Symantec Management Platform Error and IIS 302.0 Error Browsing Virtual Directories Under /Altiris/PackageShare on Windows Server 2022

Products

• Client Management Suite
• IT Management Suite

Issue/Introduction

While working in IIS Manager and attempting to browse to a virtual directory hosted under the default path /Altiris/PackageShare, a generic Symantec Management Platform error page appears. Investigating the IIS logs reveals an HTTP 302.0 response. This issue prevents endpoints from downloading software packages.

Environment

ITMS 8.x

Physical Software Packages located on shared network drive

Cause

An IIS 302.0 status code represents an HTTP 302 Found response, indicating a temporary redirect (in this case, redirecting to the generic Symantec error page).

On Windows Server 2022, security hardening in the Windows HTTP Protocol Stack (HTTP.sys) and IIS worker thread initialization causes IIS to ignore the virtual directory's custom "Connect As" identity during initial pipeline establishment.

Before executing code or applying "Connect As" credentials, the master IIS worker process (w3wp.exe) maps the physical UNC path (\\NAS\share) using the computer account (domain\ServerName$). If the NAS denies access to the computer account, directory validation fails immediately, triggering a redirect to the error page before the custom identity can be evaluated.

Resolution

An IIS 302.0 status code is not inherently an error; it represents an HTTP 302 Found response which tells the browser to temporarily redirect to a different URL.  

If you cannot modify permissions on the NAS, you must force the underlying IIS worker process boundary to completely abandon the computer account framework.

1. Open IIS Manager and click on Application Pools.
2. Select the Application Pool assigned to your website/virtual directory and click Advanced Settings on the right.  By default it's assigned to the Symantec Agent AppPool.
3. Find the Identity property. It is likely currently set to ApplicationPoolIdentity or NetworkService (which maps to the machine's $ account on the network).
4. Change it to Custom Account and input the exact same domain user credentials you configured in your Virtual Directory's "Connect As" setting.
5. Run an iisreset via command prompt. This forces the entire worker process architecture to authenticate to the NAS as that user from the very first packet, bypassing the machine account lookup.