Return
-
Title
Error, "Unauthorized access, access denied Exception by HRESULT: 0x80070005 (E_ACCESSDENIED)" -
Description
"Check Connection" and "Test System" fails on Windows asset with "Unable to log in to the asset using service account service_account." error.
The event task displays the following error "Unauthorized access, access denied Exception by HRESULT: 0x80070005 (E_ACCESSDENIED)".
Logs may show the error:Monday, January 1, 2019 0:00:00 PM Error Unhandled exceptionSystem.Management.ManagementException: Access denied...at Pangaea.Platform.Modules.Common.Windows.WindowsHelper.GetComputerName(String addressOrName, String funcUserName, String funcPassword, Int32 timeout, String& computerName) in D:\BuildAgent2\work\b953f43f68473332\Libs\Modules.Common.Windows\WindowsHelper.cs:line 78ORJanuary 1 2018 0:00:00 Warning Unauthorized accessSystem.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))..at Pangaea.Platform.Modules.Common.Windows.WindowsHelper.GetComputerName(String addressOrName, String funcUserName, String funcPassword, Int32 timeout, String& computerName) in D:\BuildAgent2\work\b953f43f68473332\Libs\Modules.Common.Windows\WindowsHelper.cs:line 78
Sessions work without issue. -
Cause
The service account has been denied access by the target system.
-
Resolution
1/ Ensure that the username of the Service Account Name set on the "Connection" tab, has been added in unqualified format (e.g. just administrator)
2/ Ensure the password set on the service account in Safeguard matches the password set on the target system
3/ Ensure that the service account has the correct permissions on the target system- A member of the local administrators
- Remote Enable permissions in the WMI CIMV2 namespace
- Enable Account permissions on the WMI CIMV2 namespace- COM Remote Security Activation- Ensure (UAC) User Account Control is disabled for the service account:
When using a local (non domain) administrator that is not the inbuilt administrator, ensure the policy Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options | "User Account Control: Run all administrators in Admin Approval Mode option." is disabled.
If using a local administrator that is the inbuilt administrator, ensure the policy Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options | "User Account Control: Admin Approval Mode for the Built-in Administrator account " is disabled
On Windows 2012 and above, both the UAC slider AND the local policy setting need to be set.
A reboot is required if UAC options are changed
More information on permissions is available here4/ Ensure that the service account login is not being blocked via any environmental Local or Group Policy- Ensure Users or the specific service account is listed in Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment | "Access this computer from the network"- Ensure the user is NOT specified in Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment | "Deny access to this computer from the network"
5/ For workgroup machines, ensure the security policy Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options | "Network access: Sharing and security model for local accounts" is set to "Classical - local users authenticate as themselves"