Access denied when trying to deploy packages

[Mcasim]

Dear Susan.A (and all the Lansweeper Admins),

I am Harry and I'm having the same problem and i get the following error from many computers, when i try to push an installation.
The message is :
Initialization Failed! Task Registering Error. Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) Credential: (.\it-support). ShareCredential: (Domain name\Username).

I have the latest version of Lansweeper installed.

Could someone please help me in this.
Some computers are able to get the installation of a program (TeamViewer 6), but others show this error message.
I have also used the .\Administrator account and i have the same issues especially with Windows 7 Pro.
But i only use one Username/Password at the time.

When i use the Lansweeper Connection Tester i get the following errors.
These errors occur in Windows 7 Professional, joined to our 2003 R2 domain Server.
I have also tried to reboot (and shutdown) the computer with no luck.

Checking C$ Access
Connection Failure. Error: Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed. Disconnect all previous connections to the server or shared resource and try again

Checking Task Scheduler
Could not register task Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Task did not run successfully.

If anyone had the same issue as i do, and found a solution, please let me know.

Thank you for your time.
Best regards,
Harry.

[Mcasim · Accepted solution]

Hello Susan !

I have finally found out why i was getting also the :
Checking Task Scheduler
Could not register task Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Task did not run successfully.
When i was running the Lansweeper ConnectionTester.

The problem had to do with the Security that the Administrators had for the folder C:\Windows\Tasks
In the Target(client) computer, i run the following commands:
cd windows
CACLS TASKS /E /G builtin\administrators:F

The above give the Access to the Administrators to create tasks. Before that i only had read-list access.

The same can be done through Computer Policy in a Domain 2003 (i haven't tried it on 2008 or 2012 yet)
In the Group Policy Editor go to the Main Policy (or to the policy that is applied to computers) and from there :
Computer Configuration --> Windows Settings --> Security Settings --> File System --> %SystemRoot%\Tasks

From there, if they are not clicked already, click the
Configure this file or folder then
Replace existing permisions on all subfolders and files with inheritable permissions.


Then Click on the
Edit Security Click on the Administrators and give full control --> Apply --> Ok --> Apply --> Ok.


After doing the above, i was able to install-update programs to all the computers of the company.

I hope this helps, some other people having the same issue, that i had.

Best Regards,
Harry.

[Susan_A]

You still need to provide Lansweeper with a scanning credential that has full administrative privileges on the target machine in order for the deployment to work. As mentioned in my previous post as well, this credential will be used to create the scheduled task that will run the deployment. The task is run under your scanning credential, the computer's system account or the computer's currently logged on user, depending on which run mode you choose.

If you continue to run into issues with your deployments, please contact us via email at support@lansweeper.com, as opposed to updating this forum topic, and do so from a company email address. (Only trial and licensed Lansweeper users are entitled to support.) It's a lot easier to troubleshoot technical issues via email. Include the following in your email:

• Description of the problem.
  
• Program Files (x86)\Lansweeper\Service\Errorlog.txt, as present on your Lansweeper server.
  
• Excel export of the Deployment\Logs page.
  
• XML export of your deployment package.

[Mcasim]

Thank you very much.

I tried using the Currently logged on User option but it gives me error for wrong scanning credentials.

I will try in a freshly installed computer with windows XP sp3, the upcoming Tuesday, and let you know.

Best regards,
Harry.

[Mcasim]

Good day Susan.

Thank you very much for the reply.

Yes it will work, but as i said i just cannot add 340 user accounts in the Lansweeper accounnt Configuration --> Scanning Credentials, users list.
Not only this will take days to finish, but also the hudge amount of time during the installation, as it will try 340 user accounts per computer, will be quite big.

Is it in any future implementation-upgrade of the Lansweeper, the option to connect to the IP address of a deployment's target computer instead ? Or the options to use both ?

Best regards,
Harry.

[Susan_A]

Mcasim wrote:
Yes it will work, but as i said i just cannot add 340 user accounts in the Lansweeper accounnt Configuration --> Scanning Credentials, users list.
Not only this will take days to finish, but also the hudge amount of time during the installation, as it will try 340 user accounts per computer, will be quite big.

You don't need to submit the currently logged on user as a scanning credential in order to run the deployment package under that account. When deploying the package, simply select "currently logged on" as your run mode. You can configure the default run mode under Deployment\Security Options as well. I would recommend reviewing this section of our knowledge base for more information on creating and running deployment packages.

• Your scanning credentials are used to create scheduled tasks on your machines that will run the deployments.
  
• The tasks are run under your scanning credentials, your computers' system accounts or your computers' currently logged on users, depending on which run mode you choose.
  
• The share credentials you submit under Deployment\Security Options are used to access files stored in your package shares, files required for the deployments.

Mcasim wrote:
Is it in any future implementation-upgrade of the Lansweeper, the option to connect to the IP address of a deployment's target computer instead ? Or the options to use both ?

This feature is on our customer wish list, but we do not have a release date for it unfortunately.

[Susan_A]

To install something for the currently logged on user, simply running the deployment package under the currently logged on user should work.

When you initiate a deployment, a connection is made to the computer's name, not its IP address, so successful DNS resolution is a requirement. Connecting to the IP address of a deployment's target computer instead is not currently possible. For asset actions configured under Configuration\Asset Pages, you can choose which parameter (IP, computer name) to connect to. For deployment packages, this is not possible.

[Mcasim]

Hello Susan and I'm very sorry for not replying any sooner.

What i wanted to do, was to be able to install programs (TightVnc, Xnview, Vlc etc) to Users Computers without the need to log them off. To Install any program silently without the user knowing it or interrupting him or her.
Until lately i was able to install programs, but only if the user logged on the computer, was a user existing in the Configuration --> Scanning Credentials, users list.
Just because i have about 340 users i cannot add them all there.

So after searching (googling) a little bit more, i found out how to use the psexec command.
psexec \\target ip -u Administrator -p password msiexec.exe /i "\\souce ip containing the installations\DefaultPackageShare$\Installers\TightVNC\tightvnc-2.7.10-setup-32bit.msi"

Now i am creating scripts, and i will start pushing installations and configuration files, to uses computers using the lansweeper and the script with the command above.

BUT.... There is a another, rather, small problem i'm dealing with.

The Lansweeper programs is using DNS names of the computers it finds.
Is there a way, instead of using DNS names to use the Ip Addresses of the computers ?
In the main dashboard to see the Ip Adrreses instead of DNS names?
I could always and some 340 lines in my c:\windows\system32\drivers\etc\hosts file lines like
192.168.17.5 BO1
but, as you can imagine, i would like to avoid this.

Is there a way to change the DNS naming-sorting and use IP addressing instead?

Thank you very much for your time and once again sorry for the delay on answering.

Best regards,
Harry

[Susan_A]

I don't see any emails from you in our system, so I'll consider this issue resolved for now.

[Susan_A]

Technical issues like this are much easier to troubleshoot via email. I would recommend contacting support@lansweeper.com and providing a link to this forum thread.