Unable to delete registry keys for the Symantec Management Agent references

Products

• IT Management Suite

Issue/Introduction

After uninstalling the Symantec Management Agent (aka Altiris Agent), some registry keys are left behind that we can't delete. When we try to delete those registry keys manually, the following error messages are displayed in Regedit:

Error Deleting Key
Cannot delete Altiris. Error while deleting key.

Error Opening Key.
Altiris Agent cannot be opened.
An error is preventing this key from being opened.
Details: The system cannot find the file specified.

These were some registries that were left behind and we couldn't manually delete:

HKLM>Software>Altiris>Altiris Agent

HKLM>Software>Altiris>Communications

HKLM>Software>Altiris>eXpress

HKLM>Software>Altiris>eXpress>NS Client

When trying to install the Altiris Agent again on the machine, the following error entries are present in the Install Logs (under C:\ProgramData\Symantec\Symantec Agent\InstallLogs):

*ERRR CreateSymbolicLink6432: Failed to save x64 key content, error: The system cannot find the file specified (0x00000002)

*ERRR InstallPrecheck: Failed to create symbolic link between 64 and 32 bit registry views. Error: 2

*ERRR CoreUtil: GetInstallPath could not get installDir from the old key, the agent may not be installed

*ERRR Installer: Action RegisterComDll: error 0x80070002 returned from DllRegisterServer call for C:\Program Files\Altiris\Altiris Agent\AeXAgentPages.dll.

*ERRR Failed to run action: InstallCoreAgentDll

 

Environment

Symantec Management Agent 7.6, 8.0, 8.1, 8.5, 8.6

Cause

This is an issue with Windows Registry Editor. The problem is about the links: when your remove HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent in regedit, it actually removes not that key which is a link but a link target  - HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Altiris\Altiris Agent leaving the link itself intact and pointing nowhere. That’s why you see the key winWow6432 actually disappear but they key in HKLM to appear back when you refresh regedit.

 

Resolution

There is a small utility (provided as is) called "delSMARegLinks.exe". See attachment.

1. Run the executable by double-clicking on it or by running it via command prompt.

It removes the actual links in HKEY_LOCAL_MACHINE\SOFTWARE\Altiris.

After that, you can remove the keys in HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Altiris and HKEY_LOCAL_MACHINE\SOFTWARE\Altiris.

Note: If the issue still persists after trying the provided tool, the workaround is to rename the remaining Altiris Agent registry reference to something else, like "AltirisOld".

 

Note: SMA uninstall actually does exactly the same - it removes the links as one of the last steps. So you could probably just copy aexnsagent.exe to that machine and run aexnsagent.exe /uninstall.