Troubleshooting Agent Provisioning K1000 Client Deployment (124881)

  • Title

    Troubleshooting Agent Provisioning K1000 Client Deployment
  • Description

    For a list of the most common reasons for provisioning to fail, see:

    Troubleshooting Agent Provisioning on Windows 7 and Vista (111321)

    Listed below are the key areas to investigate when trying to troubleshoot agent provisioning in your network. This is an in-depth guide for a Windows environment.
    1. Check for provisioning support files
    2. Check for connectivity to the K1000 appliance shares
    3. Ping TARGETPC from the KACE K1000 Appliance
    4. Test connectivity to ports 139 and 445 on TARGETPC from the K1000 Appliance
    5. Test Admin Share & Credentials on your TARGETPC
    6. Test for installation
    7. Disable or uninstall anti-virus software
    8. New Installation versus re-provisioning
    9. When to contact support
  • Resolution

    • The PC that you are trying to provision is called TARGETPC.
    • Admin PC is called ADMINPC. 
    • Your KACE K1000 appliance hostname is called <YOURKBOX> and is the same name that is listed in the provisioning configuration AND in the Network settings.

    Check for provisioning support files:
    Provisioning uses files located on a samba share to do the install.
    Use the below instructions if you are getting the error, "The system cannot find the file specified."
    • Check for this list of files at \\<YOURKBOX>\client\agent_provisioning\windows_platform.
      • agent_msi_provision.bat
      • agent_msi_remove.bat
      • ampagent-VERSION-x86.msi
    • Check that the above location contains the installed version reported at the below location.
      • Click on Settings | Provisioning | Update Agents
    Check for connectivity to the K1000 appliance shares:
    Provisioning attempts to run the files from \\<YOURKBOX>\client.
    Here are some potential errors:
    1. Use the below instructions if you are getting the error, "The system cannot find the file specified." ERROR: Failed to copy file - /kbox/bin/KBRemoteService.exe - NT_STATUS_SHARING_VIOLATION.
      1. On a TARGETPC, open up explorer.exe.
      2. Browse to \\<YOURKBOX>\client.
        1. It should automatically connect as "Guest".
        2. You should have read-only access to this share.
        3. Make sure you are trying to connect using the host name you specified earlier.
    2. If you are getting an error when trying to map a drive to the client share, see:
      1. Microsoft network server: Digitally sign communications (always)
      2. Err Msg: System Error 1240 Has Occurred. The Account Is Not Authorized to Login from This Station

