I'm attempting to use SCCM to run a batch file to copy a file from an app deployment to machine's %public%/desktop folder but am getting an 'Access is denied' error while running.

The script itself looks like this:

copy \\SCCMfqdn\DeployApp\fm-launcher\FM-Launcher.fmp12 %public%\desktop\Launcher.blah /Y

The error I am getting is just before 'Echo Off' and it states 'Access is denied'. If I run the script as an administrator it completes successfully.

Is there any way to accomplish what I am trying to do? Would it be better to use a group policy script? (I imagine it would have the same error?)

Thanks for any help!

Update: Per comments below it looks like the script MUST run as an admin to copy to the Public Desktop. Is there a way to script this with /runas or something? I see flags for user specifications but not for a password?

  • Access to the public folder requires administrative privileges, which is why it works when ran as admin.
    – Davidw
    Sep 14, 2015 at 22:40
  • I had kind of worked that out. I am however running in to an issue with getting the .bat file to run as an administrator? I can't find out how to embed credentials and have it run properly (I can specify user but it prompts for password?) Any advice for getting it to work? @Davidw
    – Abraxas
    Sep 14, 2015 at 22:56
  • What mechanism in SCCM are you using to run this batch file on remote computers? Sep 15, 2015 at 1:49
  • @Get-HomeByFiveOClock - Application Deployment - Manually copy from distrib point - Deployment type: script Installer, Content points to the location, program points to the batch file, install for system regardless of login. Let me know if you need anything else. I'm VERY new to SCCM
    – Abraxas
    Sep 15, 2015 at 1:57

2 Answers 2


Packages and Scripts deployed through SCCM will be run on the end nodes using the NT AUTHORITY\SYSTEM account. This has absolute rights on the local machine on which it is being run.

One implication of it running under this account is that the NT AUTHORITY\SYSTEM usually does not have rights to access other networked devices or locations.

This can be remedied by adding "Domain Computers" permissions to access this directory. (Please don't add "Everyone")

For more details: you can check out this answer on SO detailing the use of the NT Authority\SYSTEM and SCCM.

  • Just to verify, you're suggesting to grant access to 'Domain Computers' on each computer's %public%/desktop folder?
    – Abraxas
    Sep 15, 2015 at 2:31
  • No, that account will by default have access to the %public%\desktop folder. Domain computers will need to be granted explicit rights to the networked path \\SCCM%fqdn%\fm-launcher\... Sep 15, 2015 at 11:49
  • 1
    Don't thank me. I did it for the points. :) Sep 15, 2015 at 18:50

perhaps net use could help

   NET USE \\SCCMfqdn\DeployApp\fm-launcher\ /u:server\user *password* 
   copy \\SCCMfqdn\DeployApp\fm-launcher\FM-Launcher.fmp12 %public%\desktop\Launcher.blah /Y

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.