Error, "The class is configured to run as a security ID different from the caller"

Products

• IT Management Suite

Issue/Introduction

Any attempt to start the Altiris Agent results in the following error message:

Could not start the Altiris Agent service on Local Computer.
Error 0x80004015: The class is configured to run as a security id different from the caller.

Cause

The issue seems to be related to computers that were under a certain GPO that restricted the SYSTEM account to start the Altiris Agent Service. Even after the GPO was disabled, the permissions were not set back to the default values for the SYSTEM account.

Resolution

To view what the current security restrictions are on the service from a command window type the following:

SC sdshow AeXNSClient.

This particular user's results were:

D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWLOCRRC;;;IU)

The normal results should be:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)

To reset the permission and enable the starting of the agent without having to reboot use the following command:

SC sdset aexnsclient D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)

Applies To
Windows XP Professional SP2
Altiris Agent 6.0.2386