Access denied when reading / writing to network lo

Question

I'm currently trying to launch a process on a remote machine using WMI in C#. The process reads and writes to a file that is stored on a separate server.

When I manually login to the remote machine, I can run the process and it all works fine.

However, when I try to launch the process on the remote from my local machine using WMI, I get the following error:

System.UnauthorizedAccessException: Access to the path '\\server\path\input.txt' is denied.

I've tried multiple connection options, but I'm not sure how to re-create the permissions that I seem to have when I login manually... What do I need to do?

Local machine code

static void LaunchRemoteProcess(string remoteMachine, string command)
{
    ConnectionOptions connectionOptions = new ConnectionOptions
    {
        Impersonation = ImpersonationLevel.Impersonate,
        EnablePrivileges = true
    };

    var managementScope = new ManagementScope(string.Format(@"\\{0}\root\cimv2", remoteMachine), connectionOptions);
    managementScope.Connect();
    var managementPath = new ManagementPath("Win32_Process");
    var objectGetOptions = new ObjectGetOptions();
    var managementClass = new ManagementClass(managementScope, managementPath, objectGetOptions);

    // Launch the command asynchronously
    var inParams = managementClass.GetMethodParameters("Create");
    inParams["CommandLine"] = command;
    var outParams = managementClass.InvokeMethod("Create", inParams, null);
}

Remote machine code

string networkPath = @"\\server\path";
string inputFile = "input.txt";
string inputText = File.ReadAllText(Path.Combine(networkPath, inputFile));

string outputFile = "output.txt";
File.WriteAllText(Path.Combine(networkPath, outputFile), inputText);

Edit 1

I have already tried using the credentials of the user for which the process works if I log on to the remote machine manually and the process still fails with the same error:

    ConnectionOptions connectionOptions = new ConnectionOptions
    {
        Username = "username",
        Password = "password",
        Authority = "ntlmdomain:COMPANYNAME.CO.UK,
        EnablePrivileges = true
    };

Am I missing something with regards to the Authority, Authentication, or Impersonation attributes?

Answer 1

As the reason states, the user id you are using on your PC does not seem to have access for to another computer's location (though it is a server, it is some other computer).

You may get access for your user id or use Impersonation to use an user id that already has access to the location.

Find more details here: https://msdn.microsoft.com/en-us/library/w070t6ka%28v=vs.110%29.aspx

Edited: Add user name password too. That may help.

Answer 2

Impersonation vs Delegation

Your WMI code uses impersonation, so the server side runs in the security context of the user who calls the code on the client. But this is only valid on the server itself, not for accessing e.g. a remote CIFS share (as in your case).

You have to use delegation.

First, change

Impersonation = ImpersonationLevel.Impersonate,

to

Impersonation = ImpersonationLevel.Delegate,

If you get an exception then, delegation does not yet work in your environment.

Check:

• Calling user account: "Account is sensitive and cannot be delegated" must not be checked in the user properties (Active Directory Users and Computers)

• server machine account: "Trust this computer for delegation to any service..." must be checked

• local security policy on the server: "Enable computer and user accounts to be trusted for delegation" must include the calling user.

See

https://msdn.microsoft.com/en-us/library/aa389288%28VS.85%29.aspx

for further information on this topic.

---

Added: (see the comments below):

If Delegate is not an option in your environment (e.g. group policies do not allow for this, and you do not have the rights to change them), you may check some alternative ways.

You probably heard of psexec.

Or, what I did some years ago, and which runs in production in a enterprise environment on a few servers for many years very successfull:

I created a scheduled task which starts a program and set the technical user + password for this task. The task was configured for "run once in year 2200 :-)".

Then I wrote commands in a queue (I used a simple command file) and started the task from a remote machine.

Doing it this way, delegation is not required, since the scheduled task itself logs on as the technical user account ("logon as batch" privs are required).