search

amidaware / tacticalrmm

A remote monitoring & management tool, built with Django, Vue and Go.
https://docs.tacticalrmm.com
Other
3.25k stars 447 forks source link

Certain service checks return error "access denied" #1724

Open Aidan-abss opened 10 months ago

Aidan-abss commented 10 months ago

Server Info (please complete the following information):

Installation Method:

Agent Info (please complete the following information):

Describe the bug Services like: RPCSS, Distributed Transaction Coordinator, and Dcom Server Process Launcher which are running on the agent system can not be checked and return an error "access denied". Those services do not show up when creating a check for a specific agent. The service does not appear in remote background.

To Reproduce Steps to reproduce the behavior:

  1. Create an automation policy with a service check for one of the affected services
  2. apply the policy to some servers
  3. run your checks on your servers
  4. See error

Expected behavior We should see that the check reports that services are running when they are running (confirmed by logging into the system and checking the services MMC snap-in). We should see the check tell us the service is stopped when it is stopped

Screenshots image image

Additional context Add any other context about the problem here.

silversword411 commented 10 months ago

This has been discussed before, can't find where ATM.

Pretty sure you are using windows server 2019/2022.

There's some kind of security or special permission where some services are protected in a new/different way for security.

If you find more info and/or a pattern please post info.

silversword411 commented 10 months ago

Found it. Discord discussion

https://discord.com/channels/736478043522072608/1138917739835166843

Are the problem services running as "NETWORK SERVICE"?

Aidan-abss commented 10 months ago

Found it. Discord discussion

https://discord.com/channels/736478043522072608/1138917739835166843

Are the problem services running as "NETWORK SERVICE"?

Yes. They do run as network service.

But not all services that are running as "network Service" experience this issue, such a s RPC locator service.

silversword411 commented 10 months ago

So it's something else along with that.

Is there any Microsoft documentation on the topic?