Configuring is failing. Failed to change bin folder browsing for virtual path.

Products

• IT Management Suite

Issue/Introduction

The customer is trying to run a repair on his current ITMS implementation. While SIM (Symantec Installation Manager) is trying to configure the installed Solutions, it fails with error:

Configuration failed.
A critical error occurred:
Product failed to install. See log for details.

Configuration failed while attempting: Configure Notification Server...

Looking at the NS logs, the following error is noticed:

Failed to configure: C:\Program Files\Altiris\Notification Server\Config\CoreSolution.config

Upgrade of database, post install, was not fully successfull.
   [Altiris.NS.Exceptions.AeXException @ Altiris.NS.StandardItems]
   at Altiris.NS.StandardItems.Product.CoreSolutionInstallation.OnInstallProduct(XmlNode installationNode)
   at Altiris.NS.StandardItems.Product.ProductInstallation.InstallProduct()
   at Altiris.NS.StandardItems.Product.CoreSolutionInstallation.InstallProduct()
   at Altiris.NS.Installation.ProductConfigurationWorker.ConfigureProductInternal(String configFile, Boolean ownsProgressContext, SerializationMode serializationMode)
   at Altiris.NS.Installation.ProductConfigurationWorker.ConfigureProductBatchInternal()

Failed to add an application: 'Failed to change bin folder browsing for virtual path:/Altiris/NS/NSCap/Bin, Exception:Filename: \\?\C:\Windows\system32\inetsrv\config\applicationHost.config
Line number: 790
Error: Can not log on locally to C:\Program Files\Altiris\Notification Server\AgentWeb\Root as user yourdomain\altirisadmin with virtual directory password

'
   [Altiris.NS.Exceptions.AeXException @ Altiris.NS]
   at Altiris.NS.Utilities.AgentSite.AgentSiteApplication.AddSiteObject()
   at Altiris.NS.Utilities.AgentSite.AgentSiteObject.Execute()
   at Altiris.NS.StandardItems.SiteManagement.AgentSiteCreateTask.CreateAgentSiteWebApplicationsFromXML(XmlNodeList productAgentWebNodes)
   at Altiris.NS.StandardItems.Product.CoreSolutionInstallation.OnInstallProductAgentSite(XmlNode installationNode)
   at Altiris.NS.StandardItems.Product.ProductInstallation.OnInstallProduct(XmlNode installationNode)
   at Altiris.NS.StandardItems.Product.CoreSolutionInstallation.OnInstallProduct(XmlNode installationNode)

Failed to change bin folder browsing for virtual path:/Altiris/NS/NSCap/Bin, Exception:Filename: \\?\C:\Windows\system32\inetsrv\config\applicationHost.config
Line number: 790
Error: Can not log on locally to C:\Program Files\Altiris\Notification Server\AgentWeb\Root as user yourdomain\altirisadmin with virtual directory password

   [Altiris.NS.Exceptions.AeXException @ Altiris.NS]
   at Altiris.NS.Utilities.AgentSite.AgentSiteApplication.SetDirectoryBrowsing(String siteName, String virtualPath, Boolean bAllowBrowsing)
   at Altiris.NS.Utilities.AgentSite.AgentSiteApplication.AddSiteObject()

Filename: \\?\C:\Windows\system32\inetsrv\config\applicationHost.config
Line number: 790
Error: Can not log on locally to C:\Program Files\Altiris\Notification Server\AgentWeb\Root as user yourdomain\altirisadmin with virtual directory password

   [System.Runtime.InteropServices.COMException @ ]
   at Microsoft.Web.Administration.Interop.IAppHostAdminManager.GetAdminSection(String bstrSectionName, String bstrPath)
   at Microsoft.Web.Administration.Configuration.GetSectionInternal(ConfigurationSection section, String sectionPath, String locationPath)
   at Altiris.NS.Utilities.AgentSite.AgentSiteApplication.UpdateDirectoryBrowsingForVirtualDir(String siteName, Boolean allowBrowseBinDirectory, String virtualPath)
   at Altiris.NS.Utilities.AgentSite.AgentSiteApplication.SetDirectoryBrowsing(String siteName, String virtualPath, Boolean bAllowBrowsing)

COM Exception errcode: 0x8007052E

Exception logged from: 
   at Altiris.NS.Installation.ProductConfigurationWorker.ConfigureProductBatchInternal()
   at Altiris.NS.Installation.ProductConfigurationWorker.ConfigureProductBatch()
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, Object)
   at System.Threading.ThreadHelper.ThreadStart()

 

-----------------------------------------------------------------------------------------------------
Date: 6/21/2022 10:09:04 AM, Tick Count: 1207114265 (13.23:18:34.2650000), Size: 4.20 KB
Process: AeXSvc (50332), Thread ID: 30, Module: Altiris.NS.dll
Priority: 1, Source: Altiris.NS.Installation.ProductConfigurationWorker.ConfigureProductBatchInternal

 

Environment

ITMS 8.6 RU1

Cause

The customer made some changes in IIS as far authentication goes that caused issues while our processes were trying to configure what we needed.

In this particular instance, the customer changed the following:

1. Under IIS Manager, go to Default Web Site>Altiris.

2. On the right pane, click on "Advanced Settings..."

3. Under "Physical Patch Credentials", the customer added his own service account as the desired account, instead of the default "Application user (pass-through authentication)"

This change caused the rights for the "Authenticated Users" role changed for the Altiris folder and subfolders. This change caused that "Authenticated Users" only had "Read" rights instead of having the other default ones "Read & execute" and "List folder contents"

Resolution

1. Make sure "Application user (pass-through authentication)" is the option selected for our "Altiris" virtual directory in IIS

2. Make sure "<install drive>:\Program Files\Altiris" directory has the expected default rights of:
"Read & execute"
"List folder contents"
"Read"

As well, based on the NS logs, Authenticated Users should have access to these subfolders:
C:\Program Files\Altiris\Notification Server\AgentWeb\Root
C:\Program Files\Altiris\Notification Server\NSCap/Bin