windows - How to troubleshoot python import error - DLL access denied

Question

I have installed a certain python package (netCDF4), which contains compiled code (extension module). I am running Anaconda and python 3.6 under Windows 10 (x64). When importing the module from console, I get the following error:

In [1]: import netCDF4
---------------------------------------------------------------------------
ImportError                               Traceback (most recent call last)
<ipython-input-1-9588a3d4fb24> in <module>()
----> 1 import netCDF4

C:Program FilesAnaconda3libsite-packages
etCDF4\__init__.py in <module>()
      1 # init for netCDF4. package
      2 # Docstring comes from extension module _netCDF4.
----> 3 from ._netCDF4 import *
      4 # Need explicit imports for names beginning with underscores
      5 from ._netCDF4 import __doc__, __pdoc__

ImportError: DLL load failed: Access is denied.

But the module is loaded flawlessly from an administrator account.

I suspect that some crucial DLL file is blocked by company-wide security policy, which is quite restrictive. For instance, binary files are blocked by default unless in the "program files" folder. But my python distribution and the netCDF4 package are already within this folder, so I'm at loss how to explain this. The AppLocker log in Windows Event Viewer does not show any blocking activity. The dependencies listed by the depencency walker tool are either system libraries or contained in the "program files" folder.

How do I start troubleshooting? How can I find out what is going on?

Answer 1

After a long struggle, I now have the solution.

I started python in admin mode, and used the tool Process Explorer to log which DLL files were loaded. The import netCDF4 statement loaded around 10 extra DLL files. I then started python in user mode, and used ctypes.WinDLL to load each of these libraries manually. I was then able to pinpoint the exact library (hdf5.dll) that caused the problems. It turned out that hdf5.dll had incomplete permissions, so that it could only be loaded with administrator privilegies.

Although my problem was very specific, I hope that my solution can help others in related situations...