Package that contains nested folders, the package server does not have permissions to write to the nested folders.

Products

• IT Management Suite

Issue/Introduction

You are seeing that when you have a package that contains nested folders, the package server does not have permissions to write to the nested folders.

The following error is noticed: 

AeXPackageDelivery.dll Download Package failed: Access is denied (-2147024891)
AeXNSAgent.exe 

Error note: UncTransfer::CreateTargetFile error. Failed to create directory

Environment

ITMS 8.x

Cause

Permissions on site servers that do not have this issue have the everyone permission present. If we add it to this server, once a package refresh
is done the everyone permissions go away. We were able to work around this using DACLmanagement = 0 (See 150861 "FAQ on Package Servers").

The customer provided the following write up on the workaround is as follows:

1. Setup Site Server with Package Services
2. Create Deployment share on Site Server
  2.a) Create directory - "%INSTALLDRV%\Deployment” (Will go to the drive that
the Altiris Agent is installed on - either C:\ or D:\)
      i) Directory Security defaults (all local)
          i.a) Administrators - Full Control - This folder, subfolders and files
          i.b) SYSTEM - Full Control - This folder, subfolders and files
          i.c) CREATOR - Full Control - This folder, subfolders and files
          i.d) Users - Read and Execute - This folder, subfolders and files
     ii) Create share - "\\COMPUTERNAME\Deployment”
          ii.a) Security - Everyone (Full Control)
3. Import Package as Software Resource (ImageScripts)
  3.a) Details Tab
      i) Package Source: Access Package from a directory on the Notification Server
     ii) Package Location: D:\Deployment\ImageScripts
  3.b) Package Server Tab
      i) Check “Package Destination Location on Package Server
          i.a) Use “\\COMPUTERNAME\Deployment\ImageScripts”
  3.c) Assign Package to Site Server
4. Perform Configuration Update on Site Server
   4.a) New package is received, begins downloading, then goes Invalid
   4.b) ImageScripts folder and and any subfolders are created, but no script
files are downloaded to the directory
   4.c) Agent Logs show that Access Denied when trying to add files to the directory

Resolution

The following steps were done to address the issue:

**Temporary Workaround

1. Manually add the directory “%INSTALLDRV%\Deployment\ImageScripts" and assign permissions for NETWORK SERVICE and IIS_IUSRS, replicating permissions for
Folder, subfolders and files
2. File download and import just fine, but upon Package Refresh, the permissions are changed, future downloads result in “Invalid Package”
   2.a) Adding registry key “EnableDACLManagement” and setting to 0 resolves this
 

**Final Resolution

1. Add NETWORK SERVICE and IIS_IUSRS permissions to “%INSTALLDRV%\Deployment” and replicate permissions down to Folders, Subfolders and files
2. Add registry key “EnableDACLManagement” and setting to 0
3. Assign Package to Package Server in Altiris Console
4. Update Configuration on Site Server
5. Package shows up and upon download shows as “Ready"