CUMULATIVE POST ITMS 8.8.1 POINT FIXES

Resolved an issue where the Entra ID Security Groups - Users to machines filter failed to include machines with their designated primary users in environments operating in hybrid deployment mode (Active Directory synchronized with Entra ID).

The resolution modifies how the Directory Services connector resolves primary user mapping. The following components are included in this PointFix:

Updated binary to support correct identity evaluation.
Contains new SQL views to correctly pull cross-referenced user keys.
Contains new stored procedures that utilize the updated SQL views.

Post-Fix Expected Behavior

AD User Import Alignment: When the "Match computers with primary users" option is enabled in the AD Import "Users" rule, target filters will now accurately populate with the correct computers. This applies whether the primary user data is reported via the Symantec Management Agent (SMA) basic inventory or assigned manually.
Azure Tenant Synchronization: If the local Active Directory is synchronized with an Azure Tenant, executing the Azure Users import rule will display user names under the AzureAD\ domain format, while preserving the correct computer associations within those specified AD filters.

An issue was identified where the Symantec Management Agent (SMA) becomes unresponsive, stalling policy and task executions. While the agent status remains "Green" (Healthy) and continues to ping the Task Server (TS), it fails to make processing requests to the Symantec Management Platform (SMP).

The hotfix corrects the critical section synchronization logic to prevent cross-thread deadlocks.

Additionally, this fix resolves another crash scenario:

Scenario: An MDP policy is in its execution phase while simultaneously being disabled on the NS and removed from the agent during a policy refresh.
Previous Behavior: The policy destructor would execute for several seconds while a UI notification was actively being generated for the partially destroyed object, resulting in an unhandled exception.
Resolution: Enhanced critical section protections ensure the agent cannot access or send UI notifications for a policy currently undergoing destruction.

Temporary Workaround

If immediate deployment of the hotfix is not possible, the following workarounds can mitigate the issue:

Service Restart: Manually restarting the SMA service will temporarily restore agent communication and clear memory.
Policy Adjustment: Identify and temporarily disable the specific script task or Managed Delivery Policy, or consolidate the nested policy logic into a single policy definition.

