Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

[curwin]

I manage hundreds of computers, and BatchPatch works fine on almost all of them. However, I have two Windows Server 2003 computers (haven’t managed to get rid of them yet), for which whenever I run a BatchPatch command I get the following error:

Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

I am an admin on those machines, and I can remotely manage them in every other way I can think of – computer management, psexec, remote registry, administrative shares.

I don’t have this problem on other 2003 servers.

Any ideas?

Thanks,

David

[jwiseguy]

Hello Curwin,

What happends if you run BatchPatch from the server what you want to update? Do you get the same Access is denied error?

[curwin]

No, when I run BatchPatch from the problematic server it works properly.

[doug]

curwin – That is certainly peculiar. Thanks for trying jwiseguy’s suggestion. That does help narrow it down a bit. The next thing I would suggest trying is from the computer running BatchPatch to the target computer, what happens when you try to connect to the two following shares?

\targetcomputerc$program filesbatchpatch

\targetcomputeradmin$

Are you able to connect to the two shares? Are you able to create files in the two shares?

Thanks,

Doug

[curwin]

Yes, I can connect to the shares and create files.

Is there something I can audit to see what is causing the access denied error?

[doug]

One other thing that I’d like you to check is just running PsExec at the command line against that target computer. What happens if you run:

psexec \targetcomputer IPCONFIG

Let’s make sure that the above command works, as expected.

Assuming the above command works, then I can only think of two other possible issues. If the command does not work, please let me know, and please tell me the exact error message that appears. If the command *does* work, then please read below.

1. When BatchPatch executes a Windows Update action, the first thing it does is deploy the BatchPatchRemoteAgent.exe to the target system in C:Program FilesBatchPatch. However, if that file is already running/locked on the target system, then when BP tries to deploy it, it is unable to overwrite the copy that is already there and running because that copy is locked by the target OS. So, please pay attention to the C:Program FilesBatchPatch dir on the target computer when you initiate the Windows Update action. Let me know what you see. Is the file already there and locked by the target OS? Or are you able to see the file appear and then disappear at the start/end of the action?

2. It’s possible that the BatchPatchRemoteAgent.exe is getting locked by the target system because of some HIPS (host intrusion prevention software) or AV (anti-virus) software or some other similar security software. See if you can disable any software like that on the target, or at least white-list BatchPatchRemoteAgent.exe.

Let me know what you discover.

Thanks,

Doug

[curwin]

OK, I did some digging and found the problem – and the solution.

psexec \targetcomputer IPCONFIG worked, and it also worked as a remote command within BatchPatch. That led me to wonder if there was a specific problem with WMI. I wrote a simple VBS script that made a WMI query against the remote server, and that also failed with “access denied”.

That led me to investigate what problems there could be with my WMI permissions. Looking at various forums, I found that the issue seemed to lie in Component Services. I compared another server of the same operating system (but one that didn’t have a problem in BatchPatch), and matched the settings under My Computer -> Default Properties, and MSDTC -> Security Configuration.

After a reboot, everything works! So maybe this will be able to help someone else with a similar problem.

[doug]

Excellent! I’m glad you got it figured out. Thank you for sharing your findings.

-Doug

[will]

Hi am getting

Fri-15:35:15> Deployment: Error: The process cannot access the file ‘\xxxxC$Program FilesBatchPatchdeploymentsourcesen-ussetupprep.exe.mui’ because it is being used by another process.

and this message Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

I can force remote reboot, send message to remote computer view c: drive details

[doug]

I would suggest you first follow the troubleshooting guide and make sure that you can complete the ‘Windows Update’ section. If ‘Check for available updates’ is working properly, then the permissions should be fine for deployments. In that case, it sounds like when you are beginning the deployment some other process (not BatchPatch) is locking the file. Anti-virus software could be one example of software that might do this. Another possibility that could cause this is if you try to execute the same BatchPatch deployment twice. The second one attempts to execute while the first one is still executing, and then it produces this error.

[Author]

Posts