Here’s a new Knowledge Base article we published. This one talks about an issue where the Orchestrator Run Program activity returns a "Process creation failed" "The system cannot find the file specified" error.
Executing the Run Program activity from either System Center Orchestrator results in the activity returning a failed status and the Error Summary Text Published Data contains the following error:
"Process creation failed on <computer> – The system cannot find the file specified. (code 2)"
This error will be returned even if the path to the program being executed has been confirmed to be valid on the target computer and the user account configured for the Orchestrator Runbook Service, or directly in the Security tab of the Run Program activity has been verified as a member of the local Administrators group on the target computer.
The Orchestrator Run Program Service (orunprogram) on the target computer, used to execute the configured program or command, does not have sufficient privilege to create the process in the manner required for the Run Program activity. This is typically a result of the service on the target computer that creates the process not using the LocalSystem user account.
The service that creates the process on the target computer, Orchestrator Run Program Service (orunprogram), by default is configured to use "LocalSystem" as the logon credentials. LocalSystem has a special user right that even members of the local Administrators do not have by default, which is "Act as part of the operating system". This user right allows the user to create a process using the credentials of another user which is required for the Run Program activity to succeed.
Act as part of the operating system
There are three resolution options available:
Stop and delete the Orchestrator Run Program Service (orunprogram) from the target computer allowing System Center 2012 Orchestrator to reinstall the service automatically using the default LocalSystem user account at next execution of the Run Program activity.
Execute the following commands using an elevated Command Prompt on the computer that is the target of the Run Program activity to stop and delete the Orchestrator Run Program (orunprogram) service:
sc stop orunprogram sc delete orunprogram
Stop the Orchestrator Run Program Service (orunprogram) on the target computer and configure the service to use the LocalSystem account to logon, then restart it.
Execute the following commands using an elevated Command Prompt on the computer that is the target of the Run Program activity to stop the Orchestrator Run Program (orunprogram) service, change the user account to LocalSystem and then restart it:
sc stop orunprogram sc config orunprogram obj= LocalSystem type= interact type= own sc start orunprogram
Resolution #3 (Not Recommended for security reasons)
Grant the user account that is specified as the logon user for the Orchestrator Run Program Service (orunprogram) the "Act as part of the operating system" user right.
For the most current version of this article please see the following:
J.C. Hornbeck | Knowledge Engineer | Management and Security Division
App-V Team blog: http://blogs.technet.com/appv/
ConfigMgr Support Team blog: http://blogs.technet.com/configurationmgr/
DPM Team blog: http://blogs.technet.com/dpm/
MED-V Team blog: http://blogs.technet.com/medv/
Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
Operations Manager Team blog: http://blogs.technet.com/momteam/
SCVMM Team blog: http://blogs.technet.com/scvmm
Server App-V Team blog: http://blogs.technet.com/b/serverappv
Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center Essentials Team blog: http://blogs.technet.com/b/systemcenteressentials
WSUS Support Team blog: http://blogs.technet.com/sus/
The Forefront Server Protection blog: http://blogs.technet.com/b/fss/
The Forefront Endpoint Security blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/