Access denied when running Upgrade Readiness Deployment Script on Windows 10 devices

%3CLINGO-SUB%20id%3D%22lingo-sub-242674%22%20slang%3D%22en-US%22%3EAccess%20denied%20when%20running%20Upgrade%20Readiness%20Deployment%20Script%20on%20Windows%2010%20devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-242674%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20implemented%20an%20Azure%20Log%20Analytics%20demo%20environment%20including%20Windows%207%20SP1%2C%20Windows%208.1%20and%20Windows%2010%20client%20machines.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMicrosoft%20Monitoring%20Agent%20is%20installed%20on%20all%20three%20machines.%3C%2FP%3E%3CP%3EThe%20Upgrade%20Readiness%20Deployment%20Script%20has%20finished%20on%20the%20Windows%207%20SP1%20and%20Windows%208.1%20machines%20without%20any%20problems%20and%200%20error(s).%20Both%20machines%20are%20already%20visible%20within%20the%20Azure%20Log%20Analytics%20dashboard%2FUpgrade%20Readiness.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUnfortunately%2C%20this%20is%20not%20the%20case%20for%20the%20Windows%2010%20client.%20Everytime%20I%20run%20the%20script%20(no%20difference%20between%20run%20as%20(local)%20administrator%2Frun%20as%20system)%20I%20receive%26nbsp%3B%20an%20%3CSTRONG%3EAccess%20is%20denied%20%3C%2FSTRONG%3Eerror%20message%20within%20the%20command%20prompt%20although%20in%20the%20log%20files%20of%20the%20script%20it%20is%20written%3A%20Success%20%3A%20Script%20succeeded%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMicrosoft%20Windows%20%5BVersion%2010.0.16299.611%5D%3CBR%20%2F%3E(c)%202017%20Microsoft%20Corporation.%20All%20rights%20reserved.%3CBR%20%2F%3E%3CBR%20%2F%3EC%3A%5CWindows%5Csystem32%26gt%3Bcd%20C%3A%5CUsers%5CUSERNAME%5CDesktop%5CPilot%3CBR%20%2F%3E%3CBR%20%2F%3EC%3A%5CUsers%5CUSERNAME%5CDesktop%5CPilot%26gt%3BRunConfig.bat%3CBR%20%2F%3E%3CSTRONG%3ERunning%20config%20batch%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CSTRONG%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%201%20file(s)%20copied.%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CSTRONG%3EAccess%20is%20denied.%3C%2FSTRONG%3E%3CBR%20%2F%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20%3CSTRONG%3E0%20file(s)%20copied.%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CBR%20%2F%3EPsExec%20v2.11%20-%20Execute%20processes%20remotely%3CBR%20%2F%3ECopyright%20(C)%202001-2014%20Mark%20Russinovich%3CBR%20%2F%3ESysinternals%20-%20%3CA%20href%3D%22http%3A%2F%2Fwww.sysinternals.com%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ewww.sysinternals.com%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EC%3A%5CWindows%5CSystem32%5CWindowsPowerShell%5Cv1.0%5Cpowershell.exe%20exited%20on%20Win10Client003%20with%20error%20code%200.%3CBR%20%2F%3E0%3CBR%20%2F%3E%3CSTRONG%3EAccess%20is%20denied.%3C%2FSTRONG%3E%3CBR%20%2F%3E%3CSTRONG%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%200%20file(s)%20copied.%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20is%20the%20problem%20with%20the%20Windows%2010%20client%20here%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBest%20regards%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EJoseph%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-242674%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOMS%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOMS%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOMS%20Operations%20Management%20Suite%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOperations%20Management%20Suite%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EPowerShell%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-312788%22%20slang%3D%22en-US%22%3ERe%3A%20Access%20denied%20when%20running%20Upgrade%20Readiness%20Deployment%20Script%20on%20Windows%2010%20devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-312788%22%20slang%3D%22en-US%22%3E%3CP%3EFor%20me%2C%20it%20turned%20out%20to%20be%20permissions%20on%20the%20powershell.exe.config%20file.%26nbsp%3B%20The%20Pilot%20script%20backs%20the%20original%20up%2C%20copies%20in%20a%20new%20one%2C%20runs%20the%20PowerShell%20script%20with%20an%20-ExecutionPolicy%20Bypass%20flag%20on%20it%20(which%20should%20allow%20for%20unsigned%20scripts%20as%20I%20understand%20it)%2C%20and%20then%20copies%20the%20backup%20config%20back%20to%20the%20original.%26nbsp%3B%20It%20was%20failing%20when%20it%20attempted%20to%20make%20a%20backup%20and%20again%20when%20trying%20to%20restore%20the%20backup.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%2C%20should%20I%20have%20needed%20to%20adjust%20the%20permissions%3F%26nbsp%3B%20Probably%20not.%26nbsp%3B%20But%20at%20least%20the%20'access%20denied'%20errors%20went%20away.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYMMV.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-283792%22%20slang%3D%22en-US%22%3ERe%3A%20Access%20denied%20when%20running%20Upgrade%20Readiness%20Deployment%20Script%20on%20Windows%2010%20devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-283792%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20reason%20this%20doesn't%20work%20is%20because%20MS%20decided%20it%20wasn't%20necessary%20to%20sign%20their%20scripts%20even%20though%20the%20guidance%20is%20to%20use%20RemoteSigned%20as%20the%20execution%20policy.%20You%20need%20to%20unblock%20the%20.PS1%20script%20and%20allow%20it%20to%20run.%20I'm%20just%20going%20to%20sign%20them%20once%20I've%20configured%20it.%20This%20should%20be%20covered%20in%20the%20documentation.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-273320%22%20slang%3D%22en-US%22%3ERe%3A%20Access%20denied%20when%20running%20Upgrade%20Readiness%20Deployment%20Script%20on%20Windows%2010%20devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-273320%22%20slang%3D%22en-US%22%3E%3CP%3ESame%20error%20here%2C%20glad%20I'm%20not%20the%20only%20one.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-260992%22%20slang%3D%22en-US%22%3ERe%3A%20Access%20denied%20when%20running%20Upgrade%20Readiness%20Deployment%20Script%20on%20Windows%2010%20devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-260992%22%20slang%3D%22en-US%22%3E%3CP%3Eon%20Windows%2010%20we%20get%20the%20same%20error%20message.%20what's%20wrong.%20the%20ntfs%20right%20are%20standard.it%20would%20be%20nice%20MS%20have%20a%20fix%20for%20this%20script%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hi,