Cumulative Point fix version in which each issue was initially addressed	Issue	KB Reference/Description
Included in pointfix v1 release	Identification is not displayed in Symantec Management Agent setting	427225
Included in pointfix v1 release	Modern Report Viewer fixes	Fixed issues and enhancements related to how Modern Report Viewer displays or interact with data: Right click menu action doesn't work if there is more than 13 items selected Implement search across all columns Ability to Group by Date A few Patch actions aren't available in right click menu Improved the performance
Included in pointfix v1 release	ASDK Rest Item Management method Very generic API to change one property of one NS item failed if property value is Boolean
Included in pointfix v1 release	Fatal error occurred in module 'AeXNetComms.dll' in 'AeXNSAgent.exe'.	433172
Included in pointfix v1 release	ASDK - GetTaskResourceStatus - Could not find any status data for the task
Included in pointfix v2 release	Unable to add Machines via .txt or .CSV to filters after upgrading	434390
Included in pointfix v2 release	Modern Report Viewer fixes	Fixed issues related to how Modern Report Viewer displays or interact with data: Today condition behaves incorrectly Implement grid personalization Value can't be used in Asset Advanced view dialog If a few columns are without data then ERR shown in pivot mode Not declared 0/1 boolean as No/Yes, or False/True values can't be filtered in report"
Included in pointfix v3 release	SMA does not properly identify logged on user in a hybrid EntraID joined device with PF	Improvements were added: Implemented processing of custom resource names/keys policy for computer/user accounts that belong to AD. SMA on a machine joined to AD/hybrid AD reports the new resource key "directoryid" for both computer and primary user resources. If AZ import also reports "directoryid" resource key, then that key will be used to match and merge user resources, so the association between the computer and primary user will be automatically updated as soon as basic inventory is processed. How to use Custom resource key and custom resource name rules for "Custom Keys and Names Policy" and AD or AZ import rules, see KB 385966
Included in pointfix v3 release	A critical error has occurred on this page. Check the Altiris Logs for more information	438583
Included in pointfix v3 release	NSEs stuck in queue and process only after Altiris Client Message Dispatcher service restart	Improvements were done on how we process NSEs. Among some SQL stored procedures improvements and config files updates: 1. Added new core setting "EvtQueueStaleProcessingMinutes" 2. New data class added ('NSE Metadata Statistics' FA99C9E9-7717-4C43-A630-284484DAB4A5)
Included in pointfix v3 release	Core Performance shows Active Threads at 0 or 1 with lots of NSE's to process	422766
Included in pointfix v3 release	Erratic behavior of CMDB Rules	439208
Included in pointfix v4 release	Double tool tip appears on Patch CVE item mouse cursor navigation	Fixed an issue where: If user navigates mouse cursor on any CVE item in the "Compliance by CVE ID" report, then double tool tip appears.
Included in pointfix v4 release	Typographic and usability problems with Modern Grid	Includes minor visual enhancements to the Modern Grid View to improve alignment with the overall ITMS design and styling
Included in pointfix v4 release	After Upgrading Tasks Shows Queued and take considerable amount of time to run	Improvements have been made to Task Server connectivity and status reporting to better detect and recover from stale or partially established connections between Task Servers and the SMP Server. These changes address scenarios where a Task Server successfully establishes a tickle (WebSocket) connection to the NS, but fails to complete the registration process because the initial registration request is lost or not processed correctly. The following core settings have been added: `TsTicklePendingTimeoutMinutes` Default: `10` Specifies the maximum time, in minutes, that a tickle connection can remain established without completing registration. If the timeout is reached, the connection is automatically closed, forcing the Task Server to reconnect and perform the registration process again. For environments requiring faster detection of stale connections, values such as 5 or 2 minutes may be considered. `TsTickleEstablishedTimeoutMinutes` Default: `30` Specifies the maximum time, in minutes, that a fully registered Task Server connection can remain inactive without sending connection health checks. If the timeout is reached, the connection is closed and the Task Server will re-establish the tickle connection if it is still operational. A value of 5 minutes is recommended as a starting point for environments that require more aggressive detection of inactive connections. These enhancements improve Task Server resiliency and help ensure that connection status accurately reflects the actual communication state between Task Servers and the SMP Server.
Included in pointfix v4 release	Support migrating on-prem VMs to VergeIO	Added enhancements to address an issue where virtual machines migrated from VMware to VergeIO could be incorrectly identified as physical computers. In environments where the system had previously been registered as a virtual machine, this detection change could prevent the client from successfully re-registering with the Symantec Management Platform (SMP). These changes improve platform transition handling and ensure consistent client registration behavior following virtualization platform migrations.
Included in pointfix v4 release	Failed to convert the value 'DD/MM/YYYY' to the required DateTime data type	440590
Included in pointfix v4 release	Fatal error occurred in module 'SMFAgent.dll'	Addressed an issue that could cause the Software Management Framework (SMF) component of the 8.8.1 Symantec Management Agent (SMA) to terminate unexpectedly during interactive software installation scenarios. The issue could occur following a user session change, such as when one user logs off and another user logs on before the installation prompt is displayed. This enhancement improves SMF stability during user context transitions.
Included in pointfix v4 release	Modern Report View: Right click action in each row makes/remains this row as selected	Addressed an issue in the ITMS 8.8.1 Modern Report Grid where right-clicking multiple rows without selecting an action could cause previously right-clicked rows to remain selected. As a result, actions performed on the final row (such as exporting data) could inadvertently include all previously selected rows. The updated behavior ensures that row selection is handled consistently and prevents unintended inclusion of previously right-clicked rows when executing report actions. Example scenario affected: Right-click Row 1 (no action selected) Right-click Row 2 (no action selected) Right-click Row 3 and select Export to CSV Previously, the exported file could contain Rows 1, 2, and 3. With this improvement, only the intended row is included, aligning the behavior more closely with the legacy reporting interface.
