# Cmdstanr Access Denied - Processx failure

**URL:** <https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072>\
**Category:** CmdStan\
**Created:** [October 16, 2023, 7:55pm UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072 "2023-10-16T19:55:25Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![cwolfe](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@cwolfe](https://discourse.mc-stan.org/u/cwolfe)\
**Post date:** [October 16, 2023, 7:55pm UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072/1 "2023-10-16T19:55:25Z")

</div>

Hi all -

I am having some trouble with cmdstanr and the compilation of code. This is an error that has been discussed previously [here](https://discourse.mc-stan.org/t/cmdstanr-processx-exec-error/30597). When I try to compile a model `mod <- cmdstan_model(...)` I get the same error as the linked page.

```r
Error in `process_initialize(self, private, command, args, stdin, stdout, …`:
! Native call to `processx_exec` failed
Caused by error in `chain_call(c_processx_exec, command, c(command, args), pty, pty_options, …`:
! create process 'D:/Projects/AABA2024/analyses/code/probit_cop.exe' (system error 5, Access is denied.
) @win/processx.c:1040 (processx_exec)
Type .Last.error to see the more details.

```

I know the `access denied` portion is tied to permissions to run arbitrary executables. The issue is I am an admin on the machine - I have full read,write,edit, etc. access to files on my machine (although I am still working on a “university-imaged” desktop. What is even weirder - when I run the above function, the `.exe` file does show up in the designated folder AND if I exit R and come back and run the same function - `mod <- cmdstan_model(...)`, I recieve no errors and get the normal message `executable is up to date`.

I have wracked my brain and I for the life of me cannot figure out what is going on here. Any suggestions from the community or devs?

---

<div class="post-metadata">

**Author:** ![andrjohns](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mc-stan.org/andrjohns/32/15297_2.png) [@andrjohns](https://discourse.mc-stan.org/u/andrjohns)\
**Post date:** [October 16, 2023, 8:34pm UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072/2 "2023-10-16T20:34:18Z")

</div>

The processes are being launched via R, so they only have the permissions that R itself has. You probably need to launch R with admin privileges if you need R to initiate processes that also have admin privileges

---

<div class="post-metadata">

**Author:** ![cwolfe](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@cwolfe](https://discourse.mc-stan.org/u/cwolfe)\
**Post date:** [October 17, 2023, 6:25pm UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072/3 "2023-10-17T18:25:31Z")

</div>

@andrjohns No such luck.

I’ve also gone through and given ‘full control’ to R, Rstudio, Rtools, etc. (Probably overkill?).

But - same `Access is Denied`.

I’m unsure where to turn to next.

---

<div class="post-metadata">

**Author:** ![andrjohns](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mc-stan.org/andrjohns/32/15297_2.png) [@andrjohns](https://discourse.mc-stan.org/u/andrjohns)\
**Post date:** [October 17, 2023, 6:37pm UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072/4 "2023-10-17T18:37:02Z")

</div>

Any difference if you try launching R by right-clicking and selecting “Run as Administrator”?

---

<div class="post-metadata">

**Author:** ![cwolfe](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@cwolfe](https://discourse.mc-stan.org/u/cwolfe)\
**Post date:** [October 17, 2023, 6:41pm UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072/5 "2023-10-17T18:41:50Z")

</div>

No difference.

I even ran the R gui followed by Rstudio as an admin - both times resulted in the `Access is Denied` warning.

---

<div class="post-metadata">

**Author:** ![andrjohns](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mc-stan.org/andrjohns/32/15297_2.png) [@andrjohns](https://discourse.mc-stan.org/u/andrjohns)\
**Post date:** [October 17, 2023, 6:45pm UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072/6 "2023-10-17T18:45:16Z")

</div>

And to double-check, are you able to compile and run the model via the command line (i.e., through plain `cmdstan`)?

---

<div class="post-metadata">

**Author:** ![cwolfe](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@cwolfe](https://discourse.mc-stan.org/u/cwolfe)\
**Post date:** [October 18, 2023, 1:44pm UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072/7 "2023-10-18T13:44:54Z")

</div>

@andrjohns Apologies for the delayed response.

