Tweet
I'm trying to run ImageUSB on a user who I shouldn't make a local admin (due to network policies). I'm getting the below error in the debug messages, and I've narrowed down a bit more using ProcMon
PC is a windows 7 SP1. I can run it fine if the user is promoted to an admin (not poweruser or normal user)
Debug:
16-May-2014 - 16:11:08:264 - PassMark Software - imageUSB v1.1.1014
16-May-2014 - 16:11:08:264 - Getting list of available removable USB drives...
16-May-2014 - 16:11:08:264 - Inspecting Drive C:\...
16-May-2014 - 16:11:08:264 - Debug: Thread (5904) Drive C:\: Not of USB Type Skipping. DriveType 3
16-May-2014 - 16:11:08:264 - Inspecting Drive D:\...
16-May-2014 - 16:11:08:279 - Debug: Thread (5904) Drive D:\: Not of USB Type Skipping. DriveType 2
16-May-2014 - 16:11:08:279 - Inspecting Drive E:\...
16-May-2014 - 16:11:08:279 - Debug: Thread (5904) Drive E:\ Size: 8038383616 Bytes Volume: CD_ROM Other: FAT32
16-May-2014 - 16:11:08:279 - Inspecting Drive F:\...
16-May-2014 - 16:11:08:279 - Debug: Thread (5904) Drive F:\ Size: 7784628224 Bytes Volume: SEABOOT Other: FAT32
16-May-2014 - 16:11:08:311 - Inspecting Drive G:\...
16-May-2014 - 16:11:08:326 - Failed to get Drive Type for Drive G:\: Error No. 1
16-May-2014 - 16:11:08:326 - Inspecting Drive I:\...
16-May-2014 - 16:11:08:326 - Failed to get Drive Type for Drive I:\: Error No. 1
16-May-2014 - 16:11:08:357 - Inspecting Drive P:\...
16-May-2014 - 16:11:08:357 - Failed to get Drive Type for Drive P:\: Error No. 1
16-May-2014 - 16:11:08:373 - Inspecting Drive Q:\...
16-May-2014 - 16:11:08:373 - Failed to get Drive Type for Drive Q:\: Error No. 1
16-May-2014 - 16:11:08:373 - Inspecting Drive R:\...
16-May-2014 - 16:11:08:373 - Failed to get Drive Type for Drive R:\: Error No. 1
16-May-2014 - 16:11:08:373 - Inspecting Drive S:\...
16-May-2014 - 16:11:08:373 - Failed to get Drive Type for Drive S:\: Error No. 1
16-May-2014 - 16:11:08:389 - Ready...
16-May-2014 - 16:11:25:432 - User chose to overwrite existing file (C:\Users\ari\Desktop\imageusb\8978.bin).
16-May-2014 - 16:11:25:452 - Drive E:\ added to queue.
16-May-2014 - 16:11:25:462 - Creating image from Drive [E:\]...
16-May-2014 - 16:11:25:462 - Debug: Thread (4812) Error: Failed to open UFD \\.\PhysicalDrive2 for read access.
16-May-2014 - 16:11:25:462 - Failed (Drive E:\) with error 5: Access is denied.
16-May-2014 - 16:13:27:649 - Exiting...
ProcMon (Not Successes shown, filtered to ImageUSB.exe only):
16:11:20.3971300 imageUSB.exe 3236 RegOpenKey HKLM\SOFTWARE\Wow6432Node\Microsoft\CTF\KnownClass es NAME NOT FOUND Desired Access: Read
16:11:24.4277573 imageUSB.exe 3236 RegOpenKey HKLM\SOFTWARE\Wow6432Node\Microsoft\CTF\KnownClass es NAME NOT FOUND Desired Access: Read
16:11:24.4325740 imageUSB.exe 3236 CreateFile C:\Users\ari\Desktop\imageusb\imageres.dll NAME NOT FOUND Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
16:11:24.4334633 imageUSB.exe 3236 CreateFileMapping C:\Windows\SysWOW64\imageres.dll FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection:
16:11:25.4404265 imageUSB.exe 3236 RegOpenKey HKLM\SOFTWARE\Wow6432Node\Microsoft\CTF\KnownClass es NAME NOT FOUND Desired Access: Read
16:11:25.4693708 imageUSB.exe 3236 CreateFileMapping C:\Windows\SysWOW64\en-US\KernelBase.dll.mui FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection:
16:11:25.9791959 imageUSB.exe 3236 RegOpenKey HKLM\Software\Wow6432Node\Microsoft\CTF\TIP\{00008 97b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436} REPARSE Desired Access: Read
16:11:26.9545592 imageUSB.exe 3236 RegOpenKey HKLM\SOFTWARE\Wow6432Node\Microsoft\CTF\KnownClass es NAME NOT FOUND Desired Access: Read
PC is a windows 7 SP1. I can run it fine if the user is promoted to an admin (not poweruser or normal user)
Debug:
16-May-2014 - 16:11:08:264 - PassMark Software - imageUSB v1.1.1014
16-May-2014 - 16:11:08:264 - Getting list of available removable USB drives...
