Reboot countdown cannot be cancelled after Symantec Management Agent initiates a power action
Article ID: 185939
Updated On:
Products
Issue/Introduction
When the Symantec Management Agent (SMA) initiates a reboot, either through a task using aexagentutil.exe /reboot or through a Patch Management or Power Management policy containing a forced power action, it writes the scheduled action to the client registry under:
HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent\Dynamic Data\PowerActions
The countdown runs locally on the client. Restarting the SMA service does not clear this state; the agent reads the cached action on service startup and resumes the countdown.
This article covers two related scenarios:
- Task-initiated reboot: A reboot was triggered via aexagentutil.exe /reboot. You want to cancel the countdown before shutdown.exe takes over.
- Policy-initiated reboot with deferral deadline: A Patch Management or Power Management policy delivered a forced power action. The policy has since been disabled on the Notification Server (NS or SMP Server), but the client already cached the action and will execute it when ScheduledPowerActionDeferralLimit is reached.
In both cases, stopping the SMA service and clearing the PowerActions registry key stops the reboot.
Environment
ITMS 8.x
Cause
The SMA stores active power action state locally in the client registry. This state is independent of the policy's current status on the Notification Server. If a policy is disabled after the client has already received and cached the power action, the client proceeds to reboot when ScheduledPowerActionDeferralLimit is reached. Restarting the SMA service does not clear the cached state — the agent reads it again on startup and resumes the countdown.
Symptoms
- The endpoint displays a reboot countdown that cannot be dismissed.
- The countdown restarts when the SMA service is restarted.
- The originating policy has been disabled on the Notification Server, but the endpoint still reboots at the scheduled time.
The following registry key is populated on the affected client:
HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent\Dynamic Data\PowerActionsWith values including:
| Value name | Type | Example data |
|---|---|---|
ScheduledPowerAction | REG_DWORD | 0x000bb001 (non-zero = active) |
ScheduledPowerActionDeferralLimit | REG_SZ | 2026-05-30 02:23:40 (hard deadline) |
ScheduledPowerActionDeferralUILimit | REG_DWORD | 0x00000b41 |
ScheduledPowerActionNotificationTimeout | REG_DWORD | 0x00003840 |
A non-zero value in ScheduledPowerAction confirms a power action is active. The timestamp in ScheduledPowerActionDeferralLimit is the hard deadline after which the user can no longer defer the reboot.
Resolution
Single machine
- Open the Services console (services.msc), locate Symantec Management Agent, and click Stop.
- Open Registry Editor (regedit.exe).
- Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent\Dynamic Data\PowerActions
- Delete the PowerActions key entirely, or delete the following individual values in the right pane:
- ScheduledPowerAction
- ScheduledPowerActionDeferralLimit
- ScheduledPowerActionDeferralUILimit
- ScheduledPowerActionNotificationTimeout
- Return to the Services console and click Start on the Symantec Management Agent service.
Multiple machines
If multiple endpoints pulled the policy before it was disabled, run the following command on each affected machine with administrative privileges, then restart the SMA service:
reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent\Dynamic Data\PowerActions" /f net stop AeXNSClient && net start AeXNSClient
Deploy this via an administrative script, GPO, or a clean SMP task targeting the affected machines.
Note: Do not use this task to deliver the fix if the SMP task delivery mechanism itself depends on the agent being in a functional, non-rebooting state on the target machines. In that scenario, use GPO or a separate remote execution method.
Verification
After completing the steps above:
- Confirm the reboot countdown prompt has disappeared from the endpoint.
- Open Registry Editor and verify the PowerActions key is absent or contains only the (Default) value with no data set.
- Confirm the Symantec Management Agent service is in a Running state.
Additional Information
Feedback
