When running AeXNSAgentHostSurrogate32.exe, customer is getting Faulting module name: OLEAUT32.dll
Article ID: 163267
Updated On:
Products
Issue/Introduction
Customer noticed that the Symantec Management Agent (aka Altiris Agent) service doesn't stay running. After 1 or 2 minutes just stops. On some other instances, the agent service may crash. If they reinstall the agent, it is just fine.
We tried running repairs on the agent by using AeXNSAgent.exe /regserver, AeXAgentUtil.exe /registerclient and AeXNSC.exe /reinstall but any of those helped.
According to the customer is that the way that they have fixed this on some of their machines was with a complete uninstall of the plugins and Altiris Agent.
This is happening with the Altiris Agent 7.5.3300.0 (7.5 SP1 HF5 version).
Looking at the System event log, we found the following:
Log Name: Application
Source: Application Error
Date: 5/12/2016 11:47:27 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: MyServer1.MyDomain.local
Description:
Faulting application name: AeXNSAgentHostSurrogate32.exe, version: 7.5.3300.0, time stamp: 0x5481b7f7
Faulting module name: OLEAUT32.dll, version: 6.1.7601.18640, time stamp: 0x5441c30c
Exception code: 0xc0000005
Fault offset: 0x0000b13a
Faulting process id: 0x1028
Faulting application start time: 0x01d1ac658e057640
Faulting application path: C:\Program Files\Altiris\Altiris Agent\x86\AeXNSAgentHostSurrogate32.exe
Faulting module path: C:\Windows\syswow64\OLEAUT32.dll
Report Id: d34d26c0-1858-11e6-a82a-d067e533fa54
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">;
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2016-05-12T15:47:27.000000000Z" />
<EventRecordID>3833</EventRecordID>
<Channel>Application</Channel>
<Computer>FR7LLN7.Foresters.local</Computer>
<Security />
</System>
<EventData>
<Data>AeXNSAgentHostSurrogate32.exe</Data>
<Data>7.5.3300.0</Data>
<Data>5481b7f7</Data>
<Data>OLEAUT32.dll</Data>
<Data>6.1.7601.18640</Data>
<Data>5441c30c</Data>
<Data>c0000005</Data>
<Data>0000b13a</Data>
<Data>1028</Data>
<Data>01d1ac658e057640</Data>
<Data>C:\Program Files\Altiris\Altiris Agent\x86\AeXNSAgentHostSurrogate32.exe</Data>
<Data>C:\Windows\syswow64\OLEAUT32.dll</Data>
<Data>d34d26c0-1858-11e6-a82a-d067e533fa54</Data>
</EventData>
</Event>
Note: You also see 'ole32.dll' as another module that could fail too.
Cause
Known issue. Fixed on later relases post 7.5 SP1 HF5. It was caused by the Patch Management plugin.
To validate if you are experiencing the same issue, try:
- Use Process Explorer and see which Altiris DLLs AeXNSAgentHostSurrogate32.exe is hosting:
- Select View | Lower Pane View | DLLs,
- then select | AeXNSAgentHostSurrogate32.exe process and you will see the list of DLLs it hosts,
- sort by company name and exclude any non Symantec DLLs and those that contain "Symantec management Agent" in the description,
- the reaming list will contain most likely what is causing the issue. In this instance, this is what was noticed:
Process: AeXAgentUIHostSurrogate32.exe Pid: 4432 Name Description Company Name Path AeXAgentUI.dll Symantec Management Agent Symantec Corporation C:\Program Files\Altiris\Altiris Agent\x86\AeXAgentUI.dll AeXAgentUIHostSurrogate32.exe Symantec Management Agent Symantec Corporation C:\Program Files\Altiris\Altiris Agent\x86 \AeXAgentUIHostSurrogate32.exe PatchMgmtAgentsUI.dll Altiris Patch Management Agents UI Symantec Inc. C:\Program Files (x86)\Altiris\Altiris Agent\Agents\PatchMgmtAgent\PatchMgmtAgentsUI.dll
Resolution
This issue has been fixed on post 7.5 SP1 HF5 releases.
The workaround is as follow:
1. For those machines that the SMAgent service keeps stopping, just remove the Patch management agent plugin:
msiexec /x {26C5D274-98EE-4CB4-A3FE-499C406F0E74}
Note: if for some reason the msi is not present under C:\Program Files\Altiris\Altiris Agent\Agents\SoftwareManagement\Software Delivery, just copy it from a working machine.
2. After that try to start the SMAgent service. If it works then you will need to reinstall Patch Management plugin on those machines.
Feedback
