none
User Group Policy Preference File Copy to Desktop Access Denied

    Question

  • What causes this?  I did click the box to run it under the users context.  I unclicked all the file attribute boxes (not sure why "archive" is checked by default).

    The user does have access to save files on the desktop.  I can log in and create files on the desktop with no errors. 

    It is a roaming user profile.

    Log Name:      Application
    Source:        Group Policy Files
    Date:          4/25/2012 10:00:49 PM
    Event ID:      4098
    Task Category: (2)
    Level:         Warning
    Keywords:      Classic
    User:          SYSTEM
    Computer:      W7E1.domain.local
    Description:
    The user '%DesktopDir%' preference item in the 'Icon {9F9EAC5E-9673-4843-AD8D-C481DF275961}' Group Policy object did not apply because it failed with error code '0x80070005 Access is denied.' This error was suppressed.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Group Policy Files" />
        <EventID Qualifiers="34305">4098</EventID>
        <Level>3</Level>
        <Task>2</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2012-04-26T05:00:49.000000000Z" />
        <EventRecordID>9341</EventRecordID>
        <Channel>Application</Channel>
        <Computer>W7E1.domain.local</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data>user</Data>
        <Data>%DesktopDir%</Data>
        <Data>Icon {9F9EAC5E-9673-4843-AD8D-C481DF275961}</Data>
        <Data>0x80070005 Access is denied.</Data>
      </EventData>
    </Event>

    Thursday, April 26, 2012 5:14 AM

Answers

  • Hi,
     
    Thank you for your question.

    Please post the GPP settings details and ensure the destination file option include the file name.
    Read this similar thread to take a reference, hope it helps you.
     
    If there are more inquiries on this issue, please feel free to let us know.

    Regards


    Rick Tan

    TechNet Community Support

    Friday, April 27, 2012 8:54 AM
  •  
    > bypassErrors="1"><Properties action="R"
    > fromPath="\\srv2\APPS\Calculator.lnk" targetPath="%DesktopDir%"
    > readOnly="0" archive="0" hidden="0"
    > suppress="0"/><Filters><FilterRunOnce hidden="1" not="0" bool="AND"
    > id="{F2FE30DF-39E8-4823-8F7B-2A9E377E943D}"/>
    > </Filters></File>
     Here we see the error: As you are copying a single file (without
    wildcards), the target MUST specify a file, too (in your definition,
    %userprofile%\Desktop is interpreted as name of the target file, but a
    folder with the same name already exists, hence "access denied"). 
    %DesktopDir%\Calculator.lnk as target should work. BTW - RunOnce is
    unneccesary in this case.
     
    regards, Martin
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    • Marked as answer by MyGposts Friday, April 27, 2012 9:14 PM
    Friday, April 27, 2012 2:30 PM

All replies

  • Hi,

    "0x80070005 Access is denied" - Generally caused by a permission issue.

    Make sure that the logged in user has sufficient permission to the share folder location. Make sure that the user can access the share location.

    Add Everyone under the Share permission of the folder \\server\folder. and also give Everyone Full control under the Security tab of that folder.


    Regards,
    Rafic

    If you found this post helpful, please give it a "Helpful" vote.
    If it answered your question, remember to mark it as an "Answer".
    This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!

    Thursday, April 26, 2012 7:08 AM
  • The user has access to the share.  I can log in to the computer and browse to the share.  It is a folder inside the netlogon folder on a domain controller.  Everyone already has the default full control to the share and read to the ntfs folder.

    However, I did notice when I tried to drag and drop the file from there to the desktop, a message popped up saying "Your internet security settings suggest that one or more files may be harmful."  I had to click OK and then it copied.

    So, I moved the file to a different share on a different server and tried dragging and dropping from there and there was no more warning message.  I edited the GPP to point to the new share and then did gpupdate on the workstation so the user would get the updated policy and the file still did not copy.  I looked in the even viewer and the same access denied message was still generated for the GPP file copy.

    I have tried this GPP file copy for both the user's desktop and start menu and both are acess denied.  I don't see where the permission problem is located.

    Thursday, April 26, 2012 12:57 PM
  •  
    > The user '%DesktopDir%' preference item in the 'Icon
    > {9F9EAC5E-9673-4843-AD8D-C481DF275961}' Group Policy object did not
    > apply because it failed with error code '0x80070005 Access is denied.'
    > This error was suppressed.
    >
    > Event Xml:
    >
     
    Would you mind posting the GPP file item XML, too? (Right click "All Tasks")
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    Thursday, April 26, 2012 3:37 PM
  • > The user '%DesktopDir%' preference item in the 'Icon
    > {9F9EAC5E-9673-4843-AD8D-C481DF275961}' Group Policy object did not
    > apply because it failed with error code '0x80070005 Access is denied.'
    > This error was suppressed.
    >
    > Event Xml:
    >
    Would you mind posting the GPP file item XML, too? (Right click "All Tasks")

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!

