Troubleshooting 'Administrative Access Denied' error message when scanning target machines using Datacenter
2 years ago
Originally Published: 2008-06-18
Article Number
000050709
Applies To
RSA DLP Datacenter 6.0
Issue
"Administrative Access Denied" received when running Datacenter scan for a target machine
Resolution
Generally if an "Administrative Access Denied" error occurs it means the system you are attempting to scan is not in the same domain as Datacenter or the admin credentials being used do not have enough privileges or is incorrect.

If the "runas" user for the agent scan group does not have admin access to target machine, or if target systems are not domain members or are on domains other than the EC/SC system, additional Credential settings within the Datacenter are required. Please review article "Inserting Credentials into Datacenter Agent Groups" - article a40644.

For systems that are not a member of the domain, over-ride credentials can be configured. Up to 10 keys for each scan group can be configured under the ?Credentials? tab when configuring a scan group

Below are a few helpful troubleshooting steps:

1. Verify Administrative privileges on the target system
Verify that the "runas" user or the credentails entered into the "Credentials" tab (under "Optional Settings") in the scan group has admin access to the remote machine.
To make sure you have administrative privileges on the remote machine, from the Datacenter Site Coordinator system, open Internet explorer and try
logging into the target machine by browsing to "\\<remote-machine>\c$\" or use the DOS prompt and type in "net use \\computer name\c$"
to make sure you can get to administrative share.

If access to the admin share is provided automatically, it would mean that the logged in user has access to the admin share (make sure that the logged in user is the user account that is being used in Datacenter) or You may be prompted to enter an username and password. Put the username as domain\username (local account username) and the password. You should be given access to the C$. If access is granted then the username and password that you put into Datacenter are ok.

a) While using the "net use" command, If you get the following error message:
C:\Documents and Settings\prasiah>net use \\computer_name\c$
System error 53 has occurred.
The network path was not found.

This usually happens when File and Print Sharing is disabled on the target system. Go to Step 2 and 3 to troubleshoot this issue.

b)While using the "net use" command, If you get the following error message:
C:\Documents and Settings\prasiah>net use \\computer_name\c$
The password or user name is invalid for \\computer_name\c$.
To connect computer_name\Guest to computer_name, press ENTER, or type a new user name:
Enter the password for computer_name:
System error 1326 has occurred.
Logon failure: unknown user name or bad password.

This is caused if the target machine does not belong to the domain and has a "Local Security Setting" that disallows login. On target machine, Go to Control Panel > Administrative Tools > Local Security policy > Security Settings > Local Policy > Security options and check for "Network access: Sharing and security model for local accounts". Change this setting from "Guest Only - local users authenticate as Guest" to "Classic- Local users authenticate as themselves"

2. On remote machine check if "File and Print Sharing" is enabled. Go to the network properties for the interface and check and see if "File and Print Sharing" has been enabled. By default Windows should have this Enabled.

3. Check Firewall Settings on remote machine
On remote machine go to Control Panel > Windows Firewall and check if the firewall is turned ON. If turned "On" please check up and see if there is an exception for "File and print sharing". By default Windows will have an exception for File and print sharing if firewall is turned ON.
Also, check for other 3rd party AV firewall settings on the target machine to see if "File and Print Sharing" is blocked.