Symantec-Altiris Software Management - General Configuration

General Configuration

For effective use of Software Management, it’s important to set all the general settings as needed for your environment. Though some of these settings won’t be known until later, I’ll cover all general settings for reference.

Software Library

The Software Library is a location where all Packages are stored (when Software Library is selected as the Package Source). The Software Library has two requirements before it can be used successfully. One is a one-time only setting, and the other is required on any system that needs to run the Console in conjunction with the Software Library.

1. Software Library Location – This should be a location that has a lot of storage, or at least sufficient storage for all packages to be managed within the infrastructure. To set the location, follow these steps:
   1. At the desired location where you wish to store the packages within the Software Library create a base folder. When packages are added they will be added to this folder as subfolders.
   2. The folder requires a share that the Application Identity can access (preferably all administrators on the system should have access). It is recommended to keep the share name short for ease of configuration.
   3. In the Symantec Management Console, browse under Settings > All Settings > Software > Software Catalog and Software Library Settings > Software Library Configuration, as shown below:
      
   4. Set the location as a UNC path to the desired location.
   5. Click Validate to ensure the path is set correctly. Reasons it may fail are:
      1. The Altiris Application ID, or the Account associated with NS, may not have rights to the UNC specified
      2. The UNC is not a valid share
      3. The UNC cannot be reached (DNS or other related network issues)

   6. Click Save changes to commit the settings once validated.

Note the timeout value set here. For very large packages we have seen instances where this value should be increased beyond the default 600. Also note that very large files can also reach the timeout value when importing into the library.

If your Software Library resides on the same disk as a Package Source, the files will be duplicated into the Software Library share, taking twice the necessary disk space. If the package is local to the Software Library, you can use a UNC Package Source as the source instead of the Software Library, or mount the package in another location to use as a source. The benefit for having a separate source outside of the library is for package integrity.

1. Importing many files and folders – The file picker does not allow to import more than one file at a time. To handle the import of many files and folders, compress the contents of the package into a single archive ZIP file. When importing into the Software Library, select the ZIP file and it will extract the contents into the Software Library.
2. Permissions – By default, we use the Application Identity credentials to access and manage the location of the Software Library. However, if the setting to use the Agent Connectivity Credentials is set, we will then use that account. The setting is found at Settings > Agents/Plug-ins > Symantec Management Agent > Settings > and select Global Agent Settings. Under the Authentication tab you can set a different user. This is the user that will be used by the SMP and agents to access package locations, including managing the Software Library. This account needs FULL access to the share that is the Software Library.

Software Management Plug-ins

There are four Plug-ins for Software Management. The first and second ones are automatically installed as part of the Symantec Management Agent. The first is called the Software Management Framework Plug-in (SMFAgent.dll). This one is used closely with the second plug-in, which is the base Software Management Agent. This allows all Solutions and the NS itself to make use of the Software deployment and management capabilities for the distribution of packages, policies, and certain task types.

To extend the functionality for use within the Software Management Solution, the Software Management Solution Plug-in needs to be installed. The last “Plug-in” is the configuration of the Software Portal interface.

The following procedure walks through configuring and pushing out the Software Management Solution Plug-in and the Software Portal Plug-in Policy:

1. In the Symantec Management Console, go to Settings > All Settings > Software > Software Portal Settings > and select Software Portal Settings.
2. You can change the background of the Portal, and change the logo used under the UI Settings.
3. Under the Publishing Settings, you have the option to disable the ability for users to request unlisted software. Many companies do not have someone review these, so disabling the option makes sense.
4. NOTE: The option “Allow software publishing across the following trusted domains:” is an essential option to use properly to avoid long portal load times. It is recommended to check the option and select the radial “Specific trusted domains”. Add a list of domains separated by commas, such as: Symantec, Altiris.
   
5. Under Delivery Settings, set a task timeout. This will be used for software that is directly published to the portal (not via a policy). Typically the timeout won’t have to be used, but just in case…
6. Use the E-mail notifications settings as needed.
7. In the Symantec Management Console, go to Settings > Agents and Plug-ins > All Agents and Plug-ins > Software > Software Management > Windows > and select Software Management Solution Agent for Windows – Install.
8. Normally the default filter suffices, but this can be changed at this time if required, as well as the schedule.
9. This Policy controls the rollout to ALL platforms, including Windows, Mac, Linux, and UNIX. If you wish to control the Plug-in rollout separately, the Filter needs to be changed to reflect which platform to target. You can clone the Policy and configure for another platform, etc.
   1. NOTE: It is not recommended to try and edit the existing filter, since that filter is used in other places. If you wish something different, create your own filter and add that as the target.
10. Enable the Policy and Save changes.
11. In the same folder, now select the Software Portal Client Access. This screenshot shows the policy:
    
12. Select the options for where you want the link for the Software Portal to appear. Options to consider are:
    1. If your Symantec Management Agent tray icon is hidden, uncheck the option for “Show link for Software Portal in Symantec Management Agent’s context menu”.
    2. The Start Menu is a popular choice as it’s out of the way but easily understood by typical end-users.
13. It is recommended to keep the current target as that enables the Software Portal on all Managed Systems.
14. Done! The Agent will now be deployed as the target computers check in for a new Configuration. As this is policy based it may take a number of hours for all machines to run the policy and install the Plug-in.

