Why would services.msc & services.exe be "Access Denied" in WinXP?

[Susan Sharm]

Why would services.msc & services.exe be "Access Denied" in WinXP as
administrator?
The only user enabled on the WinXP SP2 desktop is "administrator".

This works perfectly:
- Right click "My Computer" & press "manage" to start Windows XP
"Computer Management", then click "Services & Applications", then click
"Services".

Yet these all pop up an "Access is denied" error!
- Start, Run, services.msc
- Start, Run, c:\windows\system32\services.msc
- Doubleclicking on windows\system32\services.msc
-
- Start, Run, services.exe
- Start, Run, c:\windows\system32\services.exe
- Doubleclicking on windows\system32\services.exe

Checking "attributes" on Microsoft "Services and Controller
Application" "services.exe" & Microsoft "Common Console Document"
"services.msc" shows "Read-only" is NOT checked & "Hidden" is NOT
checked.

A right-click property check doesn't show (me) anything abnormal (but
what do I know):
File Name: services.exe
Location: c:\windows\system32
Size: 105 KB (108,032 bytes)
Size on disk: 105 KB (108,032 bytes)
Company: Microsoft Corporation
File Version: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
-
File Name: services.msc
Location: c:\windows\system32
Size: 32.6 KB (33,464 bytes)
Size on disk: 33.0 KB (33,792 bytes)

Why would an administrator not be able to access services.msc &
services.exe?

 

[Kerem Gümrükcü]

Hi Susan,

this can happen in some situations. first: what version of windows xp do you
use: Home or Pro?
If Pro, are you inside a Windows Domain Area, controlled by a domain
controler with gpo-
restrictions (Group Policy Objects), the domain controler can deny access to
mmc snap-ins.
On local GPO's check the restrictions on the
user-configuration->administrative templates
->Microsoft Management Console ->Restricted/allowed Snap-Ins

I own a german XP, so this is a on-the-fly translation from geman to
english. i am sure,
that the nodes have different names under english xp...

Best Regards

Kerem Gümrükcü

 

[Wesley Vogel]

services.exe manages the operation of starting and stopping services. You
don't start this one, Windows does.

services.msc is the one that you want.

What is the exact error message, besides Access Denied?

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Kelly]

Hi Susan,

What happens when you try: Start/Run: services.msc

This normally has to do with running spyware, etc cleaners and/or the Print
Spooler Service. Good luck from here and keep us posted.
--

All the Best,
Kelly (MS-MVP/DTS&XP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

In memory of those lost during Katrina &
Prayers and Hope for the remaining displaced.

 

[Susan Sharm]

what version of windows xp do you use: Home or Pro?

Windows XP Professional

If Pro, are you inside a Windows Domain Area, controlled by a domain
controler with gpo-restrictions (Group Policy Objects), the domain controler
can deny access to mmc snap-ins.

I didn't install the operating system so it could have been set up to
be in a domain. How would I know? When I right click on "My Computer",
"properties", "computer name", it says "workgroup = personal". When I
hit the "change" button, it says the computer name "SUSAN" is a Member
of Workgroup "personal". The Domain button is not checked nor is there
anything in the grayed out area under the Domain selection. So, am I
correct in assuming I don't have domain controller?

On local GPO's check the restrictions on the user-configuration->administrative
templates ->Microsoft Management Console ->Restricted/allowed Snap-Ins

Is that in the Control Panel? I can not find "User Configuration"
anywhere I looked.???

Why would an administrator not be able to access services.msc yet "My
Computer", "manage", "services and applications", "services" works just
fine. Are they one and the same?

 

[Susan Sharm]

services.msc is the one that you want.
What is the exact error message, besides Access Denied?

Hi Wesley,

If I right click on "My Computer", press "Manage", up comes the
"Computer Management" GUI. If I then left click on "Services and
Applications", I can access the "Services" section.

However, if I doubleclick on c:\windows\system32\services.msc or type
"services.msc" in the Start, Run menu, the ONLY error I get is "Access
Denied". That's it. All I can do is close that access-denied pop up but
nothing else occurs.

Can someone (who has this working already) tell me whether the GUI that
pops up from "My Computer" is the same GUI that should have popped up
from services.msc?

