Kepserverex Error Code 0x5
Anyone who has used Windows has encountered the dreaded 'Access Denied' error. (AKA error code 5 or 0x5). This error typically implies you can't do something like open or save a file. The error implies that you have encountered some type of security issue.In the past, an 'Access Denied' issue came down to 2 things in Windows:. Token. DACL (Discretionary Access Control List)A token represented a user and Windows compared it to the DACL of the secured object that the user was accessing. Windows was answering the basic question, 'Does the user have the requested access to the secured object?'
Hello Below a copy-paste of a GREAT tip. Just stumbled upon it, and wanted to archive the info. It's cool, I might say; -) For short reference: here the original script. Code (0x5): Access is denied. Next retry time: 20:25:30.” Head back to the advanced settings and change the user account from machine account to a user with administrative rights. KEPServerEX is more than an OPC server—it's a connectivity platform for industrial automation and IoT. Simply download KEPServerEX, and then select from Kepware's library of more than 150 device drivers, client drivers, and advanced plug-ins to fit the communication requirements unique to your industrial control system.
Once you dig into these 2 items, explaining an 'Access Denied' error is easy but understanding whether this is the expected result is much more difficult. (I may discuss this further in a future BLOG post).Lately, solving 'Access Denied' issues have become more complex due to a new security feature which was introduced in many years ago (Windows VISTA), Mandatory Integrity Control (Integrity Levels). The purpose of Integrity Levels was to add an extra security check where a user running untrustworthy code is attempting to do something malicious. See the following for more information:There are 4 levels of integrity in Windows. Different users in Windows have a different default integrity level. Anonymous - Anonymous User. Low.
Medium - Normal User. High - Elevated User (Administrator). System - LocalSystemThe best example of Integrity Level Usage is Internet Explorer's Protected Mode (See ) Basically, Internet Explorer is running in a Low Integrity Level. What this means is that even though a user may have the appropriate access to a file, the file cannot be accessed from Internet Explorer.
I mentioned above that an access check was based on the system comparing the user's token with the secured object's DACL. Well, we need to check one more thing, the integrity level of the user's token and what level can access the secured object.
A user can only access objects that have the same or lower integrity level. In the case of IE, most files and directories in Windows have a medium or higher integrity level and since IE Is running at a low integrity level, any code running in IE will not be able to access any files or directories even if the user has the appropriate permissions to the file or directory. The above article goes into details on finding the default low integrity level directory which IE can access. Integrity levels also impact the registry as well.The integrity level for the user is stored in the token.
The integrity level for a secured object is actually stored in the SACL but the ACEs are not System Aces but they are called System Mandatory Label ACEs. The Access Check is still the same but there is an additional check that needs to be made from the token and from the Security Descriptor.So the next time you are dealing with an 'Access Denied' error, do not forget to check the integrity levels of the user and the secured object. You'll save yourself a lot of time.Follow us on Twitter,.
Hello,I'm having trouble running jobs with my active directory (ADS) account. I've setup my SQL services to run under an ADS account, but jobs cannot seem to query ADS for user information. We're running Windows Server 2003 and SQL Server 2005 SP2.Here is the error message:The job failed.
Unable to determine if the owner (ADSme) of job eFASRtest has server access (reason: Could not obtain information about Windows NT group/user 'ADSme', error code 0x5. SQLSTATE 42000 (Error 15404)).also this message in log:298 SQLServer Error: 15404, Could not obtain information about Windows NT group/user 'ADSme, error code 0x5. SQLSTATE 42000 (ConnIsLoginSysAdmin)I have done a.lot. of searching and cannot find the solution. I believe the 0x5 code is access denied.The same job runs if I change the owner to a SQL login that's not an ADS account.I'm not certain how to confirm that the SQL Agent account is the account actually querying ADS, also.Any help would be greatly appreciated!Thanks,-Tony. In my working scenario, the SQL Server service was running as a domain user in Domain A.In the non-working scenario, the SQL Server service is running as a local account that does not have domain access to Domain B.
