IBM Support

IT18097: UNABLE TO CONFIGURE CAD VIA GUI WIZARD WITH STRICT MCAFEE POLICY ENABLED

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • Using the wizard to initially configure the client schedule
    service to use the client acceptor daemon (GUI menu -> Utilities
     -> Setup Wizard -> Help me configure the TSM Client Scheduler)
    may fail to complete if you have a strict policy configured
    within the McAfee software which blocks attempts in accessing
    registry entries with read/write access within the SERVICES
    registry key.
    
    Customer/L2 Diagnostics (If Applicable)
    
    If McAfee is configured in such a way to block read/write access
    to registry keys within the SERVICES subkey of a control set, it
    will report a message similar to the following when the Wizard
    is used to configure the schedule service :
    
    2016-08-17 14:43:12 Blocked by Access Protection rule
     Mysys\Myadm D:\PROGRAM
    FILES\TIVOLI\TSM\BACLIENT\DSMAGENT.EXE HKLM\SYSTEM\CONTROLSET001
    \SERVICES\MCAFEEFRAMEWORK\ Common Standard Protection:Prevent
    modification of McAfee Common Management Agent files and
    settings Action blocked : Write
    
    The above indicates that the DSMAGENT.EXE program requires write
    access to the SERVICES\MCAFEEFRAMEWORK key and you might have a
    policy configured in such a way to block this attempt, which
    will cause the wizard to fail when configuring the schedule
    service. The only error logged, will be a GUI popup stating that
    the configuration could not complete. There is nothing logged in
    the clients error log.
    
    During the configuration, the Tivoli Storage Manager client
    will open all SERVICES subkeys within the most recent control
    set (the currentcontrolset is a pointer to the controlset000X
    key) to find all related services to the Tivoli Storage Manager
    client itself. It will open each service found with the default
    access of "read/write", even though it's only performing a query
    of the service. The client will not be making any amendments to
    the key itself.
    
    This APAR was taken to adjust the client so it has a "least
    permission required" access when accessing the registry, so for
    the SERVICES, it will query each service with readonly access
    and avoid the potential block attempt by the McAfee software.
    This only affects the wizard and not the command line, dsmcutil.
    
    
    Tivoli Storage Manager Versions Affected:
    Tivoli Storage Manager and IBM Spectrum Protect version 6.3, 7.1
    and above on Windows
    
    Initial Impact: Low|Medium|High
    Low
    
    Additional Keywords:
    TSM, Spectrum Protect,  cad, wizard, gui, config, av
    

Local fix

  • Disable the McAfee software prior to using the wizard or use the
     dsmcutil command line to install the CAD
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED:                                              *
    * IBM Spectrum Protect Backup-Archive Client GUI Version       *
    * 7.1.3, 7.1.4 and 7.1.6 running on all Windows platforms.     *
    ****************************************************************
    * PROBLEM DESCRIPTION:                                         *
    * See ERROR DESCRIPTION                                        *
    ****************************************************************
    * RECOMMENDATION:                                              *
    * Apply fixing level when available. This problem is currently *
    * projected to be fixed in level 7.1.8 and 8.1.2.  Note that   *
    * until these levels are available, this information is        *
    * subject to change at the discretion of IBM.                  *
    ****************************************************************
    *
    

Problem conclusion

  • The problem has been fixed so that Client Scheduler (managed by
    CAD) can be successfully installed via Client Java GUI's Setup
    wizard and with no conflicts with McAfee software.
    

Temporary fix

Comments

  • *
    

APAR Information

  • APAR number

    IT18097

  • Reported component name

    TSM CLIENT

  • Reported component ID

    5698ISMCL

  • Reported release

    71W

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-11-23

  • Closed date

    2017-03-06

  • Last modified date

    2017-06-13

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Modules/Macros

  • dsm
    

Fix information

  • Fixed component name

    TSM CLIENT

  • Fixed component ID

    5698ISMCL

Applicable component levels

  • R81W PSY

       UP



Document information

More support for: Tivoli Storage Manager

Software version: 71W

Reference #: IT18097

Modified date: 13 June 2017