xcompp.bat fails with Access Denied with XCOM for Windows
Article ID: 203228
Updated On:
Products
Issue/Introduction
A transfer fails due to the xcompp.bat failing with message "OpenWindowStation failed. Err:5(Access Denied).
Environment
XCOM™ Data Transport® for Windows
Cause
An XCOM trace shows the user doesn't have the correct permissions for xcompp.bat processing.
Resolution
Make sure to have the following setup:
- Make sure that the XCOMD service is "Log on as" a Local System Account and the "Allow service to interact with desktop" box is checked in the Properties of the service
- Make sure to create the "CA-XCOM-Batch-Interactive" group in Windows
- Assign the proper userids to the "CA-XCOM-Batch-Interactive" group
See online documentation:
Create the CA-XCOM-Batch-Interactive Group
Use the Processing Scripts
Additional Information
When Windows NT came out, it allowed popups from services. They were displayed on the active logon session. As pointed out, this is a potential security exposure and Microsoft implemented proper controls as of Windows 7. All services use Windows station 0, WinSta0. With XCOM’s implementation, we wanted to satisfy two customer requests:
1. Spawn child processes which run beyond the duration of the XCOM transfer
2. Offer interactive dialogues for the purpose of debugging scripts
The initial solution was
- search among the logged on users, and if there is a match with the XCOM transfer user, use that session for interactive displays.
- create an entry in WinSta0 if the XCOM userid is not logged on and leave the entry beyond the XCOM transfer.
The latter case created a new ACE for every transfer. The system would eventually run out of storage and often needed to be re-booted. At this point, the CA-XCOM-Batch-Interactive group helps. If a user is defined in that group, XCOM creates the ACE for that user only once and then re-uses it for subsequent script processing for that user.
Feedback
