Unable to delete registry keys for the Symantec Management Agent references

book

Article ID: 169499

calendar_today

Updated On:

Products

Management Platform (Formerly known as Notification Server)

Issue/Introduction

After uninstalling the Symantec Management Agent (aka Altiris Agent), some registry keys are left behind that we can't delete. When we try to delete those registry keys manually, the following error messages are displayed in Regedit:

Error Deleting Key
Cannot delete Altiris. Error while deleting key.


Error Opening Key.
Altiris Agent cannot be opened.
An error is preventing this key from being opened.
Details: The system cannot find the file specified.

These were some registries that were left behind and we couldn't manually delete:

HKLM>Software>Altiris>Altiris Agent

HKLM>Software>Altiris>Communications

HKLM>Software>Altiris>eXpress

HKLM>Software>Altiris>eXpress>NS Client


When trying to install the Altiris Agent again on the machine, the following error entries are present in the Install Logs (under C:\ProgramData\Symantec\Symantec Agent\InstallLogs):

*ERRR CreateSymbolicLink6432: Failed to save x64 key content, error: The system cannot find the file specified (0x00000002)

*ERRR InstallPrecheck: Failed to create symbolic link between 64 and 32 bit registry views. Error: 2

*ERRR CoreUtil: GetInstallPath could not get installDir from the old key, the agent may not be installed

*ERRR Installer: Action RegisterComDll: error 0x80070002 returned from DllRegisterServer call for C:\Program Files\Altiris\Altiris Agent\AeXAgentPages.dll.

*ERRR Failed to run action: InstallCoreAgentDll

 

Cause

This is an issue with Windows Registry Editor. The problem is about the links: when your remove HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent in regedit, it actually removes not that key which is a link but a link target  - HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Altiris\Altiris Agent leaving the link itself intact and pointing nowhere. That’s why you see the key winWow6432 actually disappear but they key in HKLM to appear back when you refresh regedit.

 

Environment

Symantec Management Agent 7.6, 8.0, 8.1

Resolution

There is a small utility (provided as is) called "delSMARegLinks.exe". See attachment.

Run the executable by double-clicking on it or by running it via command prompt.

It removes the actual links in HKEY_LOCAL_MACHINE\SOFTWARE\Altiris.

After that you can remove the keys in HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node.

 

Note: SMA uninstall actually does exactly the same - it removes the links as one of the last steps. So you could probably just copy aexnsagent.exe to that machine and run aexnsagent.exe /uninstall.

If the issue still persists after trying the provided tool, the workaround is to rename the Altiris Agent registry reference to something else.

Attachments

DelSMARegLinks.exe get_app