ERRR Installer: StopService action failed with reason: Access is denied (0x00000005) for service: aexnsclient

Products

• IT Management Suite

Issue/Introduction

After removing the Symantec Management Agent (SMA or Altiris Agent), you try to reinstall the agent and it fails.

The Agent Installation log (under C:\ProgramData\Symantec\Symantec Agent\Logs\InstallLogs) shows the following errors:

This is what the last agent installation log recorded:

2023-11-27 13:10:52 P:20472  T:14380   INFO InstallPrecheck: ==========================
2023-11-27 13:10:52 P:20472  T:14380   INFO InstallPrecheck: AeXInstallPreCheck started
2023-11-27 13:10:52 P:20472  T:14380   INFO InstallPrecheck: Symbolic link between 64 and 32 bit registry views either created or not required.
2023-11-27 13:10:52 P:20472  T:14380   INFO InstallPrecheck: Current dir: C:\Users\<username>\AppData\Local\Temp\AeX_{E8F4757C-1D78-49F9-A511-E0FD4873C79B}_4076.tmp
2023-11-27 13:10:52 P:20472  T:14380   INFO InstallPrecheck: Required: Windows XP SP3 (x86), Windows XP SP2 (x64), Windows Server 2003 SP2 or above.
Detected: Windows 11 Pro x64  (Version 10.0.22621)

2023-11-27 13:10:52 P:20472  T:14380   INFO InstallPrecheck: AeXInstallPreCheck Finished
2023-11-27 13:10:52 P:20472  T:14380   INFO InstallPrecheck: ===========================
2023-11-27 13:10:52 P:20472  T:14380   INFO InstallPrecheck: Passing control to AeXNSAgent
2023-11-27 13:10:52 P:20472  T:14380   INFO InstallPrecheck: Command line: AeXNSAgentInst.exe  /install
2023-11-27 13:10:52 P:5020   T:4664    INFO CallInterceptor: Failed to allocate storage, error: This security ID may not be assigned as the owner of this object (0x0000051B)
2023-11-27 13:10:52 P:5020   T:4664    INFO Installer: =========================================
2023-11-27 13:10:52 P:5020   T:4664    INFO Installer: Core Agent Installation started
2023-11-27 13:10:52 P:5020   T:4664    INFO CoreUtil: Symbolic link between 64 and 32 bit registry views either created or not required.
2023-11-27 13:10:52 P:5020   T:4664    INFO CoreUtil: Agent installation directory in registry not found, the agent may not be installed
2023-11-27 13:10:52 P:5020   T:4664    INFO CoreUtil: Checking minimum requirements
2023-11-27 13:10:52 P:5020   T:4664    INFO CoreUtil: Required: Windows XP SP3 (x86), Windows XP SP2 (x64), Windows Server 2003 SP2 or above.
Detected: Windows 11 Pro x64  (Version 10.0.22621)

2023-11-27 13:10:52 P:5020   T:4664    INFO Installer: + Running action: StopLegacyProcesses
2023-11-27 13:10:52 P:5020   T:4664    INFO Installer: StopProcess action started for process: aexagentuihost.exe
2023-11-27 13:10:52 P:5020   T:4664    INFO AeXUtility: StopProcess('aexagentuihost.exe'): Process is not running
2023-11-27 13:10:52 P:5020   T:4664    INFO Installer: StopProcess action succeeded
2023-11-27 13:10:52 P:5020   T:4664    INFO Installer: StopProcess action started for process: aexswdusruiwin.exe
2023-11-27 13:10:52 P:5020   T:4664    INFO AeXUtility: StopProcess('aexswdusruiwin.exe'): Process is not running
2023-11-27 13:10:52 P:5020   T:4664    INFO Installer: StopProcess action succeeded
2023-11-27 13:10:52 P:5020   T:4664    INFO Installer: StopProcess action started for process: aexagentlogon.exe
2023-11-27 13:10:52 P:5020   T:4664    INFO AeXUtility: StopProcess('aexagentlogon.exe'): Process is not running
2023-11-27 13:10:52 P:5020   T:4664    INFO Installer: StopProcess action succeeded
2023-11-27 13:10:52 P:5020   T:4664    INFO Installer: StopProcess action started for process: aexagentdesktop.exe
2023-11-27 13:10:52 P:5020   T:4664    INFO AeXUtility: StopProcess('aexagentdesktop.exe'): Process is not running
2023-11-27 13:10:52 P:5020   T:4664    INFO Installer: StopProcess action succeeded
2023-11-27 13:10:52 P:5020   T:4664    INFO Installer: StopProcess action started for process: aexagentactivate.exe
2023-11-27 13:10:52 P:5020   T:4664    INFO AeXUtility: StopProcess('aexagentactivate.exe'): Process is not running
2023-11-27 13:10:52 P:5020   T:4664    INFO Installer: StopProcess action succeeded
2023-11-27 13:10:52 P:5020   T:4664   *ERRR AeXUtility: StopService('aexnsclient'): Failed to open service, error 0x00000005 (Access is denied)
2023-11-27 13:10:52 P:5020   T:4664   *ERRR Installer: StopService action failed with reason: Access is denied (0x00000005) for service: aexnsclient
2023-11-27 13:10:58 P:5020   T:4664   *ERRR CoreUtil: Install failed. Error message: Failed to run action: StopLegacyProcesses
2023-11-27 13:10:58 P:5020   T:4664    INFO Installer: Core Agent Installation Ended
2023-11-27 13:10:58 P:5020   T:4664    INFO Installer: =======================================
2023-11-27 13:10:58 P:4076   T:18364   INFO Installer: Setup application '"C:\Users\<username>\AppData\Local\Temp\AeX_{E8F4757C-1D78-49F9-A511-E0FD4873C79B}_4076.tmp\AeXInstallPrecheck.exe" ' finished, exit code: The operation completed successfully (0x00000000)

Environment

ITMS 8.x

Cause

The Symantec Management Agent service was not removed properly during the uninstall process.

The error is generated when the installation process checks if it is currently installed the Symantec Management Agent service. Since it is not able to stop it or get a response from its current status, it fails.

Resolution

Try the following:

1. Check if you have by chance similar issue occurring:
   KB "Unable to delete registry keys for the Symantec Management Agent references"
2. If after cleaning up any remaining regkeys the Symantec Management Agent service is still present, try to delete the service manually. You can use for example the following steps:
   a. Open the Registry Editor and remember to export a backup.
   b. Type HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services into the address bar.
   c. Find the Service Name (in this case AeXNSClient),
   d. right-click, and click Delete.
   e. Reboot.
   
   Delete a Service in Windows | Tutorials (tenforums.com)