Licensing

Protection against unauthorized use is required for any Software Company. Licensing ensures that only authorized organizations (AKA those who have purchased) can use the software, and that they only use it within the scope of their license. While required in some form or another, it is not desired that licensing get in the way of successfully using the software if properly licensed. For the Software Management Framework, no license is required. For the Software Management Solution, a valid license must be installed in order to use it.

Software Management Solution counts licenses by the number of computers that have the Software Management Solution Plug-in installed. The count is figured off of the table Inv_AeX_AC_Client_Agent which Basic Inventory populates. The count is based off of the Agent Name: Software Management Solution Agent and the corresponding Agent Count column.

Keep a tab on how many computers have the Software Management Solution Plug-in installed. Visit SIM in the Licensing section, and ensure you don’t roll the Plug-in out to too many systems. If you need more licenses ensure you receive them and install them before you roll additional Plug-ins out. Note that licenses need to be combined as only one can be applied at any given time.

If your Software Management Solution license has been exceeded, the following action can be taken to free up licenses.

1. In the Symantec Management Console, go to Manage > Filters > Software Filters > Agent and Plug-in Filters > and select All Windows Computers with Software Management Solution Agent Installed.
2. Click Update membership to ensure the Filter is up to date.
3. In the list of computers, find those computers you wish to remove a Software Management License from. Make a list of these computers
   NOTE: If you wish to make a dynamic filter, then it is unnecessary to create a list.
4. In the Symantec Management Console, go to Settings > All Settings > Agents/Plug-ins > All Agents/Plug-ins > Software > Software Management > Windows > Software Management Solution Agent for Windows – Uninstall.
5. Under the Applied to section remove the default Filter by selecting it and clicking the red X delete button.
6. Now add the filter of the systems you wish to remove the Plug-in from. If it is a dynamic filter you’ve created, even better.
7. If you wish to use the list you acquired in step 3, follow these steps:
   1. Click Apply to > Targets.
   2. Click New > Target.
   3. Click Add Rule.
   4. Change Then to Exclude computers not in, and the next field to Computer List.
   5. Click the ellipses <…> at the end of the row to open the computer selection dialog.
   6. From the left-hand pane select the computers to remove the Plug-in from. Note that you can use the filter to find systems if you have a large list.
8. Add your selects by clicking the > button (or if you have filtered down to the list you wish, use the >> button). See this screenshot for a sample:
   
9. Click OK to apply the new filter.
10. Enable the policy, aka turn the policy to the ON status.
11. Click Save changes to save the application of the new filter.
12. Done!

13. As the targeted computers update their configuration, they will receive the new uninstall policy and remove the Plug-in. It then requires those targets to send an updated Basic Inventory. To finalize the process, the License Refresh must occur. The entire process can take time to propagate to all targeted systems.

Software Catalog

There are a number of other settings/configurations that can be utilized by the Software Catalog. The following items are available and can be used as desired. For most general use they do not necessarily require configuration beyond the defaults. To locate these items, in the Symantec Management Console go to Settings > All Settings > Software > Software Catalog and Software Library Settings.

Clean up File Resources – This is an automatic process that reconciles data captured from multiple computers to synchronize file resources, if needed.

Best Practices!: The results of Software Discovery, called Add Remove Programs data or Installed Software, may show incomplete data after machines have reported Inventory. If this occurs, manually run the Clean File Resources task to correct the problem.

Installation Error Code Descriptions – There is a large default list (600+ entries). Only if you wish to clarify specific errors or add your own should you use this feature. It can be nice is large environments where the IT professionals working on issues may benefit from more verbose error messages.

Known As – This allows catalog information to be correlated from Company Name to a corresponding resource. This also allows multiple versions of a company’s name to map to the same resource. For example:

• Microsoft > Microsoft
• Microsoft Inc. > Microsoft
• Microsoft Corp > Microsoft
• Microsoft Corporation > Microsoft

Also note that there is a Wildcard section to catch potential exceptions. Use “Microsoft” in the search field to see a list of those items already mapped.

Software Discovery – Software Discovery is executed by the Software Management Framework Agent (SMFAgent.dll), but is executed by Inventory Solution. Please see the Inventory Solution section of this document for more information. As a general rule, this built-in policy should be left disabled.