The customer is seeing that when he has a package that contains nested folders, the package server does not have permissions to write to the nested folders.
The following error is noticed:
AeXPackageDelivery.dll Download Package failed: Access is denied (-2147024891) AeXNSAgent.exe
Error note: UncTransfer::CreateTargetFile error. Failed to create directory
The customer provided the following write up on the workaround is as follows: 1. Setup Site Server with Package Services 2. Create Deployment share on Site Server 2.a) Create directory - "%INSTALLDRV%\Deployment” (Will go to the drive that the Altiris Agent is installed on - either C:\ or D:\) i) Directory Security defaults (all local) i.a) Administrators - Full Control - This folder, subfolders and files i.b) SYSTEM - Full Control - This folder, subfolders and files i.c) CREATOR - Full Control - This folder, subfolders and files i.d) Users - Read and Execute - This folder, subfolders and files ii) Create share - "\\COMPUTERNAME\Deployment” ii.a) Security - Everyone (Full Control) 3. Import Package as Software Resource (ImageScripts) 3.a) Details Tab i) Package Source: Access Package from a directory on the Notification Server ii) Package Location: D:\Deployment\ImageScripts 3.b) Package Server Tab i) Check “Package Destination Location on Package Server i.a) Use “\\COMPUTERNAME\Deployment\ImageScripts” 3.c) Assign Package to Site Server 4. Perform Configuration Update on Site Server 4.a) New package is received, begins downloading, then goes Invalid 4.b) ImageScripts folder and and any subfolders are created, but no script files are downloaded to the directory 4.c) Agent Logs show that Access Denied when trying to add files to the directory
Permissions on site servers that do not have this issue have the everyone permission present. If we add it to this server, once a package refresh is done the everyone permissions go away. We were able to work around this using DACLmanagement = 0 (See HOWTO77389 "FAQ on Package Servers").
This issue has been reviewed against Post-ITMS 8.0 HF1 and it was not present.
The following steps were done to address the issue:
1. Manually add the directory “%INSTALLDRV%\Deployment\ImageScripts" and assign permissions for NETWORK SERVICE and IIS_IUSRS, replicating permissions for Folder, subfolders and files 2. File download and import just fine, but upon Package Refresh, the permissions are changed, future downloads result in “Invalid Package” 2.a) Adding registry key “EnableDACLManagement” and setting to 0 resolves this
1. Add NETWORK SERVICE and IIS_IUSRS permissions to “%INSTALLDRV%\Deployment” and replicate permissions down to Folders, Subfolders and files 2. Add registry key “EnableDACLManagement” and setting to 0 3. Assign Package to Package Server in Altiris Console 4. Update Configuration on Site Server 5. Package shows up and upon download shows as “Ready"
Subscribing will provide email updates when this Article is updated. Login is required.