Shutdown/Restart Script - Access Denied (5)

[CHR1S]

My shutdown script (shutdown /s /f /t 0 /m \\pcname) which has worked fine for many years has just today decided to fail. It displays Access is Denied (5).

 

Is anyone aware of any recent MS patches or anything that affect RPC?

 

Thanks

 

Chris

[srochford]

Could the account you're using to do this have been removed from local admins on the remote machine? Could the machine have lost its AD account?

 

If you go to the machine can you log on locally and shut it down? Anything in event log?

 

Is this just a one-off or is it all the time? (If the server service stopped for some reason you wouldn't be able to make an RPC connection but it ought to just start at the next reboot)

[CHR1S]

Hi Steve,

 

I have been looking into security/permissions but found nothing. I have checked all groups and individual security and it all seems fine and unchanged from when it was working only last week. All services seem to be running fine too. I retested as my own account (domain admin) and then again with the buitin administrator account and got the same error. I have tested from the PDC to the PC and from my non domain laptop (with an authenticated session) to the PC and found the same issue.

 

Windows firewall is disabled (I checked) but sophos firewall is active but not reporting any blocks.

 

The only thing I have yet to test is running it localy (will try it next week).

 

Thanks

 

Chris

 

EDIT - This is on all the PCs in one ICT suite and has happened to them all at the same time, hence why i think its an update or similar.

Edited April 3, 2009 by CHR1S
added extra info

[CHR1S]

I can use shutdown script local on each PC, I have manually (re)added the admin user groups and such on each PC but still get the same error message.

 

I have a feeling the solution is staring me in the face but it will be the death of me lol!

[CHR1S]

Ok, so im starting to think its permissions issues. I have compared a working PC to a non and there are no differences in users and groups.

 

Can anyone tell me what user account is used for RPC calls?

 

Thanks

[mrbios]

I have a shutdown script that probably does the same thing in the same way, the only time ive ever had any access denied issues is when the time was set wrong in the bios/windows, try checking the time settings on the PCs

 

Afraid that is all i can suggest

[mac_shinobi]

disable the sophos firewall and try again, if not there should hopefully be events in event viewer with errors or something along those lines so report back with any errors if there are any

[K.C.Leblanc]

Might be worth trying PSShurdown instead, should be relatively easy to change your script.

[BJG]

Could try killing all non-essential processes on the client beforehand to see if something's interfering with it.

[CHR1S]

Thanks for the tips guys, I have rulled out sophos, the firewall part isnt even installed. I have already checked the event viewers and found nothing.

 

Will give PSShutdown a go.

[CHR1S]

Right, hope someone out there is still reading this... finally got some time to look into this further.

 

Went to drop the psshutdown.exe into the \\PCName\c$ and I get Access Denied. I can connect to the server just not to the ICT Suite PCs. It prompts me for a username and password but no combination works, not even admin prefixed with the domain name.

 

This all has to be related... what am I missing?

 

Thanks

 

Chris

[CHR1S]

Ahaaaaaa, wooooo I've fixed it!!!

 

Deep in AD a rouge policy where it added a specific user to remote desktop was overwriting the existing users instead of adding to them -

Computer Config - Windows Settings - Security Settings - Local Policies - User Rights Assignment - Access the computer from the network.

 

Grr all that for one wrong user account in the wrong place.

[manney]

Hi Chr1s,

I had exactly the same problem this morning, could'nt figure out why I was getting the access denied (5) message with the shudown command.

 

But I tried using the TSSHUTDN command and that worked fine!

 

TSSHUTDN /? for command syntax

 

Hope this helps

[mrbios]

Very simple but it has'nt been mentioned, have you checked the computers time? if the time is more than like 5 minutes out of the correct time it'll give you that exact problem

[angelduvon07]

This is actually very simple to fixed, just RDP to the remote computer firts and click>start>run and type secpol.msc>expand local policies>user rights assigment>add the account that you are using to force shutdown from a remote system policy, for example your personal account.

[CHR1S]

This is actually very simple to fixed, just RDP to the remote computer firts and click>start>run and type secpol.msc>expand local policies>user rights assigment>add the account that you are using to force shutdown from a remote system policy, for example your personal account.

 

Erm, thanks for the reply but this is a year old and solved!

 

Welcome BTW, go say Hi in the new members thread

[heart1lover]

I have a same problem . access is denied (5) when i try shudown/i

i m using windows 7 just help me plz plzplzplz i m waiting thx

[srochford]

What kind of machine? ie - is it managed by someone else? An administrators can configure a machine so that it can't be shutdown by a non-admin user. If you don't manage the computer you can't shutdown then that may be why.

 

If, on the other hand, you're the administrator and you don't know why it's not letting you shut down then you've probably set the policy to prevent shutdown.

[heart1lover]

1st of all thx for the reply

 

i m using Win 7 & and i m using Admin account my personal account and i also try the default admin account but the problem is the same

i try to ping the computer on my network it's work.....

but when i try the shutdown -i Or /i

i enter victim computer name the error message appear

Access denied (5)

so do me a favour plz help me out on this plz

[CHR1S]

1st of all thx for the reply

 

i m using Win 7 & and i m using Admin account my personal account and i also try the default admin account but the problem is the same

i try to ping the computer on my network it's work.....

but when i try the shutdown -i Or /i

i enter victim computer name the error message appear

Access denied (5)

so do me a favour plz help me out on this plz

 

Im hoping that some of the terms used are because of the poor translation, but "victim"? Do you have admin rights on the "victims" PC?

[heart1lover]

Im hoping that some of the terms used are because of the poor translation, but "victim"? Do you have admin rights on the "victims" PC?

 

so Mr. chris so tell me how i check that either i have the admin right on the victims pc or not

in detail thx for the reply

[CHR1S]

I don't think I will be helping you any further as to me you are using this information for malicious purposes, apologies if this isn't the case but I cant be sure.

[heart1lover]

it's fine this is not the only web which can help me

 

but let me clear one thing..

i am not using this for malicious purposes.

just i want to learn this bcoz i m running my own business in jeddah related to computer maintenance and networking..

it's fine if you can't help me thx for your time

[CHR1S]

When you invoke the shutdown -i command for any PC you are using the Remote Procedure Call service. If you do this on your own PC it will run as you have administrator access, however on the remote PC it has no way of authenticating your user account on your local PC and you are seeing the Access denied.

For the shutdown to work you have to ensure the PC you run the shutdown from has the correct security permissions on the target PC.

 

I wont go into further detail but that should give you the starting information to do your own research

[computerer]

I have the same problem using shutdown.exe to shutdown remote computer. Somehow I managed to fix this by adding NETWORK to the allowed user/group to perform "force shutdown from a remote system" on the local policy of the machine you are trying to shutdown.

1. Logon to the remote machine as administrator (the computer you want to shutdown remotely).

2. run "secpol.msc" > local policies > user rights assignment > force shutdown from a remote system

3. Add NETWORK

 

Hope this help.