PowerShell: Copy-Item fails despite the same process working with Windows Explorer

6
votes

I have a script that needs to copy files on a regular basis (every hour). I can open the source and destination folder using windows explorer and copy the file without issue.

However, if I try the same thing in PowerShell I get an Access to the path is denied error. I've checked the permissions on the share and I have full access. Why does this fail through PowerShell?

Copy-Item command:

Copy-Item \\idmststtrm2\tns_admin$\tnsnames.ora -Destination \\bts13r2b\tnsnames -Force

Errors:

Copy-Item : Access to the path '\\bts13r2b\tnsnames\tnsnames.ora' is denied.
At line:1 char:1
+ Copy-Item \\idmststtrm2\tns_admin$\tnsnames.ora -Destination \\bts13r2b\tnsnames ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : PermissionDenied: (\\idmststtrm2\tns_admin$\tnsnames.ora:FileInfo) [Copy-Item], UnauthorizedAccessException
+ FullyQualifiedErrorId : CopyFileInfoItemUnauthorizedAccessError,Microsoft.PowerShell.Commands.CopyItemCommand

Copy-Item : Access to the path '\\bts13r2b\tnsnames\tnsnames.ora' is denied.
At line:1 char:1
+ Copy-Item \\idmststtrm2\tns_admin$\tnsnames.ora -Destination \\bts13r2b\tnsnames ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [Copy-Item], UnauthorizedAccessException
+ FullyQualifiedErrorId : System.UnauthorizedAccessException,Microsoft.PowerShell.Commands.CopyItemCommand

Edits:

When I execute a Get-ChildItem against the destination path, I'm able to see the folder contents.

Results from get-item:

get-item \\idmststtrm2\tns_admin$\tnsnames.ora

Directory: \\idmststtrm2\tns_admin$


Mode                LastWriteTime     Length Name                                                                      
----                -------------     ------ ----                                                                      
-a---         3/10/2017   8:49 AM      14143 tnsnames.ora                                                              


get-item \\bts13r2b\tnsnames\tnsnames.ora

Directory: \\bts13r2b\tnsnames


Mode                LastWriteTime     Length Name                                                                      
----                -------------     ------ ----                                                                      
-a---          3/8/2017   9:51 AM      15991 tnsnames.ora 

get-item \\bts13r2b\tnsnames

Directory: 


Mode                LastWriteTime     Length Name                                                                      
----                -------------     ------ ----                                                                      
d----         3/21/2017  11:14 AM            tnsnames

Tried using xcopy:

xcopy \\idmststtrm2\tns_admin$\tnsnames.ora \\bts13r2b\tnsnames\tnsnames.ora

Access is denied.
4
powershellfile-copying
In your PowerShell window run the whoami just to check it is running as the correct credentials. – gvee
Just tested it. The correct credentials appear. – Geoff Dawdy
Can you do a Get-ChildItem on the same items? Wondering if this is permissions to a specific file, rather than the directory as a whole – gvee
-Force switch indicates that Copy-Item cmdlet will copy items that cannot otherwise be changed, such as copying over a read-only file or alias. This does not cover system flagged destination file. – JosefZ
(Get-Acl filepath\tnsnames.ora).Access | ft -AutoSize -Wrap - double check your access rights, again for both source and destination filepath. – JosefZ

4 Answers

5
votes

This problem is due to permissions writing to a network share. While the share permissions were set correctly, the NTFS permissions were missing. A system administrator will need to ensure both sets of permissions allow for the account to write to the folder. Once this was updated correctly the script was able to perform a copy to the network share.

2
votes

You have the correct idea, but what if you try using the 'Administrative Share' to access the other system.

Created some standard variables: $Source and $Target. Now we use Get-ChildItem and the switch -Path to grab the file or directory we need. Then we use Copy-Item and the switch -Force to send the file to the other server. This method should work, but will describe another method.

I assume it would look something like this.

$Source = "\\idmststtrm2\c$\app\oracle\product\11.2.0\dbhome_1\network\admin\tns_admin$\tnsnames.ora"
$Target="\\bts13r2b\c$\app\oracle\product\11.2.0\dbhome_1\network\admin\tnsnames"
Get-ChildItem -Path $Source | Copy-Item -Destination $Target -Force

Another option is to make sure that you first have write access to both shared directories. Once that is verified, we run the following:

$Source="\\idmststtrm2\tns_admin$\tnsnames.ora"
$Target="\\bts13r2b\tnsnames"
Get-ChildItem -Path $Source | Copy-Item -Destination $Target -Force
#(Get-Acl $Source).Access #Verify $Source Access
#(Get-Acl $Target).Access #Verify $Target Access

Let us know if this works.

2
votes

I know this is old, but I had a hair-pulling experience trying to get a scheduled job (running as a GMSA) to work calling a .ps1 using Copy-Item and getting the same "Access to the path ... is denied" error. I checked and double-check permissions on the remote shares - both Share permissions and NTFS permissions. It ran successfully with my login, it ran successfully with Admin login.

Finally, just for grins, I changed the Share permissions from "All Users" to "Everyone" and it started working! Therefore, it appears that GMSA accounts are not part of "All Users". I would have never guessed!

Hopefully this saves someone 10 hours of fruitless labor...

1
votes

Try opening powershell as an administrator, some times that causes this issue