Client Management Suite

  After upgrading from 7.5 HF6 to 7.5 SP1 our software advertisements in the software portal are no longer being displayed to any users.

 

What it currently looks like:

 

What it should look like (old picture):

 

 

 

Hi!

Does software product/Managed Delivery policy still have previous users assigned as published for, or after upgrade they were rejected, removed by someone?

Thanks,

IP.

I'm seeing the same issue after the install of 7.5 SP1.  Adding it to my list of post SP1 issues.  I checked some of the policies that are published and the appropriate user groups are still assigned.  Also checked my Software Portal Settings and they are set properly.   When on 7.1 I had implemented the steps in TECH161630 to extend the list of trusted domains.  I confirmed those settings were still in place as well.

Just noticed one other thing.  One of my custom settings on the Software Portal Settings page is a custom logo for my company.  the logo still shows on the settings page but when workstations open portal, its showing the default Symantec logo.  Tried manipulating settings and re-saving.  No change in results.

 

There have been no modifications to the groups that software or policies are being advertised to.  Attempted to remove/readd advertisement and they still do not publish.  This is regardless to whether I am publishing a policy or software package.

I attempted to remove/readd the link to the software portal from the clients but they still experience this issue.

Did you execute the upgrade with the appid?

I'm not clear on your question burndtjammer.  The upgrade to 7.5 SP1 was done via SIM per the documentation, is that what you mean?

Were you logged in to the NS and installed the upgrade using the account that runs the altiris Services?  Symantec calls this account the appid.  In our environment we call that account a service account.

Yes, I did the upgrade while logged on as the AppID / Service account.

Ive had a ticket in for almost 3 weeks but they have been working on it.  It was with the Software Portal team for a few days, and then with core(?).  Now its with the development team marked as a high priority.  The last engineer assigned told me he had 3 tickets with the similar issue with slight variations so they haven't been able to pinpoint it yet. Hopefully the development team can figure it out.  It looks like as part of the upgrade their were some improvements made to the software portal as far as its responsiveness.  Maybe that has something to do with it?

I've got what might be a similar issue. I have 7.5 SP1 and looking at the portal on a couple of test machines with various accounts and all the items I can request are greyed out and I can't tick the boxes. It's just possible I forgot to use the AppID to upgrade to SP1 - might this be the problem? If so, how do I rectify it?
 

@MrSoapsud

• Your clients are already upgraded to 7.5 SP1 version, where you're opening Software portal page? (Clear I.E cache, etc on client side and refresh page?)
• Does your previous AppID is in "Symantec Administrators" role now? Does this AppID also see that all is greayed out on Software portal pge?
• Did you check what privileges and permissions are now for you current AppID?

@Igor,

Thanks for the quick reply! Here are my answers:

• Yes, the clients have upgraded to 7.5SP1. I've also tested on a machine that was only connected to the server after SP1 was installed.
• The previous AppID is still in Symantec Administrators.
• Everything on the portal is grey for the original AppID and the account I may have done the upgrade as.
• The account I may have used for the upgrade is also in Symantec Administrators.

Regards

Martin

Martin,

if I've correctly understood, Software Portal page correctly worked on same clients before upgrade to 7.5 SP1? Now you've observed that on clients where SMA and Software Management Solution agent are upgraded to 7.5 SP1 version, unable to request, etc software on portal page and same occurs for clients, where SMA and Software Management Solution plug-in isn't upgraded to 7.5 SP1 yet?

Did you install this HF for 7.5 SP1? https://www-secure.symantec.com/connect/blogs/itms-75-sp1-hf1-now-available

Then other ways to try to figure out this problem:

• Your software is published to Software portal through Managed Delivery policy or from Software package directly for specified domain or local users?
• How about to re-publish some previouslly published software or publish a new one?
• Disable and re-enable "Software Portal" page policy for problematic client
• Try to reset a GUID of managed client computer via cmd on client computer and re-open Software portal

C:\Program Files\Altiris\Altiris Agent\AeXAgentUtil.exe /ResetGuid

 

Hi Igor,

Thanks again. I'll be honest - I don't test the portal every day! The last time I did anything with it was almost certainly before SP1. I upgraded to SP1 a few weeks back, not long after it came out, and I've only just tried it again. Since the upgrade though, all the clients have upgraded so I can't test with a pre-SP1 client (or at least I don't think I can...)

I haven't installed the HF1 yet but the release notes suggest that only deals with the high CPU issue?

