I am working with a Windows Server 2003 R2 SP2 server. When programs are launched, it will sometimes give access denied errors. I am also getting 7000, 10005, and 10000 errors in the system log for services that try to start. These issues occurr at random and are itermittent. This occurrs occasionally when you try to launch a program from the start menu, or from the dos prompt. I have had it fail to log in because it can't start explorer. In all cases, it is random. A program may start 10 times in a row, then fail, or it may fail 10 times and then succeed. I have not been able to find any pattern to the behavior. Some information points to the IE enhanced security config, but this happens with virtually every program. Not just those launched from IE or Explorer. Any suggestions would be greatly appreciated.

Please check the permissions Under %Systemroot%\System32 folder NT Authority\Authenticated Users should be present with the following rights: Read and Execute List Folder Contents Read- thestriver

Hi, Did the issue occur for all the users or some specific users? Please check it on your side. Is the problematic PC stand alone, a DC or a member server? The issue can be caused due to the permission factor. For troubleshooting, please refer to the following steps: Suggestion 1 Give Full Control Permission ======================================= 1. Start Windows Explorer, right-click the computer’s root hard drive C:, and then click Properties. 2. Click the Security tab, and then click Edit. 3. In the Group or user names box, click the SYSTEM account. 4. Under Allow, make sure the Full Control checkbox is checked , and then click OK. 5. Please also check the Administrator account. Suggestion 2 Verify the Registry Permissions ========================== 1. Click Start, Run, type regedit and then press Enter. 2. Select HKEY_CLASSES_ROOT, on the Edit menu, click Permissions. 3. Verify that the SYSTEM account has been added and that it has Full control. If it does not, add the SYSTEM account with Full control. 4. Please use the same method to give Full control permission to the following registry keys: HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_USERS HKEY_CURRENT_CONFIG 5. Please also check the Administrator account. If the issue persists, I suggest you use Process Monitor to trace any trouble encountered when running the program. You can check it on your side or send us the Process Monitor log for further troubleshooting. 1. Visit the following Web site: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx 2. Click Download Process Monitor, and then click Save to save the package to the hard disk. 3. Open the folder where you saved the downloaded file. Right-click the file, and then click Extract All. 4. Select to extract the contents of the tool to "this folder," and then click Extract. 5. After the contents is extracted, double-click the Procmon file to start Process Monitor. 6. While Process Monitor is running, run the program. 7. After the error again occurs, switch to the Process Monitor window, and then click the microscope icon in the toolbar to stop the capture. 8. On the File menu, click Save. Save the Process Monitor log to any folder that you want. 9. Upload the file to the following workspace. Also, please help gather the MPS report for research. MPSReport ------------------- Please generate a MPS Directory Service report on the computer that is reporting the error. The MPS report is utilized to gather detailed information regarding a system's current configuration. The data collected will assist me with problem isolation. To do this: a. Download Microsoft Product Support Reports tool from the following link, according to your system architecture. http://www.microsoft.com/downloads/details.aspx?FamilyId=CEBF3C7C-7CA5-408F-88B7-F9C79B7306C0&displaylang=en b. Right click on downloaded mpsreports_x86.exe or mpsreports_x64.exe, and choose Run as Administrator. c. Agree the License Agreement, and choose This Computer. d. Select General, Internet and Networking, Business Networks, Server Components, and click Next. e. After finishing collecting logs, please choose Save the result to save it to a .CAB file, and send the CAB file to the workspace. Note: Sometimes the CAB file may fail to be generated on your machine. This is usually caused by the interference from some third-party application such as certain antivirus program. If it still cannot be generated after another attempt, then please manually zip all the output files in the following folder and send the .zip file to the workspace. "%systemroot%\MPSReports\DirSvc\Logs Upload these file to the following workspace. ------------------------------------------------------------ You can upload the information files to the following link. (Please choose "Send Files to Microsoft") Workspace URL: (https://sftus.one.microsoft.com/choosetransfer.aspx?key=d764194e-e742-4291-9e3e-aaeba65c789d) Password: Z73sl6$wU1fZt Note: Due to differences in text formatting with various email clients, the workspace link above may appear to be broken. Please be sure to include all text between '(' and ')' when typing or copying the workspace link into your browser. Meanwhile, please note that files uploaded for more than 72 hours will be deleted automatically. Please ensure to notify me timely after you have uploaded the files. Thank you for your understanding. Thanks. NinaThis posting is provided "AS IS" with no warranties, and confers no rights.

I check this, and Authenticated users is not present, but it is not present on any of my other servers either. I'll try it and post back with results.

This issue has occurred for at some point for all users who have logged in at the console or through terminal services. The machine is a domain member server. I checked the permissions as suggested. There are no permissions defined explicitly for the Administrator account, but there are permissions defined for the Administrators group. All of the accounts that we use at the console on that host are members of the domain admins group. I checked to make sure that the Domain Admins group is a member of the local Administrators group, and it is. As a result, full control should be allowed. I will see if I can try it with the local admin account. The account is disabled for security reasons, so I have some paperwork to do before I can attempt that. Permissions for the System account are defined exactly as recommended. I will attempt to use procmon. This is an intermittent problem, so I may have trouble capturing the event. It typically happens just a few times a day, so it may be hard to catch. As for the MPS report tool, does that get installed, or is it just a utility that you run? The reason that I ask is that if it installs, I will need to complete a changed request and get that approved before I can perform that step. Thank you for your help, Jeremy Hicks

Hi, Thanks for your update on the permission factor. For your inquiry on the MPS report tool, we do not need to install it. Please just right click on mpsreports_x86.exe or mpsreports_x64.exe, and choose Run as Administrator. Then, please follow the process to gather the data required. If there is any update after checking with the Process Monitor tool, please let us know. Thanks. NinaThis posting is provided "AS IS" with no warranties, and confers no rights.

Hi, I would like to confirm the current situation. If there is anything that I can do for you, please do not hesitate to let me know, I will be happy to help. Regards, NinaThis posting is provided "AS IS" with no warranties, and confers no rights.