I set it up this way because I thought it was the SQL Agent account that was actually doing the AD query.I changed the SQL Server service to run as a domain user account and the agent jobs now appear to be working when a domain account is the owner.I am going to do some more testing, but I think that the SQL Server service account was my problem.Thank you very much, Raul. Hi, Raul.Thanks for your reply.I tested the service account's ability to query ADS in this way: On the server, whenever I adjust NTFS permissions on a file or folder and want to add an ADS account or group, I have to supply an ADS username and password to query ADS. I did this using the SQL Server Service account's name and password, and I was able to 'check names' in ADS. I'm assuming this is a valid test.Also, in one test, I set the owner of the job to the service account and the job ran. So, it looks like the service account has permission to check itself in ADS, but not other ADS objects. (Assuming the SQL Server Service account is the account actually making the query to ADS.)So, I'm still not certain if I need to adjust SQL Server, Windows Server, or the ADS service account permission to ADS (which I cannot do myself - I'm on a very large ADS with limited rights to objects).Thanks again,-Tony. SQL Server should ask for all the group memberships for any Windows user; I am not sure if the test you tried with NTFS ACLs would do something similar.Try the following statement in SQL Server using a sysadmin account:EXECUTE AS LOGIN = ‘ADSme’GoThe SQL Server impersonation token for Windows users is based on the information SQL Server gets back from the AD.
If the impersonation succeeds, I would assume SQL Server has absolutely no problems querying the AD and that we will need to look for a different reason. If this query fails then we will need to find out what part of the AD queries the account is restricted to perform.-Raul GarciaSDE/TSQL Server Engine. Hi, Raul.I executed the following:EXECUTE AS LOGIN='ADSme'GoMessage:Msg 15404, Level 16, State 19, Line 1Could not obtain information about Windows NT group/user 'ADSme', error code 0x5.I also executed that command with the service account:EXECUTE AS LOGIN='ADSmyserviceaccountname'GoMessage:Command(s) completed successfully.So, it's as if the service account can query its own information but not that of other ads user objects.
Operation Failed Error Code 0x5
I suspect that SQL is trying to validate my SID with the SID it has for me within a SQL system table to verify that my ADS account really is a SQL login, but I'm just guessing there.I'm going to send this information to our ADS admins. It really seems to point to a permission problem in ADS.If it is a SQL issue, could it be that ADSme doesn't have permission to execute a system stored procedure in order to perform the ADS query? To answer my own question, it seems like the service account would be doing this and not my ADSme account.Thoughts?Thanks very much,-Tony. I have to admit I am also a little bit surprised. I have never faced a scenario where an account is getting an explicit access denied when querying information about itself and all its groups, but succeeds while querying information about other principals and objects in the AD. I agree with you, check with your AD administrator, probably they have some security policy we are not aware of that may be causing this problem.I personally don’t think the problem is regarding any permission to execute a system stored proc (EXECUTE AS should call the code directly); but let’s wait until we have more information from the AD admins regarding this issue.One more thing you can try: Can you install a test-only copy of SQL Server 2005 (i.e. SQL Server Express) using a different account for the service?
(it could be a different machine). If you can install it, can you try the same EXECUTE AS LOGIN tests?Thanks a lot,-Raul GarciaSDE/TSQL Server Engine. Raul,Can you give me the step by step on how to grant, or make sure, the SQL Server service account has access to query AD? I'm new to SQL and not sure how to do this. I have two domains setup. One is internet facing, and one is our regular domain. Our regular domain doesn't trust out Interent domain, but our Internet domain trusts our regular domain.
The SQL server I am working on is in our Internet domain, and the jobs are falling with the same messages above. We are running a few jobs with different user accounts. Some from our regular domain, and a few with our admin account on the Internet domain.All jobs are falling.
