions:

1.x, 2.0.x

 

Solution:

 To fix this issue, each task/package server to be used with DX needs a registry key added to that server.  In regedit, navigate to the following key:

 

HKLM\Software\Altiris\Altiris Agent\Package Server\

 

Create a new DWORD value in this folder with a value of 0.  Finally, set the permissions appropriately on the DX folder in the Deployment share on the Task Servers.  The DX service account and the Symantec App Identity account should have Read/Write access of this folder.

3. Driver Harvest and Management

3.1. Adding an Application to a Specific Class

Description:  Adding applications to classes


 


Environment:  SMP 7.1


 


DX version: 2.x, 3.0


 


Process:


Once you add an application to the Application Repository, it will show up with all the other drivers in the Driver Repository.  It will be at the bottom of the Driver Repository list, or you can sort just the apps by selected the "Show only Applications" from the actions pane in Driver Repository view.  From there, you can add associations like any other driver.

3.2. Error 1 during Harvest

Problem:

The Harvest_Drivers Task in the DX Harvest Drivers job is throwing an Error 1.

 

Cause:

The harvesting utility, DriverManager.exe, could not be accessed by the task or it could not be copied down to the client, or could not be executed on the client.

 

Environment:

Symantec SMP 7.1

 

Affected Versions:

2.0.x

 

Solution:

Verify that the account used by the Harvest Drivers job has access to the Deployment share of the client's task server.  The DriverManager.exe should be found in

\\taskserver\deployment\dx\tools

The account will require read access on this folder to run a harvest job.

If the tools folder is missing, or the drivermanager.exe is missing, then the Altrinsic Deployment Site Server Components need to be installed or re-installed on the Task Server.

 

If the permissions seem to be in order, check the client to see if there are any third-party Anti-virus software or firewall services that may be halting the execution of the DriverManager.exe  If there is, add an execption for DriverManager.exe to execute on the client.

3.3. Error 2 during Harvest

Problem:

The Harvest_Drivers Task in the DX Harvest Drivers job is throwing an Error 2.

 

Cause:

The DriverManager.exe was not able to access or was not able to write the drivers to the shared path specified in the DX Harvest job.  

 

Environment:

Symantec SMP 7.1

 

Affected Versions:

1.x, 2.0.x

 

Solution:

Verify that the account used by the Harvest Drivers job has access to the Shared Path.  This UNC path is shown in the DX Harvest Drivers job, and is originally specified in the configuration of DX in the Data Repository Wizard.  To view this UNC path, open the DX Console and open Settings -> Global Settings -> Data Repository.  The second UNC path is the shared path.

 

The Shared Path is used as a temporary staging location for the drivers during a harvest, where clients will copy their drivers to until they can processed and added to the master DX library of single-source drivers.

 

3.4. Unknown User Name or Invalid Password during Harvest

Problem:

The Prepare Task in the DX Harvest Drivers job is throwing an Error "Unknown User Name or Invalid Password".

 

Cause:

The DriverManager.exe was not able to use the provided credentials to access the UNC share.

 

Environment:

Symantec SMP 7.1

 

Affected Versions:

1.x, 2.0.x

 

Solution:

Verify the credentials in the DX Console are correct and that the harvest job is showing the correct credentials in the Symantec Console.  If the credentials appear to be correct, try re-making the credential in the Credentials interface and then changing which credential is used in the Data Repository settings interface in the DX Console.

4. Image Creation

4.1. DX Create Image job not rebooting to automation

Problem:

The DX Create Image task does not reboot the system in automation.

 

Cause:

If the system does not reboot, that means that it was not able to execute a Reboot to Automation task.  If the system rebooted, but did not enter automation, it is not configured properly to automation boot or the PXE server was not responding.

 

Environment:

Symantec SMP 7.1

 

Affected Versions:

1.x, 2.0.x

 

Solution:

If the system does not reboot after Sysprep, it likely means that the Altiris Deployment Solution Plug-in is missing from the client.  This Plug-in is a Symantec Plug-in that is required for any imaging job or task that requires an automation environment.  Installing this plug-in to the client should resolve this issue.  The policy for this can be found in the Symantec Management Console in

Settings -> All Settings -> Deployment and Migration -> Windows (architecture) -> Deployment Solution Plug-in Install

If the Symantec Agent on the client has this plug-in, but still was unable to reboot into automation, verify that the system is properly configured to either boot to the NIC or has an automation folder installed.  Also, verify that the PXE server for the client is properly responding and serving automation boot images.

5. Image Deployment and Sysprep

5.1. Sysprep throws a Parsing Error

Problem:  When Sysprep unseals after a DX deployment, sysprep halts with an error "Windows could not parse or process the unattend answer file for pass [specialize]".

This completely ends the process and the system must be re-imaged. 

 

Cause:  When sysprep finds an invalid or incomplete property in the unattend file, it will throw this error.  The error should also show the invalid component as well as the pass. 

 

 

Environment:

All Windows 7 deployments

 

Affected Versions:

1.x, 2.0.x, 3.x

 

Solution:

The solution depends on the component that is failing.

If the component that has failed is Microsoft-Windows-Shell-Setup, it is likely either

  • An invalid character in the ComputerName, UserName, Or OrganizationName.  Check for special characters or spaces in in these fields and remove them from the unattend.xml file.
  • An invalid product key.  Verify it is the correct key if it is a MAK. If you are using an activation server, the product key is unnecessary and the entire property should be removed.

