DS7.5 (Unsupported) How to enable Anonymous Access for capturing images to a Site Server

Products

• Deployment Solution

Issue/Introduction

 

Resolution

There are a number of scenarios where access for capturing an image on a site server may be restricted due to rights problems.  There are even some rights issues that may cause the DSPS site components to not install correctly (known issue on Windows 7 site servers for instance, in the GA release).

This article discusses how to "force" these issues to the sidelines and allow capturing images via anonymous access.  These will work on any supported DSPS site server.

NIOTE:  To make these changes constitutes a relatively significantly security risk because we're opening anonymous access to the altris folder and in IIS.  Therefore, it is not recommended or supported by Symantec.

 

The following steps assume you have a fully functioning Package Server already configured.

1. Add the Altiris App ID and IUSR account to the Altiris Agent folder in the file system (generally undre Progam Files) with full rights to the folder tree.  This is needed for creating the images, and for running the installer under Windows 7.
   1. In IIS, if there is not already an Altiris\PS\Deployment, then re-run the DSPS component installation to create this sub folder under PS.
2. Modify DCom settings:
   1. Under Control Panel | Administrative Tools, go into Component Services.
   2. Expand to Computers | My Computer | DCom Config
   3. Scroll down to UTIL Class and go to the Properties for this class.
   4. Modify the 3 items under Security to use "Custom" and add both IUSR and the App ID account to have full permissions on all 3.
3. In IIS, modify several security settings:
   1. (may not be required) Highlight the Altiris/PS/Deployment application and select Basic Settings at the right.  Under Connect As, add the App ID with password.
   2. Again highlight the Altiris/PS/Deployment application, and select Authentication.  Enable Anonymous access.

 

Verify Success:

If you run the following (on the site server in a browser window), you'll find out if security is now passing through correctly (you should NOT be prompted for credentials):

http://YourSiteServer.YourDomain.com:80/Altiris/PS/Deployment/DSPSPackageInfo.aspx?xml=<request><CreatePackageFolder><inputFolderGuid>{D91A85BB-BEC4-4C20-82D0-3D9116355555}</inputFolderGuid></CreatePackageFolder></request>

Browsing to the Package Delivery folder under the Altiris Agent will show a new folder with the name of the GUID in this request if this works (you can try over and over by changing the last digits of the GUID).  If security is not open yet, you'll get an "Invalid XML" response in the browser window and a slew of instructions on how to fix it.  That message is, again, false.  If it works, you'll get about 1-3 lines of valid XML and you'll see the new folder.

Finally, try to capture an image.  It should now work.  Again, this is NOT a supported scenario!