Security Compliance

Troubleshoot "Access Denied" errors in Patch Manager

This article describes how to troubleshoot Access Denied error messages that you may encounter while using Solarwinds Patch Manager.

First published date

11/29/2018 10:39 PM

Last published date

11/29/2018 10:39 PM

Overview

This article describes how to troubleshoot Access Denied error messages when trying to connect Patch Manager to a remote computer. These errors occur when deploying updates to remote computers or executing other tasks on a remote computer—for example, when you open Computer Explorer.
 

Product section

Patch Manager

Cause

  • Machine not joined to the domain correctly
  • Wrong UN / Password
  • Lack of privileges for the account

Resolution

Basic Troubleshooting:
  1. Verify that you can ping the remote computer by hostname and IP address from the Patch Manager server.
  2. Verify that the user account specified in the error has local admin privileges on the remote computer.
  3. Verify that you can connect to the remote computer's admin share with the account specified in the error. Open a command prompt with admin rights on the Patch Manager server and run
net use z: \\remoteComputer\admin$ /user:domain\username password
where:
    • remoteComputer is the remote computer's name.
    • domain is the domain for the account specified in the error.
    • username is the account specified in the error.
    • password is the password for the account specified in the error.
  2. If the command returns the server is not configured for remote administration, perform the following steps. Otherwise, go to step 7.
    1. Make sure the File and Print Sharing option is enabled on the remote computer by opening port 445 TCP/UDP on the computer's firewall for communication from the Patch Manager server.
    2. Make sure the group policy allows your account to access the computer from the network.
    3. Open the Group Policy editor and go to Computer configuration > Policies > Windows Settings > Security Settings > User Rights Assignment > Access this computer from the network.
  3. If the command returns Error 1326, configure the remote computer to use the Classic sharing and security model by following these steps:
    1. Open the computer's Local Security Settings.
    2. Expand Local Policies, and then select Security Options.
    3. Select Network access: Sharing and security model for local accounts, and then click Action > Properties.
    4. Select Classic - local users authenticate as themselves from the menu, and then click OK.
  4. Re-run the net use command if necessary.
Check the WMI connection 
Verify that you can make a WMI connection to the remote computer using wbemtest.
  1. Launch wbemtest.exe from the Patch Manager server using a command prompt or the Run dialog box.
  2. Click Connect
  1. Complete the Connect window fields.
    1. In the Namespace field, enter:
\remoteComputer\root\default
where remoteComputer is the remote computer's name.
    1. Enter the credentials for the account specified in the error in the Credentials section.
  2. Click Connect.
Troubleshoot the WMI connection to the remote computer 
  1. Make sure the firewall on the remote computer is not blocking the connection.
    1. If you have the permissions, disable the firewall on the remote computer and test the connection again.
    2. Open the ports required to establish communication from the Patch Manager server to the remote computers.
  2. Enable DCOM on the remote computer.
    1. On the remote computer, launch dcomcnfg using a command prompt or the Run dialog box.
    2. In the navigation pane, expand Component Services > Computer and then click My Computer.
    3. Click the Action menu, and then select Properties.
    4. Click the Default Properties tab.
    5. Select Enable Distributed COM on this computer if necessary.
    6. Click OK.
  3. If the remote computer is not running Windows XP, you are finished.
    If the remote computer is running Windows XP, disable the simple file sharing option. 
    1. Click Start > My Computer on the remote computer.
    2. Click the Tools menu, and then select Folder Options.
    3. Click View.
    4. Under Advanced settings, clear Use simple file sharing (Recommended) at the bottom of the list.
    5. Click OK
Troubleshoot Access Denied Errors Between Automation And Primary Patch servers
Scenario 1: Access denied errors between Automation server and PAS
Wireshark capture filter on port = 4092 shows below error
    527 5.335574    10.177.17.6           10.177.17.15          DCERPC   Fault: call_id: 9 ctx_id: 1 status: nca_s_fault_access_denied
  1. Ensure the connection is being tested from SAS
  2. And you are using the correct credentials i.e the same credentials used on the Primary Server when launching the PM MMC console.
Solution:
  1. The new automation server was not joined to the domain correctly
  2. Remove and re-join the domain with right credentials
  3. Re-run the Automation server configuration wizard