16-May-2014 - 16:11:08:264 - Inspecting Drive C:\...
16-May-2014 - 16:11:08:264 - Debug: Thread (5904) Drive C:\: Not of USB Type Skipping. DriveType 3
16-May-2014 - 16:11:08:264 - Inspecting Drive D:\...
16-May-2014 - 16:11:08:279 - Debug: Thread (5904) Drive D:\: Not of USB Type Skipping. DriveType 2
16-May-2014 - 16:11:08:279 - Inspecting Drive E:\...
16-May-2014 - 16:11:08:279 - Debug: Thread (5904) Drive E:\ Size: 8038383616 Bytes Volume: CD_ROM Other: FAT32
16-May-2014 - 16:11:08:279 - Inspecting Drive F:\...
16-May-2014 - 16:11:08:279 - Debug: Thread (5904) Drive F:\ Size: 7784628224 Bytes Volume: SEABOOT Other: FAT32
16-May-2014 - 16:11:08:311 - Inspecting Drive G:\...
16-May-2014 - 16:11:08:326 - Failed to get Drive Type for Drive G:\: Error No. 1
16-May-2014 - 16:11:08:326 - Inspecting Drive I:\...
16-May-2014 - 16:11:08:326 - Failed to get Drive Type for Drive I:\: Error No. 1
16-May-2014 - 16:11:08:357 - Inspecting Drive P:\...
16-May-2014 - 16:11:08:357 - Failed to get Drive Type for Drive P:\: Error No. 1
16-May-2014 - 16:11:08:373 - Inspecting Drive Q:\...
16-May-2014 - 16:11:08:373 - Failed to get Drive Type for Drive Q:\: Error No. 1
16-May-2014 - 16:11:08:373 - Inspecting Drive R:\...
16-May-2014 - 16:11:08:373 - Failed to get Drive Type for Drive R:\: Error No. 1
16-May-2014 - 16:11:08:373 - Inspecting Drive S:\...
16-May-2014 - 16:11:08:373 - Failed to get Drive Type for Drive S:\: Error No. 1
16-May-2014 - 16:11:08:389 - Ready...
16-May-2014 - 16:11:25:432 - User chose to overwrite existing file (C:\Users\ari\Desktop\imageusb\8978.bin).
16-May-2014 - 16:11:25:452 - Drive E:\ added to queue.
16-May-2014 - 16:11:25:462 - Creating image from Drive [E:\]...
16-May-2014 - 16:11:25:462 - Debug: Thread (4812) Error: Failed to open UFD \\.\PhysicalDrive2 for read access.
16-May-2014 - 16:11:25:462 - Failed (Drive E:\) with error 5: Access is denied.
16-May-2014 - 16:13:27:649 - Exiting...
ProcMon (Not Successes shown, filtered to ImageUSB.exe only):
16:11:20.3971300 imageUSB.exe 3236 RegOpenKey HKLM\SOFTWARE\Wow6432Node\Microsoft\CTF\KnownClass es NAME NOT FOUND Desired Access: Read
16:11:24.4277573 imageUSB.exe 3236 RegOpenKey HKLM\SOFTWARE\Wow6432Node\Microsoft\CTF\KnownClass es NAME NOT FOUND Desired Access: Read
16:11:24.4325740 imageUSB.exe 3236 CreateFile C:\Users\ari\Desktop\imageusb\imageres.dll NAME NOT FOUND Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a
16:11:24.4334633 imageUSB.exe 3236 CreateFileMapping C:\Windows\SysWOW64\imageres.dll FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection:
16:11:25.4404265 imageUSB.exe 3236 RegOpenKey HKLM\SOFTWARE\Wow6432Node\Microsoft\CTF\KnownClass es NAME NOT FOUND Desired Access: Read
16:11:25.4693708 imageUSB.exe 3236 CreateFileMapping C:\Windows\SysWOW64\en-US\KernelBase.dll.mui FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection:
16:11:25.9791959 imageUSB.exe 3236 RegOpenKey HKLM\Software\Wow6432Node\Microsoft\CTF\TIP\{00008 97b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436} REPARSE Desired Access: Read
16:11:26.9545592 imageUSB.exe 3236 RegOpenKey HKLM\SOFTWARE\Wow6432Node\Microsoft\CTF\KnownClass es NAME NOT FOUND Desired Access: Read
Comment