# Server 2008 R2 Access Denied for PIDs

**URL:** <https://discuss.elastic.co/t/server-2008-r2-access-denied-for-pids/53232>\
**Category:** Beats\
**Created:** [June 19, 2016, 11:01am UTC](https://discuss.elastic.co/t/server-2008-r2-access-denied-for-pids/53232 "2016-06-19T11:01:44Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![jezeling](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jezeling](https://discuss.elastic.co/u/jezeling)\
**Post date:** [June 19, 2016, 11:01am UTC](https://discuss.elastic.co/t/server-2008-r2-access-denied-for-pids/53232/1 "2016-06-19T11:01:44Z")

</div>

Hi,

I've recently deployed topbeat to a single Windows 2008 R2 server and when running it starts without issue, however, I don't get any process information and no matter what admin logon as account I use, local or domain, the log file fills up with -

Skip process pid=4: error getting process state for pid=4: OpenProcess fails with Access is denied.

Any suggestions as to what may cause this?

Many Thanks

Jez

---

<div class="post-metadata">

**Author:** ![Kevin\_Csuka](https://avatars.discourse-cdn.com/v4/letter/k/7feea3/32.png) [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\
**Post date:** [June 19, 2016, 1:21pm UTC](https://discuss.elastic.co/t/server-2008-r2-access-denied-for-pids/53232/2 "2016-06-19T13:21:51Z")

</div>

Got the same issue here:  
[https://discuss.elastic.co/t/server-2012-r2-some-metrics-not-send/?source\_topic\_id=53232](https://discuss.elastic.co/t/server-2012-r2-some-metrics-not-send/?source_topic_id=53232)

By any chance, is topbeat installed on a VMware machine?

---

<div class="post-metadata">

**Author:** ![jezeling](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jezeling](https://discuss.elastic.co/u/jezeling)\
**Post date:** [June 19, 2016, 2:54pm UTC](https://discuss.elastic.co/t/server-2008-r2-access-denied-for-pids/53232/3 "2016-06-19T14:54:58Z")

</div>

This one is running on a Hyper-V 2012 R2 host, I've not compared to physical machine but I can do that and test on VMWare as well and report the results.

---

<div class="post-metadata">

**Author:** ![jezeling](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jezeling](https://discuss.elastic.co/u/jezeling)\
**Post date:** [June 19, 2016, 3:04pm UTC](https://discuss.elastic.co/t/server-2008-r2-access-denied-for-pids/53232/4 "2016-06-19T15:04:13Z")

</div>

Works fine on a physical server with the same OS.

---

<div class="post-metadata">

**Author:** ![Kevin\_Csuka](https://avatars.discourse-cdn.com/v4/letter/k/7feea3/32.png) [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\
**Post date:** [June 20, 2016, 12:45pm UTC](https://discuss.elastic.co/t/server-2008-r2-access-denied-for-pids/53232/5 "2016-06-20T12:45:49Z")

</div>

I'm guessing this issue exists because the OS is hosted on a virtual platform.  
You have the issue on an Hyper-V host. I have the issue on a VMware host.  
When topBeat runs from a physical server, it runs fine.

In the case of a virtual host; TopBeat can't access several parts of the OS.  
Either because it has no rights (even tho it is executed as admin with the highest privileges)  
Or because topbeat is trying to access parts which are 'locked' in the OS, therefor cannot be accessed.  
Or because it is trying to capture the wrong resources.

I'm still just guessing. Perhaps a dev from Elastic can respond.

---

<div class="post-metadata">

**Author:** ![jezeling](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jezeling](https://discuss.elastic.co/u/jezeling)\
**Post date:** [June 20, 2016, 1:07pm UTC](https://discuss.elastic.co/t/server-2008-r2-access-denied-for-pids/53232/6 "2016-06-20T13:07:27Z")

</div>

Interesting, it should be transparent to the beat though. I'll do some more testing at this end. Curious if anyone else has it running in a VM already as well...we can't be the first.....and as you say maybe some feedback from a dev.

I'll feedback any findings I come up with, I've done the usual compatibility mode settings etc. and even run it from a PowerShell command line and all give the same results.

With Metric Beats on the horizon maybe its fixed in there, I can test that as well.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [June 20, 2016, 2:57pm UTC](https://discuss.elastic.co/t/server-2008-r2-access-denied-for-pids/53232/7 "2016-06-20T14:57:27Z")

</div>

It looks like an access problem (as also discussed in the other thread). As topbeat and metricbeat use the same code in the background, I would be surprised if the problem is solved with Metricbeat.

It would be nice if you could post more details about your tests and log outputs (but please not as screenshot).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2016, 11:01am UTC](https://discuss.elastic.co/t/server-2008-r2-access-denied-for-pids/53232/8 "2016-07-10T11:01:51Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.