    Ping TARGETPC from the KACE K1000 Appliance:
    To ping the TARGET PC you are trying to provision from the KACE K1000 appliance:
    For appliances with Organizations enabled, this is done under the systemui.
    For appliances without Organizations enabled, it is done under the adminui.
    1. Click on Settings | Support.
    2. Under Troubleshooting Tools, click on Run diagnostic utilities.
    3. Click on the dropdown under Test and select ping.
    4. Enter appropriate IP.
    5. Click Run Now.
    Test connectivity to ports 139 and 445 on TARGETPC from the K1000 Appliance:
    On Windows devices, ports 139 and 445, File and Print Sharing, and Administrator credentials are required only during Agent installation. You can disable access to these ports and services after installation if necessary. The Agent uses port 52230 for ongoing communications. After installation, the Agent runs within the context of the Local System Account, which is a built-in account used by Windows operating systems.
    To test:
    • Telnet from ADMINPC to TARGETPC on ports 139 and 445.
    • If you see a blank screen, then the connection is working.
    • If you see an error, then it is not working, and you probably need to configure file and print sharing according to the K1000 appliance documentation.
    Test Admin Share & Credentials on your TARGETPC:
    The K1000 appliance uses a stub called kbrsl (pronounced "kbrizzle") to connect to the admin$ share on your PC.
    Use the below instructions if you are getting the error, ERROR: Failed to copy file - /kbox/bin/KBRemoteService.exe - NT_STATUS_SHARING_VIOLATION.
    To test if this is working outside of the K1000 appliance do this:
    Method 1 (works well if you cannot easily control the TARGETPC)
    1. Open up Computer Management.
    2. Navigate to Shared Folders | Shares.
    3. Check that the "ADMIN$" share is listed.
    4. On an admin PC, download PsExec and save it to C:\
    5. Extract psexec.exe from the tools archive.
    6. On an admin PC, tell psexec to connect to the target PC and issue the command c:\psexec.exe \\TARGETPC -u Domain\username ipconfig /all. This should report back the ipconfig information of the remote machine.
    7. Map a drive to that machine, and if the folder %systemroot%\temp\kace exists, then delete it.
    8. Run this command c:\psexec.exe \\TARGETPC -u DOMAIN\username cmd.exe /c mkdir %systemroot%\temp\kace
    Method 2
    1. On the TARGETPC, open up Computer Management.
    2. Navigate to Shared Folders | Shares.
    3. Check that the "ADMIN$" share is listed.
    4. From an ADMINPC, open explorer.exe and browse to \\TARGETPC\Admin$. You should be prompted to login.
    5. Login with the same credentials you are using in the provisioning setup.
    6. Browse to %systemroot%\temp on that machine (which is likely c:\windows\temp) and attempt to create a file in the directory.
      1. On the TARGETPC browse to C:\Program Files\Dell\KACE for 32 bit systems and C:\Program Files (x86)\Dell\KACE for 64 bit systems.
      2. Is AMPAgent.exe, AMPWatchDog.exe and other executables there?
    7. Launch services.msc.
      1. Is the Dell KACE Agent running?
      2. Is the DellKACE Agent WatchDog running for 6.3 agents and above?
    Test for installation:
    If the installation files are there and the service is running, then provisioning was successful. You do not have a provisioning problem, but you might have a check-in problem and should review the below article.
    Disable or uninstall anti-virus software:
    Example of an error you might see caused by anti-virus software:
    ERROR: Failed to copy file - /kbox/bin/KBRemoteService.exe - NT_STATUS_SHARING_VIOLATION
    • If you are running anti-virus software such as McAfee, Symantec, etc., disable it temporarily, then attempt to provision again. 
    • If disabling still yields the same error, uninstall your anti-virus software temporarily, then test again.
    • If the problem still exists, continue onto the next steps in this article or search our K1000 Systems Management Appliance - Knowledge Base or ITNinja for more specific provisioning issues.
    New Installation versus re-provisioning:
    In an efficient environment, you should never have to re-provision your end points. If you are upgrading your KACE K1000 appliance and agent software regularly (i.e. within a few months of each release) then you should have a smooth upgrade path that allows your devices to upgrade themselves. This is facilitated by the Provisioning module under the link "Update Agents" (i.e. Settings | Provisioning | Update Agents). When enabled, the new agent version will be installed as a managed install the next time the device checks into the K1000 appliance.
    However, there may be exceptions when you have to re-provision:
    1. Orphaned agents due to host name change: You can often deal with this by creating a temporary DNS name so that agents will connect to the new server.
    2. Orphaned agents due to misconfiguration of SSL: It is possible to orphan your agents if you mistakenly enable SSL on the K1000 appliance, then disable it, OR if you enable SSL using incorrect host settings.  In the later scenario, the agents are looking for a host that does not match the certificate. (Note: Starting at version 5.1.X, the agent is smart enough to try a last known good connection on port 80.)
    3. When a machine that is re-imaged: This is not technically a re-provision. Furthermore, it is preferable to deploy the agent as a post-image installation task (after establishing the name of the machine).
    Removing previous installations Method 1
    Setup a provisioning schedule using the option to uninstall the agent.
    Removing previous installations Method 2
    Check the TARGETPC for existence of C:\ProgramData\Dell\KACE for both 32 and 64 bit machines, C:\Program Files\Dell\KACE for 32 bit machines and C:\Program Files (x86)\Dell\KACE for 64 bit machines.
    1. If either exists, then stop all K1000 services.
    2. Delete both directories (if both exist) and all contents including the amp.conf and amp_auto.conf files (if either file exists). The amp_auto.conf file is for 6.3 agent and above; any agent 6.2 and below won’t have it.
    3. You may have to delete registry keys as well.
      1. For 32 bit machines: HKEY_LOCAL_MACHINE | Software | Dell | Kace
      2. For 64 bit machines: HKEY_LOCAL_MACHINE | Software | WOW6432Node | Dell | Kace
      3. Delete the follow two keys:
        1. MachineID
        2. InstallID
    4. Re-provision.
    When to contact support:
    If all of the above settings have been checked and passed, then please contact technical support.
    Be prepared to provide the following:
    1. Evidence of all the tests.
    2. Demonstrated attempts at solving the problem, including a description of the current roadblocks.
    3. Log file from a sample provisioning that has the debug log option turned on.
      1. How to enable debug logs on the KACE K1000 Client (112035)
      2. How to Use the Dell KACE Kapture State Utility for Windows (116144)

Feedback submitted.

Did this article help?

[Select Rating]

Thank you for your rating!


Request or Create a KB Article »

K1000 Systems Management Appliance
6.3, 6.2.109330, 6.2.109329, 6.0.101865, 6.0.101864, 6.0.101863, 5.5.x, 5.4.76848, 5.4.76847, 5.4.70402

Troubleshooting, Troubleshooting, Troubleshooting, Troubleshooting

Article History:
Created on: 5/7/2014
Last Update on: 8/26/2015