none
Startup Script Failed: Access Denied (Event ID: 1130) RRS feed

  • Question

  • We have a GPO with a single startup script - an EXE that launches from a network share - applied to an OU for workstations. The GPO fails to execute the app at startup and an 1130 event is logged in the events of the workstations. This is the intended way to deploy the software from the vendor of the app, who insists something is just wrong with our AD/workstations.

    So far I have:

    • Verified the GPO is being applied correctly via GPResult (it is - otherwise this error wouldn't even appear) and the permissions on the GPO are at their default.
    • Verified Authenticated Users have access to the files needed, both in share and NTFS permissions. I even tried explicitly adding a test workstation by name to the permissions.
    • Changed the "Specify startup policy processing wait time" to 60 and enabled the "Always Wait for the Network at Computer Startup and Logon" policy.
    • Tried moving the path for the EXE and associated files to the NETLOGON folder.
    • Verified a test batch file that writes the date/time to a dummy file is able to run during startup from the same GPO.
    • Verified we can run the EXE from the share using psexec with the -s option to execute as the local system account.

    

    Any idea what else we can do to troubleshoot this issue? Because of the nature of the software, it has to run at startup - we can't simply deploy it with PDQ or another packager post-boot.


    Paul Hite - MCSE, MCITP

    Wednesday, June 12, 2019 4:48 PM

Answers

  • We had already checked that out, but we did find the issue. Turned out to be antivirus, which was the very first thing I had checked. We have a ticket open with them now because nothing in the management console or even in the local AV agents logs with verbose mode enabled indicated any sort of blocks occurring and all the apps involved are explicitly whitelisted. 

    Paul Hite - MCSE, MCITP

    • Marked as answer by Paul Hite Tuesday, June 18, 2019 1:42 PM
    Tuesday, June 18, 2019 1:41 PM

All replies