VBscript Access Denied running from UNC or mapped drive

Question

_{Thursday, February 9, 2017 10:14 PM}

Windows 10 is new for our environment.  We are testing a new Windows 10 image and trying to run vbscript for a network share but get an access denied.  If we copy a script locally it works fine.  Running a script from a network share on our Windows 7 works fine. 

We disabled Symantec DLP, no luck.

We disabled Symantec SEP, no luck.

Any guidance on what we should be looking at?

All replies (2)

_{Wednesday, February 15, 2017 6:20 PM ✅Answered}

Resolved:

InfoSec Document: CIS_Microsoft_Internet_Explorer_11_Benchmark_v1.0.0

Section: 8.2.3 Set 'Intranet Sites: Include all network paths (UNCs)' to 'Disabled'

GPO Path: Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Sites: Include all network paths (UNCs) = Disabled

Registry Key: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet

If we re-enable this, we can successfully run a vbscript from a network share.

Karen - not to ignore your response.  we could access files\vbscript from the network share.  we could copy and paste to\from successfully.  we just could not run the script successfully from the UNC.  Our test script was so basic it was a simple msgbox "hi".  We did not go through the process monitor suggestion.  When we denyed the (machine and user) accounts from all the new W10 GPOs the issue went away.  so we just started removing the deny from each GPO until the process broke again.. then just dug into that GPO specific configs to find the above.

_{Friday, February 10, 2017 3:09 AM}

Hi,

Please check if your Windows 10 current account could access that network share file.

Meanwhile, use the process monitor to trace the activity when you run the VBScript from the network share. Then open the log file to see which file that show "access denied".

Afterwards, grant the proper permission of that file to Windows 10 user account.

Process Monitor v3.31

https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].