Cannot store environments, access is denied

We are running TFS2013 Update 4 (12.0.31101.0), with SCVMM 2012 R2 (3.2.7768.0).
At some point in the recent past, we have become unable to store environments. We get "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) (type TeamFoundationServiceException)".
I checked the library shares, and the TFS/VMM accounts have full access.
Then, I turned up logging on the TFS server, and got this:
TFSJobAgent: OnStart entry.
TFSJobAgent: GetApplicationDbConnectionString entry.
TFSJobAgent: GetApplicationDbConnectionString exit.
TFSJobAgent: OnStart exit.
TfsJobAgent.exe Information: 0 : [Info, PID 7596, TID 3864, 2015/01/27 21:14:46.052, 9 ms, General] Entered CatalogTransactionContext.Save().
TfsJobAgent.exe Information: 0 : [Info, PID 7596, TID 3864, 2015/01/27 21:14:46.063, 19 ms, General] Asking for the Catalog database lock.
TfsJobAgent.exe Information: 0 : [Info, PID 7596, TID 3864, 2015/01/27 21:14:46.069, 25 ms, General] Got the Catalog database lock.
TfsJobAgent.exe Information: 0 : [Info, PID 7596, TID 3864, 2015/01/27 21:14:46.069, 25 ms, General] Running the catalog rules.
TfsJobAgent.exe Information: 0 : [Info, PID 7596, TID 3864, 2015/01/27 21:14:46.085, 41 ms, General] Finished running the catalog rules.
TfsJobAgent.exe Information: 0 : [Info, PID 7596, TID 3864, 2015/01/27 21:14:46.085, 41 ms, General] Calling the catalog database to save the changes.
TfsJobAgent.exe Information: 0 : [Info, PID 7596, TID 3864, 2015/01/27 21:14:46.138, 94 ms, General] Returned from the catalog database after saving changes.
TfsJobAgent.exe Information: 0 : [Info, PID 7596, TID 3864, 2015/01/27 21:14:46.139, 95 ms, General] Finished building the returned catalog objects.
TfsJobAgent.exe Information: 0 : [Info, PID 7596, TID 3864, 2015/01/27 21:14:46.144, 100 ms, General] Exiting CatalogTransactionContext.SaveCatalogChanges().
TfsJobAgent.exe Information: 0 : [Info, PID 7596, TID 3864, 2015/01/27 21:14:46.294, 250 ms, API] Raising Status Changed for caa5b090-4e33-4e03-ae29-ff2f0b415b07 with status Started
Registering Tagging routes
[Verbose, PID 7596, TID 7860, 2015/01/27 21:15:01.220, 15175 ms, General] Trying to get credential for Microsoft_VSTL_ConnectionTo_VMM_SERVER_DefaultCollection
[Verbose, PID 7596, TID 7860, 2015/01/27 21:15:01.220, 15175 ms, General] Found no credentials
[Verbose, PID 7596, TID 7860, 2015/01/27 21:15:01.220, 15175 ms, General] Trying to get credential for Microsoft_VSTL_ConnectionTo_VMM_SERVER
[Verbose, PID 7596, TID 7860, 2015/01/27 21:15:01.220, 15175 ms, General] Found no credentials
TfsJobAgent.exe Error: 0 : [Error, PID 7596, TID 844, 2015/01/27 21:15:47.204, 61160 ms, General] TF53010: The following error has occurred in a Team Foundation component or extension:
Date (UTC): 1/27/2015 9:15:47 PM
Machine: TFS-1
Application Domain: TfsJobAgent.exe
Assembly: Microsoft.TeamFoundation.Framework.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a; v4.0.30319
Service Host:
Process Details:
Process Name: TFSJobAgent
Process Id: 7596
Thread Id: 844
Account name: DGSLAB\tfs-main
Detailed Message: "A LabService error has occurred"
Exception Message: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) (type TeamFoundationServiceException)
Exception Stack Trace:
Anybody run into something similar?
Mark
Mark E. Scott Jr.

Hi novasbc,
It needs the account when configure lab management in TFS admin console (pop up window).
Could you re-configure the lab management?
There is a link that may benefit you (Take care of it):
# TFSConfig Lab /Delete Command
https://msdn.microsoft.com/en-us/library/ee712732.aspx
Regards
Starain
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Similar Messages

Quicktime in Win7 (32bit) program files security is corrupted. I cannot install/uninstall: access is denied. How do I clear the security lock?

