After a failed upgrade, many pages give "Access Denied" or certain items or products do not show in the SMP Console

Products

• IT Management Suite
• Client Management Suite

Issue/Introduction

When trying to upgrade to a newer version of ITMS the SIM (Symantec Installation Manager) tool failed during the upgrade process. Ran the repair via SIM multiple times until the upgrade was successful.  After the upgrade was finished some unusual behaviors in the SMP Console were seen. When going to Settings>All Settings or Reports>All Reports for example, the error "Access Denied" was seen when logged into the SMP Console as the AppID account or any other account.

Not every place in the SMP Console gives "Access Denied". Some places still can display the usual pages and content. Some will load just fine and others may not return results.

For example, when going to Manage>computers the "No results found" is seen under Filters, Targets, Computer Views, and Groups.

If going to Settings>Security only the "Security Role Manager" option is seen. When opening Security Role Manager, under the "Role" dropdown list, it comes back blank. 

  

No errors are seen in the Notification Server (SMP) logs that would indicated that the logged in account doesn't have "Read" or access permissions to see those pages.

Environment

ITMS 8.1, 8.5

Cause

The problem was not permissions. It was because some objects were set to "ProductUninstalled" to 1 in the database. So, since there was nothing to return as far as data goes (because they were set to uninstalled), the SMP Console page/frame was considering that if there was no data then it is because maybe it does not have rights to read it.

When we fail in an upgrade, there are some internal procedures that go through these objects in the database and uninstall the pieces that failed on install/update. Since there were so many repairs and attempts to upgrade made it was very likely that we removed more than we should have due to this unique situation.

Resolution

Look at the database and see if there are items set to uninstalled:

--Query 1
select i.name, ns.* from NSInternal_ItemInstalled ns
join item i on i.guid = ns.guid
where ns.ProductUninstalled = '1'

--Query 2
select * from NSInternal_ItemInstalled
where ProductUninstalled != 0

Usually these queries should return nothing.

The way to fix this issue on the SMP Console is to run the following queries:

--Query 1:
update Item
set [ProductUninstalled] = 0

--Query 2:
--Run this query until you get 0 results on it
update top(1000) NSInternal_ItemInstalled
set ProductUninstalled = 0
where ProductUninstalled != 0

NOTE: These queries above should set those uninstalled (1) items back to installed (0). 

Next, close the SMP Console page if it is opened and restart all Altiris Services and IIS.  Then open the SMP Console again and test the pages that were failing.