Obtain a primary token for a user who does not have permission to logon locally

I would like to know whether it's possible to obtain a primary token for a user who doesn't have permission to log on locally. If yes, what the recommended way is for doing that.
I called LogonUserW with logon32_logon_network logontype for user which is not allowed to logon locally. It returned impersonation token. I called DuplicateTokenEx to create primary token but it still returned impersonation token.

A Network Logon is always going to return an impersonation token. This is by design.
A Batch or Service logon would return a Primary Token. The user would need the corresponding right to return these 2 types of token. Typically, all users are allowed to generate a Network Token (Impersonation Token) but as you have discovered
it has limited usage which is by design.
thanks
Frank K [MSFT]
Follow us on Twitter, www.twitter.com/WindowsSDK

Similar Messages

User anonymous does not have permission to perform lookup : help needed

Hi All,
I'm facing a strange problem.
I'm using weblogic 8.1
Some ejbs are deployed in the application and security settings are done properly.
But sometimes, i get an exception saying that
'javax.naming.NoPermissionException: User <anonymous> does not have permission on weblogic to perform lookup operation. [Root exception is javax.naming.NoPermissionException: User <anonymous> does not have permission on weblogic to perform lookup operation.]
at weblogic.rjvm.BasicOutboundRequest.sendReceive(BasicOutboundRequest.java:108)' .
This ejb is invoked from a web application, and the exception happens only once in the server lifecycle (but not on the first try).
This happens in a JTA transaction and eventually the transaction gets timed out. Once timed out for the first time, further requests are executing fine and it is connecting with the configured security credentials.
Initially i thought ejb caching was causing the problem. But even after removing the cache, it is throwing the exception.
Only sometimes, it is trying to connect as <anonymous> user.
I'm so fed up with this..
Can anybody help me out..?

Which 8.1 SP are you on? If you open a support case, a support engineer may be able to identify a fix that has been included in a newer Service Pack.

VMM Shared ISO error "User account does not have permission required to open attachment"

I had this error once because the local service account was selected during installation of VMM. I have reinstalled VMM with a Domain service account and the error went away. However, the error is back.
"User account does not have permission required to open attachment '\\[servername]\VMMLibrary\server.ISO'. Error: 'General access denied error' (0x80070005). (Virtual machine ID GUID)"
I tried to create this VM on Host1 and got the error.
I then went to Host2 and was able to create the VM while using the same ISO on the same VMM library that failed on the Host1.
Both hosts have agent 3.2.7634.0 and are both running Hyper-V Server 2012 R2.
What is wrong with Host1 and how do I correct it?
Thank you.

This is a share configuration permissions issue.
http://technet.microsoft.com/en-us/library/ee340124.aspx
Brian Ehlert
http://ITProctology.blogspot.com
Learn. Apply. Repeat.

Find all users who does not have access to a shared mailbox.

Hi all,
We are in the proces of setting up a hybrid enviroment with our E2010 towards Office365. As part of that, we want to move several batches of users. The first bunch if users we move should not use any shared mailboxes etc. but how do I find
those? I can see there are powershell scripts that find users who has a shared mailbox and then list the permission - but that is kind of the opposite than what I want :)
Browsing manually through users is not practical either as we have 10000+ mailboxes at the moment.
Hoping for a quick reply :)
/Trev

It is not possible to accomplish this by using powershell. Easier one is to get the list of people who has access on something with below and do easier data manipulation in Excel :
Get-Mailbox -Resultsize Unlimited | Get-MailboxPermission | ?{$_.isinherited -eq $False -and $_.user -notlike "*self*"} | select identity, user,accessrights
[url=http://www.lepide.com/]Lepide[/url]

I received a text from another iPhone user who does not have an iPad, why did I receive the text on my iPad rather than my iPhone?

I have both the iPhone and New iPad and I was under the impression when sending a text it went from iPhone to iPhone or iPad to iPad. Also, if I send a text from my iPad to someone who only has the iPhone, it comes in on their iPhone. However, I received a text from an individual who only has an iPhone and it came to my iPad and never showed up on my phone...Which means had I not been at home I would not have known I had a text on my iPad???? How does it determine which device it will appear on?

You are probably right - I don't have my iPad with me and was confusing myself. But on the iPad it is receive at email addresses only.
Sending to the phone number will mean ONLY your iPhone gets the message. If you want it to go to ALL devices, then you should have them send to the email address associated with the AppleID you used to set up iMessage originally. Also set that email address up as your caller id on the iPhone so as you send out messages, people will reply to that and both your devices should get them.
Although Apple's notes indicate you should be able to do it - http://support.apple.com/kb/TS2755
what if you just type in a 10-digit phone number on the iPad instead of an email?
(I originally did all this with iOS 5.0, and I know then the number did not work on an iPad, but maybe with iOS 5 updates, it does now?)