The security owner has: "Unable to display current owner". I cannot change ownership to my administrator account. Access is denied on uninstall & upgrade to 7.7.3.
How do I clear ownership?

what if they are turned off? I cannot install iTunes or QuickTime Pro 7 on my WIN7/64 Lenovo W520. ran all the repair cycles uninstalls, reinstalls about 10X each, no luck

SSRS 2005 report: Cannot bulk load Operating system error code 5(Access is denied.)

I built a SSRS 2005 report, which calls a stored proc on SQL Server 2005. The proc contains following code:
CREATE TABLE #promo (promo VARCHAR(1000))
BULK
INSERT #promo
FROM '\\aseposretail\c$\nz\promo_names.txt'
WITH
--FIELDTERMINATOR = '',
ROWTERMINATOR = '\n'
SELECT * from #promo
It's ok when I manually execute the proc in SSMS.
When I try to run the report from BIDS I got following error:
*Cannot bulk load because the file "\aseposretail\c$\nz\promo_names.txt" could not be opened. Operating system error code 5(Access is denied.).*
Note: I have gooled a bit and see many questions on this but they are not relevant because I CAN run the code no problem in SSMS. It's the SSRS having the issue. I know little about the security of SSRS.

I'm having the same type of issue. I can bulk load the same file into the same table on the same server using the same login on one workstation, but not on another. I get this error:
Msg 4861, Level 16, State 1, Line 1
Cannot bulk load because the file "\\xxx\abc.txt" could not be opened. Operating system error code 5(Access is denied.).
I've checked SQL client versions and they are the same, I've also set the client connection to TCP/IP only in the SQL Server Configuration Manager. Still this one workstation is getting the error. Since the same login is being used on both workstations and it works on one but not the other, the issue is not a permissions issue. I can also have another user login into the bad workstation and have the bulk load fail, but when they log into their regular workstation it works fine. Any ideas on what the client configuration issue is? These are the version numbers for Management Studio:
Microsoft SQL Server Management Studio 9.00.3042.00
Microsoft Analysis Services Client Tools 2005.090.3042.00
Microsoft Data Access Components (MDAC) 2000.085.1132.00 (xpsp.080413-0852)
Microsoft MSXML 2.6 3.0 5.0 6.0
Microsoft Internet Explorer 6.0.2900.5512
Microsoft .NET Framework 2.0.50727.1433
Operating System 5.1.2600
Thanks,
MWise

Dynamic Send Port : The FILE send adapter cannot open file C:\Temp for writing. Details: Access is denied.

Hi All,
We have requirement of using ESB toolkit and transforming incoming xml file to edi format. So, we are using ItinerarySelectReceiveXML pipeline for receiving the input from the input location and "EDISend" pipeline for transforming it into EDI and
send it to destination.
Now, the receive pipeline is picking up the file, but it is not processed and sent to destination.
And, we are getting an Access Denied error from Dynamic send port.
Error Description :
The FILE send adapter cannot open file C:\Users\Public\Temp for writing.
Details: Access is denied.
Any Immediate solutions/suggestions are appreciated...Thanks.
Anand

The difference between dynamic and static port would be send handler. For dynamic port, default send handler will be used and for static port the one configured on the port will be used, could you validate this configuration.
Also sometimes, administrative privileges are not "real" administrative privileges and company admins will have limited permissions on C Drive folders. Try writing to some other folder to isolate the issue.
Regards, Ajeet Kumar MCTS Biztalk Server

New ipod - "cannot install this hardware" and "access is denied"

Over the weekend I got a new iPod Video. Previously I had an iPod Photo. This new one plugged in just fine on my two computers at home but will not install to my work computer.
It will work as I can play and transfer files through iTunes, but everytime I plug it in I get USB errors:
"Windows cannot install this hardware - access is denied"
In the Device Manager it gives me a "Code 28"
Like I said, it does seem to work, I just want to make sure this isn't going to screw anything up when I plug in each day and get these errors.

iPods use the standard Windows USB mass storage drivers. it is possible for those to go walkabout on a PC. if that is what has happened to you, the techniques from this MarkJones post may be of some assistance:
MarkJones: Re: Windows XP (SP2) Laptop only finds generic "New USB 2.0 Device"

Cannot open backup device 'F:\foldername'. Operating system error 5(Access is denied.).

