Access is denied. (ExecuteProgram)

Symptoms

The error may be reported when running backups for backup sets configured with VSS option, or for backup sets protecting System State and Services Database ( the VSS option will be used even if not selected when backing up the system state of computers running Windows Vista/2008 or newer ).

Usually this error comes together with other error messages, like: - Access is denied. (\\ICBSVR001\ADMIN$\complusbackup\vsscontrolin.dat) (End Snap) - Access is denied. (Scheduler - "C:\Windows\complusbackup\sfcfiles.exe")

Cause

1. Task Scheduler, Remote Registry or Volume Shadow Copy services are disabled / not running on the computer to be backed up.
2. The user provided when creating the backup set ( or backup set credentials updated later ) doesn't have rights to run the VSS snapshots or to connect to the remote Task Scheduler / Remote Registry service on the target machine and start these services if necessary.
3. When the backup set was created or credentials updated one ore more spaces have been mistakenly entered before or after the actual user-name.
4. "Remote Scheduled Task Management" is not enabled in Windows firewall configuration on the backup source computer (this rule must allow the DS-Client IP).
5. In the From field of the backup set credentials screen an invalid domain name is entered or if there are multiple domains a domain name is entered which is not trusted with the domain of the source machine (if there is no domain the local source computer name should be used).
6. The VSS timeout needs to be increased.
7. DS-Client computer or the backup source computer runs Windows 2008 and the SP2 for this OS was not applied.
8. UAC is turned on (on the backup source computer) and a user different than the one called "Administrator" is used.

Workaround

1. Make sure the Task Scheduler and Remote Registry services are enabled/running and the Volume Shadow Copy service is not disabled on the backup source machine.
   For Windows 2012 R2 and newer, the Remote Registry service should have the Startup type 'Automatic (Trigger Start)',it is stopped and started by applications only when needed (so when no backups are running this service might be stopped, just ensure it is not disabled).
2. Ensure the user configured for the backup set credentials can execute these tasks.
3. Ensure that no spaces before or after the backup set user-name ( In DS-User right click on the problematic backup set > Properties > Share > Connect as, click on '>>' to be able to edit/verify the user-name ).
4. On the backup source computer go to Start > Settings > Control Panel > System and Security > Windows Firewall > Allow programs to communicate through Windows Firewall, tick "Remote Scheduled Task Management" ensuring the DS-Client IP is allowed, save the change and try the backup again.
5. Enter the correct domain name or source computer name in the From field of the backup set credentials screen.
6. Increase VSSKeepAliveTimeout from DS-User > Setup > Configuration > Advanced > Category: Communication > Parameter: VSSKeepAliveTimeout, set to 600 (default is 300). It is expected a response without 300 seconds but the server is sometimes slower to respond (maybe load is high), so adjust it as needed.
7. Apply SP2 for Windows 2008 if the backup source computer or DS-Client computer runs Windows 2008 SP1 or no SP.
8. If the UAC is turned on in the backup source computer, either use the user called Administrator as the backup set credentials, or implement the LocalAccountTokenFilterPolicy registry key, for details please check dsuser.pdf (DS-Client User Guide) document.
9. At a time when no backups are running for that backup source server, remove the folder C:\Windows\complusbackup (this is a hidden folder, so you have to enable viewing of hidden files and folders first), then try the backup again.