AnsweredAssumed Answered

Error code 5 : Access denied, CreateProcessAsUser

Question asked by RayFox608611 on Jun 18, 2018
Latest reply on Oct 11, 2018 by PhilippElmer

Like • Show 0 Likes0
Comment • 8

Agent Version: version '12.0.3+build.791'

Windows 2016 server.

I am getting the following in the Agent log on Windows 2016:

20180618/132637.350 - U02001040 Error in function 'CreateProcessAsUser', error code '5', error description: 'Access is denied.'.
20180618/132637.366 - U02001000 Job 'MSSQL_T03_TEST' could not be started. Error code '5', error description: 'Access is denied.'.

I have granted the following to the user/group concerned:

1) Logon as batch job
2) Act as part of operation system
3) Create a token object
4) Replace a process level token

The same user/group works on Windows 2012 Server.

Firewall is disabled for tests

Anybody in the same situation?

Thanks,

Ray FOX

RayFox608611 Jun 19, 2018 8:16 AM

Correct Answer

Thanks for your suggestions Wolfgang and Chandru.

I have found that McAfee Endpoint Security is the culprit. There are errors in the Windows Event Viewer as follows:

EventID=18060 NT AUTHORITY\SYSTEM ran UCXJWX6.EXE, which tried to access C:\AUTOMIC\AGENTS\WINDOWS\TEMP, violating the rule "Suspicious Double File Extension Execution", and was blocked. For information about how to respond to this event, see KB85494.

I disabled McAfee Endpoint Security and executed the job - it worked.

Ray

See the reply in context

No one else had this question

Outcomes

Chandru.Venkataraman

Jun 19, 2018 7:27 AM

Is UAC enabled? Does turning it off make any difference?

Actions

FrankMuffke Jun 19, 2018 8:00 AM

did you grant ALL of the privileges to the user - mentioned here:

Automic

cheers, Wolfgang

Actions

RayFox608611 Jun 19, 2018 8:16 AM

Thanks for your suggestions Wolfgang and Chandru.

I have found that McAfee Endpoint Security is the culprit. There are errors in the Windows Event Viewer as follows:

I disabled McAfee Endpoint Security and executed the job - it worked.

Ray

2 people found this helpful

Actions

FrankMuffke @ RayFox608611 on Jun 19, 2018 8:20 AM

Great!

THX for the info!

cheers, Wolfgang

Actions

Olgun_Onur_Ozmen Jul 12, 2018 10:52 AM

Hi,

The same situation we have experienced.We disabled McAfee Endpoint Security on server and solved.

Olgun.

2 people found this helpful

Actions

JohnO'Mullane Jul 18, 2018 10:48 AM

Hi all,

We have seen this error for the first time today.

It is on a couple of new Windows2016 servers.

Likewise, we see this error in the log...

EventID=18060

NT AUTHORITY\SYSTEM ran UCXJWX6.EXE, which tried to access C:\AUTOMIC\AGENTS\WINDOWS\TEMP, violating the rule "Suspicious Double File Extension Execution", and was blocked. For information about how to respond to this event, see KB85494.

I don't really want to have to Disable McAfee Endpoint Security on all new Windows servers.

Any other option?

John.

Actions

Chandru.Venkataraman

@ JohnO'Mullane on Jul 18, 2018 11:58 PM

Endpoint Security Natural Language String event messaging index

Determine whether the behavior was expected:

If expected, you must either:
- Accept/ignore the data
- Create an exclusion for the specified rule to exclude the process that is violating the rule
If not expected, investigate the behavior further because either:
- The behavior is occurring because of malware that has infiltrated the process
- The behavior is normal and needs to be reclassified as expected behavior, in which case you would see the previous bullet for expected behavior

Actions

PhilippElmer @ JohnO'Mullane on Oct 11, 2018 11:36 AM

Hi John,

the problem McAffee has is the double extensions of the Job-Files in the temp directory (J******.TXT.BAT)
It should be possible to exclude only the double extension check for the servers with Automic Windows Agents.

Cheers, Philipp

Actions

8 Replies

Chandru.Venkataraman Jun 19, 2018 7:27 AM
Mark Correct
Correct Answer
Is UAC enabled? Does turning it off make any difference?
Like • Show 0 Likes0
Actions
FrankMuffke Jun 19, 2018 8:00 AM
Mark Correct
Correct Answer
Hi

did you grant ALL of the privileges to the user - mentioned here:
Automic

cheers, Wolfgang
Like • Show 0 Likes0
Actions
RayFox608611 Jun 19, 2018 8:16 AM
Unmark Correct
Correct Answer
Thanks for your suggestions Wolfgang and Chandru.

I have found that McAfee Endpoint Security is the culprit. There are errors in the Windows Event Viewer as follows:

EventID=18060 NT AUTHORITY\SYSTEM ran UCXJWX6.EXE, which tried to access C:\AUTOMIC\AGENTS\WINDOWS\TEMP, violating the rule "Suspicious Double File Extension Execution", and was blocked. For information about how to respond to this event, see KB85494.

I disabled McAfee Endpoint Security and executed the job - it worked.

Ray
2 people found this helpful
Like • Show 1 Like1
Actions
- FrankMuffke @ RayFox608611 on Jun 19, 2018 8:20 AM
  Mark Correct
  Correct Answer
  Great!
  
  THX for the info!
  
  cheers, Wolfgang
  Like • Show 0 Likes0
  Actions
Olgun_Onur_Ozmen Jul 12, 2018 10:52 AM
Mark Correct
Correct Answer
Hi,

The same situation we have experienced.We disabled McAfee Endpoint Security on server and solved.

Olgun.
2 people found this helpful
Like • Show 0 Likes0
Actions
JohnO'Mullane Jul 18, 2018 10:48 AM
Mark Correct
Correct Answer
Hi all,
We have seen this error for the first time today.
It is on a couple of new Windows2016 servers.

Likewise, we see this error in the log...

EventID=18060

NT AUTHORITY\SYSTEM ran UCXJWX6.EXE, which tried to access C:\AUTOMIC\AGENTS\WINDOWS\TEMP, violating the rule "Suspicious Double File Extension Execution", and was blocked. For information about how to respond to this event, see KB85494.

I don't really want to have to Disable McAfee Endpoint Security on all new Windows servers.

Any other option?

John.
Like • Show 0 Likes0
Actions
- Chandru.Venkataraman @ JohnO'Mullane on Jul 18, 2018 11:58 PM
  Mark Correct
  Correct Answer
  Endpoint Security Natural Language String event messaging index
  
  Determine whether the behavior was expected:
  If expected, you must either:
  Accept/ignore the data
  Create an exclusion for the specified rule to exclude the process that is violating the rule
  If not expected, investigate the behavior further because either:
  The behavior is occurring because of malware that has infiltrated the process
  The behavior is normal and needs to be reclassified as expected behavior, in which case you would see the previous bullet for expected behavior
  Like • Show 0 Likes0
  Actions
- PhilippElmer @ JohnO'Mullane on Oct 11, 2018 11:36 AM
  Mark Correct
  Correct Answer
  Hi John,
  the problem McAffee has is the double extensions of the Job-Files in the temp directory (J******.TXT.BAT)
  It should be possible to exclude only the double extension check for the servers with Automic Windows Agents.
  Cheers, Philipp
  Like • Show 0 Likes0
  Actions

Error code 5 : Access denied, CreateProcessAsUser

Outcomes

Related Content

Recommended Content

Incoming Links