AnsweredAssumed Answered

Error code 5 : Access denied, CreateProcessAsUser

Question asked by RayFox608611 on Jun 18, 2018
Latest reply on Jul 18, 2018 by Chandru.Venkataraman
  • Comment • 7

Agent Version: version '12.0.3+build.791'

Windows 2016 server.

I am getting the following in the Agent log on Windows 2016:

 

20180618/132637.350 - U02001040 Error in function 'CreateProcessAsUser', error code '5', error description: 'Access is denied.'.
20180618/132637.366 - U02001000 Job 'MSSQL_T03_TEST' could not be started. Error code '5', error description: 'Access is denied.'.

 

I have granted the following to the user/group concerned:

1) Logon as batch job
2) Act as part of operation system
3) Create a token object
4) Replace a process level token

 

The same user/group works on Windows 2012 Server.

 

Firewall is disabled for tests

 

Anybody in the same situation?

 

Thanks,

Ray FOX

RayFox608611
RayFox608611 Jun 19, 2018 8:16 AM
Correct Answer

Thanks for your suggestions Wolfgang and Chandru.

 

I have found that McAfee Endpoint Security is the culprit. There are errors in the Windows Event Viewer as follows:

 

EventID=18060 NT AUTHORITY\SYSTEM ran UCXJWX6.EXE, which tried to access C:\AUTOMIC\AGENTS\WINDOWS\TEMP, violating the rule "Suspicious Double File Extension Execution", and was blocked. For information about how to respond to this event, see KB85494.

 

I disabled McAfee Endpoint Security and executed the job - it worked.

 

Ray

See the reply in context
No one else had this question

Outcomes