 

I have implemented an Azure Log Analytics demo environment including Windows 7 SP1, Windows 8.1 and Windows 10 client machines.

 

Microsoft Monitoring Agent is installed on all three machines.

The Upgrade Readiness Deployment Script has finished on the Windows 7 SP1 and Windows 8.1 machines without any problems and 0 error(s). Both machines are already visible within the Azure Log Analytics dashboard/Upgrade Readiness.

 

Unfortunately, this is not the case for the Windows 10 client. Everytime I run the script (no difference between run as (local) administrator/run as system) I receive  an Access is denied error message within the command prompt although in the log files of the script it is written: Success : Script succeeded

 

Microsoft Windows [Version 10.0.16299.611]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\Windows\system32>cd C:\Users\USERNAME\Desktop\Pilot

C:\Users\USERNAME\Desktop\Pilot>RunConfig.bat
Running config batch
        1 file(s) copied.
Access is denied.
        0 file(s) copied.

PsExec v2.11 - Execute processes remotely
Copyright (C) 2001-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe exited on Win10Client003 with error code 0.
0
Access is denied.
        0 file(s) copied.

 

What is the problem with the Windows 10 client here?

 

 

Best regards

 

Joseph

4 Replies
Highlighted

on Windows 10 we get the same error message. what's wrong. the ntfs right are standard.it would be nice MS have a fix for this script

 

Highlighted

Same error here, glad I'm not the only one. 

Highlighted

The reason this doesn't work is because MS decided it wasn't necessary to sign their scripts even though the guidance is to use RemoteSigned as the execution policy. You need to unblock the .PS1 script and allow it to run. I'm just going to sign them once I've configured it. This should be covered in the documentation. 

Highlighted

For me, it turned out to be permissions on the powershell.exe.config file.  The Pilot script backs the original up, copies in a new one, runs the PowerShell script with an -ExecutionPolicy Bypass flag on it (which should allow for unsigned scripts as I understand it), and then copies the backup config back to the original.  It was failing when it attempted to make a backup and again when trying to restore the backup.

 

Now, should I have needed to adjust the permissions?  Probably not.  But at least the 'access denied' errors went away.

 

YMMV.