«Access is denied» error when you try to create NTDS Settings object

This article provides a solution to fix an error (Access is denied) that occurs when you promote new Windows Server 2012 R2 domain controllers in an existing domain.

Original product version: В Windows Server 2012 R2
Original KB number: В 3207962

Symptoms

When you try to promote new Windows Server 2012 R2 domain controllers in an existing domain, the operation fails with an «Access is denied» error. This issue occurs even when the user is a member of the Domain Admins or Enterprise Admins group.

In this situation, the administrator sees the following error message:

Title: Windows Security
Message Text: Network Credentials

The operation failed because: Active Directory Domain Services could not configure the computer account $ to the remote Active Directory Domain Controller account . «Access is denied»

The failure occurs when adding the NTDS Settings object for the new Domain Controller, returning the following error message:

The operation failed because:

Active Directory Domain Services could not create the NTDS Settings object for this Active Directory Domain Controller CN=NTDS Settings,CN=TEST-DC,CN=Servers,CN=mysite,CN=Sites,CN=Configuration,DC=domain,DC=com on the remote AD DC DCName.ChildDomain.domain.com. Ensure the provided network credentials have sufficient permissions.

Additionally, the DCPromo.log file shows the following errors:

Error — Active Directory Domain Services could not create the NTDS Settings object for this Active Directory Domain Controller CN=NTDS Settings,CN=TEST-DC,CN=Servers,CN=mysite,CN=Sites,CN=Configuration,DC=domain,DC=com on the remote AD DC DCName.ChildDomain.domain.com. Ensure the provided network credentials have sufficient permissions. (5)

DateTime[INFO] EVENTLOG (Error): NTDS General / Internal Processing: 1168 Internal error: An Active Directory Domain Services error has occurred.

Error value (decimal):

Error value (hex):

Internal ID: 30017c6

.
DateTime[INFO] NtdsInstall for ChildDomain.domain.com returned 5
DateTime [INFO] DsRolepInstallDs returned 5
DateTime [ERROR] Failed to install to Directory Service (5)
DateTime[ERROR] DsRolepFinishSysVolPropagation (Abort Promote) failed with 8001
DateTime[WARNING] Failed to abort system volume installation (8001)
DateTime[INFO] Starting service NETLOGON
DateTime[INFO] Configuring service NETLOGON to 2 returned 0
DateTime[INFO] The attempted domain controller operation has completed

Where the errors map to the following:

Cause

This issue occurs because the Add/Remove Replica In Domain permission is missing for the Domain Admins and Enterprise Admins groups on the domain partition of the domain.

Resolution

To resolve this issue, follow these steps:

Verify that all the steps and conditions in the «Resolution» section of Knowledge Base article 2002413 are true for your environment.

If domain controller promotion still fails even after you make sure that the user also has the SeEnableDelegationPrivilege permission, check ADSIEdit.msc to verify the user’s effective permissions for the domain partition:

Click Start, click Run, and then type adsiedit.msc.

Expand Default naming context, right-click DC=domain,DC=com, and then click Properties.

On the Security tab, click the Advanced button.

On the Effective Access tab, enter the user or group name of the user who is performing the operation that’s failing in DCPromo.

Confirm whether the Add/remove replica in domain control access permission has been granted.

If the Add/Remove Replica In Domain permission is missing for the user or group, add it by using ADSIEdit.msc:

Click Start, click Run, and then type adsiedit.msc.

Expand Default naming context, right-click DC=domain,DC=com, and then click Properties.

On the Security tab, click the Advanced button.

On the Permissions tab, add the Add/remove replica in domain control access permission for the desired user or group as follows:

Type: Allow
Applies to: This object only

More information

there could be additional reasons why a domain controller promotion or demotion fails with an «Access is denied» error. For more information, see KB 2002413.

OpenProcess: access denied error only on Windows 8.1

I have a program which adjusts SeDebugPrivilege and then starts to iterate through system processes and calls OpenProcess for them (and does other stuff, but it’s not important now). Also the program runs in administrator mode of course. On Windows XP and Windows 7 it works fine, but on Windows 8.1 OpenProcess fails for the following system processes with ERROR_ACCESS_DENIED(5): smss.exe, csrss.exe, services.exe. As I know with SeDebugPrivilege I should be able to open these processes and retrieve a handle for them. Does anybody have a clue, what kind of magic causes this error only on Windows 8.1?

(Anyway I have the same error with the same processes for CreateToolhelp32Snapshot)

3 Answers 3

Windows 8.1 introduces the concept of a system protected process. This is documented in the context of third-party anti-malware software, but it seems reasonable to suppose that it is also used to protect particularly critical system processes.

