Return
-
Title
Troubleshooting Agent Provisioning KACE SMA Client Deployment -
Description
Listed below are the key areas to investigate when trying to troubleshoot agent provisioning in your network. This is an in-depth guide for a Windows environment.
- Check for provisioning support files
- Check for connectivity to the SMA appliance shares
- Ping TARGETPC from the KACE K1000 Appliance
- Test connectivity to ports 139 and 445 on TARGETPC from the SMA.
- Test Admin Share & Credentials on your TARGETPC
- Test for installation
- Disable or uninstall anti-virus software
- New Installation versus re-provisioning
- Other errors that may be encountered
- When to contact support
-
Resolution
For more information on this topic, please see the KACE-SMA Course 2 Installing the KACE SMA Agent-Web-based Training.
Assumptions:- The PC in the provisioning schedule as the target IP is called TARGETPC.
- Admin PC is called ADMINPC.
- The KACE SMA appliance hostname is called and is the same name that is listed in the provisioning configuration AND in the Network settings.
1- Check for provisioning support files:Provisioning uses files located on a samba share to do the install.Use the below instructions if receiving the error, "The system cannot find the file specified."- Check for this list of files at \\SMA.ip.or.fqdn\client\agent_provisioning\windows_platform.
- agent_msi_provision.bat
- agent_msi_remove.bat
- ampagent-VERSION-x86.msi
- Check that the above location contains the installed version reported at the below location.
- Click on Settings | Provisioning | Update Agents
2- Check for connectivity to the SMA appliance shares:Provisioning attempts to run the files from \\SMA.ip.or.fqdn\client.Here are some potential errors:- Use the below instructions if receiving the error, "The system cannot find the file specified." ERROR: Failed to copy file - /kbox/bin/KBRemoteService.exe - NT_STATUS_SHARING_VIOLATION.
- On a TARGETPC, open up explorer.exe.
- Browse to \\SMA.ip.or.fqdn\client.
- It should automatically connect as "Guest".
- Should have read-only access to this share.
- Host name must match what is in the settings for the SMA
- If receiving an error when trying to map a drive to the client share, see:
- If receiving the error: /client/agent_provisioning/windows_platform/agent_msi_remove.bat 0) could not be launched: 2 The system cannot find the file specified. See: Provisioning failed: The system cannot find the file specified (150994)
3- Ping TARGETPC from the KACE SMA Appliance:To ping the TARGET PC from the KACE SMA appliance:For appliances with Organizations enabled, this is done under the systemui.For appliances without Organizations enabled, it is done under the adminui.- Click on Settings | Support.
- Under Troubleshooting Tools, click on Run diagnostic utilities.
- Click on the drop-down under Test and select ping.
- Enter appropriate IP.
- Click Run Now.
4- Test connectivity to ports 139 and 445 on TARGETPC from the SMA Appliance:On Windows devices, ports 139 and 445, File and Print Sharing, and Administrator credentials are required only during Agent installation. If necessary, these ports can be disabled after installation. The Agent uses port 52230 for ongoing communications. After installation, the Agent runs within the context of the Local System Account, which is a built-in account used by Windows operating systems.To test:- Telnet from ADMINPC to TARGETPC on ports 139 and 445.
- If a blank telnet cmd opens, then the connection is working.
- If the telnet fails, it will typically produce an error message and it may be necessary to configure file and print sharing according to the K1000 appliance documentation.
- For the Administrator Guide, see K1000 Systems Management Appliance - Release Notes and Guides
- If Windows Firewall is enabled, it is necessary to enable File and Print Sharing in the Exceptions list of the Firewall Configuration. For instructions, see the Microsoft Support website.
5- Test Admin Share & Credentials on your TARGETPC:The K1000 appliance uses a stub called kbrsl (pronounced "kbrizzle") to connect to the admin$ share on a PC.Use the below instructions if receiving the error, ERROR: Failed to copy file - /kbox/bin/KBRemoteService.exe - NT_STATUS_SHARING_VIOLATION.To test if this is working outside of the SMA appliance do this:Method 1 (works well if unable to control the TARGETPC)- Open up Computer Management.
- Navigate to Shared Folders | Shares.
- Check that the "ADMIN$" share is listed.
- On an admin PC, download PsExec and save it to C:\
- Extract psexec.exe from the tools archive.
- On an admin PC, tell psexec to connect to the target PC and issue the command c:\psexec.exe \\TARGETPC -u Domain\username ipconfig /all. This should report back the ipconfig information of the remote machine.
- Map a drive to that machine, and if the folder %systemroot%\temp\kace exists, then delete it.