Included in pointfix v4 release	NSEs stuck in queue and process only after dispatcher service restart	Further improvements have been added in NSE queue processing.
Included in pointfix v4 release	Replicated policy showing as disabled on Child due to the unexpected target	Addressed an issue where replicated Software Delivery (SWD) policies could incorrectly appear as Disabled on a Child SMP and fail to operate as expected under certain conditions. The issue could occur when replicated policies allowed editing of Resource Targets and additional Child SMP-specific targets were added locally. In some cases, policy membership updates could lead to inconsistent policy states, causing otherwise valid policies to be displayed as disabled. To improve reliability, the policy save and membership update process has been reworked: Client policy membership updates are now processed through a dedicated external update engine. Policy update requests are queued and processed sequentially. Sequential processing reduces lock contention during replication activities. Failures in individual membership update operations no longer impact the overall policy save process. By default, the update queue is hosted within the main service. These changes improve policy consistency across Parent and Child SMP environments and enhance resilience during policy replication and target membership updates.
Included in pointfix v5 release	Entra ID - Security Groups - Users to machines filter does not match primary user to a machine	Resolved an issue where the Entra ID Security Groups - Users to machines filter failed to include machines with their designated primary users in environments operating in hybrid deployment mode (Active Directory synchronized with Entra ID). The resolution modifies how the Directory Services connector resolves primary user mapping. The following components are included in this PointFix: Updated binary to support correct identity evaluation. Contains new SQL views to correctly pull cross-referenced user keys. Contains new stored procedures that utilize the updated SQL views. Post-Fix Expected Behavior AD User Import Alignment: When the "Match computers with primary users" option is enabled in the AD Import "Users" rule, target filters will now accurately populate with the correct computers. This applies whether the primary user data is reported via the Symantec Management Agent (SMA) basic inventory or assigned manually. Azure Tenant Synchronization: If the local Active Directory is synchronized with an Azure Tenant, executing the Azure Users import rule will display user names under the `AzureAD\` domain format, while preserving the correct computer associations within those specified AD filters.
Included in pointfix v5 release	Sorting by Computer name no longer works	An issue was identified where sorting by Computer name within the SMP Console (Manage > Computers) did not function as expected. Specifically, the grid applied a strict case-sensitive sorting logic instead of the expected case-insensitive alphanumeric order. This behavior resulted in capital-letter hostnames (e.g., `DK2-2012`) being grouped entirely separately from lowercase hostnames (e.g., `dk2-2008-32`). Reproduction Steps Launch the SMP Console and navigate to Manage > Computers. Attempt to sort the grid list by the Computer name column. Result: The grid sorts using case-sensitive constraints rather than standard case-insensitive ordering.
Included in pointfix v5 release	SMA - Agent stuck not updating configuration	An issue was identified where the Symantec Management Agent (SMA) becomes unresponsive, stalling policy and task executions. While the agent status remains "Green" (Healthy) and continues to ping the Task Server (TS), it fails to make processing requests to the Symantec Management Platform (SMP). The hotfix corrects the critical section synchronization logic to prevent cross-thread deadlocks. Additionally, this fix resolves another crash scenario: Scenario: An MDP policy is in its execution phase while simultaneously being disabled on the NS and removed from the agent during a policy refresh. Previous Behavior: The policy destructor would execute for several seconds while a UI notification was actively being generated for the partially destroyed object, resulting in an unhandled exception. Resolution: Enhanced critical section protections ensure the agent cannot access or send UI notifications for a policy currently undergoing destruction. Temporary Workaround If immediate deployment of the hotfix is not possible, the following workarounds can mitigate the issue: Service Restart: Manually restarting the SMA service will temporarily restore agent communication and clear memory. Policy Adjustment: Identify and temporarily disable the specific script task or Managed Delivery Policy, or consolidate the nested policy logic into a single policy definition.
Included in pointfix v5 release	Modern Report View: Advanced view shows no data for Software License resource type editing Modern Report View: Advanced dialog shows all resource types in grid for Software License resource type editing	This fix addresses an issue where the Advanced View dialog failed to display data when editing a Software License resource type within the Asset/CMDB modern report view. This occurred because required hidden parameters (such as 'Resource Type') were not being properly passed to the REST API. Fixes & Improvements Resolved Data Display Issue: Fixed in issue where the advanced view dialog showed no data during Software License editing. Corrected Grid Filtering: Resolved an issue where the advanced dialog incorrectly displayed all resource types in the grid. Parameter Passing: Ensured that missing hidden parameters are now successfully passed to the REST API to allow reports to run correctly.
Included in pointfix v5 release	Asset name changes in CMDB import rules appear inconsistent across console views and database records in ITMS 8.8.1	441742
Included in pointfix v6 release	Editing a view in report builder show a GUID in the type dropdown 4412724e-d2c4-4110-a97d-47a20912d302	449590
Included in pointfix v6 release	Security fixes
Included in pointfix v6 release	Task Service crashing apparently after enabling persistent connection	452887

