Failed to load inventory. The current user 'NS Agent Identity' does not have required permission 'read' to load item

Products

• IT Management Suite

Issue/Introduction

The Symantec Management Platform (SMP) logs show errors such as:

Entry 1:
"Failed to load inventory. The current user 'NS Agent Identity' does not have required permission 'read' to load item" and  "Message dispatch failed for: id=36267906, from: add95918-8669-47c8-955d-3fdc8272b22a, to: 'Basic Inventory Capture Item' (1592b913-72f3-4c36-91d2-d4eda21d2f96)

The current user 'NS Agent Identity' does not have required permission 'read' to load item: 77c8ceca-9093-4cef-af21-68ddd9c13d86
[Altiris.NS.Exceptions.AeXUnauthorizedAccessException @ Altiris.NS]
at Altiris.NS.ItemManagement.Item.RaiseItemLoadFlagsSecurityException(String message)
at Altiris.NS.ItemManagement.Item.CheckCanGetItem(IItem item, IEnumerable`1 accessPermissions, ItemLoadFlags itemLoadFlags)
at Altiris.NS.ItemManagement.Item.GetItemInternal(Guid itemGuid, IEnumerable`1 accessPermissions, ItemLoadFlags itemLoadFlags)
at Altiris.NS.ItemManagement.Item.GetItem[T](Guid itemGuid, IEnumerable`1 accessPermissions, ItemLoadFlags itemLoadFlags)
at Altiris.NS.ResourceManagement.DataClassImporter.LoadInventoryImpl(XmlReader reader, Boolean bProcessData, Boolean bForceSchemaValidation, Guid resourceGuidOverride)
...

Entry 2:
Message dispatch failed for: id=36267906, from: add95918-8669-47c8-955d-3fdc8272b22a, to: 'Basic Inventory Capture Item' (1592b913-72f3-4c36-91d2-d4eda21d2f96)
Failed to load inventory.
[Altiris.NS.Exceptions.AeXException @ Altiris.NS]
at Altiris.NS.ResourceManagement.DataClassImporter.LoadInventoryImpl(XmlReader reader, Boolean bProcessData, Boolean bForceSchemaValidation, Guid resourceGuidOverride)
at Altiris.NS.ResourceManagement.DataClassImporter.LoadInventory(Guid resourceGuid, XmlReader reader)
at Altiris.NS.StandardItems.Messaging.InventoryCaptureItem.ImportDataClassNode(MessagingResource fromResource, XmlTextReader xmlReader, ResourceImporter resourceImporter,
DataClassImporter inventoryImporter)
...
 

Additional errors may include:

• Message dispatch failures
• Inventory processing failures

As a result:

• Inventory data is not processed correctly
• Data classes fail to load

Cause

This issue occurs when the NS Agent Identity account loses required read permissions to inventory-related resources.

In most cases, permissions are missing at the "Resource and Data Class Settings" level, preventing proper inheritance to child data classes.

For example, CEM (Cloud-Enabled Management) uses an account called NS Agent Identity. The permissions for this account had been removed from the "Resource and Data Class Settings" folder in the console. The NS Agent Identity account should have "Read" permissions assigned at this level. They are then inherited down several data classes.

The issue occurs due to missing or broken permissions for the NS Agent Identity account.

Common scenarios:

1. Permissions removed at:
   • Resource and Data Class Settings (root level)
2. Broken inheritance:
   • Child objects do not inherit required permissions
3. Manual permission changes:
   • Individual resources modified incorrectly

Resolution

Step 1 – Fix Root Permissions (Primary Solution)

Navigate to:

• SMP Console > Settings > Security > Security Role Manager

Then:

1. Set role to your primary Security Role (we will use Symantec Administrators as example)
2. Set view to All Items
3. Go to:
   • Settings > Notification Server > Resource and Data Class Settings

4. Click Advanced
5. Verify NS Agent Identity:
   • Exists
   • Has:
     • ✅ Read
     • ✅ Read Resource Data
6. If missing:
   • Click + (Add trustee)
   • Select:
     • Accounts → NS Agent Identity
7. Apply permissions and save
   
   
   
   

Step 2 – Ensure Permission Inheritance

Important:

• Ensure permissions are inherited to child objects
• Even if permissions appear set, inheritance may be broken

 

Advanced Troubleshooting (If Issue Persists)

If errors continue:

Identify specific affected resource

Identify the folder name and the parent folder name of the resource that permissions needing to be restored to. This can be done with the following query by replacing the '<Folder_Guid_goes_here>' with the GUID from the error message:

--Looking for the parent folder of a dataclass

Declare @folderguid uniqueidentifier
set @folderguid = '<Folder_Guid_goes_here>'

select vi1.Name as [Folder Name],
itf.ItemGuid as [Folder Guid],
vi2.Name AS [Parent Folder Name],
itf.ParentFolderGuid AS [Parent Folder Guid]
from ItemFolder itf
join vItem vi1 on vi1.Guid = itf.ItemGuid
join vItem vi2 on vi2.Guid = itf.ParentFolderGuid
where itf.ItemGuid = @folderguid

 

Then:

• Locate item in console (enable hidden items 👓)
• Manually assign:
  • NS Agent Identity → Read permissions

Note: It may be necessary to repeat the query in step 1 by replacing the GUID you entered with the one it returns for the parent folder. This will climb backwards through the structure and give you a clue as to where the resource you are looking for may be. It may also be necessary to work with a higher tier resource and allow the permissions to inherit down.