Susan

 

[Kelly]

No, she meant domain, yet again. However, the same can be accomplished via:

On local GPO's check the restrictions on the
user-configuration->administrative
templates ->Microsoft Management Console ->Restricted/allowed Snap-Ins

Is that in the Control Panel? I can not find "User Configuration"
anywhere I looked.???

Start/Run: gpedit.msc

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

what version of windows xp do you use: Home or Pro?

Windows XP Professional

If Pro, are you inside a Windows Domain Area, controlled by a domain
controler with gpo-restrictions (Group Policy Objects), the domain
controler
can deny access to mmc snap-ins.

I didn't install the operating system so it could have been set up to
be in a domain. How would I know? When I right click on "My Computer",
"properties", "computer name", it says "workgroup = personal". When I
hit the "change" button, it says the computer name "SUSAN" is a Member
of Workgroup "personal". The Domain button is not checked nor is there
anything in the grayed out area under the Domain selection. So, am I
correct in assuming I don't have domain controller?

On local GPO's check the restrictions on the
user-configuration->administrative
templates ->Microsoft Management Console ->Restricted/allowed Snap-Ins

Is that in the Control Panel? I can not find "User Configuration"
anywhere I looked.???

Why would an administrator not be able to access services.msc yet "My
Computer", "manage", "services and applications", "services" works just
fine. Are they one and the same?

 

[Susan Sharm]

What happens when you try: Start/Run: services.msc

This pops up an "Access Denied" message no matter HOW I start
"services.msc", whether it is via doubleclicking directly on the
"Microsoft Common Console Document" (whatever that means) services.msc
file in C:\windows\system32 or if it's via the Start, Run menu (whether
I type the full path or just the file name services.msc).

Yet, inexplicably, the Computer Management GUI pops up when I right
click on My Computer and press "Manage".

Is this "computer managent" GUI the same or different from what should
have happened when I tried to execute the services.msc file? Where is
it set that the services.msc file have its access denied by the
administrator?

This is all very confusing, but interesting nonetheless!

Susan

 

[Kelly]

Is this the only Service? Either way....
http://www.google.com/search?hl=en&q=services.msc+access+denied
--

All the Best,
Kelly (MS-MVP/DTS&XP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

 

[Steven L Umbach]

It probably is because you do not have proper permissions to the file
services.msc. Look at the security properties. You would need at least
read/list/execute permissions and not be a member of any group [including
everyone/users] that has deny permissions to that file. When you use
Computer Management you are not using the file services.msc to open Computer
Management even though you can access services via Computer Management. The
free utility filemon can be very helpful in tracking down such problems
looking for access denied under the result column. Filemon will record lot
of entries in the log but you can use options - filter and enter access
denied in the highlight box to quickly find pertinent entries. --- Steve

http://www.sysinternals.com/ --- link to filemon.

 

[Susan Sharm]

The free utility filemon can be very helpful in tracking down such problems
looking for access denied under the result column.

Thank you for that advice Steven. I will pick up "filemon" and see what
it tells me. I had previously right clicked on the services.msc file to
see only that it was not "hidden" or "read only" but I am not aware of
permissions based on the user or group (or even how to tell what those
permissions would be for any particular file).

It may be interesting to note that "Start, Run, msconfig" seems to work
in that it pops up a "System Configuration Utility" which has a
"Services" tab which seems to also let me turn off and on services
(although this GUI seems less functional than the "My Computer",
"Manage", "Computer Management" GUI.

I'll run filemon on the c:\windows\system32\services.msc file and let
you know the results.

Thanks for the advice - this is interesting - if a bit frustrating,
Susan

 

[Steven L Umbach]

You would need to look at permissions in the security tab of the properties
of the file. If you see no security tab then you will have to disable simple
file sharing by opening Windows Explorer and then selecting tools/folder
options/view - use simple file sharing that you would want to uncheck. The
link below explains more on how to configure NTFS permissions in Windows
P. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;308418

 

[Susan Sharm]

If you see no security tab then you will have to disable simple
file sharing by opening Windows Explorer and then selecting tools/folder
options/view - use simple file sharing that you would want to uncheck.

