Return
-
Title
Error: "Unauthorized access, access denied Exception by HRESULT: 0x80070005 (E_ACCESSDENIED)" on Windows asset -
Description
"Check Connection" and "Test System" fails on Windows asset with "Unable to log in to the asset using service account service_account." error.
The event task displays the following error "Unauthorized access, access denied Exception by HRESULT: 0x80070005 (E_ACCESSDENIED)".
Logs may show the error:
Error Unhandled exceptionSystem.Management.ManagementException: Access denied...at Pangaea.Platform.Modules.Common.Windows.WindowsHelper.GetComputerName(String addressOrName, String funcUserName, String funcPassword, Int32 timeout, String& computerName) in D:\BuildAgent2\work\b953f43f68473332\Libs\Modules.Common.Windows\WindowsHelper.cs:line 78ORWarning Unauthorized accessSystem.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))..at Pangaea.Platform.Modules.Common.Windows.WindowsHelper.GetComputerName(String addressOrName, String funcUserName, String funcPassword, Int32 timeout, String& computerName) in D:\BuildAgent2\work\b953f43f68473332\Libs\Modules.Common.Windows\WindowsHelper.cs:line 78
Sessions work without issue. -
Cause
The service account has been denied access by the target system.
-
Resolution
1/ If using Authentication Type "Password" ensure that the username of the Service Account Name set on the "Connection" tab, has been added in unqualified format (e.g. just administrator).
2/ Ensure the password set on the service account in Safeguard matches the password set on the target system
3/ Ensure that the service account has the correct permissions on the target system- A member of the local administrators
- Remote Enable permissions in the WMI CIMV2 namespace
- Enable Account permissions on the WMI CIMV2 namespace- COM Remote Security Activation- Ensure (UAC) User Account Control is disabled for the service account:
When using a local (non domain) administrator that is not the inbuilt administrator, ensure the policy Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options | "User Account Control: Run all administrators in Admin Approval Mode option." is disabled.
If using a local administrator that is the inbuilt administrator, ensure the policy Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options | "User Account Control: Admin Approval Mode for the Built-in Administrator account " is disabled
On Windows 2012 and above, both the UAC slider AND the local policy setting need to be set.
A reboot is required if UAC options are changed
More information on permissions is available here
4/ If using Authentication type Directory and usiing an AD accout. Ensure the AD service account is not disabled or locked. Validate the "Logon Hours" and correct and that "Log On To" is set to "All Computers".
5/ Ensure that the service account login is not being blocked via any environmental Local or Group Policy- Ensure Users or the specific service account is listed in Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment | "Access this computer from the network"- Ensure the user is NOT specified in Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment | "Deny access to this computer from the network"
6/ For workgroup machines, ensure the security policy Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options | "Network access: Sharing and security model for local accounts" is set to "Classical - local users authenticate as themselves"