Intel SCS - Bug in RCSUtils.exe - Certifcate View parameter not working for NetworkService 0x8007049

[Horgster]

Hi All!

Today I noticed that there is an bug in the "RCSUtils.exe" utility when running following command as administrator:

RCSUtils.exe /Certificate View /RCSuser NetworkService /Log File c:\logfile.txt.

The utility is not able verify the certificates that exist in the "Network Services" certificate store.
The utility simply returns this error:

18.01.2021 08:13:17: -------------------------------------------------------------------------------
18.01.2021 08:13:17: Intel(R) SCS Utils log, running user: <Domain>\<UserName>
18.01.2021 08:13:17: -------------------------------------------------------------------------------
18.01.2021 08:13:17: Waiting for the task scheduler to run the requested task using the Network Service account (can take up to 60 seconds).
18.01.2021 08:13:19: Waiting for the task scheduler to run the requested task using the Network Service account (can take up to 60 seconds).
18.01.2021 08:13:19: -------------------------------------------------------------------------------
18.01.2021 08:13:19: Exit status for the running user <Domain>\<UserName>:
18.01.2021 08:13:19: Failed to impersonate to the user - Element not found. (Exception from HRESULT: 0x80070490).

I wanted to run above command to verify that my certificate was successfully added to the networkservice certificate store. The RCSUtility.exe works when adding certificates to NetworkService, but simply can't read the NetworkService certificate store when using the View parameter.

So; if I run this PSExec to open CMD i NetworkService context, I can see that the certificate was added correctly by RCSutility

1. psexec -i -u "nt authority\network service" cmd.exe

2. RCSUtils.exe /Certificate View

It seems that the "Scheduled Task" that RCSUtils creates to run for NetworkService is not working as it should!

Running Windows Server 2019 and RCSutility.exe v12.2.0.150

Please fix this bug!
Best Regards
Horgster

[JoseH_Intel]

Hello Horgster,

Thank you for joining the Intel community

In the download section for the SCS v12.2.0.150 I can see the following note:

"Special Release Note for Version 12.2.0.150:

SCS 12.2.0.150 will not upgrade an existing installation of 12.2.0.139. Prior to installing this update you must first uninstall the previous release of Intel® Setup and Configuration Software 12.2.0.139 from Apps and Features and then install version 12.2.0.150. Follow the same procedure with Intel® SCS ACUConfig 12.2.0.139 and Intel® SCS ACUWizard 12.2.0.139 where needed. For all other previous versions, an uninstall is not required and an in-place upgrade is supported."

Could you please confirm you uninstalled any previous version of SCS and installed the latest one after that?

If yes then we will proceed to elevate your question to our senior team

I will look forward for your reply

Regards

Jose A.

Intel Customer Support Technician

[Horgster]

Hi @JoseH_Intel 

This is an fresh installation of Intel SCS.
Please escalate to product group.

Cheers
Horgster

[JoseH_Intel]

Hello Horgster,

Not a problem, I will let our senior team know. We will be in contact soon

Regards

Jose A.

Intel Customer Support Technician

[MichaelA_Intel · Accepted solution]

Hi Horgster, I was able to confirm what you are seeing with RCSUtil on SCS 12.2. My output using your command running command prompt as administrator with my user account logged in:

2/16/2021 4:50:22 PM: -------------------------------------------------------------------------------

2/16/2021 4:50:22 PM:  Intel(R) SCS Utils log, running user: domain\user

2/16/2021 4:50:22 PM: -------------------------------------------------------------------------------

2/16/2021 4:50:22 PM: Waiting for the task scheduler to run the requested task using the Network Service account (can take up to 60 seconds).

2/16/2021 4:50:24 PM: -------------------------------------------------------------------------------

2/16/2021 4:50:24 PM:  Intel(R) SCS Utils log, running user: NT AUTHORITY\SYSTEM

2/16/2021 4:50:24 PM: -------------------------------------------------------------------------------

2/16/2021 4:50:24 PM: Getting the certificates from the user NT AUTHORITY\SYSTEM personal Certificate store

2/16/2021 4:50:24 PM: Enumerating the user certificate store succeeded. 

No certificates found in the store.

2/16/2021 4:50:24 PM: -------------------------------------------------------------------------------

2/16/2021 4:50:24 PM: Exit status for the running user NT AUTHORITY\SYSTEM: 

2/16/2021 4:50:24 PM: Success. 

2/16/2021 4:50:28 PM: -------------------------------------------------------------------------------

2/16/2021 4:50:28 PM: Exit status for the running user Domain\user 

2/16/2021 4:50:28 PM: Success. 

We will open up a sighting with the developers.

You also noted the workaround:

1. psexec -i -u "nt authority\network service" cmd.exe

2. RCSUtils.exe /Certificate View

Another workaround with psexec would include your step 1

1. mmc
2. add/remove snap-in
3. select certificate and ok

From here you can go to the personal certificate store of the account.

Regards,

Michael

[Horgster]

Hi @MichaelA_Intel 

Yes this is correct observed!

The extra workaround as you mentioned is also nice and easy to verify is that certificate is registered in Network Service CA Store on the machine.

1. psexec -i -u "nt authority\network service" cmd.exe
2. mmc
3. add/remove snap-in
4. select certificate and ok