System protected processes are an extension of the Protected Process mechanism (Microsoft Word document) introduced in Windows Vista as a DRM measure.

You cannot obtain any of these access rights for a protected process, even with debug privilege:

• DELETE
• READ_CONTROL
• WRITE_DAC
• WRITE_OWNER
• PROCESS_CREATE_THREAD
• PROCESS_DUP_HANDLE
• PROCESS_QUERY_INFORMATION
• PROCESS_SET_QUOTA
• PROCESS_SET_INFORMATION
• PROCESS_VM_OPERATION
• PROCESS_VM_READ
• PROCESS_VM_WRITE

You should still be able to open the process by requesting PROCESS_QUERY_LIMITED_INFORMATION access. According to the documentation, SYNCHRONIZE and PROCESS_TERMINATE access are also permitted.

It can only be done in the kernel. The best way to get the info you need would be to:

Or if you are just experimenting and not putting anything into production code, you can traverse the various semi-opaque structures (EPROCESS, PEB, VAD, etc) to get the information you need.

I was recently running into Access is Denied errors (error code 5 in my case), while running the Win32 OpenProcess API and then later while running CreateProcessAsUser. In my case, I was running on Windows 10, but I suspect it’s similar, but since I got it working I thought I would share a couple things that helped me.

As I was using C# my Win32 method signature is as follows:

One key factor that effected the success of accessing the existing process, which in my case was a winlogon.exe process, was to properly defined the right «desired access» value. In my case, I used a constant «MAXIMUM_ALLOWED» defined as:

This call to the service looks like this:

This established the right kind of access. I was also running my process (web service) as the LocalSystem account, which had pretty good privileges. It started off as:

Please note, I was able to run this command using the SYSTEM account, by downloading PsExec.exe and running PsExec.exe -i -s cmd.exe to launch a command prompt so I could query the privileges using that account. You can find a good list of permissions here:

In my case, I wanted to add SeAssignPrimaryTokenPrivilege and SeIncreaseQuotaPrivilege, which I added via secpol.msc:

Your particular permissions required may depend on the account you’re using, but I hope this helps!

How to avoid “WindowsError: [Error 5] Access is denied”

There’s the script to re-create folder:

This works nearly always, but in some cases (on creation step) I get

What could cause this error and how can I avoid it?

7 Answers 7

See RemoveDirectory documentation; «The RemoveDirectory function marks a directory for deletion on close. Therefore, the directory is not removed until the last handle to the directory is closed.»

This means that if something manages to create a handle to the directory you remove (between creation and removal) then the directory isn’t actually removed and you get your ‘Access Denied’,

To solve this rename the directory you want to remove before removing it.

can fail, solve with;

Permissions might be the problem, but I had the same problem ‘[Error 5] Access is denied’ on a os.rename() and a simple retry-loop was able to rename the file after a few retries.

What could cause this error?

You simply do not have access to the folder you are writing in for the process that is currently running (python.exe), or maybe even for the user. Unless your user is an admin there may be directories for which you do not have write permissions.

How can I avoid it?

In general to avoid such an exception, one would use a try and except block, in this case it would be an IOError . Therefore if you just want to overlook access denied and continue with the script you can try:

If you truly were not expecting this error and it is not supposed to happen you have to change the permissions for the file. Depending on your user permissions there are various steps that you could take.

User that can execute programs as Admin: Option A

1. Right-Click on cmd.exe .
2. Click on Run as Administrator.
3. Go to your script location via cd since it will be opened at C:\Windows\system32 unless you have edit certain parameters.
4. Run your script > python myscript.py .

User that can execute programs as Admin: Option B

1. Open file explorer.
2. Go to the folder, or folders, you wish to write in.
3. Right-Click on it.
4. Select Properties.
5. In the properties window select the security tab.
6. Click Edit and edit it as you wish or need to give access to programs or users.

User with no Admin privileges:

1. This probably means it is not your computer.
2. Check for the PC help desk if at Uni or Work or ask your teacher if at School.
3. If you are at home and it is your computer that means you have logged in with a non-admin user. The first one you create typically is by default. Check the user settings in the Control Panel if so.
4. From there on the rest is pretty much the same afterwards.

How to fix — Error 5: Access is Denied in Windows 10

Replies (13) 

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

Thank you for posting your query in Microsoft Community.

Error indicates that you wont have required privileges to install the application to that particular system drive. Right-click on the application(.exe) file and select Run as administrator installing the same. Do f ollow the below mentioned steps and heck if it helps.

Method 1:

Open the properties of the main User Profile folder where the files are located (such as Documents, Pictures, etc.). You can open the properties of a particular folder by Right-clicking on it and select Properties from context menu.