SQL 2005 Enterprise
Even if I logon as Administrator and try to backup any of my databases to local partitions, I get this error below. I have been operating fine up until this point and doing backups all the time. As far as I know, and after checking, no permissions have changed and of course Administrator has ntfs permissions to my local C and other partitions on this server:
TITLE: Microsoft SQL Server Management Studio
Backup failed for Server 'servername'. (Microsoft.SqlServer.Smo)
For help, click: http://go.microsoft.com/fwlink?ProdName=Microsoft+SQL+Server&ProdVer=9.00.1399.00&EvtSrc=Microsoft.SqlServer.Management.Smo.ExceptionTemplates.FailedOperationExceptionText&EvtID=Backup+Server&LinkId=20476
ADDITIONAL INFORMATION:
System.Data.SqlClient.SqlError: Cannot open backup device 'F:\foldername'. Operating system error 5(Access is denied.). (Microsoft.SqlServer.Smo)
For help, click: http://go.microsoft.com/fwlink?ProdName=Microsoft+SQL+Server&ProdVer=9.00.1399.00&LinkId=20476
BUTTONS:
OK
In the Event log for Windows Server 2003 I see this:
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10016
Date:  3/6/2006
Time:  3:35:06 PM
User:  NT AUTHORITY\NETWORK SERVICE
Computer: servername
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{BA126AD1-2166-11D1-B1D0-00805FC1270E}
to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission can be modified using the Component Services administrative tool.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

SQL Service account is DOMAIN\SQLAdmin
Have given the SQLAdmin AD account access to the Backup shares on the file servers (2 file servers, FILE1, FILE2)
and I still get the error
Operating system error 5(Access is denied.).
RESTORE FILELISTONLY
FROM DISK = N'\\SERVER\APPS\backups\UA\DB\DB.BAK'
I trid to attach it as device, which runs
sp_addumpdevice 'disk', 'Network_Share', '\\SERVER\backup\APPS\UA\DB\DB.BAK'
BUT when restoring, same error occurred (Access denied)
Only case I can backup/restore to/from network shares, is from the machines where SQL Server runs (SQL1, SQL2)
e.g. I copy the BAK file from FILE1 to SQL2, share the folder (add SQLAdmin account with access), then restore on SQL1 with file from SQL2 Share
RESTORE FILELISTONLY
FROM DISK = N'\\SQL2\backups\UA\DB\DB.BAK'

Acrobat X Pro v10.1.9: Cannot print to Adobe PDF Printer (access is denied)

Hello.
Suddenly I was not able to print Office 2013 files / Autocad files / Internet Explorer pages directly to Adobe PDF Printer anymore on my WINDOWS 7 Ultimate x64 sp1 computer.
I have tried to uninstall and reinstall Acrobat X Pro, but the issue was not resolved.
Neither after updating to the latest version (10.1.9).
When I try to print from any software (Office 2013 / AutoCAD 2012 / Others), are displayed two windows:
a) the first one named "Printing (not responding)", with the information: "now printing the file..."
b) the second one named "Save PDF File As", to where I do not have access to the filename fied to insert it neither to click the "cancel" button to abort the print dialog. It seems that this window is not active.
I have to click on the red "X" button on the first window to shutdown the application. Here is the error dialog I got:
Description:
A problem caused this program to stop interacting with Windows.
Problem signature:
Problem Event Name: AppHangXProcB1
Application Name: EXCEL.EXE
Application Version: 15.0.4551.1510
Application Timestamp: 528bece9
Hang Signature: c8e1
Hang Type: 32
Waiting on Application Name: acrotray.exe
Waiting on Application Version: 10.0.0.396
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1033
Additional Hang Signature 1: c8e100fcd630e6760c7abd2fba3f982e
Additional Hang Signature 2: ae17
Additional Hang Signature 3: ae17043737b8c27016deab1151342ddf
Additional Hang Signature 4: c8e1
Additional Hang Signature 5: c8e100fcd630e6760c7abd2fba3f982e
Additional Hang Signature 6: ae17
Additional Hang Signature 7: ae17043737b8c27016deab1151342ddf
Read our privacy statement online:
http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409
If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt
When I try to print a webpage in Internet Explorer using the same printer, I get an "Adobe PDF" window stating "Access is denied".
Can anyone help me restoring this feature?

The reinstall is typically the last ditch effort to do. The first step is Help>Repair and Help>Updates. As far as Office 2013, the PDF Maker of AA X is not compatible and you can only print. In your list of errors it showed a problem with AcroTray.exe. As a first step, go to the print and select print-to-file. The file will be a PS file (maybe with a PRN extension). Once the printer if finished, open the file in Distiller to complete the process. If that is successful, then the problem is with AcroTray. Check your running tasks to be sure AcroTray is indeed running. If not, that is likely the problem. If it is, then restart it (it is located in the Acrobat folder). AcroTray provides the interface between the PS creation and Distiller to automate the process of creating the PDF.

