Access denied when trying to manage a computer remotely

[Elly Poppe]

Hi,

I've seen a couple of posts related to this problem, but I
didn't see a resolution. My problem is this, I've recently
upgraded most of our desktops to WXP. Our servers our
running W2k. Since the Upgrade, when I try to manage
local users and groups (or view the Event Viewer)through
the Computer management console (from an XP workstation),
I get an error: access denied. I can still do this from
the servers running W2k. Also, I can manage workstations
still running W2k. And frustratingly enough I have one
(and only one) WXP station that I can remotely manage.
I've been through this workstation with a fine tooth comb
looking for differences. It is in the same OU with the
other PCs. Does anyone know what account is trying to
access the remote computer and what is actually being
accessed. Is it the registry? Also, is there a reference
that anyone knows about that tells what security changes
were made in XP. I've ran into a couple of other access
related issues, but were able to resolve them. I would
appreciate any ideas that anyone might have, I've been
searching for days looking for a hint as to where to look
next!
Thanks in advance,

Elly

 

[davetest]

Hi,

I've seen a couple of posts related to this problem, but I
didn't see a resolution. My problem is this, I've recently
upgraded most of our desktops to WXP. Our servers our
running W2k. Since the Upgrade, when I try to manage
local users and groups (or view the Event Viewer)through
the Computer management console (from an XP workstation),
I get an error: access denied. I can still do this from
the servers running W2k. Also, I can manage workstations
still running W2k. And frustratingly enough I have one
(and only one) WXP station that I can remotely manage.
I've been through this workstation with a fine tooth comb
looking for differences. It is in the same OU with the
other PCs. Does anyone know what account is trying to
access the remote computer and what is actually being
accessed. Is it the registry? Also, is there a reference
that anyone knows about that tells what security changes
were made in XP. I've ran into a couple of other access
related issues, but were able to resolve them. I would
appreciate any ideas that anyone might have, I've been
searching for days looking for a hint as to where to look
next!
Thanks in advance,

Elly

Have you checked to see if there are any policy differences on
the PC's?
start/help and support/use tools to view your computer info...
Advanced system information/view group policy settings applied.

Dave

 

[Elly Poppe]

Thanks Dave,

I looked at the group policy settings and No there aren't
any differences. I do have a couple of machines that are
blocking inheritence of Group policy and the problem
exists there also. I compared the services that are
running on the two machines and the only difference there
is wzcsvc.exe (which I believe has to do with wireless
connectivity) and MDM.exe (which has to do with
debugging). So it doesn't look like a stopped service is
the culprit.
I'll keep looking - anymore ideas are appreciated!
Elly

 

[Tony]

In Group Policy, find the GPO you are pushing compatws with and the
setting is under Computer Configuration | Windows Settings | Security
Settings | Registry. Look for
"MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg".
Double-click it and Click the "Edit Security" button. In the Security
Tab, add "Local Service" by using your local computer as the "From
this Location", and give it "Read" access. Close GP and sync your
domain controllers. At the XP machine at a command prompt type:
gpupdate /target:computer /force. You won't need to reboot. Try to
remotely manage that computer. You should get access.

If you are not pushing this via GPO, it is in the registry under
HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg and set
read security for Local Service. Hope this resolves your issue too!

Tony

 

[Shain Wray [MSFT]]

Hello Elly,

The following KB article should address your issue -

314837 How to Manage Remote Access to the Registry
http://support.microsoft.com/?id=314837

Best regards,
--
Shain Wray
Microsoft PSS Security Team

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!