Re: Access is denied error 5

From: Walt (Walt_at_discussions.microsoft.com)
Date: 01/25/05

  • Next message: Angelo F.: "I need a gina stub working with server 2003 in Terminal Service" 
    Date: Tue, 25 Jan 2005 11:37:05 -0800

    I posted a reply... but I don't see it yet.... its been over a half hour... so

    Thanks Pavel!!

    FileMon showed me what was going on.

    The Service was getting Access is denied when it got to a UNC specified
    entry in the PATH environment variable for the process. Since the system
    process has no network credentials it gets this error. However this short
    circuits the search... further down the path the file is found. So its
    really a bug....

    I know of a way to disable UNC checking for regular users... but not for a
    System Process....

    Anyone know of something there?

    Thanks!!

    "Pavel Lebedinsky" wrote:

    > Try running filemon and regmon from SysInternals and look
    > for access denied errors.
    >
    > If that doesn't help, attach windbg to the service process,
    > set a breakpoint on kernel32!CreateProcessW (or CreateProcessA)
    > and trace its execution using the "wt -or" command to see
    > where the error comes from.
    >
    > "Walt" wrote:
    >
    > > Currently there are some machines that have problems running an
    > > application
    > > that is a Windows Service. When Service goes to create a process it gets
    > > an
    > > error 5 on some machines “Access is denied”.
    > >
    > > The machines (both good and bad) report that they are at Windows 5.0.2195
    > > Service Pack 4 Build 2195.
    > >
    > > The Service currently has access to the desired executable. The path
    > > variable also had the executable in its path.
    > >
    > > The Service process can indeed “open” the executable for read (it also
    > > has
    > > execute access).
    > >
    > > The Service usually attempts to “CreateProcessAsUser” however
    > > short-circuiting it to merely do a “CreateProcess” fails in a similar
    > > manner
    > > (Access Denied).
    > >
    > > The Service appears to have access to the Winstat0\Default desktop since
    > > it
    > > is installed with “SERVICE_INTERACTIVE_PROCESS”.
    > >
    > > Using SysInternals ProcessViewer I have checked the Security attributes
    > > for
    > > the Windows Service on a "good" machine and “bad” machine. I can see
    > > no
    > > appreciable differences. However a few (3 fields) do not provide a value
    > > on
    > > the bad machine however they are shown as “Disabled” on my good
    > > machine. The
    > > three items are “SeLoadDriverPriv, SeSystemtimePrivilege,
    > > SeUndockPrivilege).
    > > None of these privileges appear to have any bearing on creating a
    > > process….
    > > However… the difference is noted.
    > >
    > > It appears that the "bad" machines can't create a process for some reason.
    > >
    > > Any ideas???
    >
    >
    >

  • Next message: Angelo F.: "I need a gina stub working with server 2003 in Terminal Service"