Link to home
Start Free TrialLog in
Avatar of geoffcluts

asked on

Access Denied when trying to execute cmd or Bat files from wanywhere on the network

I have a very peculiar issue.  I have one user who recieves the following error when trying to double click on a *.cmd or *.bat file anywhere on our network.

"Access to the specifed device, path, or file is denied"

I have verified he has all the neccesary NTFS permissions, and I even created a copy of his acccount.  The same error occurs with the new account as well.  It does not happen with any other accounts in the same OU, so i do not think it's a GPO.  You can even copy the files to the desktop, double click them, and recieve the same error.  This happens no matter which workstation on the network the user is logged in to. If you use a command prompt and type in the path to run the files they execute without issue.  I am totally stumped. Do anyone have any ideas?
Avatar of CptnTrips

IS the bat or cmd trying to execute something on the users machine? Does the person have the proper rights on that machine to execute either?
Avatar of geoffcluts


Deffinitely not a rights issue on the workstation.  It happens on any workstation this users log into, and I have added the test account I created to the duplicate to the issue as a local admin on my test workstation.  The issue still occurs.  
have you moved the files to a public share that you are sure evryone can hit and tried it from there? IS the file something you can post the contents of here?
The particular cmd files he is trying to run are on a share that "everyone" has read/execute access to.   Keep in mind he can run these just fine from a command prompt. We just get access denied when he tries to double click via the GUI.   I am not going to attach a batch file because its any cmd or batch file.  I have even made some that just try to ping something and output to a text file.  

And this is just on one machine? not matter who logs into that machine? This user can do these things from any other machine? Is the machine using the Active desktop thing? If so, is it an IE security setting being to high? Yes, I know that sounds insane.
No this happens for the same user on any machine.  I will go over my troubleshooting steps up to current. Hopefully that will clarify.  I am the administrator for the file servers hence why this fell in my court.

1) User gets access denied when trying to double click a cmd file which is used to launch an application

2) I verify permissions and see that NTFS/Share permissions are adequate to allow the user to execute the files from this share.   I even used the "effective permissions" tab in advanced security window to verify the user is not in some group that may have explicit "deny" permissions

3) Stumped, I obtained the user's login info and duplicated the issue from two test workstations in my cubicle.  

4) I made a copy of the users login, the error occurs with this login as well.

5) I added the account I created in step 4 for to the local admin group one my test boxes.  The error still occurs

6) I copy the account of another user in the same Organizational Unit thinking it may be a GPO issue.  The issue DOES NOT occur with this account, effectively ruling out and GPO related problems.

7) I log back in with the problem account and try to run a batch, or cmd file from any server on the network. The error occurs on every file i try.

8) I copy the files to the local desktop and try to execute them.  The error still occurs.  You can even right click and edit them successfully, but double clicking still produces the error.

9) running the file from a command prompt works fine, so that is what the user is doing currently as a work around.

I know this makes no sense.... it should be worth about 2 million points if someone can figure this out.
Wow, that is very strange. Does the user have a roaming profile?
Step 4 - You copied the user's login.. Do you mean you made a new account by copying the user's problem account?
Yeah in step 4 I right clicked his account and selected copy.  So it retained all his group membership etc..  He doesnt have a roaming profile. We are about to give up and just delete his account and recreate it from a copy of someone not having the problem.
Yeah it sounds like that might be the quickest solution now. Does it happen with an account you create from scratch?
It doesnt happen on new accounts no.  So far it is just this one account and any copies I have made of it.
Avatar of ee_auto

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial