Getting Access is Denied when Running Script in OSD Task Sequence
I am attempting put in a script that will move the computer account to the proper OU in AD. I have the script but when it launches inside of the TS I get "CScript Error: Loading script "C:\_SMSTaskSequence\WDPackage\Scripts\MoveOU.vbs" failed
(Access is denied. )."
I am using the Run Command Line, and using the "Run this step as the following account" I have verified that the account has access to do what I need it to do in AD. I have attached the logs as well.
PackageID = 'WI10015A' InstallSoftware
3/21/2012 8:46:53 AM 3316 (0x0CF4)
BaseVar = '', ContinueOnError='' InstallSoftware
3/21/2012 8:46:53 AM 3316 (0x0CF4)
SwdAction = '0001' InstallSoftware
3/21/2012 8:46:53 AM 3316 (0x0CF4)
Getting linked token InstallSoftware
3/21/2012 8:46:53 AM 3316 (0x0CF4)
failed to get the token information InstallSoftware
3/21/2012 8:46:53 AM 3316 (0x0CF4)
Get RunAs private desktop SMSTS-169042\SMSTSDesktop
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
Run command line under a user account InstallSoftware
3/21/2012 8:46:54 AM 3316 (0x0CF4)
Found the location for the package _SMSTSWI10015A. The location is on \\<SCCMSERVERNAME>\SMSPKGF$\WI10015A\
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
nPos != CCM::Utility::String::npos, HRESULT=80004005 (e:\nts_sms_fre\sms\framework\tscore\resolvesource.cpp,253)
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
Creating a connection to \\<SCCMSERVERNAME>\SMSPKGF$\WI10015A\ with default account
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
Connection request for "\\<SCCMSERVERNAME>\SMSPKGF$\WI10015A"
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
No credentials available for connecting to "\\<SCCMSERVERNAME>\SMSPKGF$\WI10015A". See whether the share has already been connected.
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
Connecting to "\\<SCCMSERVERNAME>\SMSPKGF$\WI10015A"
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
Successfully connected to "\\<SCCMSERVERNAME>\SMSPKGF$\WI10015A"
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
Resolved source to '\\<SCCMSERVERNAME>\SMSPKGF$\WI10015A'
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
Command line for extension .exe is "%1" %* InstallSoftware
3/21/2012 8:46:54 AM 3316 (0x0CF4)
Set command line: Run command line InstallSoftware
3/21/2012 8:46:54 AM 3316 (0x0CF4)
Working dir '\\<SCCMSERVERNAME>\SMSPKGF$\WI10015A'
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
Executing command line: Run command line InstallSoftware
3/21/2012 8:46:54 AM 3316 (0x0CF4)
Create a process under given user token InstallSoftware
3/21/2012 8:46:54 AM 3316 (0x0CF4)
Process completed with exit code 1 InstallSoftware
3/21/2012 8:46:54 AM 3316 (0x0CF4)
Microsoft (R) Windows Script Host Version 5.8
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
Copyright (C) Microsoft Corporation. All rights reserved.
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
CScript Error: Loading script "C:\_SMSTaskSequence\WDPackage\Scripts\MoveOU.vbs" failed (Access is denied. ).
InstallSoftware
3/21/2012 8:46:54 AM 3316 (0x0CF4)
Command line returned 1 InstallSoftware
3/21/2012 8:46:54 AM 3316 (0x0CF4)
Entering ReleaseSource() for \\<SCCMSERVERNAME>\SMSPKGF$\WI10015A\
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
reference count 1 for the source \\<SCCMSERVERNAME>\SMSPKGF$\WI10015A\ before releasing
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
Released the resolved source \\<SCCMSERVERNAME>\SMSPKGF$\WI10015A\
InstallSoftware 3/21/2012 8:46:54 AM
3316 (0x0CF4)
Process completed with exit code 1 TSManager
3/21/2012 8:46:54 AM 2520 (0x09D8)
!--------------------------------------------------------------------------------------------!