• The package I was trying was published as a package, not a policy. However I also have a MSD policy published and that is showing the same problem.
• The package I really wanted to test has only just been published.
• I've turned the portal policy off, updated config, turned on again and that hasn't helped.
• I've tried resetting the GUID and that hasn't helped either.

Next idea?

Thanks

Martin

Hi Martin,

lets then check I.E security settings, etc: Trusted Sites, download settings, clear all current temp I.E files? What about just for a test purpose, try to use another browser to open Software portal on same client?

I haven't heard about such problems in Software Portal page after upgrade, so for now I'm just trying to find a potential ways for attempt to find a root cause.

Hi again...

This is getting stranger and stranger...

I've tried clearing temp files and I've tried Chrome - same result. (One machine had Chrome come up even though IE was supposed to be the deafult but that's another story!)

The weird bit is that on one test machine, the NS was in the internet zone and offering 5 packages/policies. I moved the NS to the intranet zone, reloaded, and the package I really wanted to test disappeared from the list!!! The 4 remaining options are still grey. (I still get 5 if I put the NS in the trusted zone instead.)

Confused...

Martin

I've also seen where portal comes up in Chrome even when IE is set as the default browser.  I assume that means portal prefers Chrome but I've not seen that documented anywhere and it does seem odd to take that preference out of the users control.  

For me, the issue of an empty software portal has been coming and going.  I've had the ticket open for a few weeks.  A few times I've worked on it with support, we've been able to capture logs but they did not give us any hints at the root cause.  Then suddenly portal started working again following a weekend where MS patches were applied.  It stabalized for a few days and worked consistently to the point I was ready to close the ticket then it stopped working again.  Now it is working again.  When the problem occurs, it happens for multiple machines, multiple users.   Reboot of the NS has no impact. 

I do have HF1 applied.  Not sure if I had the problem before that. 

About why Chrome is triggered to open Software Portal, instead of I.E

• https://www-secure.symantec.com/connect/forums/software-portal-opens-chrome-even-though-ie-default-browser

Seems like need to profile via Altiris Profiler on NS server, while Software portal loads and populates data on client PC (Maybe Joe has done it already with support, when ticket was opened about this problem).

Joe and Martin,

do you have every week schedule to perform AD Import of users, computers?

I'm not sure that it makes sense, but according to information from Joe, he said that it worked but then stopped again.

@Martin,

Mystery for me, about such behavior after I.E zone modifications...

Back to greyed out controls on Portal:

• Try to use another user account for this client PC for Software portal login?
• Do you have ability to delete this prolematic client PC from SMP Console? If yes, then delete it -> refresh policy on client PC to receive GUID and configuration policies -> try to logon to Software Portal.

@Igor,

Looks like I set up regular import of computers but not users - I haven't imported users for nearly 4 months as we are still testing the service. I'll try and update the users and see what happens.

From your other message I've tried 3 users and 4 computers!

Interesting that yours has come back and forth without any known causes for it to do so. I was debating on applying HF1 and seeing if it reconfiguring everything would do anything but I should probably check with the assigned engineer to my ticket first.

It's unusually hot here at the moment - maybe I'm not thinking straight!! The more I poke, the more I fear this may be the case, but if so, they're an indication of an issue with the portal UI.

The boxes for Approved and Recommended are grey, and clicking the mouse around there does absolutely nothing. (Remember in NS6 you click in a box on the portal to request something...) If you click on the name of the package, the line changes colour and the "Request software" button comes to life. Actually - no - you can click anywhere apart from in the boxes, and get the line to be selected. It's only clicking in the inviting looking boxes that gives no response.

Feeling a bit stupid now and sorry to have bothered you folks, but maybe this thread will help someone and maybe someone at Symantec will have another think about the workings of the portal page.

Many thanks for your time Igor and the others who've responded...

<Crawls off feeling very embarassed...>

Martin

Interesting on the Chrome front.  However, this hasn't been a major concern for me.  The problems I describe where the portal comes with no packages happen in both IE and Chrome.

Yes, we import AD user information.  Full import monthly, delta import nightly.  It appears it has been working fine.  We have about 19,000 users.  Are you thinking that is part of the issue?  Even when the issue happens, the user information shows up properly, there are just no applications listed for them.

We import computers as well, similar schedule and similar quantity.  Both users and computers are imported from three different domains.