Thanks again Steven for the wonderful advice (I wish more people were
like you!).

When I right click & select properties on the "services.msc" file, I
see only two tabs "general" & "summary". On "services.exe" I see four
tabs "general", "version", "compatibility", & "summary". As you noted,
there was no "security" tab available.

So, in that system32 window, I selected the menu "tools", "folder
options", "view", and I turned off (unchecked) these two which had
"simple" in the description:
- display simple folder view in Explorer's Folders list
- use simple file sharing (Recommended)

Thanks to your advice, this action added a "security" tab to the
right-click properties of both services.exe and services.msc (I never
knew about this so I'm glad I learned something interesting today!).

Here is what I saw in the "security" tab of a right-clicked properties
of "services.msc" (given the "Full Computer Name is "SUSAN" and I'm
logged in as "Administrator" and I know of no other logins on this
computer other than administrator.

Group or user names:
- Administrators (SUSAN\Administrators)
--- Full Control [^]Allow [ ]Deny
--- Modify [^]Allow [ ]Deny
--- Read & Execute [^]Allow [ ]Deny
--- Read [^]Allow [ ]Deny
--- Write [^]Allow [ ]Deny
--- Special Permissions [ ]Allow [ ]Deny
- Power Users (SUSAN\Power Users)
--- Full Control [ ]Allow [ ]Deny
--- Modify [ ]Allow [ ]Deny
--- Read & Execute [^]Allow [ ]Deny
--- Read [^]Allow [ ]Deny
--- Write [ ]Allow [ ]Deny
--- Special Permissions [ ]Allow [ ]Deny
- SYSTEM
--- Full Control [^]Allow [ ]Deny
--- Modify [^]Allow [ ]Deny
--- Read & Execute [^]Allow [ ]Deny
--- Read [^]Allow [ ]Deny
--- Write [^]Allow [ ]Deny
--- Special Permissions [ ]Allow [ ]Deny
- Users (SUSAN\]Users)
--- Full Control [ ]Allow [ ]Deny
--- Modify [ ]Allow [ ]Deny
--- Read & Execute [^]Allow [ ]Deny
--- Read [^]Allow [ ]Deny
--- Write [ ]Allow [ ]Deny
--- Special Permissions [ ]Allow [ ]Deny

I'm confused what this is telling me. There is an additional "Advanced"
button which, for the "Administrators (SUSAN\Administrators)" selection
shows the four tabs "Permissions", "Auditing", "Owner", & "Effective
Permissions" which are lengthy but summarized below:

Permissions:
- Allow Users (SUSAN\Users) Read & Execute <not inherited>
- Allow Power Users (SUSAN\Power Users) Read & Execute <not inherited>
- Alow Administrators (SUSAN\Administrators) Full Control <not
inherited>
- Alow SYSTEM Full Control <not inherited>
- [ ]Inherit from parent the auditing entries that apply to child
objects
Auditing:
- [^]Inherit from parent the auditing entries that apply to child
objects
Owner:
- Current owner of this item: Administrators (SUSAN\Administrators)
Effective Permissions:
- All the boxes are grey

Leaving everything as noted above (only having unchecked simple file
permissions), I still see "access denied" when I type "services.msc"
into the start run menu. Do you have a suggestion as to which
permission to change above?

Thanks in advance,
Susan

 

[Steven L Umbach]

Hmm. Your permissions look fine for services.msc. and there are no deny
permissions assuming you were looking at the services.msc in the
\windows\system32 folder. The advanced tab is for defining special
permissions which allows more granular control of NTFS permissions but those
permissions look fine also. What is the exact error you get when you are
denied access and when you look in the application log via Event Viewer in
Computer Management are there any warnings [Software Restriction Policies,
etc] that may be related to running services.msc?? If you can run rsop.msc
do so and check to see if you have any Group Policy restrictions configured
particularly under administrative templates/Windows components/Microsoft
Management Console and administrative templates/system. Beyond that I would
use the filemon tool to try and track down where access is being
enied. --- Steve

If you see no security tab then you will have to disable simple
file sharing by opening Windows Explorer and then selecting tools/folder
options/view - use simple file sharing that you would want to uncheck.

