Cluster Automation Server: Access Denied for [NT AUTHORITY\SYSTEM]

[Simon]

Hi All,

I'm hoping someone will have some words of wisdom for me regarding MS
Clustering on Windows 2003.

I have a service that runs on a cluster. During invocation it's
supposed to determine from the cluster which node is active (this is a
active/standby configuration) and either proceed or sleep depending on
the status. The interface to the cluster is that advertised by the
standard interop layer built by Visual Studio for the Microsoft Cluster
Service Automation Classes (MSClusterLib)

The problem is that when the service runs under the Local System
context the call to the open the cluster object fails with an Access
Denied exception being reported from the underlying COM interface.

System.UnauthorizedAccessException: Access is denied. (Exception from
HRESULT: 0x80070005 (E_ACCESSDENIED)) at
MSClusterLib.ClusterClass.Open(String bstrClusterName)

Strangely, when running under a domain account (granted, one that is a
member of the local administators group) it works fine (either as a
service, or from a console based app that invokes the same clustering
wrapper that I wrote). A low privileged, local account account also
fails. According to the cluster adminstator application, SYSTEM has
Full Control granted for the cluster. I've also verified that I am
actually running under the correct context after setting
AppDomain.CurrentDomain.SetSecurityPrincipal(PrincipalPolicy.WindowsPrincipal)

I guess what I'm looking for are some ideas of where to start looking.
The infuriating this is that this *has* worked previously, and the fact
that I can get success when executing under my own account context at
least proves that the code is not fundamentally flawed.

Hopefully someone has some thoughts that they'd care to share. I'm
enclosing a sample (vb rather than C#) so you can see what I'm talking
about (and how there's not a lot that I can actually mess up here)

Public Sub New(ByVal cluster As String)
clusterToQuery = cluster
clusterIntf = New MSClusterLib.Cluster
Try
If Not clusterIntf Is Nothing Then
clusterIntf.Open(cluster) <------ the
exception is raised here.
Else
Throw New ClusterOpenFailException(cluster, "Cannot
open cluster")
End If
Catch ex As System.Runtime.InteropServices.COMException
Throw New ClusterOpenFailNoRPC("Cluster", ex)
Catch ex As Exception
Throw New ClusterOpenFailException(cluster, "Cannot
open cluster", ex)
End Try
End Sub

Regards

Simon

 

[Willy Denoyette [MVP]]

Hi All,

I'm hoping someone will have some words of wisdom for me regarding MS
Clustering on Windows 2003.

I have a service that runs on a cluster. During invocation it's
supposed to determine from the cluster which node is active (this is a
active/standby configuration) and either proceed or sleep depending on
the status. The interface to the cluster is that advertised by the
standard interop layer built by Visual Studio for the Microsoft Cluster
Service Automation Classes (MSClusterLib)

The problem is that when the service runs under the Local System
context the call to the open the cluster object fails with an Access
Denied exception being reported from the underlying COM interface.

System.UnauthorizedAccessException: Access is denied. (Exception from
HRESULT: 0x80070005 (E_ACCESSDENIED)) at
MSClusterLib.ClusterClass.Open(String bstrClusterName)

Strangely, when running under a domain account (granted, one that is a
member of the local administators group) it works fine (either as a
service, or from a console based app that invokes the same clustering
wrapper that I wrote). A low privileged, local account account also
fails. According to the cluster adminstator application, SYSTEM has
Full Control granted for the cluster. I've also verified that I am
actually running under the correct context after setting
AppDomain.CurrentDomain.SetSecurityPrincipal(PrincipalPolicy.WindowsPrincipal)

I guess what I'm looking for are some ideas of where to start looking.
The infuriating this is that this *has* worked previously, and the fact
that I can get success when executing under my own account context at
least proves that the code is not fundamentally flawed.

Hopefully someone has some thoughts that they'd care to share. I'm
enclosing a sample (vb rather than C#) so you can see what I'm talking
about (and how there's not a lot that I can actually mess up here)

Public Sub New(ByVal cluster As String)
clusterToQuery = cluster
clusterIntf = New MSClusterLib.Cluster
Try
If Not clusterIntf Is Nothing Then
clusterIntf.Open(cluster) <------ the
exception is raised here.
Else
Throw New ClusterOpenFailException(cluster, "Cannot
open cluster")
End If
Catch ex As System.Runtime.InteropServices.COMException
Throw New ClusterOpenFailNoRPC("Cluster", ex)
Catch ex As Exception
Throw New ClusterOpenFailException(cluster, "Cannot
open cluster", ex)
End Try
End Sub

Regards

Simon

Please (cross)post the the appropriate NG, VB is not Csharp. That said, IMO you are using
"localsytem" account to open a remote cluster server, this is simply not possible, you have
to run your code in an account that has administrative privileges on the (remote) cluster.

Willy.

 

[Simon]

I was sure I'd posted a response to this, but it looks like it never
showed up.

It's not obvious from my posting, but this code is executing directly
on the cluster servers rather than from a remote workstation or server.
The end application is performing audits against SQL Server instances
and the idea is for it to determine if the hosting server is clustered
and if so to query the cluster and only execute on the node that is
owning the sql server resource but for to sleep on the standby members
(so I don't have extra audits originating from standby cluster members)

My example was just to show that I was essentially calling the open
method of the interop assembly that VS2005 produces and IMO there's
likely to be more experience with clustering here than in the vb groups
as more places *seem* to use c# for this type of enterprise stuff. I'm
looking for people with a bit of experience with clustering under .NET
rather than for a specific language resolution as I suspect that this
is a COM/Clustering issue. Hope that clarifies things a bit.

Cheers

 

[Willy Denoyette [MVP]]

I was sure I'd posted a response to this, but it looks like it never
showed up.

It's not obvious from my posting, but this code is executing directly
on the cluster servers rather than from a remote workstation or server.
The end application is performing audits against SQL Server instances
and the idea is for it to determine if the hosting server is clustered
and if so to query the cluster and only execute on the node that is
owning the sql server resource but for to sleep on the standby members
(so I don't have extra audits originating from standby cluster members)

My example was just to show that I was essentially calling the open
method of the interop assembly that VS2005 produces and IMO there's
likely to be more experience with clustering here than in the vb groups
as more places *seem* to use c# for this type of enterprise stuff. I'm
looking for people with a bit of experience with clustering under .NET
rather than for a specific language resolution as I suspect that this
is a COM/Clustering issue. Hope that clarifies things a bit.

Cheers

You are running this as a service in the "localsystem" account, this account is a LOCAL
account which has not network access privilege, that is, the service cannot access a "remote
"resource and that's exactly what *MSClusterLib.ClusterClass.Open(String bstrClusterName)*
is trying to do. The argument bstrClusterName denotes a "network resource", the COM client
doesn't care whether it's actually pointing to a local or remote resource, the client's
token has no network access privileges, result Access Denied for [NT AUTHORITY\SYSTEM]. Your
only option is to run this in the "cluster administrator account" (a domain account).

Willy.