Reader XI - Cannot open PDFs from Outlook: Internal error occured. Access is denied.

I have a user that when they try to open a PDF from Outlook they get two errors. An internal error occured, and Access is denied. I HAVE tried everyone's solution of unchecking 'Enabled Protected Mode' in Adobe > Edit > Preferences...but, this has NOT worked. The user is currently running Windows XP and has Outlook 2010. The attachments DO open if you save them to computer first, or if Adobe Reader is already open. Please help. Thank you.

"Internal Error Occurred" appears when .pdf is opened from Outlook 2010 email
I am absolutely pulling out my hair over this one!!
PC/Win 7 64bit/Adobe XI/Office 2010
I have tried Uninstalling and re-installing
I have tried using an adobe software removal tool
I have tried modifying the security settings in reader
I've tried running repair on MS Office
If you open the .pdf from an email directly, it opens Reader with the error "Internal Error Occurred"
If you drag and drop the .pdf onto the desktop, and then open it, it opens.
If you open Adobe Reader FIRST, then open the .pdf from the email, it opens fine.
ONLY when you open a .pdf from an email with Adobe Reader closed (so Outlook is asking AR to open first, and then present the .pdf) is it behaving this way.
Hypothesis: Outlook 2010 does not like to open Adobe Reader.
SO....tell me all of you brilliant geniuses? How do I solve this puzzle and become an end user's hero?

WWAN AutoConfig cannot start with error 5 : Access is denied

Hi,
first , when i start my lenovo S110 windows7 , i need to repair my system . i just click 'repair' then my laptop start like usually . i try to connect my mobile modem but still show 'connection terminated' . then i try to connect with wifi (wireless) but
the internet bar still not connected . i just trying my luck to open google and surfing even the internet bar show not connected ( red X ) . i dont believe it that i can online while the internet bar still not connected . i try another way , try to google
my connection problem with another computer . then , i found that my WWAN AutoConfig not start . i try to fix it by myself . but it still not working . when i start the WWAN AutoConfig , it show error 5 means access was denied . i dont know what to do . please
help me :'(
( sorry , broken english )

Hi,
From your description, it should be the permission issue.
Make sure you logon with an account that have administrator privilege to start the service.
And then open the command prompt with administrator, run this command:
Karen Hu
TechNet Community Support

Cannot install SQL Server Express - Access is denied messagwe

When trying to run the downloaded SQL Server Express EXE, I get an error message "Access is denied". Can anyone advise me how to proceed?

Are you running from special folder i.e desktop ?
Can you try to de-compress first then launch setup
to de-compress express package run from the commandline
<package.exe> /x:"<decompression path>"
FAQ
Regards,
Ahmed Ibrahim
SQL Server Setup Team
My Blog
This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click
"Mark as Answer" and "Vote as Helpful"
on posts that help you.
This can be beneficial to other community members reading the thread.

Cannot remove the access control entry object on the object because the ACE isn't present

Hello,
I am very new to using Powershell and Exchange Management Shell, and have no prior experience using either of these tools. However, the software I am installing requires me to use the EMS tool in order to set certain permissions for a user in Exchange, which
will be like the admin account.
The command I am attempting to run follows as:
Get-ExchangeServer | Remove-ADPermission -User $newusername -Deny -ExtendedRights Receive-As -Confirm:$False
This throws me an error saying:
cannot remove the access control entry on the object because the ACE isn't present. I've done some research, and have found that this error is quite common, but the solutions do not apply to what I am specifically trying to accomplish. I am simply trying
to remove the Receive-As permission for the admin user that I just created.
Once again, I am very new to Exchange and Powershell, but if there is any advice anyone has, it would greatly appreciated.

I ran this command, and a very long list was displayed, it looks like everything is there.
The weird thing is that I was able to run a previous command which granted Receive-As access to the user I am creating:
Get-ExchangeServer | Add-ADPermission -User $newusername -accessrights GenericRead, GenericWrite -extendedrights Send-As, Receive-As, ms-Exch-Store-Admin -Confirm:$False
The description for the commands to run read to 'grant permissions and to revoke denies, if present'. I'm not sure what this means, but the second part of this pertains to the second command that I am having trouble with:
Get-ExchangeServer | Remove-ADPermission -User $newusername -Deny -ExtendedRights Receive-As -Confirm:$False

