Shutdown/Restart Script - Access Denied (5)

[CHR1S]

My shutdown script (shutdown /s /f /t 0 /m \\pcname) which has worked fine for many years has just today decided to fail. It displays Access is Denied (5).

Is anyone aware of any recent MS patches or anything that affect RPC?

Thanks

Chris

[srochford]

Could the account you're using to do this have been removed from local admins on the remote machine? Could the machine have lost its AD account?

If you go to the machine can you log on locally and shut it down? Anything in event log?

Is this just a one-off or is it all the time? (If the server service stopped for some reason you wouldn't be able to make an RPC connection but it ought to just start at the next reboot)

[CHR1S]

Hi Steve,

I have been looking into security/permissions but found nothing. I have checked all groups and individual security and it all seems fine and unchanged from when it was working only last week. All services seem to be running fine too. I retested as my own account (domain admin) and then again with the buitin administrator account and got the same error. I have tested from the PDC to the PC and from my non domain laptop (with an authenticated session) to the PC and found the same issue.

Windows firewall is disabled (I checked) but sophos firewall is active but not reporting any blocks.

The only thing I have yet to test is running it localy (will try it next week).

Thanks

Chris

EDIT - This is on all the PCs in one ICT suite and has happened to them all at the same time, hence why i think its an update or similar.

[CHR1S]

I can use shutdown script local on each PC, I have manually (re)added the admin user groups and such on each PC but still get the same error message.

I have a feeling the solution is staring me in the face but it will be the death of me lol!

[CHR1S]

Ok, so im starting to think its permissions issues. I have compared a working PC to a non and there are no differences in users and groups.

Can anyone tell me what user account is used for RPC calls?

Thanks

[mrbios]

I have a shutdown script that probably does the same thing in the same way, the only time ive ever had any access denied issues is when the time was set wrong in the bios/windows, try checking the time settings on the PCs

Afraid that is all i can suggest

[mac_shinobi]

disable the sophos firewall and try again, if not there should hopefully be events in event viewer with errors or something along those lines so report back with any errors if there are any

[K.C.Leblanc]

Might be worth trying PSShurdown instead, should be relatively easy to change your script.

[BJG]

Could try killing all non-essential processes on the client beforehand to see if something's interfering with it.

[CHR1S]

Thanks for the tips guys, I have rulled out sophos, the firewall part isnt even installed. I have already checked the event viewers and found nothing.

Will give PSShutdown a go.

[CHR1S]

Right, hope someone out there is still reading this... finally got some time to look into this further.

Went to drop the psshutdown.exe into the \\PCName\c$ and I get Access Denied. I can connect to the server just not to the ICT Suite PCs. It prompts me for a username and password but no combination works, not even admin prefixed with the domain name.

This all has to be related... what am I missing?

Thanks

Chris

[CHR1S]

Ahaaaaaa, wooooo I've fixed it!!!

Deep in AD a rouge policy where it added a specific user to remote desktop was overwriting the existing users instead of adding to them -
Computer Config - Windows Settings - Security Settings - Local Policies - User Rights Assignment - Access the computer from the network.

Grr all that for one wrong user account in the wrong place.

[manney]

Hi Chr1s,
I had exactly the same problem this morning, could'nt figure out why I was getting the access denied (5) message with the shudown command.

But I tried using the TSSHUTDN command and that worked fine!

TSSHUTDN /? for command syntax

Hope this helps

[mrbios]

Very simple but it has'nt been mentioned, have you checked the computers time? if the time is more than like 5 minutes out of the correct time it'll give you that exact problem

[angelduvon07]

This is actually very simple to fixed, just RDP to the remote computer firts and click>start>run and type secpol.msc>expand local policies>user rights assigment>add the account that you are using to force shutdown from a remote system policy, for example your personal account.