Token-Based Authentication Setup and ACC Account Disablement in ITMS 8.7.3 and Later

Products

• IT Management Suite

Issue/Introduction

You want to move away from ACC-based authentication because of repeated account lockouts tied to password expiration, and you want a documented path to confirm token-based authentication is working before turning ACC off.

Agent Connectivity Credentials (ACC) authenticate the Symantec Management Agent against Site Servers and the SMP (Symantec Management Platform) Server by default. Because ACC is typically a domain or local account, an expired password locks the account and breaks authentication until it's manually reset. ITMS 8.7.3 introduced token-based authentication as an alternative that removes password expiration from this path. Whitepaper: Using ITMS with Token-Based Authentication

This article walks through enabling token-based authentication, confirming it’s working, and disabling ACC once it’s no longer needed.
This article does not cover Notification Server tokens used for ASDK access, Internet Gateway reporting, or push installations. Creating Notification Server tokens for ASDK access, Internet Gateway reporting, or SMA push installations. See the whitepaper above for those procedures.

Environment

ITMS 8.7.3, 8.8.x

Prerequisites

• ITMS 8.7.3 or later
• Admin access to the SMP Console
• HTTPS connectivity between agents and the Notification Server

Resolution

Table of Contents

• • Normal authentication flow
  • Components involved
  • Common failure points
• PROCEDURE
  • Step 1: Check for UNC package locations
  • Step 2: Enable token-based authentication
  • Step 3: Set token timeout periods
  • Step 4: Resolve any existing ACC lockout root cause
  • Step 5: Roll out and monitor
  • Step 6: Disable the ACC account
• Verification

Normal authentication flow

When both authentication methods are enabled, the Symantec Management Agent attempts token-based authentication first. Tokens have two parts, both unique to the agent: the first part regenerates automatically when its timeout period expires, and the second part is single-use, generated fresh for each authentication attempt.

If token authentication fails, or if the resource being accessed is on a UNC path, the agent falls back to ACC credentials (when ACC is still enabled). Token-based authentication does not support UNC code bases — only HTTP and HTTPS.

Components involved

Component	Role
Symantec Management Agent (SMA)	Requests tokens and authenticates to Site Servers and the Notification Server to access packages and policies.
_SMP_IUSR (local Windows account)	Created automatically on Site Servers and the Notification Server when token authentication is enabled. Used by IIS to impersonate the logged-on user and by Windows security descriptors to restrict resource access. Do not delete manually — doing so breaks token-based authentication.
_SMP_USERS (local security group)	Always exists regardless of authentication method. Holds _SMP_IUSR when token auth is enabled and the ACC account when ACC is enabled. Used in folder security descriptors so access doesn't need to be rebuilt when you switch methods.
Access Tokens Configuration page	Sets the Agent token expiration timeout and the NS token expiration default timeout, and lists issued Notification Server tokens.

 

Common failure points

• UNC package locations, a UNC-configured Software Library, or UNC-based Deployment Solution images — these always require ACC, regardless of whether token authentication is enabled.
• An unresolved root cause behind a prior ACC lockout — if ACC is kept as a fallback and the original lockout cause (expired password, cached old credentials, repeated failed retries) isn't fixed, the account will lock out again the moment the agent falls back to it.
• Retrieving tokens over HTTP — this is blocked outright; token retrieval requires HTTPS. You may see the message "Tokens data can’t be accessed over unsecured connection" in the Access Tokens Configuration page.
• Manually deleting the _SMP_IUSR account — this breaks token-based authentication; the SMA manages this account's lifecycle automatically.

Clarification — HTTP is supported for client-server tokens: The Access Tokens Configuration page's HTTPS warning applies only to creating or retrieving Notification Server tokens in the SMP Console (used for ASDK and Internet Gateway access — see Additional Information). It does not apply to the token-based authentication this article sets up. Agent-to-server authentication works over HTTP or HTTPS, and those tokens are generated and renewed automatically; there's no token to create manually for this connection.

PROCEDURE

Step 1: Check for UNC package locations

Do this before enabling anything. It determines whether ACC can be fully disabled later or must stay enabled for specific paths.

1. Go to Manage > Software > Software Catalog and review package locations for paths starting with \\Server\Share.
2. Go to Settings > All Settings > Software > Software Library and check whether a UNC path is configured.
3. If Deployment Solution is in use, go to Settings > Deployment > Image Management and confirm the image storage path.

Note: If any of these use UNC, token-based authentication won't cover that path. The agent detects a UNC code base and uses ACC automatically for it, regardless of the settings in Step 2 and Step 6.