BizTalk exposed WCF 403 - Forbidden: Access is denied WCF

Im using BizTalk server 2010.cretaed Certificate in IIS and shared to client the same as a public cert.
Im using httpsTransport with customBinding.followed below url
http://blogs.msdn.com/b/bizintegration1/archive/2011/08/23/exposing-biztalk-orchestration-as-a-wcf-service-over-ssl.aspx
When I try to Browse in BizTalk server with https, im able to browse, but in the client side, they are not able to browse
and they get "403 - Forbidden: Access is denied. You do not have permission to view this directory or page using the credentials that you supplied." Is there anythng that needs to be set in BizTalk or the settings should be done at the client end?
IIS autehntification mode is anonymous is configued.plz let me know anything to do in biztalk and IIS level
Regards BizTalkWorship

This is because your client has not provided the certificate while browsing the service URL.
If they (client) have installed the certificate in correct folder and then while browsing folder the service, client should provide the certificate through browser.
For Internet Explorer, a pop-up should with all the certificates
installed in their personal store. They need to select the certificate that they already installed in it.
Look into this article (from
On the client side: section onwards) for how to browse the service from IE by providing the certificate.
http://blogs.msdn.com/b/asiatech/archive/2014/02/13/how-to-configure-iis-client-certificate-mapping-authentication-for-iis7.aspx
Note: Above article is just relavant to you from
On the client side: section onwards i.e for instructing your client to use certificate while browsing.
FireFox
You will get an error that says “HTTP Error 403.7 – Forbidden” “The page you are attempting to access requires your browser to have a Secure Sockets Layer (SSL)
client certificate that the Web server recognizes.”
In
FireFox go to Tools –> Options –> Advanced –> Encryption –> View Certificates
Click import and select the certificate with private key file you exported earlier (the .pfx file)
You will need to clear history now or restart browser
Just FYI for installing certifate correctly in client side, if they use Windows (off-course):
MMC, add certificate snap-in for “current user”
Browse to Certificates (Current User) –> Personal –> Certificates
Right click this node and select All Tasks and Import from the popup menu
Follow the steps in the wizard, selecting the public certificate you have shared o client.
Regards,
M.R.Ashwin Prabhu
If this answers your question please mark it accordingly. If this post is helpful, please vote as helpful by clicking the upward arrow mark next to my reply.

403 - Forbidden: Access is denied. You do not have permission to view this directory or page using the credentials that you supplied

I got this message when trying to checkout from a site store:
403 - Forbidden: Access is denied.
You do not have permission to view this directory or page using the credentials that you supplied.
Any ideas how can I solve it?

Ask the people running the store; that error generally means that you tried to do something they don't allow or something's wrong on their end.
(89086)

Error Code: -2147024891 (Access is denied)

Hi
I've just installed a new SCOM 2007 R2 server and I added some servers to it, but only in all the Windows 2008 servers that have Exchange 2007 SP3 I can not install the SCOM agent, even if I try to manually install the agent, raise this error and
the installation rolls back, this is the screen:
I tried to follow this link to solve the problem:
http://social.technet.microsoft.com/Forums/sqlserver/en-US/44192faa-12cc-4bd7-9605-0d9ae1444f37/scom-2007-r2-error-25211-failed-to-install-performance-counters-error-code-2147024891-access?forum=operationsmanagergeneral
But when I try to rebuild the counters with lodctr /r, but I have the response "Error: Unable to rebuild performance counter setting from system backup store, error code is 5", the most rare is that
I used the domain admin user and the local admin user, so I don't know what permission it's necessary to install or rebuild the counters.
No one process is using the counters, so may be the problem could be permissions, but this is not sense to me cause I'm using the highest privileges account in the domain...

