I'm still learning PowerShell and am trying to use N-able to run a script on a client computer. The script reads System event ID 1808 and appends the results to a text file. It works when I run it locally, but the N-able execution fails when the output path is a UNC share such as \realhostnamegoesherecommonoutput_log.txt. The error is: "Out-File : Access to the path '\slsindfps02commonoutput_log.txt' is denied." N-able appears to execute the script under the local System account. The share is intended to be broadly accessible, so I'm trying to determine whether this is a credential, share-permission, or network-authentication issue.
4 Answers
N-able commonly runs scripts under the local System account. That account has extensive rights on the client itself, but it usually doesn’t authenticate to remote network shares as a normal user. Check the execution identity with `whoami` or `$env:USERNAME`. You can either configure the job to use a credential that has access to the share, or grant the client computer account access to both the share and the underlying NTFS folder.
The custom `Select-Object` expression for the computer name isn’t necessary. You could use `Select-Object PSComputerName,TimeCreated,Id,Message` if that property is available, or add the computer name with a calculated property as you already did. That cleanup won’t fix the access-denied error, though; the main issue is the account used to access the UNC path.
The simplest diagnostic is to run the script interactively under the same account N-able uses and compare the results. If it succeeds as your account but fails as System, the script itself is probably fine—the remote share is rejecting the execution identity. Writing locally first, then copying the file with a properly authenticated process, can also help isolate the problem.
Even if the share is configured for broad access, the local System account is presented to another computer as the client’s machine account, not as an interactive user. Also, some credential types cannot be delegated to a second server. Test the script under the exact account used by N-able, and if appropriate authenticate to the share with a dedicated service credential before calling `Out-File`. Avoid embedding a real password directly in the script.
That makes sense. I’ll verify the N-able execution identity first and check whether the computer account or a configured service credential has permissions on both the share and the folder.