Go to the Security tab and click Advanced. Check the box at the bottom of this window. It is labeled «Replace all child object permissions with inheritable permissions from this object» and then click Ok.

This does a one-time action that replaces the security on all the files/subfolders. It’s one-time, so you won’t find that box checked if you peek at it later. Please let us know if it’s working

Method 2:

* Press Windows Key + R , type netplwiz

* Click and highlight the User profile, which you want to make administrator

* Click on Properties , then select the Group Membership tab

* Select the Administrator, Click apply/ok

Windows API error 5: “Access is denied” when trying to compile TikZ picture

I installed PGF but are unable to compile the following document:

This is the console output:

11 Answers 11

You have to give yourself the permissions to read and write in MiKTeX 2.9 folder.

Go to Program Files and right click MiKTeX 2.9 folder. Then click Properties > Security Tab > Edit Button. Select Users (Bla/Bla) from the list and check all grants.

If that is not enough, click Advanced button on the Security Tab. A window named Advanced Security Settings for Folder Name pops up. Then click Auditing Tab > Continue Button > Add Button. Type Users under «Enter the object names to select» and click OK.

Or, simply don’t put your MiKTeX 2.9 folder into Program Files .

This seems to be some form of conflict between MiKTeX and another software, maybe Adobe Reader.

I looked around and found the following related post with a solution. It is about the installation, not compilation but the reason and fix should be identical:
http://entangled.wordpress.com/2009/09/18/installation-of-miktex-2-8-failed/

A possible solution was posted as a comment there:

I have got the real solution 🙂
Run regedt32.exe , then navigate to HKEY_CLASSES_ROOT\.pdf
Rightclick .pdf , click permissions, and grant the administrator full rights.

I found another potential solution to this problem: make sure that your TMP environment variable points to a writable source. For instance, I changed my TEMP and TMP environment variables (System -> Advanced -> Env. Variables) to a drive other than C:, but I accidentally had the TMP instance point to the D: drive instead of E: — the former was unwritable. The API Access Error 5 for the MikTeX installation/removal was resolved when I fixed the TMP path.

Hope that helps someone.

Apparently you need Administrator rights. What is important is how you installed miktex. If you are asked wether you want to install miktex just for the current user or for all, I reccommend selecting install for all. If you select just for me, it is installed without admin rights, even if the logged in user is in fact an Administrator.

In short: uninstall and install with option «install» for all users» fixed it for me

I got the same error during MiKTeX’s installation. To solve this, I right clicked on the downloaded MiKTeX installation file, «Run as administrator», and marked the «Install for all users» box. Everything worked after that.

I found this error as I was trying to install MiKTeX from the downloaded folder. I copied the file to a new folder and it worked properly.

The problem is that in Windows-MiKTeX the following code:

(search for it in *.cpp files) does not function correctly (e.g. install MikTeX to the program folder and then try to run it without admin rights). After replacing the above code with:

the compiled MiKTeK does run without admin rights. Of course, there should be a better solution, replacing the code with something that supplies the correct answer to the read-only question.

In my case, I closed Kile, simply deleted every file, except the BIB and the TEX files, and re-ran PDFLaTeX. That solved it.

I experienced that this problem arrises when a new package is installed and I press ‘stop’ at the «play/stop» button (to generate a PDF) too soon. When I press too soon the package is not installed correctly and it will not work, giving acces denied. In my case I saved my tex code file in a .txt file and deleted the entire editing program from my program files (Texworks, MIkTex). Make sure to first shut down your computer, because all relating programs have to be closed (best achieved by just shutting down the computer). Then re-install your program again and make sure to not click the «play/stop» button too soon again when a package is installed. It worked for me so I figured why not share it ;)!

Just wanted to mention a scenario where I got error 5 ‘access denied’.

I run lualatex from an ASP.NET web site under impersonation. According to this http://support.microsoft.com/en-us/kb/317012 an impersonating user actually uses Default User directory and runs as NETWORK SERVICE. I might be getting it wrong, but the solution is anyway,

to create MikTex folder under Default User\Application Data give NETWORK SERVICE Write/Modify access to that folder. Then I had to give NETWORK SERVICE write/modify access to the folder where the web page dumped the .tex files to be compiled.

Hoping that helps someone.

What I have realized during my multiple attempts to install Miktex is that the most common mistake people do (like me) is to run the setup as normal user! Setup must «Run as Admin» Thanks

Not the answer you’re looking for? Browse other questions tagged tikz-pgf errors miktex windows or ask your own question.

Linked

Related

Hot Network Questions

Subscribe to RSS

To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

site design / logo © 2021 Stack Exchange Inc; user contributions licensed under cc by-sa. rev 2021.4.16.39093

By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.