Hi Alexis
Thanks for the tip, but did not work, the run as administrator was done before, and the error 5 still is raising... :(
When I ran lodctr /r (with "Run As Administrator") in the application Event Viewer raise this about LoadPerf:
3001: The performance counter name string value in the registry is not formatted correctly. The malformed string is 2182. The first DWORD in the Data section contains the index value
to the malformed string while the second and third DWORDs in the Data section contain the last valid index values.
System
- Provider
   [ Name] Microsoft-Windows-LoadPerf
   [ Guid] {122EE297-BB47-41AE-B265-1CA8D1886D40}
   [ EventSourceName] LoadPerf
- EventID 3001
   [ Qualifiers] 49152
   Version 0
   Level 2
   Task 0
   Opcode 0
   Keywords 0x80000000000000
- TimeCreated
   [ SystemTime] 2013-12-22T01:36:13.000Z
   EventRecordID 193126
   Correlation
- Execution
   [ ProcessID] 0
   [ ThreadID] 0
   Channel Application
   Computer HT02.domain.com
   Security
- UserData
- EventXML
   param1 2182
   binaryDataSize 16
   binaryData 860800003607000037070000C3010000
When I try to install manually the agent (amd64\MOMAgent.msi), this events raise:3001,3013, 3009 and repeat 3001, 3013 and 3009, all them about Loadperf too:
3001: The performance counter name string value in the registry is not formatted correctly. The malformed string is 2182. The first DWORD in the Data section contains the index value
to the malformed string while the second and third DWORDs in the Data section contain the last valid index values.
System
- Provider
   [ Name] Microsoft-Windows-LoadPerf
   [ Guid] {122EE297-BB47-41AE-B265-1CA8D1886D40}
   [ EventSourceName] LoadPerf
   - EventID 3001
   [ Qualifiers] 49152
    Version 0
    Level 2
    Task 0
    Opcode 0
    Keywords 0x80000000000000
   - TimeCreated
   [ SystemTime] 2013-12-22T01:20:37.000Z
    EventRecordID 193110
    Correlation
   - Execution
   [ ProcessID] 0
   [ ThreadID] 0
    Channel Application
    Computer HT02.domain.com
    Security
- UserData
- EventXML
   param1 2182
    binaryDataSize 16
    binaryData 860800003607000037070000C3010000
3013: Unable to update the performance counter strings defined for the 009 language ID. The first DWORD in the Data section contains the error code.
System
- Provider
   [ Name] Microsoft-Windows-LoadPerf
   [ Guid] {122EE297-BB47-41AE-B265-1CA8D1886D40}
   [ EventSourceName] LoadPerf
- EventID 3013
   [ Qualifiers] 49152
   Version 0
   Level 2
   Task 0
   Opcode 0
   Keywords 0x80000000000000
- TimeCreated
[ SystemTime] 2013-12-22T01:20:37.000Z
   EventRecordID 193111
   Correlation
- Execution
[ ProcessID] 0
[ ThreadID] 0
   Channel Application
   Computer HT02.domain.com
   Security
- UserData
- EventXML
   param1 009
   binaryDataSize 8
   binaryData 050000006F0D0000
3009: Installing the performance counter strings for service HealthService (HealthService) failed. The first DWORD in the Data section contains the error code.
System
- Provider
   [ Name] Microsoft-Windows-LoadPerf
   [ Guid] {122EE297-BB47-41AE-B265-1CA8D1886D40}
   [ EventSourceName] LoadPerf
- EventID 3009
   [ Qualifiers] 49152
   Version 0
   Level 2
   Task 0
   Opcode 0
   Keywords 0x80000000000000
- TimeCreated
   [ SystemTime] 2013-12-22T01:20:37.000Z
   EventRecordID 193112
   Correlation
- Execution
   [ ProcessID] 0
   [ ThreadID] 0
   Channel Application
   Computer HT02.domain.com
   Security
- UserData
- EventXML
   param1 HealthService
   param2 HealthService
   binaryDataSize 8
   binaryData 05000000F1120000
And finally 10005: -- -2147024891 (Access is denied.).
System
- Provider
   [ Name] MsiInstaller
- EventID 10005
   [ Qualifiers] 0
   Level 2
   Task 0
   Keywords 0x80000000000000
- TimeCreated
   [ SystemTime] 2013-12-22T01:20:53.000Z
   EventRecordID 193116
   Channel Application
   Computer HT02.Domain.com
- Security
   [ UserID] S-1-5-21-2805081708-1522538877-527695900-1142023
- EventData
   Product: System Center Operations Manager 2007 R2 Agent -- Error 25211.Failed to install performance counters.. Error Code: -2147024891 (Access is denied.).
   (NULL)
   (NULL)
   (NULL)
   (NULL)
   7B32353039373737302D324231462D343946362D414239442D3143373038423936323632417D
Binary data:
In Words
0000: 3035327B 37373739 42322D30 342D4631
0008: 2D364639 44394241 3743312D 39423830
0010: 32363236 7D41
In Bytes
0000: 7B 32 35 30 39 37 37 37   {2509777
0008: 30 2D 32 42 31 46 2D 34   0-2B1F-4
0010: 39 46 36 2D 41 42 39 44   9F6-AB9D
0018: 2D 31 43 37 30 38 42 39   -1C708B9
0020: 36 32 36 32 41 7D         6262A}