Can I Share a document with a user who does not have righs to the site? (SharePoint 2013 on prem)

Joe is in Sales
He must Share a document with Jane in Marketing.
He only wants to Share this one document.
Does he need to go into the Sales site and add Jane as a site user? Jane will then be able to see everything on the site. No good.
Does Joe now need to break inheritance on all the other site libraries from Jane to hide them??
In a perfect world, Joe shares the doc with Jane. Jane gets email with link. Jane clicks link and goes to sale site where all she sees is the document that was Shared- nothing else.
Cheers, Jim ___________________________________________________ If this was helpful please mark as an answer.

With 2013, you can just Share the specific item. It will automatically break inheritance on that item and allow Jane to see that one document only and Jane will get a link inviting her to the document.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

SCSFileDownloadServlet fails: User 'guest' does not have sufficient priv.

Hi,
We have an ADF application that is using SCSFileDownloadServlet to get documents from UCM. We added the servlet in web.xml and we are using this link to download the documents: /getfile?adapterName=our_adapter_name&dDocName=document12345&dID=12345
The issue is that sometimes it works but sometimes it fails throwing this message in the logs:
Event generated by user 'guest' at host 'CIS'. Unable to download 'COR-ER-421722'. User 'guest' does not have sufficient privileges. [ Details ]
An error has occurred. The stack trace below shows more information.
!csUserEventMessage,guest,CIS!$!csUnableToDownload,COR-ER-421722!csUserInsufficientAccess,guest
intradoc.common.ServiceException: !csUnableToDownload,COR-ER-421722!csUserInsufficientAccess,guest
*ScriptStack GET_FILE
3:checkSecurity,dID=421317,dDocName=COR-ER-421722
at intradoc.server.ServiceRequestImplementor.buildServiceException(ServiceRequestImplementor.java:2115)
at intradoc.server.Service.buildServiceException(Service.java:2260)
at intradoc.server.Service.createServiceExceptionEx(Service.java:2254)
at intradoc.server.ServiceSecurityImplementor.validateSecurityPrivilegeLevel(ServiceSecurityImplementor.java:813)
at intradoc.server.DocumentAccessSecurity.checkSecurity(DocumentAccessSecurity.java:170)
at intradoc.server.DocumentAccessSecurity.checkSecurity(DocumentAccessSecurity.java:121)
at intradoc.server.ServiceSecurityImplementor.checkSecurity(ServiceSecurityImplementor.java:371)
at intradoc.server.Service.checkSecurity(Service.java:2829)
at intradoc.server.FileService.checkSecurity(FileService.java:337)
at intradoc.server.Service.checkSecurity(Service.java:2807)
at sun.reflect.GeneratedMethodAccessor456.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
Is it possible to set a user/password to this servlet so it is able to download the documents everytime?
Thanks,
Josue

Hi go9189,
According to your description, you come across the error that User 'guest' does not have permission to run DBCC checkprimaryfile. This issue could happen when the login account doesn't have CREATE DATABASE, CREATE ANY DATABASE,
or ALTER ANY DATABASE permission in SQL Server instance, or that the login account has no access to the mdf and ldf files when attaching database, so SQL Server recognize the login account as a "Guest".
To solve the issue, you could pay attention to the points below.
1. Ensure that the login account has at least CREATE DATABASE, CREATE ANY DATABASE, or ALTER ANY DATABASE permission. You could grant the fixed server role 'dbcreator' or 'sysadmin' to the login account following the steps below.
a. Connect to SQL Server instance with the login account which has sysadmin fix server role.
b. Expand the folder 'Security', right click the login, and select Properties.
c. In the Server Roles tab, check the checkbox for 'dbcreator' or 'sysadmin'.
2. Make sure that the the login account has full control permission on the mdf and ldf files. For how to grant the login account with full control permission on the mdf and ldf files, please refer to the steps in the following article:
http://msdn.microsoft.com/en-us/library/bb727008.aspx
There is a similar thread for your reference:
https://social.technet.microsoft.com/Forums/en-US/e463df4c-8d26-46cf-aa2e-bddd97c7a9b8/user-guest-does-not-have-permission-to-run-dbcc-checkprimaryfile?forum=sqlgetstarted
Regards,
Michelle Li

User "system" doesn not have Permission "modify"

Using the Admin console, I am trying to add a new permission to an ACL and I am running
in to an error. The ACL is "weblogic.jndi.lightbridge.rms" and I am trying to add
the "lookup" permission. The error that I encounter is:
User "system" does not have Permission "modify" based on ACL "weblogic.admin.acl".
I have tried given the "system" user the permission (through the Admin console) but
I encounter the same error. I seem to have run into a "chicken or the egg" problem.
How do I give the "system" user the permission?