Cumulative Point fix version in which each issue was initially addressed	Issue	KB Reference/Description
Included in pointfix v1 release	Add filter collection parameter in Compliance Patch Linux reports

Cumulative Point fix version in which each issue was initially addressed	Issue	KB Reference/Description
Included in pointfix v1 release	Support migrating on prem VMs to VergeIO	Further enhancements to improve Imaging process handling and ensure consistent client registration behavior following virtualization platform migrations.
Included in pointfix v1 release	DS 8.8.x - Two entries in Agent Plugin Inventory	Corrected Duplicate Agent Plug-in Inventory Records During Initial WinPE Inventory Collection Addressed an issue where a computer performing its first Basic Inventory collection from WinPE could generate two Agent Plug-in Inventory records. One record contained blank values while the second contained the correct hardware model information. The issue was observed only during the initial inventory collection from WinPE and did not occur after the system booted into the production operating system or when an already-known computer was subsequently booted into WinPE.
Included in pointfix v1 release	Agent crashing on policy update when performing SBS UpdateImage	Improved Stability of Site Server Agent Operations Addressed an issue that caused the Symantec Management Agent on Site Servers to terminate unexpectedly under certain conditions. This enhancement improves agent stability and helps prevent intermittent Site Server agent crashes.
Included in pointfix v1 release	Preboot Configuration - Current Selected computers are not retrieved	Improved Site Server Assignment Management for Pre-Boot Configurations Addressed an issue where previously configured Site Server assignments for pre-boot environments were not retained or displayed when editing an existing configuration. In certain scenarios, opening an existing pre-boot configuration and adding an additional Site Server could result in the current server list not being shown, causing the newly selected server to overwrite the existing assignments rather than being added to them. This improvement ensures that existing Site Server assignments remain visible and can be modified without unintentionally replacing previously configured servers. This is particularly beneficial in environments with a large number of Site Servers.
Included in pointfix v2 release	PXE boot fails if Secure Boot is enabled	431919
Included in pointfix v2 release	PXE boot fails when PXE server is installed with DHCP server	Improved PXE Service Compatibility with DHCP Services Addressed an issue where a Site Server running PXE services could fail to bind to UDP port 67 when a DHCP service was already listening on that port. In affected environments, the Site Server PXE service would not start successfully until the DHCP service was stopped. This behavior was not observed in previous ITMS releases. This enhancement restores compatibility and improves coexistence between PXE and DHCP services on Site Servers.
Included in pointfix v3 release	Unable to Export and Import Copy File type tasks in 8.8.x with Error: str cannot be null	450104

Cumulative Point fix version in which each issue was initially addressed	Issue	KB Reference/Description
Included in pointfix v1 release	Unable to search the Microsoft Store when using a Proxy Server	Now Admin is able to perform apps search and download from MS Store via specified proxy server in Notification Server Settings. 442987

Cumulative Point fix version in which each issue was initially addressed	Issue	KB Reference/Description
Included in pointfix v1 release	System Number auto-generation fails when editing asset records	Fixed an issue related to: When an administrator edits an asset and clicks the button intended to automatically generate the System Number, no action occurs and the expected value is not generated.

CUMULATIVE POST ITMS 8.8.1 POINT FIXES

Article ID: 433118

Updated On:

Products

Issue/Introduction

Environment

Resolution

`TsTicklePendingTimeoutMinutes`

`TsTickleEstablishedTimeoutMinutes`

post /api/v1/smf/PackageManagement/packages/{package_id}/package_server2

Additional Information

Attachments

Feedback