# Agent Installation - Knowledge base

## Access Denied

### Problem

You can see the error message **"Access Denied"** on the screen when you try to do either of the following:

- Install an agent/Distribution server remotely using the Scope of Management (SoM) feature
- Complete tasks like scan for patches, inventory or use the remote control feature

### Cause

You require administrator credentials to enable an Endpoint Central server to complete remote operations like agent/Distribution server installation, patch scanning, inventory scanning and use features like the remote control feature. You will see the error message **"Access denied"** if the credentials specified in the SoM do not have administrator privileges.

> **Note**: The causes and resolutions explained in this article are based on our experiences in our production and client environments. However, there may still be a few unknown causes which are not covered in this article. If this article does not resolve your issue and if you have an Active Directory-based network, you can [automate agent installation](https://www.manageengine.com/products/desktop-central/agent_installation_windows_gpo.html) using a startup script.

### Resolution

To resolve this problem, identify the kind of network setup you have and follow the appropriate resolution specified below.

### For a Workgroup setup

In case of a workgroup setup, the credentials specified should have administrator privileges on all the computers in a particular workgroup. To modify the credentials, follow the steps given below:

1. Click the **Admin** tab
2. In the **Global Settings** section, click **Scope of Management**
3. Click **Edit Credentials**
4. Select the required domain
5. Select **Workgroup** as the network type
6. Specify the following:
   - Admin username
   - Password
   - DNS suffix
7. Click **Update Domain Credentials**

You have modified the domain credentials.

For client computers which have Microsoft Windows Vista and later versions, you are required to disable either the User Account Control (UAC) or the Remote UAC in all client computers.

#### Disabling UAC in the client computers

You are required to disable the UAC feature in all client computers. To disable the UAC feature, follow the steps given below:

1. Click **Start > Settings > Control Panel > User Accounts**
2. Disable the UAC settings:

   **For Windows 7 and later versions / Windows 2008 R2 and later versions**

   a. Click **User Account Control Settings**  
   b. Drag and choose the control level to **Never Notify**  
   c. Click **OK**

   **For Windows Vista and older versions / Windows 2008 and older versions**

   a. Click **Turn User Account Settings On or Off**  
   b. Uncheck the **Use User Account Control (UAC) to protect your computer** checkbox  
   c. Click **OK**

3. Close the Control Panel window.

This will disable the UAC in the client computer. You need to perform the same steps manually on all client computers that have Windows Vista or higher.

#### Disabling Remote User Account Control in the client computers

You are required to disable the Remote UAC feature by changing the registry entry that controls it. To disable the Remote UAC feature, follow the steps below:

1. Click **Start > Run**
2. Enter `regedit`
3. Click **OK**
4. Navigate to  
   **HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Policies \ system**
5. Right-click on the white space and click **New > DWORD Value**
6. Enter the name **LocalAccountTokenFilterPolicy**

   > **Note**: If this key name is available, then right-click on the name > Modify and follow the steps given below.

7. Click **Modify**
8. Change the value data to `1`
9. Click **OK**

You have disabled the Remote UAC feature.

### For an Active Directory setup

If you have an Active Directory setup, you must specify credentials that have administrator privileges for a domain to avoid seeing this error. The administrator credentials are specific to an Organizational Unit (OU). You cannot use the administrator credentials of one OU to complete operations on computers that belong to another OU.

### For both Workgroup and Active Directory setup

The below given steps apply for both workgroup and Active Directory setups:

- Check whether the Domain Administrator credentials supplied while defining the Scope of Management are still valid and have not been changed.

#### Enable DCOM settings in the client computers

Enable DCOM settings in all the computers in your network. To enable DCOM settings, follow the steps given below:

1. Click **Start > Run**
2. Enter `dcomcnfg`
3. Click **OK**

   The dialog box that appears depends on the Windows operating system installed on your computer. If you are using Windows NT/2000, you will see the **Distributed COM Configuration Properties** dialog box. If you are using Windows XP, you will see the **Component Services** dialog box.

   To access the Properties tab:

   a. Expand **Component Services**  
   b. Expand **Computers**  
   c. Right-click on **My Computer**  
   d. Click **Properties**

4. Click the **Default Properties** tab
5. Select **Enable Distributed COM on this computer**
6. Select **Enable DCOM Internet Services on this computer**
7. Select an appropriate authentication level
8. Select an appropriate impersonation level

You have enabled DCOM settings in the computers in your network.

**Applies to:** Agent/Distribution server Installation Failure, Endpoint Central Agent/Distribution server Installation, Remote Desktop Sharing, Remote Control

**Keywords:** Agent/Distribution server Installation, Endpoint Central Agent/Distribution server Installation Failure, Installation Failure, Access Denied, Remote Control, Desktop Sharing

## Other KB articles

- [Agent Installation](https://www.manageengine.com/products/desktop-central/knowledge-base.html#agent-installation)
- [Configurations](https://www.manageengine.com/products/desktop-central/knowledge-base.html#windows-configurations)
- [Inventory Management](https://www.manageengine.com/products/desktop-central/knowledge-base.html#inventory-management)
- [Patch Management](https://www.manageengine.com/products/desktop-central/knowledge-base.html#patch-management)
- [Software Distribution](https://www.manageengine.com/products/desktop-central/knowledge-base.html#software-distribution)
- [Service Pack Installation](https://www.manageengine.com/products/desktop-central/knowledge-base.html#service-pack-installation)
- [Desktop Sharing](https://www.manageengine.com/products/desktop-central/knowledge-base.html#remote-desktop-sharing)
- [Active Directory Reports](https://www.manageengine.com/products/desktop-central/knowledge-base.html#active-directory-reports)
- [User Logon Reports](https://www.manageengine.com/products/desktop-central/knowledge-base.html#user-logon-reports)
- [Endpoint Central SP Upgrade](https://www.manageengine.com/products/desktop-central/knowledge-base.html#service-pack-upgrade)
- [Miscellaneous](https://www.manageengine.com/products/desktop-central/knowledge-base.html#miscellaneous)
- [» More](https://www.manageengine.com/products/desktop-central/knowledge-base.html)