Receiving messages about: Failed to handle web service request: RegisterClient. Access is denied
Article ID: 175335
Updated On:
Products
Issue/Introduction
The customer has recently added an ACC (Altiris Connectivity Credentials) account or changed the password for it. After that, the client machines and Task Servers can't register to a Task Server.
Examples like the following can be seen on the agent logs:
- Example 1:
- Client Task Server failed to complete registration. Will be retried in 120 seconds.
- Server Refresh Manager startup failed.
- Example 2:
- http://SMPServer.example.com/Altiris/TaskManagement/ClientTask/ExecTSMethod.aspx?clientTaskServerGuid=2c0e4f4f-2ddd-4fbf-9f8a-4fffc56b9f37
- The remote server returned an error: (401) Unauthorized.
- Example 3:
- Failed to handle web service request:
- RegisterClient Access is denied.
- Example 4:
- NotificationServerWebConnection.PostToNotificationServer().
- The remote server returned an error: (401) Unauthorized.
- Example 5: Task Execution Engine inner loop cycle failed.
- The remote server returned an error: (401) Unauthorized.
- OR sequences like:
- Loaded connection settings: resource guid=2c0e4f4f-2ddd-4fbf-9f8a-4fffc56b9f37, user name=svcsmpACC
- Checking "http://SMPserver.example.com/Altiris/TaskManagement/ClientTask/Authenticate.aspx" with credentials domain: "" username: "svcsmpACC"
- NotificationServerWebConnection.PostToNotificationServer()
- The remote server returned an error: (401) Unauthorized.
- Failed to perform re-register.
- Unauthorized
http://SMPserver.example.com/Altiris/TaskManagement/ClientTask/ExecTSMethod.aspx?clientTaskServerGuid=2c0e4f4f-2ddd-4fbf-9f8a-4fffc56b9f37
The remote server returned an error: (401) Unauthorized.
[System.Net.WebException @ System]
at System.Net.HttpWebRequest.GetResponse()
at Altiris.DotNetLib.Helpers.AtrsHttpOps.Execute[T](Func`2 action, String url, ICredentials credentials, Boolean isPost, Int32 timeout)
Failed to handle web service request: RegisterClient
Access is denied
[System.ComponentModel.Win32Exception @ mscorlib]
NotificationServerWebConnection.PostToNotificationServer()
The remote server returned an error: (401) Unauthorized.
[System.Net.WebException @ System]
at System.Net.HttpWebRequest.GetResponse()
at Altiris.DotNetLib.Helpers.AtrsHttpOps.Execute[T](Func`2 action, String url, ICredentials credentials, Boolean isPost, Int32 timeout)
at Altiris.ClientTask.Server.Communication.NotificationServerWebConnection.PostToNotificationServer(String url, ICredentials nsCredentials, NSWebConnectionBuildRequestStreamDelegate requestStreamDelegate, Int32 nMaxAttempts, Int32 nTimeout)
Task Execution Engine inner loop cycle failed.
The remote server returned an error: (401) Unauthorized.
[System.Net.WebException @ System]
at System.Net.HttpWebRequest.GetResponse()
at Altiris.DotNetLib.Helpers.AtrsHttpOps.Execute[T](Func`2 action, String url, ICredentials credentials, Boolean isPost, Int32 timeout)
at Altiris.ClientTask.Server.Communication.NotificationServerWebConnection.PostToNotificationServer(String url, ICredentials nsCredentials, NSWebConnectionBuildRequestStreamDelegate requestStreamDelegate, Int32 nMaxAttempts, Int32 nTimeout)
at Altiris.ClientTask.Server.Communication.NotificationServerWebConnection.PostToNotificationServer(String url, NSWebConnectionBuildRequestStreamDelegate requestStreamDelegate, Stream& respStream, StreamReader& streamRdr, XmlTextReader& xmlTxtRdr, Boolean& dataEncryped, Int32 nMaxAttempts, Int32 nTimeout)
at Altiris.ClientTask.Server.Communication.NotificationServerWebConnection.ExecuteMethodOnNs(String methodName, String xmlParameters)
at Altiris.ClientTask.Server.Communication.NotificationServerWebConnection.GetClientTaskRequests(Guid clientTaskServerGuid, String requestXml)
at Altiris.ClientTask.Server.Execution.ClientTaskExecutionEngine.GetDatabaseWorkToDo(String requestXml)
at Altiris.TaskManagement.Common.Execution.Engine.TaskExecutionEngine.ProcessWorkToDo()
at Altiris.TaskManagement.Common.Execution.Engine.TaskExecutionEngine.OnProcess()
at Altiris.TaskManagement.Common.Execution.Engine.TaskExecutionEngine.RunTaskExecutionEngineLoop()
Loaded connection settings: resource guid=2c0e4f4f-2ddd-4fbf-9f8a-4fffc56b9f37, user name=svcsmpACC
Checking "http://SMPserver.example.com/Altiris/TaskManagement/ClientTask/Authenticate.aspx" with credentials domain: "" username: "svcsmpACC"
NotificationServerWebConnection.PostToNotificationServer()
The remote server returned an error: (401) Unauthorized.
