Information about installing the Symantec Management Agent (Altiris Agent) on computers (2023)

The Symantec ManagementAgent Installation page, located under the Settings > Agents/Plugins > Symantec ManagementAgent > Configuration tree node, is where users can enable installation of the Altiris Agent on a computer.
The site is designed to be extensible and other agents, e.g. Linux/Unix/Mac to add tabs to the page. This model provides a single page for all types of agent installations.

The InstallAgent tab can be divided into 3 main areas:

• 1. Deployment of agents in teams
• 2. Download page URL
• 3. Scheduled Push to Computer
  Also, a Security section has been added to describe what security permissions are required to activate an Altiris Agent installation.

Altiris Agent is installed on computers
This section allows users to remotely install the SymantecManagementAgent on one or more computers. To send the agent to a computer, the computer must first be added to the grid. Users can then select one or more computers in the grid and click the "Install" button to start the automatic installation.
Note that adding computers to the grid does not mean adding them as an NS compute resource.

Selection of the equipment to be pushed
There are three ways users can add computers to the embed grid:

1. Quickly add computer name (via text field)

• By team name
  • Supported format:
    • FQDN (z. B. name.domain.com)
    • Name @domain
    • [email protected]
    • Name.Domain
    • Name
  • Invalid characters:
    • Space (" ")
    • Greater than (">")
    • Less than ("<")
    • Come (",")
  • Extended ASCII characters are supported.
  • The maximum length of the team name is 15 characters. This is a limitation of the NetBIOS protocol.

Things to note also:

Windows does not allow characters: apostrophe (‘), (~), exclamation point (!), at sign (@), hash (#), dollar sign ($), (^), ampersand (&), asterisk ( * ), parentheses (()), equals (=), plus (+), parentheses ([]), parentheses ({}), forward slash (), (|), semicolon ((wink) , colon ( ( smile) , quotation marks ('), double quotation marks ("), backslash (/), and question mark (?).

Netbios does not allow characters: space (), slash (), backslash (/), colon ((smile), asterisk (*), question mark (?), double quote ("), semicolon ( ( wink), ( |) and Name with more than 15 characters.

Consider removing support for the name@domain format as it is not a commonly used format.

• By IP address
  • Supported format:
    • IPv4
    • *Decimal only (we may not be able to support this by changing the IP address validation logic in the Altiris.NS.Utilities.ClientPushMgr.PushAgentToComputers() method to use IpAddress.TryParse() instead.
    • IPv6
    • *Decimals only
    • * Does not work with computers without an IPv4 address. Internally, the push continues to be via the IPv4 address.
    • The IP address is displayed in the "Name" column. This changes to the computer names when the agent push is triggered.
    • By computer resource GUID

2. Import CSV files (using the Import devices from a selected file toolbar button)

• Supported format:
  • Same as "Add Team Name Quickly" above.
• The failed import is logged but not shown in the UI.

3. Select Computer dialog box

• By clicking the button:
  • If no computers are found in the NS database, the user is redirected to the Discover Computers page.
  • If devices are found, the device selection dialog is displayed.
• When you select one or more computers from the selector, the selected rows should be transferred to the insertion grid.
• If you cancel the selector, no more entries are added to the insertion grid

sliding grate
The embedding grid remembers all previously added computers unless specifically removed by the user. This data is stored in the NS database table AgentPushData.
As the selected computers are added to the insertion grid, the Name and Domain columns are filled in appropriately, based on the format you entered. The remaining columns are empty because the machines have not yet been discovered.
The following are the expected results in the grid when adding an input based on the input format:

If a previously managed computer is added to the grid, only the "Name" and "Domain" columns need to be filled out.
The delete buttons in the toolbar are available to delete entries from the insertion grid. They are:

• "Remove All" - Simply hides the entries so they don't appear in the embed grid.
• "Delete" - Deletes the entry from the grid and the "AgentPushData" database table.

A Refresh button is located to the right of the grid toolbar. This button provides the ability to refresh the data in the grid. Because the agent push task is an asynchronous, long-running process, the user needs to refresh the grid regularly if they want to see the progress of the push in detail. Alternatively, you can browse the reports using the View Installation Status Report button below the grid.
The embedding grid also supports context menus. Right-clicking on an entry in the insertion grid opens the context menu depending on whether the machine was recognized or not.
If the machine has already been detected or pushed, you will see this context menu item:

• Delete Selected Teams - Equivalent to the Delete button.