The short answer is no. I was able to compile the example  
`mingw32-make examples/bernoulli/bernoulli.exe`

But, when I fit:  
`./examples/bernoulli/bernoulli.exe sample data file=examples/bernoulli/bernoulli.data.json`

I have a similar error `bash: ./examples/bernoulli/bernoulli.exe: Permission denied`.

---

<div class="post-metadata">

**Author:** ![andrjohns](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mc-stan.org/andrjohns/32/15297_2.png) [@andrjohns](https://discourse.mc-stan.org/u/andrjohns)\
**Post date:** [October 18, 2023, 1:53pm UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072/8 "2023-10-18T13:53:49Z")

</div>

It looks like you’ll need to contact your IT department for instructions on adding permissions for running arbitrary executables. There’s not really anything we can do from the cmdstan/cmdstanr side unfortunately

---

<div class="post-metadata">

**Author:** ![cwolfe](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@cwolfe](https://discourse.mc-stan.org/u/cwolfe)\
**Post date:** [October 18, 2023, 1:56pm UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072/9 "2023-10-18T13:56:30Z")

</div>

Totally okay - Now if only the IT department had a better idea of how to help. They seem to be lost at the moment…

Thanks Andrew!

---

<div class="post-metadata">

**Author:** ![cwolfe](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@cwolfe](https://discourse.mc-stan.org/u/cwolfe)\
**Post date:** [October 18, 2023, 6:12pm UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072/10 "2023-10-18T18:12:28Z")

</div>

Just filling you in on the update for any future issues that may arise for others-

It is related to the antivirus software through the university and I found it after going through Window’s Defender protection history. It reads as follows:

```plaintext
App or process blocked: "mod.exe"
Blocked by: Attack Surface Reduction

Rule: Block executable files from running unless they meet a prevalence, age, or trusted list criteria

```

Now IT is arguing there is nothing they can do because the security policy is set “company-wide”…

Thanks for the help!

---

<div class="post-metadata">

**Author:** ![jswesner](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mc-stan.org/jswesner/32/14387_2.png) [@jswesner](https://discourse.mc-stan.org/u/jswesner)\
**Post date:** [June 23, 2024, 3:11pm UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072/11 "2024-06-23T15:11:38Z")

</div>

We continue to have the same issues as cwolfe with cmdstan at our university (and our IT tries, but doesn’t know anything about Stan and has bigger fish to fry). Unfortunately it means we cannot teach classes using cmdstan. I wonder if this is a bigger issue that is limiting the use of cmdstan? Is there a possible fix coming in future updates?

---

<div class="post-metadata">

**Author:** ![WardBrian](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mc-stan.org/wardbrian/32/12078_2.png) [@WardBrian](https://discourse.mc-stan.org/u/WardBrian)\
**Post date:** [June 24, 2024, 7:18pm UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072/13 "2024-06-24T19:18:18Z")

</div>

The specific issue @cwolfe mentioned above is due to [this Windows Defender rule](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion), which involves a heuristic provided by Microsoft from their cloud servers to determine if a executable is trusted. This means that is is a moving target, and one that any user-compiled program is unlikely to pass. I don’t anticipate there being anything Stan could do to get around this

---

<div class="post-metadata">

**Author:** ![cwolfe](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@cwolfe](https://discourse.mc-stan.org/u/cwolfe)\
**Post date:** [June 25, 2024, 12:01am UTC](https://discourse.mc-stan.org/t/cmdstanr-access-denied-processx-failure/33072/14 "2024-06-25T00:01:33Z")

</div>

@jswesner I had my university whitelist a folder on my machine where executables could be excluded from the firewall. Basically, anything I do in Stan goes into this folder. I also had them whitelist a separate folder where I kept cmdstan (I have cmdstan on the C: and I work locally from D:). I do this for anything the Defender may flag. There is no other work around given the set-up between Windows and the University.