Author: SynapticFire
Subject: PSExec Access Denied & Other Weirdness
Posted: 20 November 2013 at 10:40am
I have come across two issues. I'm not ruling out me being the cause, but it has me stumped.
Subject: PSExec Access Denied & Other Weirdness
Posted: 20 November 2013 at 10:40am
I have come across two issues. I'm not ruling out me being the cause, but it has me stumped.
I've had many batch files setup to do software deployment, and they were all working up until a couple of months ago (not sure what changed).
I have the following:
"C:\MIS Share\PSTools\psexec.exe" @"C:\Resources Share\Software\Computers.txt" -u DOMAIN\adminaccount -p PASSWORD -c -f "\\server\Resources\Software\Oracle Java 7 Update 45 x64\Install.bat"
pause
This all triggers fine, but the MSI doesn't run, giving me Error 1603. When I look at the event viewer of the targeting machine(s), it tells me "Product: Java 7 Update 45 (64-bit) -- This account does not have sufficient privileges to install Java. Please login to an account with administrative permissions."
The user specified HAS administrative permissions on the machine; it is a member of a security group which is added to the local Administrators group via Group Policy Preferences!
----
The above was and continues to be a problem. To get around it and to move towards my preferred design, I created a service account, the idea being that everything would run as that account, obviating the need to put our own usernames and passwords in.
However, running the above command using the service account's credentials instead, I get "Install.bat exited on MACHINE with error code -1073741515".
The service account is in security groups which allow it to logon as a batch and logon as a service. It is also made a direct member of the local Administrators group in the say way via Group Policy Preferences, and Administrators have the ability to login locally.
The only 'deny' in place is that Batch and Service accounts cannot logon via RDP, but I don't see why that should be a problem ...