Thanks again Steven for the wonderful advice (I wish more people were
like you!).

When I right click & select properties on the "services.msc" file, I
see only two tabs "general" & "summary". On "services.exe" I see four
tabs "general", "version", "compatibility", & "summary". As you noted,
there was no "security" tab available.

So, in that system32 window, I selected the menu "tools", "folder
options", "view", and I turned off (unchecked) these two which had
"simple" in the description:
- display simple folder view in Explorer's Folders list
- use simple file sharing (Recommended)

Thanks to your advice, this action added a "security" tab to the
right-click properties of both services.exe and services.msc (I never
knew about this so I'm glad I learned something interesting today!).

Here is what I saw in the "security" tab of a right-clicked properties
of "services.msc" (given the "Full Computer Name is "SUSAN" and I'm
logged in as "Administrator" and I know of no other logins on this
computer other than administrator.

Group or user names:
- Administrators (SUSAN\Administrators)
--- Full Control [^]Allow [ ]Deny
--- Modify [^]Allow [ ]Deny
--- Read & Execute [^]Allow [ ]Deny
--- Read [^]Allow [ ]Deny
--- Write [^]Allow [ ]Deny
--- Special Permissions [ ]Allow [ ]Deny
- Power Users (SUSAN\Power Users)
--- Full Control [ ]Allow [ ]Deny
--- Modify [ ]Allow [ ]Deny
--- Read & Execute [^]Allow [ ]Deny
--- Read [^]Allow [ ]Deny
--- Write [ ]Allow [ ]Deny
--- Special Permissions [ ]Allow [ ]Deny
- SYSTEM
--- Full Control [^]Allow [ ]Deny
--- Modify [^]Allow [ ]Deny
--- Read & Execute [^]Allow [ ]Deny
--- Read [^]Allow [ ]Deny
--- Write [^]Allow [ ]Deny
--- Special Permissions [ ]Allow [ ]Deny
- Users (SUSAN\]Users)
--- Full Control [ ]Allow [ ]Deny
--- Modify [ ]Allow [ ]Deny
--- Read & Execute [^]Allow [ ]Deny
--- Read [^]Allow [ ]Deny
--- Write [ ]Allow [ ]Deny
--- Special Permissions [ ]Allow [ ]Deny

I'm confused what this is telling me. There is an additional "Advanced"
button which, for the "Administrators (SUSAN\Administrators)" selection
shows the four tabs "Permissions", "Auditing", "Owner", & "Effective
Permissions" which are lengthy but summarized below:

Permissions:
- Allow Users (SUSAN\Users) Read & Execute <not inherited>
- Allow Power Users (SUSAN\Power Users) Read & Execute <not inherited>
- Alow Administrators (SUSAN\Administrators) Full Control <not
inherited>
- Alow SYSTEM Full Control <not inherited>
- [ ]Inherit from parent the auditing entries that apply to child
objects
Auditing:
- [^]Inherit from parent the auditing entries that apply to child
objects
Owner:
- Current owner of this item: Administrators (SUSAN\Administrators)
Effective Permissions:
- All the boxes are grey

Leaving everything as noted above (only having unchecked simple file
permissions), I still see "access denied" when I type "services.msc"
into the start run menu. Do you have a suggestion as to which
permission to change above?

Thanks in advance,
Susan

 

[Susan Sharm]

Your permissions look fine for services.msc.
What is the exact error you get when you are denied access and when
you look in the application log via Event Viewer in Computer Management
are there any warnings [Software Restriction Policies, etc] that may be
related to running services.msc??
If you can, run rsop.msc to check for Group Policy restrictions
under administrative templates/Windows components/Microsoft
Management Console and administrative templates/system.
Use filemon to try and track down where access is being denied.

Thank you again Steven.
When I Start, Run, services.msc, there is no other error visible other
than "access denied". Likewise when I Start, Run, rsop.msc (whatever
that is), I get "Access Denied".

After attempting services.msc & rsop.msc, I right-clicked "My
Computer", pressed "Manage", selected the "Event Viewer" in the
resulting "Computer Management" console. Three items were available,
"Application", "Security", & "System".

