When I logged into one of our Citrix Servers, I noticed something interesting: The user directory folder (C:\Users on Windows 2008), contained multiple copies of users' cached roaming profiles. So, for example, there would be folders maugustine.domain, maugustine.domain.000, maugustine.domain.001, etc. I thought for sure that I had set the Group Policy to remove locally cached roaming profiles upon log out to avoid this sort of mess, and when I double checked, my memory was correct.
Upon further scrutiny, I discovered that everything was being deleted from the user's profiles except for one empty directory: C:\Users\username.domain\AppData\LocalLow\Microsoft\CryptnetUrlCache, which is related to Security Certificates when using Internet Explorer. In a few tests, I was able to reproduce the problem by logging in, opening IE, browsing to an https site (like www.bankofamerica.com), and then trying to log off.
After going through the services on the system and the startup items under msconfig one by one, I learned that it was the Altris DAgent service that caused this. If I stopped the service and then ran the previously mentioned test, the user's profile would be deleted just fine.
So, I went straight to Symantec support, who has acknowledged the problem, has been able to reproduce it, and now considers it a "known issue." If you are sitting on Windows Server 2008 and are experiencing the same problem, unfortunately there is no permanent fix available yet. Your best bet is to disable the Altiris DAgent services and startup items and subscribe to the following KB article for updates:
https://kb.altiris.com/article.asp?article=51228&p=1
However, if you happen to not be on Vista or 2008, you also have the option of going back to the Altiris AClient until they release a new version of the DAgent. Unfortunately, the AClient is not compatible with Vista or Server 2008.
Sorry for not providing a permanent solution at this point in time, but at least you have a workaround and a KB article to follow!
Showing posts with label Altiris. Show all posts
Showing posts with label Altiris. Show all posts
Monday, February 8, 2010
Tuesday, June 9, 2009
Getting around the Windows Rearm Limit with Sysprep and Altiris
We are currently in the process of deploying 9 IBM Blade servers as a Citrix XenApp farm for our employees. After evaluating the options for maintaining the servers, and their images, we settled on using Altiris. The past several weeks has been consumed with coming up with a "Golden" image that we can use across all 9 servers so that each user's experience will be consistent and predictable (well, as much as possible anyway). Coming up with this "Golden" image required going through a few iterations of a Server 2008 build, installing applications, customizing options and updates, etc. We finally came to the point yesterday when we were ready to make one last change and take a final image -- and this is when I ran into a problem. For the life of me, I could not get Altiris to take the image properly from the "Golden" server.
For the record, we've never used Altiris before, so for the most part we kept most of the default settings: we chose a path to save the image to, we chose to sysprep (using the default answer file) the server, and then take the image. I was finally able to narrow down the problem to sysprep not running correctly. So, at that point, I went on to the server to try and manually run sysprep and got a fatal error! (A full description of the problem can be found in this MS knowledgebase article).
Basically, it boils down to these facts: When Altiris syspreps a server it generalizes it (as it should since this strips out all of the uniqueness of the server, so it can be applied to other servers), resetting the licensing information (or rearming it), and whatever else it does to prepare the image. Now, this is all well and good except for the fact that Microsoft limits the number of rearms to 3 for any given Vista/Server2008 image. So, not really being exposed to this world before, I burned up these 3 rearms very quickly :)
At that point I scoured the internet for workarounds for this problem, since I had a golden image, but could not sysprep it. I tried the answer file solution proposed in the knowledgebase article above, but could not get it to work for whatever reason. Finally after much searching I came across this article, which describes how to get around this limitation.
So, to solve this problem (if you've read the entire post until this point, well done -- but if you just skipped down here to the solution, I don't blame you), I just went into the registry on the "Golden" server and set the following key to a value of "1":
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurentVersion\SL\SkipRearm (For Windows 7: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SoftwareProtectionPlatform\SkipRearm, thanks Mike!)
Without a restart, I was able to run the Altiris imaging job again successfully. It cost me a day of work, so I hope someone finds this helpful. If you have any questions, feel free to leave a comment below.
Note: I also noticed that I had to do this registry change EVERY time before taking an image. The image does not retain this value, it gets reset after doing the sysprep.
For the record, we've never used Altiris before, so for the most part we kept most of the default settings: we chose a path to save the image to, we chose to sysprep (using the default answer file) the server, and then take the image. I was finally able to narrow down the problem to sysprep not running correctly. So, at that point, I went on to the server to try and manually run sysprep and got a fatal error! (A full description of the problem can be found in this MS knowledgebase article).
Basically, it boils down to these facts: When Altiris syspreps a server it generalizes it (as it should since this strips out all of the uniqueness of the server, so it can be applied to other servers), resetting the licensing information (or rearming it), and whatever else it does to prepare the image. Now, this is all well and good except for the fact that Microsoft limits the number of rearms to 3 for any given Vista/Server2008 image. So, not really being exposed to this world before, I burned up these 3 rearms very quickly :)
At that point I scoured the internet for workarounds for this problem, since I had a golden image, but could not sysprep it. I tried the answer file solution proposed in the knowledgebase article above, but could not get it to work for whatever reason. Finally after much searching I came across this article, which describes how to get around this limitation.
So, to solve this problem (if you've read the entire post until this point, well done -- but if you just skipped down here to the solution, I don't blame you), I just went into the registry on the "Golden" server and set the following key to a value of "1":
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurentVersion\SL\SkipRearm (For Windows 7: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SoftwareProtectionPlatform\SkipRearm, thanks Mike!)
Without a restart, I was able to run the Altiris imaging job again successfully. It cost me a day of work, so I hope someone finds this helpful. If you have any questions, feel free to leave a comment below.
Note: I also noticed that I had to do this registry change EVERY time before taking an image. The image does not retain this value, it gets reset after doing the sysprep.
Subscribe to:
Posts (Atom)