AT command and Access Denied

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hi,
I have used the AT command fairly extensively since the NT4 days but I can't
seem to figure this out. Normally I will issue a command from my workstation
such as
c:\>at \\severname
and I can get a list of task if any. however this one particular server I
immediately receive Access Denied and if I logon locally and just type
c:\>at
I still get access denied.
Any ideas?
 
First double check that you are logged on as an account that is a local
administrator as shown by membership on the local administrators group. If
you are logged on as a domain admin it is possible that group has been
removed from the local administrators group. Then check the logs in Event
Viewer to see if any pertinent errors are recorded. You may also want to
enable auditing of logon events for success and failure and privilege use
for failure which may generate some helpful info. That can be done in the
Local Security Policy of the server via secpol.msc. The other thing to check
is to see if the Task Scheduler service is started and that it is configured
to logon via the local system account and allow service to interact with
desktop is selected which is the default setting. --- Steve
 
I've checked the task scheduler and it is set to default all the other
settings are also okay. Even if I log in as the local Admin I get the access
denied error. this is only happening to a handful of servers (4 or 5 out of
53) I'm jsut worried now that I may have some sort of virus or something.
All servers are created from the same image and they all have citrix and they
all boot from M:. I turned on auditing for privilege use and this is the
only error that comes up.
Event Type: Failure Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 578
Date: 10/28/2004
Time: 7:12:43 AM
User: IAC_NT\xASerret
Computer: GCMF02
Description:
Privileged object operation:
Object Server: Security
Object Handle: 4294967295
Process ID: 3492
Primary User Name: GCMF02$
Primary Domain: IAC_NT
Primary Logon ID: (0x0,0x3E7)
Client User Name: xaserret
Client Domain: IAC_NT
Client Logon ID: (0x0,0x414444)
Privileges: SeIncreaseBasePriorityPrivilege
 
I don't think that event is related unless it is generated at the same time
that you tried to run the AT command, though be default administrators have
that user right. To see the explanation of that user right see the link
below.

http://www.microsoft.com/resources/...dowsServ/2003/standard/proddocs/en-us/542.asp

http://tinyurl.com/4hnn7 -- same link, shorter

The only other thing I can think of is to go to Control Panel, open
Scheduled Tasks and in go to advanced - view log to see if anything is
recorded there as to what the problem could be. There are free tools like
filemon and regmon from SysInternals that may help if you run them just
before you try to use the AT command, stop them as soon as the AT command
fails, and then look in the log of the program to see if you can find any
access denied messages for files or registry. The problem though is that
would be very hard to do on a busy server unless you can take it off the
network for a bit as regmon and filemon can generate thousands of entries in
their logs in half a minute. -- Steve
 
Back
Top