Server 2012 R2 - "Access is denied." error

so this has been happening ever since i've installed Windows updates on our accounting server(windows server 2012 r2), and upgraded the RAM on the VM server(all these Server 2012 R2's are hosted on a VMware 5.5, client & server) . Sometimes, when trying
to log in as an Active Directory user via RDP, i'll get an "Access is denied" error. This occurs for 3 different users, all of whom are domain admins. When this done happen, I'm only able to log in as the local machine administrator. Our AD server
is also a 2012 R2.
Some things to note:
1) I can ping to the AD server, and ping from AD to the accounting server in question- all traffic is allowed over a VPN connection, and no traffic is being blocked by the firewall. Windows Firewall is turned off completely for both servers. Tracert finds
both servers in 3 hops, but times out on the 2nd hop. also, the preferred DNS server for the accounting is the IP address for the primary domain controller.
2) The time is the same on both the AD and accounting servers(at least when logged in as a local admin on the accounting server). Most of the most recent Windows updates are installed on both.
3) I've tried removing the accounting server from the domain, and adding it back to the domain, and removing the accounting computer object in AD- the computer object was never added back after rejoining the domain, automatically or manually.
3) I can't run a gpupdate on this accounting server. It returns this error:
Computer policy could not be updated successfully. The following errors were encountered:
Windows was unable to determine whether new Group Policy settings defined by a network administrator should be enforced for this user or computer because this computer's clock is not synchronized with the clock of one of the domain controllers for the domain. Because of this issue, this computer system may not be in compliance with the network administrator's requirements, and users of this system may not be able to use some functionality on the network. Windows will periodically attempt to retry this operation, and it is possible that either this system or the domain controller will correct the time settings without intervention by an administrator, so the problem will be corrected.
If this issue persists for more than an hour, checking the local system's clock settings to ensure they are accurate and are synchronized with the clocks on the network's domain controllers is one way to resolve this problem. A network administrator may be required to resolve the issue if correcting the local time settings does not address the problem. User Policy could not be updated successfully. The following errors were encountered:
The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windowswill automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful. To diagnose thefailure, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.so this has been happening ever since i've installed Windows
updates on our accounting server(windows server 2012 r2), and upgraded
the RAM on the VM server(all these Server 2012 R2's are hosted on a
VMware 5.5, client & server) . Sometimes, when trying to log in as
an Active Directory user via RDP, i'll get an "Access is denied" error.
This occurs for 3 different users, all of whom are domain admins. When
this done happen, I'm only able to log in as the local machine
administrator. Our AD server is also a 2012 R2.
Some things to note:
1) I can ping to the AD server, and ping from AD to the accounting
server in question- all traffic is allowed over a VPN connection, and no
traffic is being blocked by the firewall. Windows Firewall is turned
off completely for both servers. Tracert finds both servers in 3 hops,
but times out on the 2nd hop. also, the preferred DNS server for the
accounting is the IP address for the primary domain controller.
2) The time is the same on both the AD and accounting servers(at
least when logged in as a local admin on the accounting server). Most of
the most recent Windows updates are installed on both.
3) I've tried removing the accounting server from the domain, and
adding it back to the domain, and removing the accounting computer
object in AD- the computer object was never added back after rejoining
the domain, automatically or manually.
3) I can't run a gpupdate on this accounting server. It returns this error:
Computer policy could not be updated successfully. The following errors were encountered:
Windows was unable to determine whether new Group Policy settings defined by a network administrator should be enforced for this user or computer because this computer's clock is not synchronized with the clock of one of the domain controllers for the domain. Because of this issue, this computer system may not be in compliance with the network administrator's requirements, and users of this system may not be able to use some functionality on the network. Windows will periodically attempt to retry this operation, and it is possible that either this system or the domain controller will correct the time settings without intervention by an administrator, so the problem will be corrected.