TSManager 3/21/2012 8:46:54 AM
2520 (0x09D8)
Failed to run the action: Move Computer to Correct OU.
Incorrect function. (Error: 00000001; Source: Windows)
TSManager 3/21/2012 8:46:54 AM
2520 (0x09D8)
Sending status message . . . TSManager
3/21/2012 8:46:54 AM 2520 (0x09D8)
Send a task execution status message SMS_TSExecution_ActionFailError
TSManager 3/21/2012 8:46:54 AM
2520 (0x09D8)
MP server <SCCMSERVERNAME> and port 80. SSL=false. CRL=false.
TSManager 3/21/2012 8:46:54 AM
2520 (0x09D8)
Site code: WI1 TSManager
3/21/2012 8:46:54 AM 2520 (0x09D8)
Client machine name: 1J44KQ1 TSManager
3/21/2012 8:46:54 AM 2520 (0x09D8)
Client Identity: GUID:6ffb32d4-1184-4e40-a1c8-26272a707a72
TSManager 3/21/2012 8:46:54 AM
2520 (0x09D8)
Advertisement ID: WI12029D TSManager
3/21/2012 8:46:54 AM 2520 (0x09D8)
Package ID: WI1001E7 TSManager
3/21/2012 8:46:54 AM 2520 (0x09D8)
Sending StatusMessage TSManager
3/21/2012 8:46:54 AM 2520 (0x09D8)
Formatted header: TSManager
3/21/2012 8:46:54 AM 2520 (0x09D8)
<Msg SchemaVersion="1.1" ReplyCompression="zlib"><ID/><SourceID>ABB94CBE-33F4-4EB9-A151-34EE3474A0F9</SourceID><SourceHost/><TargetAddress>mp:[http]MP_StatusManager</TargetAddress><ReplyTo>direct:OSD</ReplyTo><Priority>3</Priority><Timeout>3600</Timeout><SentTime>2012-03-21T12:46:54Z</SentTime><Protocol>http</Protocol><Body
Type="ByteRange" Offset="0" Length="4174"/><Hooks/><Payload Type="inline"/><TargetHost/><TargetEndpoint>StatusReceiver</TargetEndpoint><ReplyMode>Sync</ReplyMode><CorrelationID/></Msg>
TSManager
3/21/2012 8:46:54 AM 2520 (0x09D8)
CLibSMSMessageWinHttpTransport::Send: URL: <SCCMSERVERNAME>:80 CCM_POST /ccm_system/request
TSManager 3/21/2012 8:46:54 AM
2520 (0x09D8)
The request has succeeded. 200 OK TSManager
3/21/2012 8:46:55 AM 2520 (0x09D8)
Set a global environment variable _SMSTSLastActionRetCode=1
TSManager 3/21/2012 8:46:55 AM
2520 (0x09D8)
Set a global environment variable _SMSTSLastActionSucceeded=false
TSManager 3/21/2012 8:46:55 AM
2520 (0x09D8)
Clear local default environment TSManager
3/21/2012 8:46:55 AM 2520 (0x09D8)
Let the parent group (Testing) decides whether to continue execution
TSManager 3/21/2012 8:46:55 AM
2520 (0x09D8)
The execution of the group (Testing) has failed and the execution has been aborted. An action failed.
Operation aborted (Error: 80004004; Source: Windows)
TSManager 3/21/2012 8:46:55 AM
2520 (0x09D8)
Failed to run the last action: Move Computer to Correct OU. Execution of task sequence failed.
Incorrect function. (Error: 00000001; Source: Windows)
TSManager 3/21/2012 8:46:55 AM
2520 (0x09D8)
Any suggestions would be greatly appreciated!
"You can't fix stupid!"
March 21st, 2012 9:29am
looks like there is something wrong with the script...
Failed to run the action: Move Computer to Correct OU.
