Windows Local Account “Access Denied” Errors: PowerShell Fix ...

IBM Support

No results were found for your search query.

Tips

To return expected results, you can:

• Reduce the number of search terms. Each term you use focuses the search further.
• Check your spelling. A single misspelled or incorrectly typed term can change your result.
• Try substituting synonyms for your original terms. For example, instead of searching for "java classes", try "java training"
• Did you search for an IBM acquired or sold product ? If so, follow the appropriate link below to find the content you need.

Our apologies

Search results are not available at this time. Please try again later or use one of the other support options on this page.

Windows Local Account “Access Denied” errors: PowerShell fix script for Windows 10 or Windows Server 2016

Troubleshooting

Problem

Beginning with Windows 10 version 1607 (Creator’s Update) and Windows Server 2016, the default GPO security descriptor denies users remote access to Security Account Manager (SAM) with non-domain credentials, and therefore prevents remote heartbeat and password changes made by otherwise-authenticated local user accounts. Affected Windows Local Account secrets would return “Access Denied” on a heartbeat or remote password change. The script addresses these "Access Denied" errors by modifying the default local group policy Remote SAM Access security descriptor to allow all local users on a specified machine remote SAM access after authentication. This script requires elevated PowerShell permissions.

Document Location

Worldwide

[{"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSWHLP","label":"IBM Security Secret Server"},"Component":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB77","label":"Automation Platform"}}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Was this topic helpful?

Not usefulUseful

Document Information

Modified date: 30 April 2019

UID

ibm10879505

Page Feedback

Share your feedback

Need support?

• Submit feedback to IBM Support

• 1-800-IBM-7378 (USA)

• Directory of worldwide contacts