If the component that has failed is Microsoft-Windows-Deployment, it is probably:

  • The InstallDrivers.vbs did not copy down.  Check the permissions on the task server for  \\server\deployment\dx\tools and verify that the DX account has access to this folder.
  • An associated application did not copy down.  Check the permissions on the task server for  \\server\deployment\dx\repository and verify that the DX account has access to this folder.
 
 
 
If a different component has failed, you can check the setuperr.log file on the client.  You can do this at the error by hitting Shift+F10 .
This will present a command prompt.  The setuperr file is in C:\windows\panther
 
This should contain a more detailed error that you can view and diagnose.
 
If you are getting other parsing errors, you should open the .xml file in the Windows System Image Manager, which can be found as a part of the WAIK tools.

http://www.microsoft.com/en-us/download/details.aspx?id=5753

5.2. Package Refresh Resetting Security Credentials on DX Repository Package Destination Folders

Problem:  DX Repository is not accessible by DX Deploy Jobs because the NTFS security permissions on the DX Repository package on the site servers are regularly reset to no access, making them inaccessible.

Cause: Whenever a package refresh occurs on a Symantec Site Server, all folders in the file system that are acting as Package Destination locations have their NTFS security permissions reset to no access. These permissions do not affect the access of the packages through the package server, but only through third-party or manual methods, as in the way DX accesses the drivers during the deployment job.

Environment: 
Symantec Management Platform 7.1 SP1, SP2 

Affected Versions:
2.x, 3.x 

Solution:

Turn off DACL Management on each package server.
1) Open the registry editor on your package server
2) Open registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent\Package Server
3) Create a new DWORD value named "EnableDACLManagement" with a value of "0"
4) Restart the package Server

This will affect the DACL Management for all packages on the site server, but does not alter the existing security permissions.

5.3. Metadata task never starts

Problem:

The Metadata Task in a DX Deployment Job hangs indefinitely until it times out. 

 

Possible Causes:

  1. This task is attempting to access a script from the Altrinsic.TaskServerHandler,dll file on the client's task server.  If this task is not accessible, the Symantec agent will continually put this task to sleep until a timeout occurs.
     
  2. This task was unable to reach the connector's host.

Environment:

Symantec SMP 7.1

 

Affected Versions:

2.0.x

 

Solution:

  1. The Altrinsic Deployment Task Server Handler Agent needs to be installed on the client's Task Server.  All Task Servers in the environment need to have these handlers installed.  To install or upgrade to the latest version, you can access the policy in Settings -> All Settings -> Deployment and Migration -> Windows.
    If you believe that the correct version of the Task Server Handlers are installed, verify that the .dll is in the Global Assembly cache.  This can be found in C:\windows\assembly and the file name is 'Altrinsic.TaskServerhandler.dll' .  If the file is missing or is the wrong version, re-install the Altrinsic Task Server Handlers.  If there is an old version of the .dll alongside the correct version, simply remove the old version.
  2. The Connector config file must be edited to use the correct Connector path.  This is originally configured in the installer, but if left as "localhost" there will be an issue resolving this.  Open file "C:\program files (x86)\altrinsic\DX Connector\Altrinsic.DXE.Connector.SMP.exe.config" on the DX server in a text editor.  Search for the property called "ServiceURL" in the file and replace the string from localhost to the appropriate resolvable server name.

     

    <setting name="ServiceURL" serializeAs="String">
            <value>net.tcp://servernamehere:8095/Altrinsic.Connector.SMP</value>
    </setting>

6. Troubleshooting

6.1. Tools for Troubleshooting

DX Log Viewer 

The Log Viewer is the main tool for monitoring all activity from the DX Console.  The Log Viewer can be accessed from the Windows menu in the DX Console. The Log Viewer Runtime Logs will show all responses sent and from the Windows menu in the DX Console. The Log Viewer Runtime Logs will show all responses sent and received from connections as well as status messages and information from various functions in the DX Console.

The DX Log Viewer can be accessed through the View menu in the DX Console, or from the Start Menu in Altrinsic - Diagnostics.

Message Log Viewer

The Message Log Viewer is the tool for monitoring all messages that occur during the use of the DX Console.  The Message Log Viewer can be accessed from the Windows menu in the DX Console.

The Message Log Viewer can be accessed through the View menu in the DX Console

Background Task Manager

The Background Task Manager is the tool for monitoring currently running tasks and processes both internally and on SMP Connectors.  This includes inventory checks, analysis, driver harvesting, driver inventories, and various other asynchronous tasks throughout DeployExpert.

The Background Task Manager can be accessed through the View menu in the DX Console.

Altiris Log Viewer

The Altiris Log Viewer can be used to monitor any tasks that are running in the Symantec Agent, either in production or in automation.  This can be accessed from the Start Menu under Symantec.

6.2. Contacting Support

Support for DX can be accessed by emailing support@altrinsicsolutions.com. Gratis email support is available at this address, but is provided on an availability basis. Gratis email support may incur a 72 hour or more delay in live response.


Support tickets can also be opened at http://www.altrinsicsolutions.com/hd/ or posted on the Altrinsic Solutions forum at http://www.altrinsicsolutions.com/forum/forum.php .
Organizations wishing to access priority phone fee based support may purchase support incident packages from your DX reseller. For more information, contact sales@altrinsicsolutions.com.