SIM configuration error: "Failed to change bin folder browsing for virtual path ..."

Products

• IT Management Suite

Issue/Introduction

You are trying to run a repair on your current ITMS implementation. While SIM (Symantec Installation Manager) is trying to configure the installed Solutions, it fails with error:

Configuration failed.
A critical error occurred:
Product failed to install. See log for details.

The configuration failed while attempting: Configure Notification Server... as shown here:

Looking at the NS logs, the following error is noticed:

Failed to configure: C:\Program Files\Altiris\Notification Server\Config\CoreSolution.config

Upgrade of database, post install, was not fully successfull.
   [Altiris.NS.Exceptions.AeXException @ Altiris.NS.StandardItems]
   at Altiris.NS.StandardItems.Product.CoreSolutionInstallation.OnInstallProduct(XmlNode installationNode)
   at Altiris.NS.StandardItems.Product.ProductInstallation.InstallProduct()
   at Altiris.NS.StandardItems.Product.CoreSolutionInstallation.InstallProduct()
   at Altiris.NS.Installation.ProductConfigurationWorker.ConfigureProductInternal(String configFile, Boolean ownsProgressContext, SerializationMode serializationMode)
   at Altiris.NS.Installation.ProductConfigurationWorker.ConfigureProductBatchInternal()

Failed to add an application: 'Failed to change bin folder browsing for virtual path:/Altiris/NS/NSCap/Bin, Exception:Filename: \\?\C:\Windows\system32\inetsrv\config\applicationHost.config
Line number: 790
Error: Can not log on locally to C:\Program Files\Altiris\Notification Server\AgentWeb\Root as user example\altirisadmin with virtual directory password

'
   [Altiris.NS.Exceptions.AeXException @ Altiris.NS]
   at Altiris.NS.Utilities.AgentSite.AgentSiteApplication.AddSiteObject()
   at Altiris.NS.Utilities.AgentSite.AgentSiteObject.Execute()
   at Altiris.NS.StandardItems.SiteManagement.AgentSiteCreateTask.CreateAgentSiteWebApplicationsFromXML(XmlNodeList productAgentWebNodes)
   at Altiris.NS.StandardItems.Product.CoreSolutionInstallation.OnInstallProductAgentSite(XmlNode installationNode)
   at Altiris.NS.StandardItems.Product.ProductInstallation.OnInstallProduct(XmlNode installationNode)
   at Altiris.NS.StandardItems.Product.CoreSolutionInstallation.OnInstallProduct(XmlNode installationNode)

Failed to change bin folder browsing for virtual path:/Altiris/NS/NSCap/Bin, Exception:Filename: \\?\C:\Windows\system32\inetsrv\config\applicationHost.config
Line number: 790
Error: Can not log on locally to C:\Program Files\Altiris\Notification Server\AgentWeb\Root as user example\altirisadmin with virtual directory password

   [Altiris.NS.Exceptions.AeXException @ Altiris.NS]
   at Altiris.NS.Utilities.AgentSite.AgentSiteApplication.SetDirectoryBrowsing(String siteName, String virtualPath, Boolean bAllowBrowsing)
   at Altiris.NS.Utilities.AgentSite.AgentSiteApplication.AddSiteObject()

Filename: \\?\C:\Windows\system32\inetsrv\config\applicationHost.config
Line number: 790
Error: Can not log on locally to C:\Program Files\Altiris\Notification Server\AgentWeb\Root as user example\altirisadmin with virtual directory password

   [System.Runtime.InteropServices.COMException @ ]
   at Microsoft.Web.Administration.Interop.IAppHostAdminManager.GetAdminSection(String bstrSectionName, String bstrPath)
   at Microsoft.Web.Administration.Configuration.GetSectionInternal(ConfigurationSection section, String sectionPath, String locationPath)
   at Altiris.NS.Utilities.AgentSite.AgentSiteApplication.UpdateDirectoryBrowsingForVirtualDir(String siteName, Boolean allowBrowseBinDirectory, String virtualPath)
   at Altiris.NS.Utilities.AgentSite.AgentSiteApplication.SetDirectoryBrowsing(String siteName, String virtualPath, Boolean bAllowBrowsing)

COM Exception errcode: 0x8007052E

Exception logged from: 
   at Altiris.NS.Installation.ProductConfigurationWorker.ConfigureProductBatchInternal()
   at Altiris.NS.Installation.ProductConfigurationWorker.ConfigureProductBatch()
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, Object)
   at System.Threading.ThreadHelper.ThreadStart()

-----------------------------------------------------------------------------------------------------
Date: 6/21/2022 10:09:04 AM, Tick Count: 1207114265 (13.23:18:34.2650000), Size: 4.20 KB
Process: AeXSvc (50332), Thread ID: 30, Module: Altiris.NS.dll
Priority: 1, Source: Altiris.NS.Installation.ProductConfigurationWorker.ConfigureProductBatchInternal

Environment

ITMS 8.x

Cause

Some changes were made in IIS as far authentication goes and these caused issues while processes were trying to configure what was needed.

In this particular instance, the following changes were made:

1. Under IIS Manager, go to Default Web Site>Altiris.
2. On the right pane, click on "Advanced Settings..."
3. Under "Physical Patch Credentials", the customer added his own service account as the desired account, instead of the default "Application user (pass-through authentication)"

This change caused the rights for the "Authenticated Users" role to change for the Altiris folder and subfolders. This caused the "Authenticated Users" to only have "Read" rights instead of having the other default rights of "Read & execute" and "List folder contents" as shown here:

Resolution

Make sure that the "Application user (pass-through authentication)" is the option selected for our "Altiris" virtual directory in IIS

Make sure the  "<install drive>:\Program Files\Altiris" directory has the expected default rights of:

• "Read & execute"
• "List folder contents"
• "Read"

Also, based on the NS log entries, the Authenticated Users should have access to the following subfolders:

• C:\Program Files\Altiris\Notification Server\AgentWeb\Root
• C:\Program Files\Altiris\Notification Server\NSCap/Bin