Troubleshooting Agent Provisioning KACE SMA Client Deployment (4367904)

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

Troubleshooting Agent Provisioning KACE SMA Client Deployment
Description

Listed below are the key areas to investigate when trying to troubleshoot agent provisioning in your network. This is an in-depth guide for a Windows environment.
Resolution
For more information on this topic, please see the KACE-SMA Course 2 Installing the KACE SMA Agent-Web-based Training.
Assumptions:
- The PC in the provisioning schedule as the target IP is called TARGETPC.
- Admin PC is called ADMINPC.
- The KACE SMA appliance hostname is called and is the same name that is listed in the provisioning configuration AND in the Network settings.
1- Check for provisioning support files:

Provisioning uses files located on a samba share to do the install.

Use the below instructions if receiving the error, "The system cannot find the file specified."
- Check for this list of files at \\SMA.ip.or.fqdn\client\agent_provisioning\windows_platform.
  - agent_msi_provision.bat
  - agent_msi_remove.bat
  - ampagent-VERSION-x86.msi
- Check that the above location contains the installed version reported at the below location.
  - Click on Settings | Provisioning | Update Agents
2- Check for connectivity to the SMA appliance shares:

Provisioning attempts to run the files from \\SMA.ip.or.fqdn\client.

Here are some potential errors:
1. Use the below instructions if receiving the error, "The system cannot find the file specified." ERROR: Failed to copy file - /kbox/bin/KBRemoteService.exe - NT_STATUS_SHARING_VIOLATION.
  1. On a TARGETPC, open up explorer.exe.
  2. Browse to \\SMA.ip.or.fqdn\client.
    It should automatically connect as "Guest".
    Should have read-only access to this share.
    Host name must match what is in the settings for the SMA
2. If receiving an error when trying to map a drive to the client share, see:
  1. Microsoft network server: Digitally sign communications (always)
3- Ping TARGETPC from the KACE SMA Appliance:

To ping the TARGET PC from the KACE SMA appliance:

For appliances with Organizations enabled, this is done under the systemui.

For appliances without Organizations enabled, it is done under the adminui.
1. Click on Settings | Support.
2. Under Troubleshooting Tools, click on Run diagnostic utilities.
3. Click on the drop-down under Test and select ping.
4. Enter appropriate IP.
5. Click Run Now.
4- Test connectivity to ports 139 and 445 on TARGETPC from the SMA Appliance:

On Windows devices, ports 139 and 445, File and Print Sharing, and Administrator credentials are required only during Agent installation. If necessary, these ports can be disabled after installation. The Agent uses port 52230 for ongoing communications. After installation, the Agent runs within the context of the Local System Account, which is a built-in account used by Windows operating systems.

To test:
- Telnet from ADMINPC to TARGETPC on ports 139 and 445.
- If a blank telnet cmd opens, then the connection is working.
- If the telnet fails, it will typically produce an error message, and it may be necessary to configure file and print sharing according to the SMA's documentation.
  - For the Administrator Guide, see KACE Systems Management Appliance - Release Notes and Guides
  - If Windows Firewall is enabled, it is necessary to enable File and Print Sharing in the Exceptions list of the Firewall Configuration. For instructions, see the Microsoft Support website.
5- Test Admin Share & Credentials on your TARGETPC:

The SMA uses a stub called kbrsl (pronounced "kbrizzle") to connect to the admin$ share on a PC.

Use the below instructions if receiving the error, ERROR: Failed to copy file - /kbox/bin/KBRemoteService.exe - NT_STATUS_SHARING_VIOLATION.

To test if this is working outside of the SMA appliance do this:

Method 1 (works well if unable to control the TARGETPC)
1. Open up Computer Management.
2. Navigate to Shared Folders | Shares.
3. Check that the "ADMIN$" share is listed.
4. On an admin PC, download PsExec and save it to C:\
5. Extract psexec.exe from the tools archive.
6. On an admin PC, tell psexec to connect to the target PC and issue the command c:\psexec.exe \\TARGETPC -u Domain\username ipconfig /all. This should report back the ipconfig information of the remote machine.
7. Map a drive to that machine, and if the folder %systemroot%\temp\kace exists, then delete it.
8. Run this command c:\psexec.exe \\TARGETPC -u DOMAIN\username cmd.exe /c mkdir %systemroot%\temp\kace
Method 2
1. On the TARGETPC, open up Computer Management.
2. Navigate to Shared Folders | Shares.
3. Check that the "ADMIN$" share is listed.
4. From an ADMINPC, open explorer.exe and browse to \\TARGETPC\Admin$. You should be prompted to login.
5. Login with the same credentials you are using in the provisioning setup.
6. Launch services.msc.
  1. Is the KACE Agent running?
  2. Is the KACE Agent WatchDog running?
6- Test for installation:

The KACE agent is not located in Add/Remove Programs (Programs and Features) within the control panel. To check for the KACE agent, it will be necessary to check for both directories and running service(s):
1. Browse to C:\Program Files (x86)\Quest\KACE
  1. Are AMPAgent.exe, AMPWatchDog.exe and other executables there?
2. Browse to C:\Programdata\Quest\KACE
  1. Are there multiple logging files here and a folder called User?
3. Launch services.msc.
  1. Is the KACE Agent service running?
  2. Is the KACE Agent WatchDog service running?
If the installation files are there and the service is running, then provisioning was successful. If the agent is installed, but has not reported to the SMA, this is not a provisioning issue and instead an agent communication issue.
7- Disable or uninstall anti-virus software

Example of an error which may be caused by anti-virus software:

ERROR: Failed to copy file - /kbox/bin/KBRemoteService.exe - NT_STATUS_SHARING_VIOLATION
- If running anti-virus software., disable it temporarily, then attempt to provision again.
- If disabling still yields the same error, uninstall the anti-virus software temporarily, then test again.
- If the problem still exists, continue onto the next steps in this article or search our KACE Systems Management Appliance - Knowledge Base
8- New Installation versus re-provisioning:

In an efficient environment, it should never be necessary to re-provision your end points. If upgrading the KACE SMA appliance and agent software regularly (i.e. within a few months of each release) then a smooth upgrade path should be available that allows devices to upgrade themselves. This is facilitated by the Provisioning module under the link "Update Agents" (i.e. Settings | Provisioning | Update Agents). When enabled, the new agent version will be installed as a managed install the next time the device checks into the SMA appliance. See How to update Agents using Client Bundles (4328664)

SMA Server and Agent Upgrade Path (4284819)

However, there may be exceptions when you have to re-provision:
1. Orphaned agents due to host name change: Create a temporary DNS name so that agents will connect to the new server.
2. Orphaned agents due to misconfiguration of SSL: It is possible to orphan agents by mistakenly enabling SSL on the SMA appliance, then disabling it, OR if SSL is enabled using incorrect host settings. In the later scenario, the agents are looking for a host that does not match the certificate.
3. When a machine that is re-imaged: This is not technically a re-provision. Furthermore, it is preferable to deploy the agent as a post-image installation task (after establishing the name of the machine).
Removing previous installations Method 1

Setup a provisioning schedule using the option to uninstall the agent.

See: Uninstalling the SMA Agent (4285391)

Removing previous installations Method 2

Check the TARGETPC for existence of C:\ProgramData\Quest\KACE and C:\Program Files\Quest\KACE

If either exists, then stop all SMA services.
Delete both directories (if both exist) and all contents including the amp.conf and amp_auto.conf files (if either file exists).
Re-provision.

9- Other errors that may be encountered

Receiving the error: STEP 3: PUSH SCRIPT\PROVISIONING - FAILED

See Provisioning log indicates agent install failed when provisioning with the KACE SMA

Receiving ERROR: Failed to open connection - NT_STATUS_RESOURCE_NAME_NOT_FOUND
See ERROR: Failed to open connection - NT_STATUS_RESOURCE_NAME_NOT_FOUND while provisioning client (4330655)

10 - When to contact support

If all of the above settings have been checked and passed, then please contact technical support.

Be prepared to provide the following:

Evidence of all the tests.
Demonstrated attempts at solving the problem, including a description of the current roadblocks.
Log file from a sample device that gets the agent to install Using the KACE Agent Toolkit (KAT / kapture)

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Request a KB Article

Troubleshooting Agent Provisioning KACE SMA Client Deployment (4367904)

Title

Description

Resolution

7- Disable or uninstall anti-virus software

9- Other errors that may be encountered

10 - When to contact support

Leave a Comment