Symantec Management Agent not sending basic inventory nor requesting configuration

Products

• IT Management Suite

Issue/Introduction

Symantec Management Agent (Altiris agent or SMA) is not sending basic inventory and requesting updated configuration. When clicking on "Update Configuration" and then "Send Basic Inventory", it won't do anything. After restarting the Agent service it will send the Basic Inventory and Update the Configuration. 

While looking at the Agent logs, we can't see any errors or warnings that indicate that it is having a hard time sending Basic Inventory nor that it is trying to send it ("Next basic inventory update will be sent to server" message) or messages about requesting configuration ("The policies have not been changed since the last request" or "Next policy request from server" message).

Disabling the Antivirsus (AV) on one of those systems didn't make a difference.

Environment

ITMS 8.6, 8.7

Cause

Support collected a Full Support Package from one of the client machines. See the following KB for information about creating a Support Package:

Creating a Support Package for Symantec Management Agent troubleshooting

After reviewing the information provided and discussing this with our Dev team we determined:

1. Based on the agent logs and dump files, the Sym Agent (SMA) is requesting the policy already, that’s why it does not do anything when you press the buttons. Everything is stuck in the kernel while waiting for a reply from the Notification Server (NS), and usually this indicates some sort of AV software interfering. The winsocket call is hanging in the kernel. We still see that in the information collected in the last full support package.

2. Disabling AV (Antivirus) is not enough, you need to uninstall it, since even if AV is disabled, its drivers are still running.

Resolution

Uninstalled the Antivirus software.

NOTE: If Antivirus being used is CrowdStrike, then send the Altiris Administrator to CrowdStrike for further review of their processes.