command prompt: 'tasklist' logon failure

[sfeeser]

Hello-

I'm experiencing a strange problem in a WinXP Pro command prompt.

Running:
C:\>tasklist

Produces the following reply:

ERROR: Logon failure: unknown user name or bad password.

I have a script output from 4/07 where it ran fine. Can't think of
any system changes since then that would cause this...

And, event viewer logs 2 logon/logoff and 2 privilege use events after
running the command, but both are success, and not denied.

I issued a bunch of other commands and all ran fine,

Any ideals?

Thanks,
Scott

 

[Ramesh, MS-MVP]

Scott,

See the solution posted here by "SA_labs" (scroll to the bottom)
http://www.geekstogo.com/forum/lofiversion/index.php/t57986.html

For more clarity, the proposed solution is:

1. Click Start, and then click Control Panel.
2. Double-click Administrative Tools.
3. In the Administrative Tools window, double-click Local Security Policy.
4. In the left pane, expand Local Policies, and then click Security Options.
5. In the right pane, double-click Network access: Sharing and security model for local accounts.
6. In the Network access: Sharing and security model for local accounts dialog box, click Classic - local users authenticate as themselves, and then click OK.
7. On the File menu in the Local Security Settings window, click Exit.
8. Restart the computer.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting http://www.winhelponline.com


Hello-

I'm experiencing a strange problem in a WinXP Pro command prompt.

Running:
C:\>tasklist

Produces the following reply:

ERROR: Logon failure: unknown user name or bad password.

I have a script output from 4/07 where it ran fine. Can't think of
any system changes since then that would cause this...

And, event viewer logs 2 logon/logoff and 2 privilege use events after
running the command, but both are success, and not denied.

I issued a bunch of other commands and all ran fine,

Any ideals?

Thanks,
Scott

 

[sfeeser]

Thank you for the reply Ramesh.

I tried the solution you posted and the specified key was already set
to 'classic'.

I'll keep searching...

Thanks,
Scott

 

[Ramesh, MS-MVP]

Hi Scott,

Don't have a solution ATM, but will work on this issue.

Good luck, and let's know if you find a solution.

Meanwhile see if you're able to run PSList.

PsList v1.28:
http://www.microsoft.com/technet/sysinternals/utilities/pslist.mspx

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting http://www.winhelponline.com


Thank you for the reply Ramesh.

I tried the solution you posted and the specified key was already set
to 'classic'.

I'll keep searching...

Thanks,
Scott

 

[sfeeser]

Hello Ramesh.

I tried PsList and it does run fine (thanks for pointing me there,
those tools look very helpful).

Latest status: (ProblemMachine= system with tasklist error,
RemoteMachine=a system without tasklist errors)

On problemMachine accessing remote machine:
c:\tasklist /S remotemachine
works fine, demonstrating tasklist does work.

On remote machine

Runnig tasklist /S ProblemMachine produces this:

"ERROR: The remote system must be running Windows 2000 or above"

and
tasklist on the problem machine produces:
"ERROR: Logon failure: unknown user name or bad password."

I also turned on all of the audit features and this event is in the
security log.
-----------------------------------------------------------------------------------------------------------
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 7/18/2007
Time: 10:45:38 AM
User: SCOTT_HP_LAPTOP\Scott
Computer: SCOTT_HP_LAPTOP
Description:
Object Open:
Object Server: Security
Object Type: Event
Object Name: \BaseNamedObjects\DINPUTWINMM
Handle ID: -
Operation ID: {0,3847965}
Process ID: 3840
Image File Name: C:\WINDOWS\system32\tasklist.exe
Primary User Name: Scott
Primary Domain: SCOTT_HP_LAPTOP
Primary Logon ID: (0x0,0x3A3F8)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses: DELETE
READ_CONTROL
WRITE_DAC
WRITE_OWNER
SYNCHRONIZE
Query event state
Modify event state

Privileges: -
Restricted Sid Count: 0

 

[sfeeser]

I believe I may have found the root of the problem....

when starting msinfo32, the main tab displays "Can't access the window
management instrumentation software"

I have found several WMI solutions posted on MS KB, but none have
solved the problem yet,
(tried re-building the repository, re-registering the .dll and .exe
files) Started and stopped the WMI service several times (it does not
give an error when starting, which seems strange since it is
apparently not working)

I'll keep searching.

Thanks,
Scott

 

[Ramesh, MS-MVP]

Scott,

See if the comprehensive reinstallation method listed here helps.

Repairing and re-registering the WMI:
http://windowsxp.mvps.org/repairwmi.htm

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting http://www.winhelponline.com


I believe I may have found the root of the problem....

when starting msinfo32, the main tab displays "Can't access the window
management instrumentation software"

I have found several WMI solutions posted on MS KB, but none have
solved the problem yet,
(tried re-building the repository, re-registering the .dll and .exe
files) Started and stopped the WMI service several times (it does not
give an error when starting, which seems strange since it is
apparently not working)

I'll keep searching.

Thanks,
Scott

 

[sfeeser]

I have successfully solved the problem.

The root of the problem was actually DCOM, which caused WMI to fail,
which caused tasklist to fail (msinfo32 showed the "wmi missing" error
message on the main tab). Checked all the obvious WMI problems and
performed many of the commonly posted WMI fixes like delete/rebuild
repository, re-register associated WMI .dll and .exe files, etc. and
nothing worked. Then I came across a very useful tool from MS called
WmiDiag.vbs. It produces an extremely detailed set of reports about
everything related to WMI. After studying these logs for some time,
it became apparent the issue was an incorrect permission in DCOM that
caused WMI to run at the wrong permission level. Anyhow, the final
solution was setting "local_access" and "local_launch" permissions for
the "everyone" user in DCOM default permissions.

The error was my fault, in the process of configuring other software
tools that use DCOM for remote solution processes, I set remote access
and remote launch for the everyone user and apparently cleared the
local access permissions. Wow, what a headache for clearing one
checkbox!

Scott

 

[Ramesh, MS-MVP]

Excellent post, Scott! Thanks for the update.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting http://www.winhelponline.com


I have successfully solved the problem.

The root of the problem was actually DCOM, which caused WMI to fail,
which caused tasklist to fail (msinfo32 showed the "wmi missing" error
message on the main tab). Checked all the obvious WMI problems and
performed many of the commonly posted WMI fixes like delete/rebuild
repository, re-register associated WMI .dll and .exe files, etc. and
nothing worked. Then I came across a very useful tool from MS called
WmiDiag.vbs. It produces an extremely detailed set of reports about
everything related to WMI. After studying these logs for some time,
it became apparent the issue was an incorrect permission in DCOM that
caused WMI to run at the wrong permission level. Anyhow, the final
solution was setting "local_access" and "local_launch" permissions for
the "everyone" user in DCOM default permissions.

The error was my fault, in the process of configuring other software
tools that use DCOM for remote solution processes, I set remote access
and remote launch for the everyone user and apparently cleared the
local access permissions. Wow, what a headache for clearing one
checkbox!

Scott