Skip to main content

Access Denied Error Connecting to a Non-domain-joined Windows Resource

Overview​

This article describes how to resolve the Access Denied message you may receive in the ActionServiceWorker log when connecting to a non-domain-joined Windows resource to provision an activity session or run a resource scan.

Example error:

Add-SbPAMActionLog: Warn Message: Unable to create New-PSSSession for HOSTNAME using ComputerName (HOSTNAME)
Error: [HOSTNAME] Connecting to remote server HOSTNAME failed with the following error message :
Access is denied.
For more information, see the about_Remote_Troubleshooting Help topic

Instructions​

Review the local configuration of the target host resource:

  1. Run lusrmgr.msc from the Run command window and ensure the Netwrix Privilege Secure for Access Management service account is a member of the Administrators group. If the account is not a member of the Administrators group, proceed to the next step.

  2. Change a User Account Control (UAC) setting that prevents remote PowerShell authentication for non-Administrator accounts. Run the following line in elevated PowerShell:

    New-ItemProperty -Name LocalAccountTokenFilterPolicy `
    -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System `
    -PropertyType DWord -Value 1

    You should now be able to use your service account to connect to the resource through Privilege Secure.

    NOTE: For details on enabling remoting for administrators in other domains, see about_Remote_Troubleshooting − How to enable remoting for administrators in other domains ⸱ Microsoft 🡥.

For additional information on configuring non-domain-joined Privilege Secure resources, see Managing Non-Domain-Joined Windows Computers with Netwrix Privilege Secure.