Fixing “Error 5: Access is Denied” when using “Run As” command

“Error 5: Access is Denied” when using “Run As” command
New here?
Read more about why software developers are adopting Thinfinity® VirtualUI to run desktop apps in the cloud and increase the value of their Windows applications.

Error 5 access is denied



Some days ago, we received an issue report related to an “Access is Denied” error that came up trying to run a Thinfinity® VirtualUI web-enabled application.
We replicated the user environment and made absolutely sure that the configuration was identical, but we could not reproduce the error.
In the user environment, the program insisted on running perfectly from the desktop, but it didn’t run through the web using VirtualUI.
We double-checked all security settings, unsuccessfully looking for a clue as to why this could be happening.
There’s nothing more annoying than a non-reproducible error!

Digging for an “Access is denied”

Persistence pays off. The clue to solving the Access Denied error was related to the way VirtualUI runs a program. When you run a program from the desktop (by double-clicking on the executable file, etc.) you are using your user account. But when accessing the program through VirtualUI, it is run under a secondary logon, which is exactly what happens when the “Run as…” command is used.
That is why we asked the user to run their desktop application in their environment using the “Run as” command. This test produced the same error and enabled us to isolate it out of VirtualUI.
This put us on the right track. We did some research and we found that the problem occurred in upgraded Windows installations only. In this scenario, when trying to use the “Run as…” command, an “Error 5: Access is Denied” occurs.

In its support site, Microsoft says:“This issue occurs because the discretionary access control list (DACL) for the Secondary Logon service is not set correctly when you upgrade from Windows Server 2003 or from Windows Server 2008. This problem prevents a standard user from starting this service and from running an application as a different user.”


The workaround

We found that the first of the two possible workarounds provided by Microsoft fixed the issue.
To solve the problem, please execute the following command from a cmd prompt window:

net stop seclogon

Make sure to copy this command correctly, without the double quotes it fails with this error:

[SC] ConvertStringSecurityDescriptorToSecurityDescriptor FAILED 87:
The parameter is incorrect.

By running this command that fixes the secondary login error, we can make sure that it doesn’t produce an “Access Denied” error and the application can work as expected.
Have any questions? Contact us at [email protected] or leave a message on this same post.

Leave a comment

Privacy Preferences
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.