Symantec Management Agent not sending basic inventory nor requesting configuration

Products

• IT Management Suite

Issue/Introduction

Symantec Management Agent (Altiris agent or SMA) is not sending basic inventory and requesting updated configuration. 
If the customer clicks on "update configuration" and then "send basic inventory", it won't do anything. After restarting the Agent service it will send the basic inventory and update the configuration. 

While looking at the Agent logs, we can't see any error that indicates that it is having a hard time sending basic inventory nor that it is trying to send it ("Next basic inventory update will be sent to server" message) or messages about requesting configuration ("The policies have not been changed since the last request" or "Next policy request from server" message).

They disabled the AV on one of those systems but it didn't make a difference.

Environment

ITMS 8.6, 8.7

Cause

We collected a Full Support Package from one of the client machines. (See KB 267055 "Creating a Support Package for Symantec Management Agent troubleshooting")

After reviewing the information provided and discussing this with our Dev team:

1. Based on the agent logs and dump files, SMA is requesting the policy already, that’s why it does not do anything when you press the buttons. Everything is stuck in the kernel while waiting for a reply from NS, usually, that’s some sort of AV software interfering.
The winsocket call is hanging in the kernel. We still see that in the information collected in the last full support package.

2. Disabling AV (Antivirus) is not enough, you need to uninstall it, since even if AV is disabled, its drivers are still running.

 

Resolution

Uninstall your Antivirus. If Antivirus is CrowdStrike, then send the customer to CrowdStrike for further review of their processes.