I am very confused about what I see. For example, if I sort by date the
"Application" selection, I see multiple events (from McAfee VirusScan
perhaps?) of the format:
- Type=Error, Date=11/6/2005, Time=9:22:43PM, Source=McLogEvent,
Category=none, Event=1006, User=N/A, Computer=SUSAN Description=Task
Manager : Service Error : MID Configuration Applicator: Password
authentication failed.

Likewise, when I run filemon.exe, there is so much output that I am not
sure what exactly I am looking for. I see very many entries in
filemon.exe of the format, but maybe this is of interest:
- #=24, Time=10:32:19 PM, Process=explorer.exe:1816, Request=QUERY
INFORMATION, Path=C:\windows\sytem32\services.msc, Result=SUCCESS,
Other=Attributes: D
- #=77, Time=10:33:25 PM, Process=explorer.exe:1816, Request=QUERY
INFORMATION, Path=C:\WINDOWS\system32\rsop.msc, Result=SUCCESS,
Other=Atributes: C

If I look at the wmiprov.log, I see a zillion entries of:
(Sun Nov 06 22:22:48 2005.2117284) :
(Sun Nov 06 22:22:49 2005.2118325) : WDM call returned error: 4201
(Sun Nov 06 22:22:49 2005.2118325) :
***************************************
(Sun Nov 06 22:22:49 2005.2118325) : The instance name passed was not
recognized as valid
(Sun Nov 06 22:22:49 2005.2118325) :
***************************************
(Sun Nov 06 22:22:49 2005.2118325) : The instance name passed was not
recognized as valid(Sun Nov 06 22:22:49 2005.2118325) :
(Sun Nov 06 22:22:50 2005.2119377) : WDM call returned error: 4201
(Sun Nov 06 22:22:50 2005.2119377) :
***************************************

If I look in c:\windows\system32\WBEM\Logs\wbemess.log, I see millions
of entries of:
(Sun Oct 30 22:32:01 2005.2581922) : NT Event Log Consumer: could not
retrieve sid, 0x8005100
(Sun Oct 30 22:32:40 2005.2621459) : NT Event Log Consumer: could not
retrieve sid, 0x80051003
(Sun Oct 30 22:39:25 2005.3026141) : NT Event Log Consumer: could not
retrieve sid, 0x80051003
(Sun Oct 30 22:39:34 2005.3035284) : NT Event Log Consumer: could not
retrieve sid, 0x80051003
(Sun Oct 30 22:39:34 2005.3035284) : Failed to log an event: 1F

Looking at C:\WINDOWS\system32\WBEM\Logs\wbemprox.log, I see entries
like
(Sun Oct 30 22:29:34 2005.3035354) : ConnectViaDCOM, CoCreateInstanceEx
resulted in hr = 0x80005003
(Sun Oct 30 22:29:34 2005.3035424) : ConnectViaDCOM, CoCreateInstanceEx
resulted in hr = 0x80005003
(Sun Oct 30 22:29:35 2005.3035815) : ConnectViaDCOM, CoCreateInstanceEx
resulted in hr = 0x80005003

Does any of this make sense to you?
Susan

 

[Susan Sharm]

Good luck and keep us posted.

Googling about, I found I could also access the Services console using
MMC:
a. Start, Run, mmc (which brings up "Microsoft Management Console 2.0")
b. In MMC, press File, Open, and select "Administrative Tools"
(which is found in the default location C:\Documents and Settings\All
Users\Start Menu\Programs\Administrative Tools)
c. Select "Services" to bring up the MMC Services GUI.

What frustrates me is I don't understand why I can access services yet
not services.msc!

 

[Susan Sharm]

In addition, I can view services using Start, Run, msconfig.exe

I just can't view services using Start, Run, Services.msc

Something esoteric must be going on here!