I have tried running the jobs with the sa account, but that fails as well.Can you help me out?Thanks,Ryan. Hello,I am also getting the same error (15404) as Syndrake. I have tried all of Raul's suggestions with the same results.I have confirmed with our AD Admin that there are no restrictions on this domain account. They setup the service account as a standard user. She actually created a new account, just as a test, while I had her on the phone and we had the same results.One intresting twist with my situation is that this issue cropped up when I migrated this server to an AD domain from a NT4 domain (seperate domains, not a domain upgrade). The Agent service account was able to query user info just fine in NT 4, but this same SQL Agentservice/job owner setup now fails in AD.Thanks,Jeff. For further assistance on AD configuration I would recommend using the directory services forum ( ), the audience of this forum will be better qualified to help you on this area than myself.Please correct me if my assumption is incorrect: Domain-A trusts Domain-B, but Domain-B doesn’t trust Domain-A SQL Server is installed on a Domain-A machineIn order to work, SQL Server should be running under a Domain-B service account, otherwise it is very likely that Domain-B will not accept the token from the service and fail.-Raul GarciaSDE/TSQL Server Engine.
Hi Raul,Thanks for replying to my post.Actually, Domain A trusts Domain B and Domain B trusts Domain A. Full 2-Way trust.SQL Server machine was a member of Domain A but now has joined Domain B. Domain A will be going away.Domain A = NT4Domain B = ADPrevious Working Scenario. Server is a member of Domain A (NT4). SQL Agent service running as Domain ASQLAgentAcct. Domain ASQLAgentAcct has sysadmin rights in SQL.
Also belongs to Domain Users domain group and the local Administrators group. SQL Agent job owner = Domain BDeveloperAgent job runs successfully. Domain ASQLAgentAcct while logged into Domain A is able to get information about Domain BDeveloper. I assume because of the 2-way trust.Non-working Scenario.Attempting to take Domain A out of the picture.
Server is now a member of Domain B (AD). Also, all accounts involved now belong to Domain B. SQL Agent service running as Domain BSQLAgentAcct. Domain BSQLAgentAcct has sysadmin rights in SQL. Also belongs to Domain Users domain group and the local Administrators group. SQL Agent job owner = Domain BDeveloperSQLAgentAcct could not obtain information about Windows NT group/user 'Domain BDeveloper'Like Syndrake, I was able to log into the server as Domain BSQLAgentAcct and add Domain BDeveloper to local groups. The check names function works great.
So, you would think Domain BSQLAgentAcct would have adequate permissions to query AD.My AD Admin claims that the Domain BSQLAgentAcct does not have any restrictions. It is setup like any other user. And, because I am able to query AD outside of SQL, this doesn't seem to be a AD permissions issue.Thanks,Jeff. In my working scenario, the SQL Server service was running as a domain user in Domain A.In the non-working scenario, the SQL Server service is running as a local account that does not have domain access to Domain B. I set it up this way because I thought it was the SQL Agent account that was actually doing the AD query.I changed the SQL Server service to run as a domain user account and the agent jobs now appear to be working when a domain account is the owner.I am going to do some more testing, but I think that the SQL Server service account was my problem.Thank you very much, Raul. I WANT 2 SOLVE BELOW PROBLEM'SLog Name: ApplicationSource: SQLSERVERAGENTDate: 2018-10-10 20:01:22Event ID: 208Task Category: Job EngineLevel: WarningKeywords: ClassicUser: N/AComputer: YO-DHK-GSD.youngonedhk.comDescription:SQL Server Scheduled Job 'GSD Database.Subplan1' (0x14684C9111C1108E7C570F) - Status: Failed - Invoked on: 2018-10-10 20:00:00 - Message: The job failed. Unable to determine if the owner (YO-DHK-GSDAdministrator) of job GSD Database.Subplan1has server access (reason: Could not obtain information about Windows NT group/user 'YO-DHK-GSDAdministrator', error code 0x6bb.
Cip Error Codes
SQLSTATE 42000 (Error 15404)).Event Xml:2083.