Database Search

If you can't find the information using the categories below, post a question over in our WinBatch Tech Support Forum.

TechHome

WinBatch

Networks - Servers

Microsoft Client

wNT

Services

Can't find the information you are looking for here? Then leave a message over on our WinBatch Tech Support Forum.

wntRunAsUser and No Permissions on Local Machine

Keywords: 	   wntRunAsUser Permissions on Local Machine

User:

Does wntRunAsUser need to be run from a domain account in the same domain that you will be trying to authenticate against?

When I do wntRunAsUser(\\pdc,user,password,3,1) I get an error 639(logon failure)...the username and password are correct; however when I look at my local event logs I see a failed logon attempt(529) the domain is correct in the event record? but when I go to \\pdc I see no failed logon attempts... anyone got any ideas? Thanks!

Tech Support:

What does "user" look like

If it is of the format "joe" then it will use "joe" in the //pdc I think

If you use the format "otherdc/joe" or was it "otherdc\joe" then it will try to authenticate to the "otherdc" domain.

User (cont'd):

I've tried user every way I can think of:
domain\user, domain/user, user@domain ...
they still all only show up in the local event logs...

along with the local 529 errors there are also 681 errors with an errorcode of 3221225572 which corresponds to "User logon with misspelled or bad user account", which locally speaking is true because there is no local "user" account...

Tech Support:

The PC you are running the script on is in Domain A, but you want to RunAs a user from Domain B. Is PDC a server in Domain A or B? And is there any trust between the domains? Can you map to the PDC (or other server in Domain B) and connect using the username and password you have?

User (cont'd):

Actually, the PC(w2k srv sp3) I'm running the script from is in Domain A of Forest1 and PDC is a (w2k srv sp3)Server in Domain B of Forest2. There is no problem in mapping a drive manually or even using the UNC style mount(it'll ask me for alternate credentials but it works fine)

Tech Support:

Also look in the wwwbatch.ini file in your Windows directory and see if there is additional error diagnostic info in there.

User (cont'd):

Here's what's in wwwbatch.ini:
[WWWNT34I] LastError=1326 (LogonUser)

Tech Support:

//
// MessageId: ERROR_LOGON_FAILURE
//
// MessageText:
//
// Logon failure: unknown user name or bad password.
//
#define ERROR_LOGON_FAILURE 1326L

And the errors are in your local event log? do you have access to the PDC event log, is there anything in there about it?

Post a sample script that does not work (replace username/password etc, but other than that leave as is).

User (cont'd):

Yeah I have access to the PDC event logs...there's nothing in them (pertaining to this) .... no evidence that it's even trying to authenticate against PDC...
My sample script is pretty short since the wntrunasuser is at the beginning:
addExtender("wwwnt34i.dll") DebugTrace(@on, "debugme.txt") srv="\\servername" user=user password=password wntRunAsUser(srv, user, password,3,1)
and it blows up...

Tech Support:

wntRunAsUser will take a Domain as the first param. Maybe try that?

User (cont'd):

Tried domain as the first parameter; didn't work:(

Thanks for all of these suggestions though!

Tech Support:

Instead of:

user=user
password=password

which would give an error that the variable user is undefined, please fake up a more realistic looking sample like:

user="Domain7\jdoe"
password="fudgesicles"

as obviously the main problem seems to be in the setitngs of these parameters.

And you *are* trying to log on to \\PDC ??

or are you trying to log on to the local machine? What machine are you trying to get security permissions for? \\PDC or the local machine?

For the local machine the first parameter should be ""

User (cont'd):

I'm on the local machine and I need to authenticate as a domain account on \\PDC that has access to resources on yet another machine. does this make sense or am I just tangling the web even more?

Tech Support:

Does the user you are trying to authenticate as have permissions to run on the local machine?

Maybe you are getting kicked off the local machine.

User (cont'd):

No, because local machine is not in the same forest as the user... does the user need permissions to run on the local machine? I wouldn't think that that would be necessary...
Let me try to explain my situation a little better...
-I'm running this script from computerA in forest1
-I need to access a share and change the privledges of that share on computerB of domainX in forest2
-The only user that has rights to assign privledges to the share on computerB is userA
-userA is a domain user account of domainY in forest2

-so I need to runas userA from ComputerA but I can't:(

Tech Support:

I think maybe the user you are trying to run as also needs permission to execute on the local machine....because that is where the script is executing, and otherwise we have an unauthorized user executing code on the local machine....

That's my best guess anyway.

Article ID:   W15565

File Created: 2003:05:13:11:28:56

Last Updated: 2003:05:13:11:28:56