SCCM Current Branch Remote Console connectivity issues Insufficient privilege to connect, error Access is denied

Since few days ,i have been working on the SCCM console connectivity issues from remote box. This is completely new setup replacing the existing CAS with primaries and going with flat design (1 Primary site.There is blog post coming soon on the SCCM design considerations and notes from the field )

As part of setting up SCCM current branch ,was creating RBAC for the team and for testing ,I have installed the current branch console (1702) on citrix and remote boxes (server/workstation) to try with different user accounts.

When i try to launch the console ,it failed with generic error message with some default possible solutions to check.

image

Next is to look at admin UI log SmsAdminUI.log on the console installation folder (C:\Program Files (x86)\Microsoft Configuration Manager\AdminConsole\AdminUILog) for further troubleshooting.

Insufficient privilege to connect, error: 'Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))'\r\nSystem.UnauthorizedAccessException\r\nAccess is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))\r\n   at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)

image

As you can see above, the log doesn't say much about the issue except that, Insufficient privilege to connect, error: 'Access is denied .

The account which am trying to connect to the console is full administrator and is working on local SCCM server but not from any other remote box.

Since the console access is not working for anyone from any remote box ,i suspect the issue is almost on the SCCM server with DCOM permissions.

I have checked the DCOM permissions ,WMI security permissions (wmigmmt.msc) and wbemtest locally on the server ,all looks good.I could not able to find anything wrong with security permissions to SMS admin group .I have also compared the DCOM permissions from working SCCM site (another domain) with this newly setup current branch 1702 site but i could not able to find any permission issues.

Then looked at event viewer if i can any information pertaining to DCOM permissions ,all looks clean from event viewer .

what else could go wrong here except security permissions on the DCOM,WMI ? well , after spending sometime on the troubleshooting  colleague of mine helped to look at MSDTC service and have decided to uninstall MSDTC (Distributed Transaction Coordinator service)  ,install and reboot the SCCM server which fixed the issue of remote console connectivity.

What made colleague to look at MSDTC component ?As he explain,for any remote connections to happen it either go with DCOM/WMI/RPC .In this case ,i could not able connect to remote SCCM server using wmi (wbemtest) and console just failed. So ,there seems major issue on DCOM connection .         For this ,we checked the permissions on DCOM (dcomcnfg) ,all looks good t,hen went to registry to look for DCOM enabled ,it also looks good. The next part of troubleshooting in DCOM is to reinstall MSDTC component .

How do you uninstall MSDTC component ?

Open the cmd as run as administrator ,perform net stop MSDTC

image

run MSDTC –uninstall

image

Review event log: In Application Event Log message confirms that MSTDC was successfully uninstalled

image

Run MSDTC –install

image

image

Review event log: In Application Event Log message confirms that MSTDC was successfully installed

start MSDTC services using net start MSDTC

image

Reboot the SCCM server ,launch the console ,you see the nodes there .

If the reinstall of MSDTC doesn't work ,then  we may have to go little deeper into DCOM to troubleshoot.

See you in the next post!

2 Responses to "SCCM Current Branch Remote Console connectivity issues Insufficient privilege to connect, error Access is denied"

  1. Hi - That is very odd. How the hell one can know DTC is the issue. If you see the service running fine then you assume it is working fine. Good you had a partner who thought about DTC and finally were able to fix the issue.

    Thanks for sharing. This note going to KB collection.

    Ram

    Reply
    1. Well ,It is one of the DCOM troubleshooting method since the remote console access is not working which means ,there is serious issue with DCOM/WMI. as part of DCOM, checked the DCOM permissions ,registry ,all looks good .So next step is to reinstall MSDTC component .Even if this MSDTC component doesnt solve the issue, we may have to go little deeper into DCOM which is not required in this case.

      Regards,
      Eswar

      Reply

Leave a Reply