[System.Net.WebException @ System]
at System.Net.HttpWebRequest.GetResponse()
at Altiris.DotNetLib.Helpers.AtrsHttpOps.Execute[T](Func`2 action, String url, ICredentials credentials, Boolean isPost, Int32 timeout)
at Altiris.ClientTask.Server.Communication.NotificationServerWebConnection.PostToNotificationServer(String url, ICredentials nsCredentials, NSWebConnectionBuildRequestStreamDelegate requestStreamDelegate, Int32 nMaxAttempts, Int32 nTimeout)
Failed to perform re-register.
Unauthorized
[System.Web.HttpException @ Altiris.ClientTask.Server]
at Altiris.ClientTask.Server.Communication.NotificationServerWebConnection.ValidateCredentials(String clientTaskUrl, NetworkCredential credentials)
at Altiris.ClientTask.Server.ClientTaskServer.RegisterTaskServer(Version taskServerVersion)
at Altiris.ClientTask.Server.ClientTaskServer.ReRegister(Version taskServerVersion)
Environment
- ITMS
- 8.1
- 8.5
Cause
The ACC account has been locked.
Resolution
- Verify that your ACC account is not locked.
- Verify that you have the proper places configured for ACC usage.
Note:
The use of ACC (Altiris Connectivity Credentials) can avoid the need of Anonymous Authentication that previously was needed, as well to avoid entries like "The remote server returned an error: (401) Unauthorized":You have to add a "NOT" domain user as ACC account on the following places:
- Add a not domain user to "Global Agent Setting" under "Authentication tab>Agent Connectivity Credential" (under Settings>All Settings>Agents/Plug-ins>Symantec Management Agent>Settings).
Note: ACC account could be any account you want, however, please remember that domain accounts will not be automatically created nor unlocked on Site Servers even if check-boxes on "Site Server Settings -> Global Site Server Settings" page are checked (see step 3 below about those settings). Those check-boxes apply only to local accounts. If they want to use any domain account, then they would need to manage it themselves." - If you have different ACC accounts that need to be set for different set of machines, add the user and password to "The Agent Connectivity Credentials that are defined on the 'Global Agent Settings' page are selected" for your active communication profile for that specific set of machines (under Settings>Agents/Plug-ins>Symantec Management Agent Communication Profiles).
Otherwise, the default value "Use default credentials" refers to the account used under 'Global Agent Settings' > 'Authentication' tab > 'Agent Connectivity Credential' page. You don't have to specify the account if it is the same as your 'Global Agent Settings' - Set the flag "Create the Agent Connectivity Credential on Site Servers" and "re-enable the created local account if it has been locked out" in "Global Site Server Settings>Security Settings" (under Settings>Notification Server>Site Server Settings>Task Service). For more info in how this "Re-enable the created local account if it has been locked out", please see 150951 "How the "Re-enable the created local account if it has been locked out" setting works".
- Update the Agents configuration on all affected computers
- Add a not domain user to "Global Agent Setting" under "Authentication tab>Agent Connectivity Credential" (under Settings>All Settings>Agents/Plug-ins>Symantec Management Agent>Settings).
Feedback