- Run this command c:\psexec.exe \\TARGETPC -u DOMAIN\username cmd.exe /c mkdir %systemroot%\temp\kace
Method 2- On the TARGETPC, open up Computer Management.
- Navigate to Shared Folders | Shares.
- Check that the "ADMIN$" share is listed.
- From an ADMINPC, open explorer.exe and browse to \\TARGETPC\Admin$. You should be prompted to login.
- Login with the same credentials you are using in the provisioning setup.
- Launch services.msc.
- Is the KACE Agent running?
- Is the KACE Agent WatchDog running for 6.3 agents and above?
6- Test for installation:Since version 6.0, the KACE agent is not located in Add/Remove Programs (Programs and Features) within the control panel. To check for the KACE agent, it will be necessary to check for both directories and running service(s):- Browse to C:\Program Files\Quest\KACE for 32 bit systems and C:\Program Files (x86)\Quest\KACE for 64 bit systems.
- Are AMPAgent.exe, AMPWatchDog.exe and other executables there?
- Browse to C:\Programdata\Quest\KACE
- Are there multiple logging files here and a folder called User?
- Launch services.msc.
- Is the KACE Agent service running?
- Is the KACE Agent WatchDog service running for 6.3 agents and above?
If the installation files are there and the service is running, then provisioning was successful. If the agent is installed, but has not reported to the K1000, this is not a provisioning issue and instead an agent communication issue. Please see the articles below for additional assistance for an agent communication issue:7- Disable or uninstall anti-virus software
Example of an error which may be caused by anti-virus software:ERROR: Failed to copy file - /kbox/bin/KBRemoteService.exe - NT_STATUS_SHARING_VIOLATION- If running anti-virus software such as McAfee, Symantec, etc., disable it temporarily, then attempt to provision again.
- If disabling still yields the same error, uninstall the anti-virus software temporarily, then test again.
- If the problem still exists, continue onto the next steps in this article or search our K1000 Systems Management Appliance - Knowledge Base or ITNinja for more specific provisioning issues.
8- New Installation versus re-provisioning:In an efficient environment, it should never be necessary to re-provision your end points. If upgrading the KACE SMA appliance and agent software regularly (i.e. within a few months of each release) then a smooth upgrade path should be available that allows devices to upgrade themselves. This is facilitated by the Provisioning module under the link "Update Agents" (i.e. Settings | Provisioning | Update Agents). When enabled, the new agent version will be installed as a managed install the next time the device checks into the SMA appliance. See How to Update Agents Using Client Bundles (111219)However, there may be exceptions when you have to re-provision:- Orphaned agents due to host name change: Create a temporary DNS name so that agents will connect to the new server.
- Orphaned agents due to misconfiguration of SSL: It is possible to orphan agents by mistakenly enabling SSL on the SMA appliance, then disabling it, OR if SSL is enabled using incorrect host settings. In the later scenario, the agents are looking for a host that does not match the certificate. (Note: Starting at version 5.1.X, the agent is smart enough to try a last known good connection on port 80.)
- When a machine that is re-imaged: This is not technically a re-provision. Furthermore, it is preferable to deploy the agent as a post-image installation task (after establishing the name of the machine).
Removing previous installations Method 1Setup a provisioning schedule using the option to uninstall the agent.Removing previous installations Method 2Check the TARGETPC for existence of C:\ProgramData\Quest\KACE for both 32 and 64 bit machines, C:\Program Files\Quest\KACE for 32 bit machines and C:\Program Files (x86)\Quest\KACE for 64 bit machines.- If either exists, then stop all SMA services.
- Delete both directories (if both exist) and all contents including the amp.conf and amp_auto.conf files (if either file exists). The amp_auto.conf file is for 6.3 agent and above.
- Re-provision.
9- Other errors that may be encountered
Receiving the error: STEP 3: PUSH SCRIPT\PROVISIONING - FAILEDSee Provisioning log indicates agent install failed when provisioning with the K1000 appliance (114088)Receiving the error: MSI Info: [ERROR_SUCCESS] The action completed successfully.Receiving the error: ERROR_INSTALL_PACKAGE_INVALIDReceiving ERROR: Failed to open connection - NT_STATUS_RESOURCE_NAME_NOT_FOUND
See ERROR: Failed to open connection - NT_STATUS_RESOURCE_NAME_NOT_FOUND while provisioning client (134236)For a list of errors with possible fixes, see K1000 Provisioning Errors (115039)10 - When to contact support
If all of the above settings have been checked and passed, then please contact technical support.Be prepared to provide the following:- Evidence of all the tests.
- Demonstrated attempts at solving the problem, including a description of the current roadblocks.
- Log file from a sample provisioning that has the debug log option turned on.