search cancel

Package that contains nested folders, the package server does not have permissions to write to the nested folders.

book

Article ID: 163178

calendar_today

Updated On:

Products

IT Management Suite

Issue/Introduction

The customer is seeing that when he has a package that contains nested folders, the package server does not have permissions to write to the nested folders.

The following error is noticed: 

AeXPackageDelivery.dll Download Package failed: Access is denied (-2147024891)
AeXNSAgent.exe 

Error note: UncTransfer::CreateTargetFile error. Failed to create directory


The customer provided the following write up on the workaround is as follows:
1. Setup Site Server with Package Services
2. Create Deployment share on Site Server
  2.a) Create directory - "%INSTALLDRV%\Deployment” (Will go to the drive that
the Altiris Agent is installed on - either C:\ or D:\)
      i) Directory Security defaults (all local)
          i.a) Administrators - Full Control - This folder, subfolders and files
          i.b) SYSTEM - Full Control - This folder, subfolders and files
          i.c) CREATOR - Full Control - This folder, subfolders and files
          i.d) Users - Read and Execute - This folder, subfolders and files
     ii) Create share - "\\COMPUTERNAME\Deployment”
          ii.a) Security - Everyone (Full Control)
3. Import Package as Software Resource (ImageScripts)
  3.a) Details Tab
      i) Package Source: Access Package from a directory on the Notification Server
     ii) Package Location: D:\Deployment\ImageScripts
  3.b) Package Server Tab
      i) Check “Package Destination Location on Package Server
          i.a) Use “\\COMPUTERNAME\Deployment\ImageScripts”
  3.c) Assign Package to Site Server
4. Perform Configuration Update on Site Server
   4.a) New package is received, begins downloading, then goes Invalid
   4.b) ImageScripts folder and and any subfolders are created, but no script
files are downloaded to the directory
   4.c) Agent Logs show that Access Denied when trying to add files to the directory

Cause

Permissions on site servers that do not have this issue have the everyone permission present. If we add it to this server, once a package refresh
is done the everyone permissions go away. We were able to work around this using DACLmanagement = 0 (See HOWTO77389 "FAQ on Package Servers").

This issue has been reviewed against Post-ITMS 8.0 HF1 and it was not present.

Resolution

The following steps were done to address the issue:

**Temporary Workaround

1. Manually add the directory “%INSTALLDRV%\Deployment\ImageScripts" and assign permissions for NETWORK SERVICE and IIS_IUSRS, replicating permissions for
Folder, subfolders and files
2. File download and import just fine, but upon Package Refresh, the permissions are changed, future downloads result in “Invalid Package”
   2.a) Adding registry key “EnableDACLManagement” and setting to 0 resolves this
 

**Final Resolution

1. Add NETWORK SERVICE and IIS_IUSRS permissions to “%INSTALLDRV%\Deployment” and replicate permissions down to Folders, Subfolders and files
2. Add registry key “EnableDACLManagement” and setting to 0
3. Assign Package to Package Server in Altiris Console
4. Update Configuration on Site Server
5. Package shows up and upon download shows as “Ready"