If you have 7.5 SP1 and don't have HF1, I'd highly recommend it.  Simple fix, just changes a DLL.  No agent updates or anything.  This fixed a significant bug in the client config generation code that caused us a lot of pain.  Not as noticable in small enviornments which is why we didn't pick up on it in our lab testing.   Note: As far as I know, HF1 has no impact on how software portal works so don't expect it to help you for the issues described in this thread.

@Joe
I've just assumed that may be somehow it could brake assignment (permissions, etc) for these domain users of already published software. Unfortunately I didn't see such problem on my side and can't try to look more deeper.

I read through the release notes and noticed it only fixes one issue.  However, I'm thinking that it may reconfigure a few services as it usually does during an install.  I'll wait until I hear from the assigned engineer before I apply it. 

As far as my issue with the software portal itself:

-AD import seems to run fine. 

-I've reinstalled the client agent, no change

-I've published new software, no change

-I've published manage delivery policies no change

-I published an existing software package to the local administrator of my NS and that user account was able to see and request that software package.  <- Thanks Igor.  (the AppId still cannot see published items, as well as any other domain account)

This is what displays in log viewer when a user attempts to access:

 

GetUserGroupsParallel for account usernamegoeshere
A local error has occurred.

   [System.DirectoryServices.ActiveDirectory.ActiveDirectoryOperationException @ System.DirectoryServices]
   at System.DirectoryServices.ActiveDirectory.PropertyManager.GetPropertyValue(DirectoryContext context, DirectoryEntry directoryEntry, String propertyName)
   at System.DirectoryServices.ActiveDirectory.Forest.GetForest(DirectoryContext context)
   at System.DirectoryServices.AccountManagement.ADStoreCtx.GetGroupsMemberOf(Principal p)
   at System.DirectoryServices.AccountManagement.Principal.GetGroupsHelper()
   at System.DirectoryServices.AccountManagement.Principal.GetGroups()
   at Altiris.SoftwarePortal.Resources.SoftwarePublishingUtil.GetUserMembershipParallel(Principal userPrincipal, Dictionary`2 allowedDomains, TraceLevel traceLevel)

A local error has occurred.

   [System.DirectoryServices.DirectoryServicesCOMException @ System.DirectoryServices]
   at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
   at System.DirectoryServices.DirectoryEntry.Bind()
   at System.DirectoryServices.DirectoryEntry.get_AdsObject()
   at System.DirectoryServices.PropertyValueCollection.PopulateList()
   at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName)
   at System.DirectoryServices.PropertyCollection.get_Item(String propertyName)
   at System.DirectoryServices.ActiveDirectory.PropertyManager.GetPropertyValue(DirectoryContext context, DirectoryEntry directoryEntry, String propertyName)

COM Exception errcode: 0x8007203B

Exception logged from:
   at Altiris.Diagnostics.Logging.EventLog.ReportException(Int32 severity, String strMessage, String category, Exception exception, String footer)
   at Altiris.NS.Logging.EventLog.ReportException(Int32 severity, String strMessage, String category, Exception exception)
   at Altiris.SoftwarePortal.Resources.SoftwarePublishingUtil.GetUserMembershipParallel(Principal userPrincipal, Dictionary`2 allowedDomains, TraceLevel traceLevel)
   at Altiris.SoftwarePortal.Resources.SoftwarePublishingUtil.GetUserMembership(String account)
   at Altiris.SoftwarePortal.Web.ContextUtil.get_UserMembership()
   at Altiris.SoftwarePortal.Web.ContextUtil.CreateContext(UserType userType)
   at Altiris.SoftwarePortal.Web.ContextUtil.Context(UserType userType)
   at Altiris.SoftwarePortal.Web.UserPortal.Home.Page_Load(Object sender, EventArgs e)
   at System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e)
   at System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e)
   at System.Web.UI.Control.OnLoad(EventArgs e)
   at Altiris.NS.UI.Controls.PageCachePage.OnLoad(EventArgs e)
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest()
   at System.Web.UI.Page.ProcessRequest(HttpContext context)
   at Altiris.NS.UI.Controls.PageCachePage.ProcessRequest(HttpContext context)
   at Altiris.NS.UI.AltirisPage.ProcessRequest(HttpContext context)
   at ASP.userportal_home_aspx.ProcessRequest(HttpContext context)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
   at System.Web.HttpApplication.ApplicationStepManager.ResumeSteps(Exception error)
   at System.Web.HttpApplication.System.Web.IHttpAsyncHandler.BeginProcessRequest(HttpContext context, AsyncCallback cb, Object extraData)
   at System.Web.HttpRuntime.ProcessRequestInternal(HttpWorkerRequest wr)
   at System.Web.HttpRuntime.ProcessRequestNoDemand(HttpWorkerRequest wr)
   at System.Web.Hosting.ISAPIRuntime.ProcessRequest(IntPtr ecb, Int32 iWRType)

