Jump to content


Photo

ALE: Exaiming logon sessions... Failed


  • Please log in to reply
3 replies to this topic

#1 Nir

Nir

    Newbie

  • Members
  • Pip
  • 7 posts

Posted 15 October 2013 - 02:02 PM

Hi all,

Whatever I try I always get the following error when examine a client computer:
Examining logon sessions... Failed due to the following error: Access is denied. (Exception from HRESULT: 0x800700005 (E_ACCESSDENIED))

I've disabled firewall and use domain administrator for testing, still the same error pops up. It works fine when examining a server though...
What are the requirements to get proper results from this check on clients too?

Many thanks
Nir

#2 jeffb

jeffb

    Advanced Member

  • Administrators
  • PipPipPip
  • 384 posts
  • Gender:Male

Posted 16 October 2013 - 12:49 PM

Nir,

Please reference the following Knowledge Base article: http://www.netwrix.com/kb/1523

-Jeff

#3 Nir

Nir

    Newbie

  • Members
  • Pip
  • 7 posts

Posted 16 October 2013 - 02:36 PM

Hi Jeff,

Many thanks for your reply.
The service account is currently member of the domain admins group, which is member of the local Administrators group. I verified this by logging into the client with the service account.
That error only appears on the "Examining logon sessions" line, everything else runs ok.
That check runs fine when examine servers.

Nir

#4 jeffb

jeffb

    Advanced Member

  • Administrators
  • PipPipPip
  • 384 posts
  • Gender:Male

Posted 16 October 2013 - 05:09 PM

Nir,

Since this works on servers and not workstations my first guess is that there is some kind of group policy applied to the workstations that is causing this access denied. I am not sure what it is but it is the only logical explanation. However, I feel like it may be possible to try to reproduce this outside of the product and try to get additional information straight from Windows.

1) Log into the Netwrix server with the service account
2) Go into Event Viewer and choose to Connect to Another Computer
3) Try to connect to the particular workstation in question to view it's security event logs and see if you can navigate through them.

-Jeff




0 user(s) are reading this topic

0 members, guests, anonymous users