    I created new GPO from scratch with different files and got the same error.

    This is from the event viewer.  I cannot find what you mean by "GPP file item XML."  Nothing I can find in the policy settings have an all tasks option when I right-click on it.

    Log Name:      Application
    Source:        Group Policy Files
    Date:          4/26/2012 7:44:21 PM
    Event ID:      4098
    Task Category: (2)
    Level:         Warning
    Keywords:      Classic
    User:          SYSTEM
    Computer:      W7E1.domain.local
    Description:
    The user '%DesktopDir%' preference item in the 'Copy file to desktop {E70C8DA0-BA31-4D8C-90E2-25A55484038B}' Group Policy object did not apply because it failed with error code '0x80070005 Access is denied.' This error was suppressed.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Group Policy Files" />
        <EventID Qualifiers="34305">4098</EventID>
        <Level>3</Level>
        <Task>2</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2012-04-27T02:44:21.000000000Z" />
        <EventRecordID>9442</EventRecordID>
        <Channel>Application</Channel>
        <Computer>W7E1.domain.local</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data>user</Data>
        <Data>%DesktopDir%</Data>
        <Data>Copy file to desktop {E70C8DA0-BA31-4D8C-90E2-25A55484038B}</Data>
        <Data>0x80070005 Access is denied.</Data>
      </EventData>
    </Event>

    Friday, April 27, 2012 3:06 AM
  • Hi,
     
    Thank you for your question.

    Please post the GPP settings details and ensure the destination file option include the file name.
    Read this similar thread to take a reference, hope it helps you.
     
    If there are more inquiries on this issue, please feel free to let us know.

    Regards


    Rick Tan

    TechNet Community Support

    Friday, April 27, 2012 8:54 AM
  •  
    > This is from the event viewer.  I cannot find what you mean by "GPP
    > file item XML."  Nothing I can find in the policy settings have an all
    > tasks option when I right-click on it.
     
    Are you using Win7 or Vista? Anyway: Then please right click on the
    element -> "copy", right click on the desktop -> "paste". Open the
    resulting xml file with notepad and post the contents.
     
    regards, Martin
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    Friday, April 27, 2012 10:31 AM
  • I don't see what you're talking about.  What is "the element" to right click on?

    Friday, April 27, 2012 1:27 PM
  •  
    > I don't see what you're talking about.  What is "the element" to right
    > click on?
    >
     
    In GPEditor, when navigating to Group Policy Preferences "Files", you
    have a list of defined "files" on the right hand side. These are "the
    elements" (or "items") in the preference...
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    Friday, April 27, 2012 1:42 PM
  • I am editing the GPP from Server 2008 SP2.

    It does not allow me to copy and paste the file because it says it can't find it.  I was able to browse to the appdata local temp directory and found an xml file with the first characters of the file name changed.

    Instead of being called %DesktopDir%.xml, it was named as ÞsktopDir%.xml

    <File clsid="{50BE44C8-567A-4ed1-B1D0-9234FE1F38AF}" name="%DesktopDir%" status="%DesktopDir%" image="1" changed="2012-04-27 02:36:49" uid="{66D6E87C-FD3C-405A-89D7-9F0D4D3A7817}" userContext="1" bypassErrors="1"><Properties action="R" fromPath="\\srv2\APPS\Calculator.lnk" targetPath="%DesktopDir%" readOnly="0" archive="0" hidden="0" suppress="0"/><Filters><FilterRunOnce hidden="1" not="0" bool="AND" id="{F2FE30DF-39E8-4823-8F7B-2A9E377E943D}"/>
    </Filters></File>

    Friday, April 27, 2012 1:55 PM
  •  
    > bypassErrors="1"><Properties action="R"
    > fromPath="\\srv2\APPS\Calculator.lnk" targetPath="%DesktopDir%"
    > readOnly="0" archive="0" hidden="0"
    > suppress="0"/><Filters><FilterRunOnce hidden="1" not="0" bool="AND"
    > id="{F2FE30DF-39E8-4823-8F7B-2A9E377E943D}"/>
    > </Filters></File>
     Here we see the error: As you are copying a single file (without
    wildcards), the target MUST specify a file, too (in your definition,
    %userprofile%\Desktop is interpreted as name of the target file, but a
    folder with the same name already exists, hence "access denied"). 
    %DesktopDir%\Calculator.lnk as target should work. BTW - RunOnce is
    unneccesary in this case.
     
    regards, Martin
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    • Marked as answer by MyGposts Friday, April 27, 2012 9:14 PM
    Friday, April 27, 2012 2:30 PM
  • OK, that worked.  Thanks.
    Friday, April 27, 2012 9:14 PM