Susan

 

[Steven L Umbach]

Access denied message is usually do to lack of permission. If the message
also says due to restrictions on your computer, a Software Restriction
Policy, or see administrator there is probably some kind of Group Policy
setting. If you can open gpedit.msc then use Group Policy and go to computer
configuration/administrative templates/Windows components/Microsoft
management console to see if any mmc snapins such as services.msc are
restricted there. If you use regedit you can also look under the registry
key [HKEY_CURRENT_USER\Software\Policies\Microsoft\MMC] to see if anything
is configured there which would indicate the Group Policy could be
restricting access. --- Steve

Your permissions look fine for services.msc.
What is the exact error you get when you are denied access and when
you look in the application log via Event Viewer in Computer Management
are there any warnings [Software Restriction Policies, etc] that may be
related to running services.msc??
If you can, run rsop.msc to check for Group Policy restrictions
under administrative templates/Windows components/Microsoft
Management Console and administrative templates/system.
Use filemon to try and track down where access is being denied.

Thank you again Steven.
When I Start, Run, services.msc, there is no other error visible other
than "access denied". Likewise when I Start, Run, rsop.msc (whatever
that is), I get "Access Denied".

After attempting services.msc & rsop.msc, I right-clicked "My
Computer", pressed "Manage", selected the "Event Viewer" in the
resulting "Computer Management" console. Three items were available,
"Application", "Security", & "System".

I am very confused about what I see. For example, if I sort by date the
"Application" selection, I see multiple events (from McAfee VirusScan
perhaps?) of the format:
- Type=Error, Date=11/6/2005, Time=9:22:43PM, Source=McLogEvent,
Category=none, Event=1006, User=N/A, Computer=SUSAN Description=Task
Manager : Service Error : MID Configuration Applicator: Password
authentication failed.

Likewise, when I run filemon.exe, there is so much output that I am not
sure what exactly I am looking for. I see very many entries in
filemon.exe of the format, but maybe this is of interest:
- #=24, Time=10:32:19 PM, Process=explorer.exe:1816, Request=QUERY
INFORMATION, Path=C:\windows\sytem32\services.msc, Result=SUCCESS,
Other=Attributes: D
- #=77, Time=10:33:25 PM, Process=explorer.exe:1816, Request=QUERY
INFORMATION, Path=C:\WINDOWS\system32\rsop.msc, Result=SUCCESS,
Other=Atributes: C

If I look at the wmiprov.log, I see a zillion entries of:
(Sun Nov 06 22:22:48 2005.2117284) :
(Sun Nov 06 22:22:49 2005.2118325) : WDM call returned error: 4201
(Sun Nov 06 22:22:49 2005.2118325) :
***************************************
(Sun Nov 06 22:22:49 2005.2118325) : The instance name passed was not
recognized as valid
(Sun Nov 06 22:22:49 2005.2118325) :
***************************************
(Sun Nov 06 22:22:49 2005.2118325) : The instance name passed was not
recognized as valid(Sun Nov 06 22:22:49 2005.2118325) :
(Sun Nov 06 22:22:50 2005.2119377) : WDM call returned error: 4201
(Sun Nov 06 22:22:50 2005.2119377) :
***************************************

If I look in c:\windows\system32\WBEM\Logs\wbemess.log, I see millions
of entries of:
(Sun Oct 30 22:32:01 2005.2581922) : NT Event Log Consumer: could not
retrieve sid, 0x8005100
(Sun Oct 30 22:32:40 2005.2621459) : NT Event Log Consumer: could not
retrieve sid, 0x80051003
(Sun Oct 30 22:39:25 2005.3026141) : NT Event Log Consumer: could not
retrieve sid, 0x80051003
(Sun Oct 30 22:39:34 2005.3035284) : NT Event Log Consumer: could not
retrieve sid, 0x80051003
(Sun Oct 30 22:39:34 2005.3035284) : Failed to log an event: 1F

Looking at C:\WINDOWS\system32\WBEM\Logs\wbemprox.log, I see entries
like
(Sun Oct 30 22:29:34 2005.3035354) : ConnectViaDCOM, CoCreateInstanceEx
resulted in hr = 0x80005003
(Sun Oct 30 22:29:34 2005.3035424) : ConnectViaDCOM, CoCreateInstanceEx
resulted in hr = 0x80005003
(Sun Oct 30 22:29:35 2005.3035815) : ConnectViaDCOM, CoCreateInstanceEx
resulted in hr = 0x80005003

Does any of this make sense to you?
Susan