-
Title
Error: "Access is denied." User Account Control blocks local user password management on Windows 2008 and above -
Description
Functional account may not be able to change local passwords when UAC (User Account Control) is enabled on Windows 2008, Windows 2012, Windows 2016, Windows 7, Windows 8 or Windows 10.
When attempting to "Reset Password" on a managed account you may see "Error: Access is denied." in the logs.
[MM/DD/YYYY HH:MM:SS] Gathering the change details for ppm on WindowsServer...
[MM/DD/YYYY HH:MM:SS] Setting the new (Windows) password for ppm on TestUAC (ip_address) using WINDOWSSERVER\funcacct and win...
[MM/DD/YYYY HH:MM:SS] Error: Access is denied.
[MM/DD/YYYY HH:MM:SS] Unable to change the password for ppm. General help for this error - verify network connectivity, account access and appropriate administrative privileges.
[MM/DD/YYYY HH:MM:SS] An error occurred changing the password for ppm on WindowsServer.If using a DPA you may see the below error
[MM/DD/YYYY HH:MM:SS] rpc command function failed! (NT_STATUS_ACCESS_DENIED)[MM/DD/YYYY HH:MM:SS] return code = -1[MM/DD/YYYY HH:MM:SS] Setting the new (Windows) password for user1 on windows7.yourdomain.com(ip_address) failed...[MM/DD/YYYY HH:MM:SS] An error occurred changing the password for ppm on WindowsServer -
Cause
This is as designed by Microsoft when UAC is enabled for the account. If the account that's being used as a functional account puts up a UAC dialog in order to do something TPAM has absolutely no way to click/accept or dismiss the dialog. Microsofts secure design of UAC means that a person at the keyboard has to interact with the alert and accept. -
Resolution
RESOLUTION 1 - Using the built-in "Administrator" account
The Built-In "Administrator" account by default is exempt from the UAC restrictions.
This requires the Local Security Policy | Local Policies | Security Options | "User Account Control: Admin Approval Mode for the Built-in Administrator account" policy to be left at the default or set to Disabled.
Changes to the local security policy or UAC will requre a reboot to take effect.
RESOLUTION 2 - To allow another account besides Administrator to act as functional account
Add the selected local user to the "Administrator" group
Disable UAC on the server by changing the slider to "Never Notify" or set the Local Security Policy | Local Policies | Security Options | "User Account Control | Run all administrators in Admin Approval Mode:" policy to Disabled.
On Windows 2012 and above, both the UAC slider AND the local policy setting need to be set.
Changes to the local security policy or UAC will requre a reboot to take effect.
RESOLUTION 3 - Using a domain account
If the machine is joined to a domain use a Domain Account which is a member of the Local Administrators group.
As per the below MSDN article "User Account Control and WMI", UAC does not apply to domain accounts.
Inside Windows 7 User Account Control -
Change Request
3515