Customer started to get error messages in the NS logs referring to Policy requests failing. The resources mentioned were Users, so these policy requests are actually User based policies. Policy request failed from: 172.16.197.169
The specified resource got linked to another resource:
ResourceGuid=bb52da17-d708-45f4-9710-2cbb39b4d742
conflicted ResourceGuid=16fc2079-b334-4fe3-981b-e3436b218d0f
ResourceType=fd864f19-4437-4a4f-8709-58eb5e3ae0a4
AgentVersion=[]
PsVersion=[]
KeyName=[name.domain]
KeyValue=[JohnDoe.EXAMPLE]
   [Altiris.NS.Exceptions.NSComException @ Altiris.NS]
   at Altiris.NS.AgentManagement.PolicyRequest.LookupResources(ParseRequestResult result)
   at Altiris.NS.AgentManagement.PolicyRequest.GetPolicies(String request, Boolean bCompress, String& agentPoliciesXml)
   at Altiris.Web.NS.Agent.GetClientPoliciesHandler.ProcessRequest(HttpContext context)

COM Exception errcode: 0x80041003

-----------------------------------------------------------------------------------------------------
Process: w3wp (3764), Thread ID: 50, Module: w3wp.exe
Priority: 1, Source: Altiris.Web.NS.Agent.GetClientPoliciesHandler.HandleNsComException
 

ITMS 7.x, 8.x

In this particular case the issue is caused by the way the customer is bringing those users via a Data Connector import rule. His Data Connector import rule imports a csv file that contains just the user names, no domain info, and other details about the users. Bringing the users without a domain reference is adding a new entry in ResourceKey table, so there are 2 entries with unique GUIDs on this table for the same user. You can validate this by running the following query (just replace the GUIDs with the ones from the error message):

select vi.Name, vi.ResourceTypeGuid, rk.* from resourcekey rk
join vRM_Resource_Item vi on vi.Guid = rk.ResourceGuid
where rk.ResourceGuid in (
'bb52da17-d708-45f4-9710-2cbb39b4d742',
'16fc2079-b334-4fe3-981b-e3436b218d0f')

In this case you may notice entries like JohnDoe and JohnDoe.Example for example.

The CMDB merge rules don't work because it needs to have name.domain references and one of the entries just has name on it.

1. The simple way to fix this issue is to make sure the Data Connector Import Rule has the right Resource lookup key setup: "User UserId/Domain". Also that the data imported has a name and a domain entry for each user.
2. Then the CMDB "Duplicate User Merge" task (under Manage>Jobs and Tasks>System Jobs and Tasks>Service and Asset Management>CMDB) should take care of the issue.

1. "Users with Duplicate ResourceKey (name.domain).xml". This report should show you what user resources have this problem
2. "Updating Inv_Global_Windows_Users.xml". This task runs a SQL query that should identify the user resources that need to be fixed and updates the records of them in the "Inv_Global_Windows_Users" table so the proper merge can be done. Depending how frequently the Data Connector import occurs, it is when this task needs to run. Usually right after the Data Connector Import occurs, then run this task.