If this issue persists for more than an hour, checking the local system's clock settings to ensure they are accurate and are synchronized with the clocks on the network's domain controllers is one way to resolve this problem. A network administrator may be required to resolve the issue if correcting the local time settings does not address the problem. User Policy could not be updated successfully. The following errors were encountered:
The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windowswill automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful. To diagnose thefailure, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.
so GPResults.html shows this(domain and AD user hidden just in case):
DOMAIN\ADuser on ACCOUNTING2
Data collected on: 12/16/2014 1:02:44 PM show all
Summaryhide
During last computer policy refresh on 12/16/2014 12:56:05 PM
   A fast link was detected More information...
During last user policy refresh on 12/16/2014 12:56:05 PM
   A fast link was detected More information...
Computer Detailshide
Generalhide
Computer name ACCOUNTING2
Domain Local
Site (None)
Security Group Membership hide
Mandatory Label\System Mandatory Level
Everyone
BUILTIN\Users
NT AUTHORITY\SERVICE
CONSOLE LOGON
NT AUTHORITY\Authenticated Users
NT AUTHORITY\This Organization
NT SERVICE\BITS
NT SERVICE\CertPropSvc
NT SERVICE\DsmSvc
NT SERVICE\Eaphost
NT SERVICE\hkmsvc
NT SERVICE\IKEEXT
NT SERVICE\iphlpsvc
NT SERVICE\LanmanServer
NT SERVICE\MMCSS
NT SERVICE\MSiSCSI
NT SERVICE\NcaSvc
NT SERVICE\RasAuto
NT SERVICE\RasMan
NT SERVICE\RemoteAccess
NT SERVICE\Schedule
NT SERVICE\SCPolicySvc
NT SERVICE\SENS
NT SERVICE\SessionEnv
NT SERVICE\SharedAccess
NT SERVICE\ShellHWDetection
NT SERVICE\wercplsupport
NT SERVICE\Winmgmt
NT SERVICE\wuauserv
LOCAL
BUILTIN\Administrators
Component Statushide
Component Name Status Time Taken Last Process Time Event Log
Group Policy Infrastructure Success   12/16/2014 12:56:05 PM
Registry Success   12/12/2014 8:05:55 AM
Security Success   12/12/2014 8:06:01 AM
Settingshide
No settings defined.
Group Policy Objectshide
Applied GPOshide
Denied GPOshide
Local Group Policy [LocalGPO]show
Link Location Local
Extensions Configured
Enforced No
Disabled None
Security Filters
Revision AD (0), SYSVOL (0)
WMI Filter
Reason Denied Empty
WMI Filtershide
Name Value Reference GPO(s)
None
User Detailshide
Generalhide
User name DOMAIN\ADuser
Domain domainname.local
Security Group Membership show
DOMAINNAME\Domain Users
Everyone
BUILTIN\Users
BUILTIN\Administrators
NT AUTHORITY\REMOTE INTERACTIVE LOGON
NT AUTHORITY\INTERACTIVE
NT AUTHORITY\Authenticated Users
NT AUTHORITY\This Organization
LOCAL
DOMAINNAME\Backup Admins
DOMAINNAME\Scans FTP Users
DOMAINNAME\Scans FTP Admin
DOMAINNAME\Domain Admins
Authentication authority asserted identity
DOMAINNAME\Denied RODC Password Replication Group
Mandatory Label\High Mandatory Level
Component Statushide
Component Name Status Time Taken Last Process Time Event Log
Group Policy Infrastructure Success   12/16/2014 12:56:05 PM
Settingshide
No settings defined.
Group Policy Objectshide
Applied GPOshide
Denied GPOshide
Local Group Policy [LocalGPO]hide
Link Location Local
Extensions Configured
Enforced No
Disabled None
Security Filters
Revision AD (0), SYSVOL (0)
WMI Filter
Reason Denied Empty
WMI Filtershide
Name Value Reference GPO(s)
None
Also, in the accounting server, i get multiple Microsoft-Windows-Security-Kerberos (codes 4 & 5)
and
Microsoft-Windows-GroupPolicy (codes 1030 & 1126) in the All
Servers > Events page. Where can i find the "Details" tab for the
error code and description?
any help would be greatly appreciated. thanks!

So I believe that I've fixed the time issue, but it still sometimes kicks off users on this accounting server, and gpupdate doesn't work. I have 2 domain controllers, and it seems that when this server queries the secondary domain controller(which was "screwed
up", i was told by the previous IT guy who set this environment up), i get the Event ID 1030[GroupPolicy (Microsoft-Windows-GroupPolicy)] error and error # 4(Security-Kerberos) after the gpupdate fails.
and Vivian, i do have a problem with AD replication. i cannot replicate the secondary DC with the primary DC. i get several event id 4 codes on the secondary DC.
when i try to force a replication via AD Sites & Services > Sites... Servers > NTDS Settings of primary DC > Right-click > Replicate Now, i get the error:
"The follow error occured during the attempt to contact the Domain Controller DCPRIMARYNAME(actual domain name hidden for privacy): The target principal name is incorrect."
which is interesting, because i've seen this "target principal name is incorrect" error in several event viewer error codes in different Servers(all 2012 R2).

Cannot store environments, access is denied

Similar Messages

Maybe you are looking for