Intel MPI 2021.12 can't run executable with UNC path

[Seifer]

Hello:

I  have noticed that Intel MPI 2021.12 replace password-based authentication with powershell remote.

I run the following command successfully.

"C:\Program Files\Intel MPI 2021\x64\mpiexec.exe" -host headnode -n 1 "C:\MyTest\IMB-MPI1.exe" : -host computenode -n 1 "C:\MyTest\IMB-MPI1.exe"

But when I change the path from local path to UNC path. it is failed.

C:\Windows\system32>"C:\Program Files\Intel MPI 2021\x64\mpiexec.exe" -host headnode -n 1 "\\headnode\Moldex3D_2025\Bin\IMB-MPI1.exe" : -host computenode -n 1 "\\headnode\Moldex3D_2025\Bin\IMB-MPI1.exe"
[proxy:0:1@computenode] launch_processes (proxy.c:568): error creating process (error code 5). Access is denied.

[proxy:0:1@computenode] main (proxy.c:902): error launching_processes
[mpiexec@headnode] Error: Downstream from host computenode exited abnormally
[mpiexec@headnode] Trying to close other downstreams
[mpiexec@headnode] HYD_sock_write (..\windows\src\hydra_sock.c:387): write error (errno = 2)
[mpiexec@headnode] HYD_sock_write (..\windows\src\hydra_sock.c:387): write error (errno = 2)
[proxy:0:1@computenode] HYD_spawn (..\windows\src\hydra_spawn.c:315): unable to run process \\headnode\Moldex3D_2025\Bin\IMB-MPI1.exe (error code 5)
+ CategoryInfo : NotSpecified: ([proxy:0:1@comp... (error code 5):String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
+ PSComputerName : computenode

C:\Windows\system32>

Do you have any solution? Thank you!

[DrAmarpal_K_Intel]

Hello Seifer.

The UNC path used in the second part of your command line looks incorrect (I am not sure if that was intentional!). The rank on the compute node was trying to access the binary on the headnode. Could you try the following variant instead?

"C:\Program Files\Intel MPI 2021\x64\mpiexec.exe" -host headnode -n 1 "\\headnode\Moldex3D_2025\Bin\IMB-MPI1.exe" : -host computenode -n 1 "\\computenode\Moldex3D_2025\Bin\IMB-MPI1.exe"

    

[Seifer]

Hello:

The path is correct. Because the executable has to be located only at the headnode. The path \\headnode\Moldex3D_2025 is shared to all compute nodes.

This commandline works fine with password-based authentication which is not available in Intel MPI 2021.12.

mpiexec.exe of Intel MPI 2021.12 uses powershell remoting, but if the executable is UNC path, it seems that mpiexec.exe does not handle the second hop of powershell remoting.

please refer to https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/ps-remoting-second-hop?view=powershell-7.4

thank you!

[DrAmarpal_K_Intel]

Hello again Seifer. Thanks for clarifying your use case.

Starting Intel MPI Library 2021 Update 9 user authorization changes were introduced for better security.

If you would like to access the binary over the network, Intel MPI Library is going to be limited by the second hop restriction of PowerShell that you mentioned in the default authentication mode.

As a workaround, can you try using the -delegate flag at runtime? This mechanism uses domain-based authorization with the delegation ability instead of PowerShell remoting. This method involves additional configuration. Please follow the steps in the link below,

https://www.intel.com/content/www/us/en/docs/mpi-library/developer-guide-windows/2021-13/user-authorization.html

Are you using a Windows-based HPC cluster or just a few connected Windows nodes?

[Seifer]

Hello:

Thanks for the explanation.

We (and our clients) are using several connected Windows nodes which are not in the domain environment.

Therefore, -delegate option is not the workaround.

[DrAmarpal_K_Intel]

Hello Seifer. If -delegate option cannot be used and UNC paths don't work due to the double-hop restriction in PowerShell in the default authentication mode of Intel MPI, please consider replicating the binary on the compute nodes.

In the meantime, I shall raise a feature request based on your scenario. However, since the limitation is on the PowerShell side, I wouldn't be too hopeful.

[DrAmarpal_K_Intel]

Hello Seifer. I have made a feature request. Is there anything else you would like to check before I mark this as closed?

[Seifer]

Hello:

I have one more question: Will password-based authentication be available in the next update?

If yes, is there any possibility to provide the non-interactive version of mpiexec.exe -register (which is interative) ?

If no, we should keep using Intel MPI 2019

thank you.

[DrAmarpal_K_Intel]

Hello Seifer,

No, password-based authentication was removed due to security concerns. There are no plans to add it back.

Would replicating the binary on the compute node hurt your workflow?

Best regards,

Amar

[Seifer]

Hi Amar:

And I wonder if the following command will also fail. (We have no time to test with Intel MPI 2021 currently.)

"C:\Program Files\Intel MPI 2021\x64\mpiexec.exe" -host headnode -n 1 "C:\Moldex3D_2025\Bin\MyApp.exe" "\\headnode\working_folder\Project1" : -host computenode -n 1 "C:\Moldex3D_2025\Bin\MyApp.exe" "\\headnode\working_folder\Project1"

Even the replicated binary is placed on every compute node, the binary may still be unable to access the shared project folder at headnode ("\\headnode\working_folder\Project1").

[DrAmarpal_K_Intel]

Hello Seifer,

Yes, even if the binary is local but if it needs a remote file then this results in the second hop scenario as well.

Is there anything else you would like to check before I mark this as closed?

Best regards,

Amar

[Seifer]

Hello Amar:

I have no more questions. Thank you.

regards,

Seifer

[DrAmarpal_K_Intel · Accepted solution]

Hello Seifer,

Thanks for confirming. Please watch out for this feature in a future release of Intel MPI. I am unable to give you a target version currently.

This issue has been resolved and we will no longer respond to this thread. If you require additional assistance from Intel, please start a new thread. Any further interaction in this thread will be considered community only.

Best regards,

Amar