**CEDUrlStart** :http://entced.symantec.com/entt?product=SMP&version=7.5.3153.0&language=en&module=CdMCH7zuq7YXd7T9bJ8iPuUKbY4HbtXoOvTlAvVOwRojSXfAAcKlLf6m9ATfUmtEaqn2D3NMNzV2sj5/LThKI4OPUtUxLDVez+tSpOfJVTWxG5T5IBo8upv1u3Fg2jKd&error=511398005&build=**CEDUrlEnd**
-----------------------------------------------------------------------------------------------------
Date: 7/24/2014 12:19:39 PM, Tick Count: 1775113953 (20.13:05:13.9530000), Host Name: Notification-Server, Size: 4.52 KB
Process: w3wp (12204), Thread ID: 96, Module: w3wp.exe
Priority: 1, Source: Altiris.SoftwarePortal.Resources.SoftwarePublishingUtil.GetUserMembershipParallel
File: C:\ProgramData\Symantec\SMP\Logs\a30.log

You can check about similar problem story, where same error code occurs:

http://forums.asp.net/t/1517772.aspx?DirectoryServicesCOMException+0x8007203b+A+local+error+has+occurred+on+IIS7+Windows+Server+2008

 

Assigned engineer just let me know that development may have found a solution for a similar problem and they think it can fix mine too.  They just have to do some testing first.

So I am getting the same error about GetUserGroupsParallel for account

I thought it was after I started to import AD users, but it was also noticed after we did the SP1 upgrade, so it could most likely be that vs what I thought.  

Any resolution?   The portal for us shows up blank for some users.

Assigned engineer notified me that they have finished compiling a fix for the issue but that it now has to go through QA/BETA testing.  He says this can take a week or more.  If you have not yet opened a case you need to.

I see that there is a point-fix for Software Portal is available http://www.symantec.com/docs/TECH223324

And there is a mention: A beta version is prepared for testing purposes. Please do not apply this fix unless under the direction of Symantec Support.

I attempted this yesterday. It did not resolve my issue, but my error is the same as the one addressed in the article.

Development has stated they it fixed part of the problem but not all of it so the fix is being reworked. Has the current fix worked for anyone? Is there anyone not experiencing this issue? Management on my end was getting annoyed and asked me to stand up a new NS but the problem existed in the fresh build as well.

We still have the issue, although it comes and goes.  They never gave me the fix to try but told me today it did not fix the issue as they had hoped and a fix is still being investigated.   The support guy I talked to today mentioned my symptoms are consistent with the bug documented in ETrack 3574190.

My symptoms include the error on portal "No Software is Available for you to request" along with errors on the server side NS logs:  GetUserGroupsParallel for account [User Name].  Unknown error (0x5011).  COM Exception errcode: 0x5011

http://www.symantec.com/docs/TECH223324

The fix has been updated on the above site.  It still hasn't resolved my issue and I am still recieving the same errors as mentioned in the article.

Joe, have you tried this pointfix?

No, support has not asked me to try that hotfix.   When I brought it up last week, they said it did not resolve the issue in the testing they had done (probably with you) They did have me install a MS hotfix on the NS.  I did that last night and so far the problem has not come back.  Then again, at the time I installed the hotfix, portal happened to be working and I've seen the issue go away for a week at a time.  I'll post an update when I have one.

MS KB:

Random exceptions occur when you use an application that uses the System.DirectoryServices.Accountmanagement namespace on a computer that is running Windows 7 or Windows Server 2008 R2

http://support.microsoft.com/kb/2683913 
 

Update:  The MS Hotfix above did NOT fix our SW Portal issues.

It didnt fix mine either, but based off the document it seemed like it could have fixed it.  

http://www.symantec.com/business/support/index?page=content&id=TECH223324

This KB has been updated.  I will be testing the update at 1130EST today.  It looks like it removes the enhancements that were made to the Software Portal.

The kb has solved my issue.  It removes the enhancements that were made to the software portal, which is fine by me because I was never able to experience them...

Now that the KB has been updated, it is the solution to my issue.