Unable to remotely manage systems upgraded to XP

  • Thread starter Thread starter David Woodward
  • Start date Start date
D

David Woodward

I am a network administrator for the State of Alabama and
we have recently started deploying Windows XP to our
clients.

Right now we are holding off on upgrading anymore clients
because we are having some issues with remote managment of
PCs that have been upgraded from Windows 2000 Pro SP4 to
Windows XP Pro SP1.

The problem (I will explain the problem wih more detail
below) appears to be specificly related to upgrading from
Windows 2000 Pro SP4. We have upgraded systems that
originally had Windows 2000 Pro with a service pack level
of less than SP4 and the problem does not exist.

We have also upgraded a stand alone system that was not
even on our domain and had the same results, so I do not
believe it is a problem with Group Policies or any another
network/domain configuration.

The symptoms are as follows:

Log in to a local system on the network as a user with
administrative rights to the remote PC. Now go to:

Control Panel -> Administrative Tools -> Computer
Management

Click on Action -> Connect to another computer...

Enter the computer name or IP address of the remote system.

At this point everything appears to be normal. But if you
attempt to view their event log you will get an "Access
Denied" error. You also get errors while trying to view
the system summary, performance logs/alerts, and device
manager.

When you attempt to read the performance logs and alerts
you will receive an error stating that you must have
access to a specific registry key in order to perform this
function. Which brings us to the next symptom.

If you open registry editor and attempt to connect to the
remote system, you are allowed to connect but you only
have access to HKEY_CLASSES_ROOT on the remote system. If
you try to read from HKEY_LOCAL_MACHINE,
HKEY_CURRENT_USER, or anything else on the remote system
you get an access denied error.

We do not depend on the remote management functions at
this point. But we are currently researching software to
aid us in remotely managing client PCs and these problems
raise concerns that we may not be able to sue such
software on systems that are upgraded to Windows XP.

Any help anyone can give us on this issue would be greatly
appreciated.

NOTE: I did submit a ticket with Microsoft on this issue
but I was directed to their professional support ($245 per
incident) which we may not be able to get approval for any
time soon. (State government is slow about these things)

Thank you,
David Woodward
 
Hi David,

Thanks for your posting here.

The issue is caused that the following registry key in your Windows XP
computer upgraded from Windows 2000 SP4 is missing "local service" with
read access.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg

Adding it will fix the problem.

If there are many clients, you can also use the Subinacl.exe utility that
is included with the Windows 2000 Resource Kit. For example, to grant Read
permissions to a registry key for the Local Service account, you would use
the command:

"subinacl /keyreg <<RegKey>> /grant="LOCAL SERVICE"=R"

If you have any further concerns about this issue please feel free to let
me know. It is my pleasure to be of assistance.

Best regards,
Bob Qin
Product Support Services
Microsoft Corporation

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Back
Top