Error accessing C:\Windows\system32\cluster.exe or whoami.exe from Service running as Local Service or Administrator
Dear all, I've got a strange behaviour with Windows Server 2008 (Core Enterprise, English, SP2 and Enterprise (nonCore), German, SP2). I've Installed an BBWin Monitorring-Client which is running fine as "Local System". There's the possibility to ad external scripts for additional monitorring tasks, so I created a vbs-script which calls "cluster.exe /Cluster:localhost group > C:\Windows\Temp\Cluster.txt" and than checked some things, doesn't matter. The script is working fine if I'm logged on localy as Administrator or as Local System (processed via sysinternals psexec -i -s cmd). If the script is added to the monitorring service, the script doesn't find the cluster.exe anymore. If I replace in the command "cluster.exe /Cluster:localhost group" with "ipconfig /all" the script will work correctly. If I use whoami, the script will fail with the same error. After that, I tried to run as an Domain Admin with the same result. Now, I created a command-file: cluster.cmd with following code: @ECHO OFF copy /Y C:\Windows\system32\cluster2.exe C:\Windows\Temp\cluster2.exe > C:\Windows\Temp\Cluster.txt 2>&1 Cluster.exe /Cluster:localhost group >> C:\Windows\Temp\Cluster.txt 2>&1 dir C:\Windows\system32\Cl*.exe >> C:\Windows\Temp\Cluster.txt 2>&1 dir C:\Windows\system32\wh*.exe >> C:\Windows\Temp\Cluster.txt 2>&1 whoami >> C:\Windows\Temp\Cluster.txt 2>&1 I run this command-file as Admin or Local-System logged on locally with success, If I try to run that as service, the output is as following: The system cannot find the file specified. 'Cluster.exe' is not recognized as an internal or external command, operable program or batch file. Volume in drive C has no label. Volume Serial Number is ###### Directory of C:\Windows\system32 11/02/2006 11:44 AM 40,960 cliconfg.exe 1 File(s) 40,960 bytes 0 Dir(s) 44,643,213,312 bytes free Volume in drive C has no label. Volume Serial Number is ###### Directory of C:\Windows\system32 11/02/2006 11:45 AM 36,352 where.exe 1 File(s) 36,352 bytes 0 Dir(s) 44,643,213,312 bytes free 'whoami' is not recognized as an internal or external command, operable program or batch file. You can see, the user didn't find the cluster.exe or whoami.exe as Local System or Administrator running as Service. I tried these things with no success: - apply "Allow Service to interact with desktop" - grant everyone FullAccess to Cluster.exe - grant Service following Privileges: SeBackupPrivilege SeRestorePrivilege SeIncreaseQuotaPrivilege SeIncreaseBasePriorityPrivilege SeTcbPrivilege SeDebugPrivilege SeSecurityPrivilege SeAuditPrivilege SeImpersonatePrivilege SeChangeNotifyPrivilege SeIncreaseWorkingSetPrivilege SeManageVolumePrivilege - Set service-sid-type from none to unrestricted (sc sidtype BBWin UNRESTRICTED) - grant service SID FullAccess to cluster.exe (sc showsid BBWin, than get SID and icacls cluster.exe /grant *SID:F) After that I compared the SDDL for the files cluster.exe (which is not found) and ipconfig.exe (which can be found and accessed), and it's still the same. As I already described before, logged on locally all the things worked as "Local System", but not running as Service. I think it's something like a security-feature, but I didn't know how to get this work. Please help... THX With best regards Daniel
August 28th, 2009 6:06pm

I think you should try omitting the ".exe" and just go with the command "cluster". Just an idea.Creativity cannot be taught, but it can be learned.
Free Windows Admin Tool Kit Click here and download it now
August 30th, 2009 12:46am

I already try'd this out, but you can't SEE THESE FILES like described above! Now I've created a clean vbs-script with wmi-requests without calling an external file which generated my needed cluster-information for the monitorring system. The behaviour above is not solved, but the results are okay!
November 5th, 2009 3:53pm

Hello, I have exactly the same problem. I try to access the cluster.exe as a service that is running to check the status uf the UPS. On power problems, I want to start a script that stops the cluster resources, but as mentioned this script can not access the cluster.exe Is there a solution for this, now? Thank you in advance. BR Matthias
Free Windows Admin Tool Kit Click here and download it now
March 3rd, 2010 5:04pm

We had a similar issue, but ours was related to problems with a 32 bit application invoking a 64 bit version of cluster.exe. Specifically, we were using a 32 bit perl executable and script to try to check for split resources to feed back to Nagios. We modified our script to use the executable at C:\windows\sysnative\cluster.exe to avoid the file system redirect that occurs in the 64 bit versions of Windows Server 2008 and Windows Server 2008 R2. Here is the page that our team found to address this issue: http://www.tipandtrick.net/2008/how-to-suppress-and-bypass-system32-file-system-redirect-to-syswow64-folder-with-sysnative/ Hope this helps. Mike Burr
March 25th, 2010 1:15am

Daniel, I'm seeing the same thing on 2008 R2 RTM Server Core systems. Strange that whoami.exe is not present in the SYSWOW64 folder of Server Core, yet it *is* in the SYSWOW64 folder of a "full" installation of the OS. Not sure why Microsoft would have omitted it from Server Core, especially since I do have the SYSWOW64 components installed. I wonder if this is a bug. In any case, I'm going to have to look at grabbing whoami.exe from a "full" install of the OS and bundling it with my script package. Kind of annoying, but whatever... Does anyone from Microsoft care to comment on why whoami.exe is not present in the SYSWOW64 folder of Server Core? Thanks, Frank
Free Windows Admin Tool Kit Click here and download it now
March 26th, 2011 5:02pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics