Re: Access is denied error 5

From: Walt (Walt_at_discussions.microsoft.com)
Date: 01/25/05 

Date: Tue, 25 Jan 2005 09:25:02 -0800

Hey that's great Pavel!

I found now that the Service is getting an Access is denied error when it is
searching the path and gets to a UNC specified value. The file does not
exist there but it is coming back with a wierd error that maps to the Access
denied and premeturely ends the search of the PATH variable for the real
executable.

I know how to Disable UNC error checking for a regular user... but not for a
System process...

For a normal user you put the entry in
[HKEY_CURRENT_USER\Software\Microsoft\Command Processor]
        "DisableUNCCheck"=dword:00000001

Anybody know how to fix that?

"Pavel Lebedinsky" wrote:

> Try running filemon and regmon from SysInternals and look
> for access denied errors.
>
> If that doesn't help, attach windbg to the service process,
> set a breakpoint on kernel32!CreateProcessW (or CreateProcessA)
> and trace its execution using the "wt -or" command to see
> where the error comes from.
>
> "Walt" wrote:
>
> > Currently there are some machines that have problems running an
> > application
> > that is a Windows Service. When Service goes to create a process it gets
> > an
> > error 5 on some machines “Access is denied”.
> >
> > The machines (both good and bad) report that they are at Windows 5.0.2195
> > Service Pack 4 Build 2195.
> >
> > The Service currently has access to the desired executable. The path
> > variable also had the executable in its path.
> >
> > The Service process can indeed “open” the executable for read (it also
> > has
> > execute access).
> >
> > The Service usually attempts to “CreateProcessAsUser” however
> > short-circuiting it to merely do a “CreateProcess” fails in a similar
> > manner
> > (Access Denied).
> >
> > The Service appears to have access to the Winstat0\Default desktop since
> > it
> > is installed with “SERVICE_INTERACTIVE_PROCESS”.
> >
> > Using SysInternals ProcessViewer I have checked the Security attributes
> > for
> > the Windows Service on a "good" machine and “bad” machine. I can see
> > no
> > appreciable differences. However a few (3 fields) do not provide a value
> > on
> > the bad machine however they are shown as “Disabled” on my good
> > machine. The
> > three items are “SeLoadDriverPriv, SeSystemtimePrivilege,
> > SeUndockPrivilege).
> > None of these privileges appear to have any bearing on creating a
> > process….
> > However… the difference is noted.
> >
> > It appears that the "bad" machines can't create a process for some reason.
> >
> > Any ideas???
>
>
>

Relevant Pages

  • Re: Access is denied error 5
    ... > I found now that the Service is getting an Access is denied error when it ... > searching the path and gets to a UNC specified value. ...
    (microsoft.public.platformsdk.security)
  • Re: How to write a nested loop using sql cursors
    ... The real trick in optimizing your code is to NOT execute any sql over and ... over in the loop. ... That means you want to open the table up ONCE, and then do your searching. ... A simple query can match ...
    (microsoft.public.access.forms)
  • RE: .Execute vexing me
    ... "Klatuu" wrote: ... Can I go back to my nap now? ... searching and I was misinterpreting the function itself. ... set a breakpoint at the .Execute line then step ...
    (microsoft.public.access.modulesdaovba)
  • Re: Newsgroups error combining messages
    ... avoid the delays with OE searching for hyperlinks. ... ErrMsg The Command Failed to Execute ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
  • Re: exec code in "globaldict"
    ... > I kept searching my online and offline python ressources to figure out ... > how to execute some code in the global dictionary. ...
    (comp.lang.python)