Differences between AeXNSC.exe, AeXNSChttp.exe, and AeXNSChttps.exe

Products

• IT Management Suite
• Client Management Suite

Issue/Introduction

Do you know what the new AexNSChttp.exe and AexNSChttps.exe files (under ".../Program Files/Altiris/Notification Server/nscap\bin\Win32\X86\NS Client Package") are for?

Differences between AeXNSC.exe, AeXNSChttp.exe, and AeXNSChttps.exe

This article provides technical details regarding the Symantec Management Agent (SMA) installation packages, including verification methods for file integrity and an explanation of why hashes for HTTP/S variants are unique per server.

Environment

ITMS 8.x

Resolution

SMA Installation Packages

About the SMA installation package:

• AeXNSC.exe - The core installer. It does not contain pre-defined Notification Server (NS) URLs or specific agent settings. This file is signed by Broadcom. 
• AeXNSChttp.exe - A modified version of the core installer containing the NS URL HTTP address and settings from the Agent Communication Profile. 
• AeXNSChttps.exe - A modified version containing the HTTPS address, server-specific certificates, and Communication Profile settings.

Note:

In some cases, in order for the AeXNSCHTTP.exe and AeXNSCHTTPS.exe files to be updated as well, re-save all the communication profiles in use (if you have more than just the default one) under Settings>Agents/Plug-ins>Symantec Management Agent>Symantec Agent Communication Profiles. Change something (uncheck/check box) and save. You should be able to see in Trace logging that these files were created.

Also, you can add a password to the AeXNSChttp.exe or AeXNSChttps.exe file so it can be protected if someone tries to run the executable manually (under Settings > Agents/Plug-ins>Symantec Management Agent > Settings > Agent Install > Default Settings > Security: Pull Packages and select the option "Password protect package".

 

Digital Certificate

Verify that AeXNSC.exe is signed by a valid Broadcom certificate. 

Technical Generation Process

It is impossible to provide a universal hash for AeXNSCHTTP.exe and AeXNSCHTTPS.exe because these files are dynamically generated and unique to every server.

How it works:

1. AeXNSC.exe is the static, signed base file installed with the product.
2. AeXNSCHTTP/S.exe are generated automatically by the server during initial startup or when an administrator modifies "Agent Install" settings or the Symantec Management Agent Communication Profile in the SMP Console.
3. The Server copies AeXNSC.exe into a new AeXNSCHTTP/S.exe container.
4. The Server injects aexnsc.xml (containing server-specific settings) and unique certificates into the container.
5. Because these injected files are unique to the SMP Server's identity, the resulting file hash will differ for every environment.

Extraction for Troubleshooting

Both the core and the HTTP/S variants are self-extracting archives. You can inspect the injected configuration files by running the following command:

 

AeXNSCHTTPS.exe /extract:<folder-path>

 

After extraction, you will find the aexnsc.xml and certificate files that define that server's unique installation package.

⚠️ Note: AeXNSCHTTP/S.exe is not digitally signed unless the administrator has provided a specific signing certificate within the ITMS Console settings.