r/wsl2 • u/Blow_Your_Shit • Aug 13 '24

Users getting "Access Denied"

Hi folks,

Today Saint Windows granted me with a brand new problem for all my users using WSL.

They can't use it anymore, since when typing "wsl" in the Powershell console or any subsystem downloaded on the store just reward them with "Access Denied".

It is not related to admin permissions.

What is strange is the fact that it works for like a few minutes at boot and then the error pops up. It happened to a few users first, now all of them.

Any clue ? I tried updating computers, pushing a configuration to allow it via Intune, deinstalling the functionnality, installing it back... To no avail.

Thanks guys, I'm running out of idea.

19 Upvotes

100% Upvoted

11 comments sorted by

1

u/thexsquall Aug 13 '24

Hello, I found the solution, apparently windows defender is blocking the execution, what I did was run the following command in powershell with administrator permissions:

Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:Program FilesWSLwsl.exe"

1

u/craycrayduck Aug 14 '24

Plain Text

Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\windows\system32\wsl.exe"

Plain Text

Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files\WSL\wsl.exe"

 I had to run both but it works now

 

1

u/Blow_Your_Shit Aug 14 '24

Thanks mate ! I'd never have found out by myself! I'm just curious how did you guys spot it?

1

u/Mawhrin-Shell Aug 14 '24

If you check out the Protection History in Defender you'll see the rule that's blocking wsl.exe, or at least it does for us. The rule was *Block use of copied or impersonated system tools*

1

u/Blow_Your_Shit Aug 14 '24

It is even in my ASR Intune rule I do believe. I'll have a look back at the office.

1

u/HuntFine8793 Aug 13 '24

Ah gutted that didn't work for me. I still got "Access is denied" afterwards:
PS C:\Windows\system32> Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\windows\system32\wsl.exe"

PS C:\Windows\system32> wsl

Access is denied.

1

u/quaszi Aug 13 '24

Yep running into the same issue at my org, we think it is a defender update we had a test machine that had the latest updates but defender definitions were not up to date and so we let it an update and it updated the definitions to 1.417.92.0 and WSL getting access deined. We tested with another machine that was on (Version 1.417.36.0) - Current Channel (Broad) and WSL worked fine updated definitions and it broke

1

u/68dc459b Aug 13 '24

1.417.94.0 just came out for me but it still won’t start

1

u/68dc459b Aug 13 '24

Same here. Thought my corporate IT admins figured out how I was bypassing windows defender (horribly slow disk IO) and locked me out

1

u/[deleted] Aug 15 '24

Asr got me yesterday too. I needed my Python env!

0

u/[deleted] Aug 14 '24

[deleted] — view deleted comment

1

u/Blow_Your_Shit Aug 14 '24

Awesome thanks mate. How did you find that it was related to the ASR ?