Step 2: Enable token-based authentication

1. Go to Settings > Notification Server > Notification Server Settings > Processing tab.
2. Under Client Authentication Options, turn Token Authentication Connectivity "On".
3. Leave Agent Connectivity Credentials "On" for now — it stays available as a fallback. When both are "On", token authentication is attempted first.

 

The Processing tab lists three independent authentication toggles. Only the first two are relevant to this procedure:

Setting	Purpose	Relevant here?
Ephemeral Certificates Authentication Connectivity	Certificate-based authentication for CEM-mode agent connectivity.	No — leave as-is. Disabling it requires re-deploying CEM certificates to CEM-enabled agents.
Token Authentication Connectivity	Bearer-token authentication for agent connectivity to the Notification Server, Site Servers, and ASDK web access.	Yes — turn "On" in this step.
Agent Connectivity Credentials	The ACC account used as the default or fallback authentication method.	Yes — turned "Off" in Step 6.

 

Not in scope: Ephemeral Certificates Authentication Connectivity governs CEM-mode agents and sits on the same settings screen. It's unrelated to the ACC/token migration this article covers — don't change it as part of this procedure.

Step 3: Set token timeout periods

1. Go to Settings > Notification Server > Access Tokens Configuration.
2. Set the Agent token expiration timeout. This controls how often the first part of each agent's two-part token regenerates.
3. Set the NS token expiration default timeout. This sets the default Valid From/To window applied when a new Notification Server token is created (used for ASDK, Internet Gateway, or push-install scenarios — see Additional Information).

Note: The Access Tokens Configuration page displays the warning "Tokens data can’t be accessed over unsecured connection" if you create or retrieve a Notification Server token (ASDK or Internet Gateway use) over HTTP — that specific action requires HTTPS. This does not apply to the client-to-server setup in this article: agent tokens work over HTTP or HTTPS and require no manual creation.

Step 4: Resolve any existing ACC lockout root cause

If ACC has locked out before, fix that now. Keeping ACC as a fallback without resolving the original cause just reproduces the same lockout the next time the agent falls back to it.

Possible cause	How to check
Expired ACC password	Validate the password manually.
Password mismatch on a Site Server	Re-enter credentials on the affected server.
Cached old credentials	Restart the Altiris services on the affected server.
Repeated failed retries	Review logs for a repetition pattern (see below).

Check for lockout evidence in two places:

• SMP logs — look for “Logon failure: unknown user name or bad password” or “Account locked out” entries in:

C:\ProgramData\Symantec\SMP\Logs\a.log

• Domain Controller security logs — review these event IDs:

Event ID	Meaning
4740	Account locked out
4625	Failed login

Multiple failed attempts from the SMP server or Site Servers point to a stored-credential problem worth investigating before you proceed.

Step 5: Roll out and monitor

1. With token authentication enabled and ACC fallback still on, monitor NS logs and Domain Controller lockout events.
2. Confirm agent package downloads succeed.
3. Confirm the _SMP_IUSR local account and _SMP_USERS group were created on Site Servers and the Notification Server. Do not delete these manually.

Note: The _SMP_IUSR account and its password are recreated automatically when the SMA starts, when the "Site Server" policy changes, and every 6 hours. The interval is set by the registry value below.

HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\Altiris Agent\Servers\<server>  (value: Server Security Environment Refresh Interval (mins))

You can monitor account creation and update issues in Reports > Notification Server Management > Server > Site Server Account Management Issues.

Step 6: Disable the ACC account

Disable ACC only if all three are true, based on Step 1: no UNC package locations, all packages served over HTTP/HTTPS, and no Deployment Solution UNC dependencies.

1. Complete the checks in Verification below first.
2. Go to Settings > Notification Server > Notification Server Settings > Processing tab.
3. Under Client Authentication Options, turn Agent Connectivity Credentials "Off".
4. Leave Token Authentication Connectivity On.
5. Monitor authentication stability using the same checks from Verification for at least one full agent policy cycle.

Note: If any package location uses UNC, do not disable ACC. Token-based authentication does not support UNC code bases, and disabling ACC will break access to those paths.

Verification

Confirm the following before disabling ACC, and again afterward to confirm stability:

Test	Expected result
Agent requests policy	No credential prompt
Package download over HTTP/HTTPS	Successful
UNC download (if applicable)	Uses ACC automatically
Domain Controller security log	No Event ID 4740 (account locked out)

Additional Information

• Whitepaper: Using ITMS with Token-Based Authentication 
• Access Tokens Configuration documentation 
• Understanding Token-Based Authentication and ACC Fallback Behavior
• What Access Rights Does the _SMP_USERS Security Group Require