Current user does not have required permission to load item: 'Access Tokens Configuration'

Products

• IT Management Suite

Issue/Introduction

You are trying to "push" the Symantec Management Agent (aka. Altiris Agent or SMA) to some client machines after you upgraded to ITMS 8.7.3.

You are using the "Install" button on the "Agent Install" page under Settings>All Settings>Agents/Plug-ins>Symantec Management Agent>Settings as seen here:

The Install page does open, and when pressing the "install" button, the following error message appears:

"Failed to initiate Symantec Management Agent installation".

It seems that all "normal" users are getting this error, members of the "Symantec Administrators" role can still do the push installation.

The SMP log is showing this message:

HTTP [POST]: https://SMPserver.Example.com/Altiris/NS/Admin/ClientManagement/AgentSettings/dlgAgentInstallSettings.aspx?PushInstall=1

<event date="04/16/2025 07:34:22.1223067 -04:00" severity="1" hostName="VMExample01" source="Item.RaiseItemLoadFlagsSecurityException" module="Altiris.NS.dll" process="w3wp" pid="35048" thread="2153" tickCount="369203781"><![CDATA[Failed initiate push installation

Current user does not have required permission to load item: 'Access Tokens Configuration' (44b20a50-825c-4b62-958d-91607cc47d5a)

   [AeXUnauthorizedAccessException @ Altiris.NS.dll]

HTTP [POST]: https://SMPserver.Example.com/Altiris/NS/Admin/ClientManagement/AgentSettings/dlgAgentInstallSettings.aspx?PushInstall=1

</event>

Affected users are members of different Security roles (but similar permissions).

Environment

ITMS 8.7.3

Cause

Known issue

Resolution

A fix has been added to our ITMS 8.8 Release.

Workaround:

With the ITMS 8.7.3 Release (see Release Notes), Token-Based Authentication was introduced. With that, a new page called "Access Tokens Configuration" under the SMP Console  under Settings>All Settings>Notification Server:

The error message Current user does not have required permission to load item: 'Access Tokens Configuration' (44b20a50-825c-4b62-958d-91607cc47d5a) refers to not having access or permissions to that page.

In order to have access to it, you need to grant at least "Read" permissions to that page for any of the Security Roles that displays the mentioned error message:

1. Open Security Role Manager (SMP Console>Settings>Security)
2. Select the desired Security Role under the "Role" drop-down list. In this example, we will use a group called "Symantec Level 2 Workers".
3. click "Show Security Role Manager Console" button
   
   
   
   
4. Under the "View" drop-down, select "Settings".
5. Click Add "+" button:
   
   
6. In the tree displayed, choose Settings>Notification Server folder and select "Access Tokens Configuration" item and click "OK"
   
    
   
   
7. Give at least "Read" permissions under the "Item Permissions" section. Save the changes.
   
   
   
   Note: If you don't see the "Access Tokens Configuration" page, it is most likely you don't have direct access to it. Just click on "Hidden" and "Show items within the selected folder in the middle pane" buttons so it can be displayed.
   
   

Now, you should be able to "push" the agent using the "Install" button.