I ran into an interesting dilemma with the Workstation Service. On startup, the service would error out with the Event ID from the subject line. If a manual start was attemted it would error out with Access Denied. The text of the from the Event Viewer also stated "Access is Denied".
There was nothing abnormal about the system in general. The service was set to log on as LocalSystem just as it should. Unfortunately, the system got wiped clean before I could look at it any further.
However, I was able to, at least, duplicate the error message on a second machine. I located the Workstation Service dll file (WKSSVC.dll) and set the security permissions for the SYSTEM group to DENY all. This environment allowed the "Access Denied" event to be generated on start up. I was able to find hits for the event but not any related to the service nor one that matched the text of the description. It seemed to only be affecting the workstation service and those that are dependant upon it.
I can't say with any certainty this is the permissions of the dll file was the root cause of the original problem, but has anyone encountered something like this before?
And if so, what could be the possible causes of an environment like this? Any insight would be appreciated.
There was nothing abnormal about the system in general. The service was set to log on as LocalSystem just as it should. Unfortunately, the system got wiped clean before I could look at it any further.
However, I was able to, at least, duplicate the error message on a second machine. I located the Workstation Service dll file (WKSSVC.dll) and set the security permissions for the SYSTEM group to DENY all. This environment allowed the "Access Denied" event to be generated on start up. I was able to find hits for the event but not any related to the service nor one that matched the text of the description. It seemed to only be affecting the workstation service and those that are dependant upon it.
I can't say with any certainty this is the permissions of the dll file was the root cause of the original problem, but has anyone encountered something like this before?
And if so, what could be the possible causes of an environment like this? Any insight would be appreciated.