Try adding this entry to filerealm.properties and rebooting the server
acl.modify.weblogic.admin.acl=Administrators
and make sure that the "system" user is in the "Administrators" group. It should be by
default.
Now you should be able to add any ACL's and corresponding privileges that you like.
You could also add your ACL manually to fileRealm.properties--
acl.lookup.weblogic.jndi.lightbridge.rms=system
Cheers
Joe Jerry
Tom Muldoon wrote:
Using the Admin console, I am trying to add a new permission to an ACL and I am running
in to an error. The ACL is "weblogic.jndi.lightbridge.rms" and I am trying to add
the "lookup" permission. The error that I encounter is:
User "system" does not have Permission "modify" based on ACL "weblogic.admin.acl".
I have tried given the "system" user the permission (through the Admin console) but
I encounter the same error. I seem to have run into a "chicken or the egg" problem.
How do I give the "system" user the permission?

I have a downloaded font file for a school problem on a flash drive and I do not know how to install it into my photoshop application. Need to be walked through this as I am an older user who does not understand any of this stuff.

I have a downloaded font file for a school problem on a flash drive and I do not know how to install it into my photoshop application. Need to be walked through this as I am an older user who does not understand any of this stuff.

Fonts are handled by your operating system and installed through the respective System Control panel (Windows) or Fontbook (Mac). On Windows simply type "Fonts" in the search bar in the start menu and when you open the panel/ folder use File --> Add Font. On Mac the procedures are similar, you just need to find the Fontbook app in Applications:Utilities.
Mylenium

List of users who do not have USER GROUP.

Hi friends,
I want to find out the list of users who do not have USER GROUP.
Can any one please let me know how to find out.
Thanks,
Ankitha

Hi,
use the transaction "suim" or the abap report "RSUSR002"
-> user information system
open tree -> user -> users by compley.... -> exec. users by complex...
next screen -> Group for authorization -> select multiple selection (right symb.) -> in the tab 'single vals' -> click on the left symb. -> select '='
leave the fields blank. -> 'F8' or ok. -> then in the main screen 'F8' or run.
so you will get all users without a group asignment
I hope it was helpfully.
best regards
Cahit

User XIRWBUSER does not have authorization for message monitoring

Hi All,
In the Runtime WorkBench, when I choose the Message Monitoring, display Messages from Component Adapter Engine from Database, when I click on the start button, it shows me a error "User XIRWBUSER does not have authorization for message monitoring", how can I configure my xi to get the authorization for message monitoring of Adapter Engine? Thanks!
Regards,
Nick

Hi Nick,
Transaction PFCG. Enter the role you wish to check (SAP_XI_RWB_SERV_USER) and click on the display button.
Check that the Authorizations tab is green. If it is not, then you might need to generate the auth profile. Also check the User tab. If it is not green, then you should do a User Comparison as well (just click on the button inside the tab).
SAP Help URL:
http://help.sap.com/saphelp_nw04s/helpdata/en/52/67151e439b11d1896f0000e8322d00/frameset.htm
Cheers
Manish

How to find vendor who does not have transactions for last one year

HI all,
We have around 20000 vendors, i want to find out who does not have any transactions for last 1 year. Any valuable suggestions on this?
Thanks and regards
Ramarao

HI,
Actually above one mehtod is very painful method. Is there any method by writing ABAP query and any other short cut method
Thanks and regards
Ram

HT2534 how do you create an AppleID for a student who does not meet the minimum age requirements?

How do you create an Apple ID for a student who does not meet the "minimum age" requirements?

A parent/guardian has to create it and supervise its use.

Query to retrieve list of users who do not have a resource provisioned

I am trying to get a list of user who do not have a particular resource provisioned. I cannot seem to find a table that links the resource object information and User information. I need to generate a CSV file. Has anyone done this before or have any ideas. If so any information would be very helpful.
Thanks

select * from usr where usr.usr_key not in (
select usr.usr_key from oiu, usr, obi, obj, ost
where oiu.usr_key=usr.usr_key
and oiu.obi_key=obi.obi_key
and obi.obj_key=obj.obj_key
and obj.obj_name = :obj_name
and oiu.ost_key=ost.ost_key
and ost.ost_status not in ('Revoked'))
-Kevin

How do I create an executable for a computer that does not have IVI drivers

I'm creating an executable driver (based on the NI drivers) for a TDS 3054 intended for a computer that does not have the IVI engine. I would prefer to install as little software on this computer as possible. Is it possible for me to build the driver with the appropriate support DLL's without installing IVI on the user's computer? How do I do this?
Thank you,
Zach Oberman

Zach,
Since the tkds30xx driver you are using is IVI based, you will not be able to use it without the IVI Engine.
If you must build an executable that does not require the IVI Engine, then you will need to use a traditional LabVIEW driver or convert a VXIpnp driver into LabVIEW. Neither of those drivers would require the IVI Engine.
At this time the only TDS 3054 driver on NI's IDNet website is the IVI-based tkds30xx driver.
You may be able to obtain a traditional LabVIEW driver from
Tektronix
Developer Exchange
Requesting a
driver
Other Resources
Thanks,
--Bankim

Obtain a primary token for a user who does not have permission to logon locally

Similar Messages

Maybe you are looking for