If the machine was discovered or pushed, you will see these context menu items:

• Resource Manager - Opens the Resource Manager for the selected computer.
• Delete selected teams

• View the Altiris Agent icon in the Start menu
  • Specifies whether the Altiris Agent adds an entry to the Windows Start menu.
• View the Altiris Agent icon in the system tray
  • Specifies whether the Altiris Agent adds an entry to the Windows notification area.
  • These settings are overridden when the Altiris Agent first receives the configuration from the client (approximately 10 minutes after installation). The setting that overrides this is on the target agent's Settings page > Interaction tab, Show client tray icon option, which is on by default.
• US-Proxy
  • Specifies whether the proxy settings found in the target computer's Internet Options will be used for communication between the NS and the target computer both during and after installation. If the attempt to connect through the proxy fails, a direct connection is attempted instead.
• Overwrite default installation patch
  • Indicates whether the agent will be installed to an alternate location.
• Specify a different notification server
  • Indicates whether the target computer will register with a different notification server after installation.
  • Http and https compatible.
• Download the agent package from the nearest package server
  • Specifies whether the target computer downloads the agent package from the closest package server instead of the current NS.
• Add the Altiris Agent to the Add/Remove Programs list
  • Specifies whether the agent adds an entry to the Windows Add/Remove Programs list.
• Use the following administrator account instead of the application credentials
  • Indicates whether different credentials are used to communicate and install the agent on the target computer.
  • For the machine in a workgroup, specify the username in the format machinename\username.
  • The credentials provided here are only used for the installation and initial communication between the agent and the NS before the initial configuration is received from the client. After that, the Agent Connectivity Credential (ACC) specified in the NS on the Agent Global Settings page > Authentication tab will be used.
  • These credentials are transmitted for both push and pull. This is done using command line arguments (-accUserName and -accUserPassword).
• additional parameters
  • Allows adding additional command line parameters during agent installation. These parameters are specified by a hyphen ("-") or forward slash ("/") and separated by a space (e.g. -diagnostic/log).

Installation
For the agent to install successfully, the following conditions must be met:

• The current NS (and alternate NS, if specified) must have a direct connection to the target computer.
• The target computer can be in the same or different domain as the NS.
• The target computer must be gbe 'pingable hostname'. See ETrack #1585494.
• The credentials used, either the application credentials or the specified administrator credentials, must be in the Windows Administrators group on the target computer.
• The credentials used, either the application credentials or the provided administrator credentials, must be valid in the domain (or domains for cross-domain push).
• The target computer is an x86 or x64-based computer.
• The operating system (OS) of the target computer must be supported by the Altiris Agent.
• The target computer's firewall is turned off or properly configured for NS Agent push installation communication. From Altiris KB Article #31920, the ports used for remote installation are:
  • Ports for file and print services:
    • TCP139
    • TCP445
    • UDP137
    • UDP138
• Enabling ports TCP 139 and TCP 445 is usually sufficient to allow remote installation.

If the installation fails, the push grid should display and update the push status according to the following failed scenarios:

• If the target computer does not exist:
  • "Network path not found" is displayed in the status column.
• If the NS does not have a direct connection to the target computer:
  • "Network path not found" is displayed in the status column.
• If the target computer's firewall is enabled and not properly configured for Agent Push:
  • "Network path not found" is displayed in the status column.
• If the operating system of the target computer is not supported:
  • Windows 95/98/NT etc.
  • The Altiris.NS.Utilities.ClientPushMgr.MinimumOS variable determines the minimum operating system version supported by the Altiris Agent.

Other supported scenarios:

• If the agent push failed for any of the above reasons but later succeeded, the push grid will display the appropriate success messages.
• If the agent sends to multiple computers with some successes and some failures, the corresponding success or failure messages appear in the sending grid.
• If a computer was previously a client (ie the Altiris Agent was installed) and has since been reimaged, sending the agent to it will not fail.
• When a sydc001.testdom01.lab machine exists and a sydc001.syd-lab.altiris.com machine does not exist. When sydc001.syd-lab.altiris.com (which does not exist) is entered into the push page grid, the push attempts a DNS lookup on the FQDN and fails. It will then try to solve it with WINS and send the agent to machine testdom01.

The database tables used to store the Agent Push data are:

• Evt_AeX_Client_LogOn
• Evt_AeX_Push_Status

These will be created during NS setup time.

Download page URL (pull install)
This section is for "Pull Install". Pull installation provides another method to install the Altiris Agent on a target computer. Instead of pushing the installation to the target computer remotely, the installation pull works on the opposite side, where the target computer downloads the agent installation package and installs it manually.
To do this, users need to follow the steps below:

1. Log on to the target computer as the computer's administrator.
2. Locate the URL in this section. By default, the URL ishttp://\[NS_SERVER_FQDN\]/Altiris/NS/Agent/AltirisAgentDownload.aspx. The URL must be in the FQDN if accessed from another domain.
3. Follow the instructions on the page to download and install the agent.

It is important to note that the pull install also uses the proxy settings within the Agent Push "Install Settings".

Scheduled sending to Teams
Schedule Push automates the agent push process using the NS resource target infrastructure. Users can select the computers on which they want to install the Altiris Agent and choose the schedule.
If the resource target's membership has changed, the scheduled push ensures that all computers belonging to the resource target have the Altiris Agent installed via the push install. If any of the scheduled agent transfers fail, users can view them in the Altiris Installation Status report.

Security
The Altiris Agent installation is protected by the NS item permissions. To push agents to computers, the current user must have at least the following NS security privileges:

• Read permission on the Altiris Agent Installation page.
• Write permission on the Install Altiris Agent page.
• Read permission for the data class "AeX AC Discovery", a basic inventory data class.

applies to

SMP 7.1 SP2 MP1
SMP7.5+

There may have been minor changes between versions, but the general behavior should be consistent.