Incorrect function. (Error: 00000001; Source: Windows)
You could try this script
http://blog.coretech.dk/jgs/vbscript-move-computer-object-to-another-ou-via-command-line-parameter/Michael Petersen | My blogs:
blog.coretech.dk/author/mip/ and SCUG.dk/ | Twitter:
@OSDeploy | Linkedin:
Michael Petersen
Free Windows Admin Tool Kit Click here and download it now
March 21st, 2012 9:50am
That is the script I am using."You can't fix stupid!"
March 21st, 2012 9:56am
if you manually run that script from within PE does it work without error also ?
Step by Step ConfigMgr 2007
Guides | Step by Step ConfigMgr 2012
Guides | I'm on Twitter > ncbrady
Free Windows Admin Tool Kit Click here and download it now
March 21st, 2012 10:19am
So what it looks like is in the TS the account does not have rights to the WSH to run the script. When I run the script as an administrator it works as it is expected. I have tried this where it was said to put it in the TS but to no avail."You can't fix stupid!"
March 21st, 2012 2:04pm
What does your run commandline looks like?Michael Petersen | My blogs:
blog.coretech.dk/author/mip/ and SCUG.dk/ | Twitter:
@OSDeploy | Linkedin:
Michael Petersen
Free Windows Admin Tool Kit Click here and download it now
March 21st, 2012 3:45pm
You can specify an account that will be used to run your command. Note however that it will only work in full OS (not in WinPE).
March 21st, 2012 8:58pm
"You can't fix stupid!"
Free Windows Admin Tool Kit Click here and download it now
March 22nd, 2012 6:51am
What if you run it like this cscript.exe MoveOU.vbs "OU", and if its win7x64, check "Disable 64-bit fil....."Michael Petersen | My blogs:
blog.coretech.dk/author/mip/ and SCUG.dk/ | Twitter:
@OSDeploy | Linkedin:
Michael Petersen
March 22nd, 2012 7:00am
I got it to work. What I had to do was put in a Command line and add the group for local admins. Now it Adds the local admin accounts (Ad Group) then moves the computer to the proper container. This solved my issue. "You can't fix stupid!"
Free Windows Admin Tool Kit Click here and download it now
March 22nd, 2012 8:35am
Can you please explain in more detail what you did to fix this issue? I am having the same problem, but I don't understand what you did. Where did you add the group for local admins? I can run the script outside the task sequence and
it works, but inside gets the exact error you received, access denied. I have an account entered under "run this step as the following account" and that account has permissions in AD and the file share that the vbs is saved.
April 12th, 2012 9:54am
Sorry for the late reply. What I did was add a couple steps to my TS.
I added our desktop admin group to the Local Administrators group
Then I ran the script that I needed to run. This case was to move computers to the proper OU.
%scriptroot% is a variable I set earlier in the TS that goes to C:\_SMSTaskSequence\WDPackage\Scripts
For the Account, That account is in the Desktop Admin Group that I added to the local admins. This gives the script rights to run and has the proper rights in AD to move it to the right OU.
Hope this helps. Let me know if you need more info I will give as much as I can.
"You can't fix stupid!"
Free Windows Admin Tool Kit Click here and download it now
April 13th, 2012 7:59am
I'm having the exact same issue. I'm using AutoIT for my script to move the computer account. I've tried using ADO, LDAP, and LDAP/ADSystemInfo object. They all fail with access denied. In fact the ADO version of my script fails just
trying to create the "ADODB.Connection" object which I know for a fact doesn't require elevation or administrator access. However, all three versions of the script work correctly when run manually outside the TS. They also work correctly on XP
machines during OSD. Only when deploying a Win7 machine do they fail during the TS. I've tried adding the runas user to the local administrators group beforehand but no dice. Did you have to restart the computer after doing the net localgroup
change? There has to be some other security config in Win7 that is set somewhere doing this. I just can't figure out what. I've even started looking at DCOM/COM permissions to see if something isn't right there.
I don't see why but maybe the script needs to be run locally? Any other ideas?
July 23rd, 2012 10:52pm