Access denied errors when verifying or synchronizing Connections

This guide will go into the causes of getting 'Access Denied'-type errors with connections that use Windows integrated security with the Cloud Connector service and how to address them.

This FAQ applies if you are getting errors like this when verifying a connection string to SQL, File System locations, ODBC, and other systems that can connect with integrated security:

Access to the path '\\<filePath>​' is denied.

Login failed for user '<DOMAIN\​Account$>'.

It also applies if you get these types of errors when using the scheduling service in version 7.7 or older to synchronize your connection, but not when you run it manually with "Run Now".

Causes

Service Account Setting

​The main cause of this error is due to how the Layer2 Cloud Connector Service handles integrated security. Instead of using the logged in account, it uses the account given on the Layer2 Cloud Connector Service itself to verify and/or run the connection. By default, this is the Local System account, which often does not have permissions to your database or your file server. 

ADO Connection Wizard Inconsistencies

There is also a difference when using the "ADO Connection Wizard" link you see in the UI - this feature uses the logged in account and not the service's account to test the connection. leading to connection information that worked before suddenly not working with the "Verify Connection String" link in the UI. This issue is known and will be addressed in a future release - until then, use the resolution steps below to address this as the "ADO Connection Wizard" link will not be accurate.

Resolution

To address this issue, you must change the account on the service to one that has access to the data source you are trying to connect to.

Open the Control Panel on the machine hosting the Cloud Connector and select Administrative Tools, and then Services.

The service to select will depend on which version of the Cloud Connector you are running:

• For 7.8+ : Layer2 Cloud Connector Backend Service
• For 7.7 and older: Layer2 Cloud Connector Service

Right click on appropriate Layer2 Cloud Connector Service and select Properties from the drop-down menu. Click on the Log On tab to see the account settings.

Click the option to select This account and fill in the necessary details for the an account that has access to the data source you are trying to access.

**Important** This account will be used to access all data sources that use integrated security - please make sure that the account given also has access to any additional sources you are connecting to, to prevent additional login/access denied errors.

Click OK to save the changes.
**Important** Do not forget to restart the Layer2 Cloud Connector Service to have the change take effect.

Now try to validate or run your connection to verify the change worked.

Additional Considerations / Data Source-Specific Information

• If connecting to MS SQL Server, you can use a SQL Account instead of integrated security to get around this error.
• You can use a user account or a new service account - the account given only needs to have sufficient permissions to the data source to work.
• Using specific credentials with the file system provider is usually not enough to get around this error. You must change the account on the service to one that has access to the file share location.
• As noted in the Cause section above, in version 7.8+, the ADO Wizard's permissions are not the same as used with the "Verify Connection String" link. Do not trust the results of the ADO Wizard at this time.

Need More Help?

For technical questions or additional help with errors, please contact [email protected].

READY TO GO NEXT STEPS?