File Access / Execution Access Denied

[TNGPicard]

I'm having some weird trouble with a Win 2008 application server and various clients - XP desktops, 2003 Servers as clients and a 2008 terminal server as a client as well.

I will go to execute a file, program, etc running available on the shared resources and on one computer it works fine and on another it does not. It can be an installer or a program file (our application launches from a UNC path). If I drop to a command line, map a drive and launch the executable from the commandline, this works but does not work through the GUI. I am not using runas or any other type of privilige escellation beyond what I'm logged into the machine as - which in my case is domain admin, with admin access on both the server (2008 standard) and client (all of the previous OS').

The exact error which I get is in an error popup, the UNC path to the executable is in the title bar and the error text is: "Windows cannot access the specified device, path, or file. you may not have the appropriate permissions to access the item." with a single OK button.

I can turn to the computer to next to it (test lab) and the same thing works fine, same user.

The share permissions grant everyone full control as do the NTFS permissions on the disc.

M:\>cacls \\lmfjascdb\appwin\ascmenu.exe
\\lmfjascdb\appwin\ASCMenu.exe Everyone:R
                               LEEPDC\Administrator:F
                               BUILTIN\Users:F
                               BUILTIN\Administrators:F
                               NT AUTHORITY\SYSTEM:F

There is nothing showing up in the event logs (although I am just now turning failure auditing on on the server, missed that setup along the way) on either the clients or the server.

Advice would be appreciated, this is driving me nuts.

TNGPicard / Mark L.

 

[porkchopexpress]

I've had similar issues on 2003 and 2008 servers and it was to do with the I.E lockdown kit, i've also sometimes had to add the server name that hosts the exe to the local intranet zone in I.E.

I know i'm stating the obvious but have you also tried turning off AV.

 

[TNGPicard]

porkchopexpress -

- yes on the AV
- re the IE lockdown, its already been removed
- the local intranet zone is a good idea, will give that a shot

TNG