Automatic and web based Windows Update Installs all fail...

[Don Holmes]

{Subject renamed to be more accurate}

I have a Gateway 600YGR running Win2K Pro Version 5.0 (build 2195: Service Pack 4).

For roughly the last two or three months (it appears) the automatic (and manual, web based) Windows Updates have been failing. I did notice one or two that worked over the last few months but I believe they were drivers only. When I run the web update from v4.windowsupdate.microsoft.com the downloads work however the installations fail. The message on the resulting "failed to install" webpage is "No Updates Were Installed" and there are no error codes whatsoever. When I try to do the updates manually or one by one they all return the error message that "You do not have permission to update Windows 2000. Please contact your system administrator." I am the system administrator and have even made myself a domain administrator to try to fix this problem...

To the best of my knowledge and research there were no security policies/authorities changed since this last worked. Using secpol.msc (Local Policies-> User Rights Assignment) I verified that Administrators (and even my own user account and local machine Administrator) had the authority to:

Back up files and directories
Manage auditing and security log
Modify firmware environment values
Restore files and directories
Take ownership of files or other objects

It doesn't matter if I login as the Network Administrator, Local Administrator, or Domain Administrator - same behavior...

I've completely removed the WUTemp directory and have forced recreation of the WindowsUpdate\V4 directory as well. I do not have a firewall running on the machine and the network firewall protects dozens of other machines on which Windows Update works fine... Downloads of the update files are received fine and security permissions on them are as expected (meaning I have full control of them). I've turned off all real-time file protection in Symantec AV just in case there was something strange there but still no change...

I've search high and low for anything on Microsoft's site and the web in general for ANYTHING on the message that "You do not have permission to update Windows 2000" and while I have found a few for XP, I've found nothing for Win2K. Just in case, I verified all of the dll registrations, MS root certificate, etc as suggested there to no avail.

When I attempt to run the "repair Windows 2000" feature using the original CD, (by clicking on the Install Windows 2000 link), I receive the infamous message "You must be an administrator to run this application". Again, I'm about as much of an Administrator (authority-wise) as one can be... Note that when using the "Install Add-On Components" link from the Win2K Pro CD - I can install/remove components using the Windows Components Wizard apparently without any issues... (at least none that Windows complains about where I can see it...)

I sure could use a fresh perspective on this one as it has stumped me completely... I'll include excerpts from the WindowsUpdate.log file as well as the iuhist.xml file below... At the bottom I include an excerpt from the KB839645.log file (one that is failing and representative of all that are failing) and it has references in it to Update.exe issuing an error code of 0xf004 and indicates something about failing to enable SE_SECURITY_PRIVILEGE but for the life of me I can't tell why... Thoughts ...


Below is an excerpt of the WindowsUpdate.log file for this last attempt via website:

2004-07-28 09:22:57 16:22:57 Success IUCTL Starting
2004-07-28 09:22:57 16:22:57 Success IUCTL Downloaded iuident.cab from http://windowsupdate.microsoft.com/v4/ to C:\Program Files\WindowsUpdate\V4
2004-07-28 09:22:57 16:22:57 Success IUCTL Current iuengine.dll version: 5.4.3790.14
2004-07-28 09:22:57 16:22:57 Success IUCTL Current iuctl.dll version: 5.4.3790.14
2004-07-28 09:22:57 16:22:57 Success IUENGINE Starting
2004-07-28 09:22:57 16:22:57 Success IUENGINE Determining machine configuration
2004-07-28 09:22:57 16:22:57 Success IUENGINE Determining machine configuration
2004-07-28 09:23:00 16:23:00 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:01 16:23:01 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:02 16:23:02 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:07 16:23:07 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:08 16:23:08 Success IUENGINE Determining machine configuration
2004-07-28 09:23:09 16:23:09 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/consumerdrivers/getmanifest.asp
2004-07-28 09:23:51 16:23:51 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:52 16:23:52 Success IUENGINE Asynchronous Download started
2004-07-28 09:23:52 16:23:52 Success IUENGINE Download destination root folder is: C:\WUTemp
2004-07-28 09:23:59 16:23:59 Success IUENGINE Downloaded file http://download.windowsupdate.com/m...U-express_67a0bec57f33208902e15d3ae1968f9.exe
2004-07-28 09:23:59 16:23:59 Success IUENGINE Local path C:\WUTemp\com_microsoft.840315_W2K_SP5_WinSE_95927_Express\Windows2000-KB840315-x86-ENU-express.exe
2004-07-28 09:23:59 16:23:59 Success IUENGINE Downloaded file http://download.windowsupdate.com/m...U-express_2f310dd9e91121cb09b4de620d7ae33.EXE
....
2004-07-28 09:24:00 16:24:00 Success IUENGINE Local path C:\WUTemp\com_microsoft.839645_W2K_SP5_WinSE_96133_Express\Windows2000-KB839645-x86-ENU-express.exe
2004-07-28 09:24:01 16:24:01 Success IUENGINE See iuhist.xml for details: Download finished
2004-07-28 09:24:01 16:24:01 Success IUENGINE Asynchronous Install started
2004-07-28 09:24:01 16:24:01 Success IUENGINE Asynchronous Install completed startup
2004-07-28 09:24:01 16:24:01 Success IUENGINE Installing SOFTWARE item from publisher com_microsoft
2004-07-28 09:24:01 16:24:01 Success IUENGINE Installer Command Type: EXE
....
2004-07-28 09:24:21 16:24:21 Error IUENGINE See iuhist.xml for details: Install finished (Error 0x8007F004)


Below is an excerpt of the iuhist.xml file for this last attempt via website:

<?xml version="1.0" ?>
- <items xmlns="x-schema:http://schemas.windowsupdate.com/iu/resultschema.xml">
- <itemStatus xmlns="" timestamp="2004-07-28T09:24:21">
- <identity itemID="win2k.windows2000.ver_platform_win32_nt.5.0.x86.en...2195.4.0.com_microsoft.839645_w2k_sp5_winse_96133_express." name="839645_W2K_SP5_WinSE_96133_Express">
<publisherName>com_microsoft</publisherName>
<language>en</language>
</identity>
- <description hidden="0">
- <descriptionText>
<title>Security Update for Windows 2000 (KB839645)</title>
<eula href="/msdownload/update/v3/static/eula/en/eula.htm" />
<details href="http://go.microsoft.com/fwlink/?LinkId=30585" />
</descriptionText>
</description>
- <platform name="ver_platform_win32_nt">
<processorArchitecture>x86</processorArchitecture>
<version major="5" minor="0" build="2195" servicePackMajor="4" servicePackMinor="0" />
</platform>
<downloadStatus value="COMPLETE" />
<downloadPath>C:\WUTemp\com_microsoft.839645_W2K_SP5_WinSE_96133_Express</downloadPath>
<client>IU_Site</client>
<installStatus value="FAILED" needsReboot="0" errorCode="-2146963452" />
</itemStatus>
- <itemStatus xmlns="" timestamp="2004-07-28T09:24:19">
- <identity itemID="win2k.windows2000.ver_platform_win32_nt.5.0.x86.en...2195.4.0.com_microsoft.directx_839643_w2k_9_0." name="DirectX_839643_W2K_9_0">
<publisherName>com_microsoft</publisherName>
<language>en</language>
</identity>
- <description hidden="0">
- <descriptionText>
<title>Security Update for DirectX 9.0 (KB839643)</title>
<eula href="/msdownload/update/v3/static/eula/en/eula.htm" />
<details href="http://go.microsoft.com/fwlink/?LinkId=27992" />
</descriptionText>
</description>
- <platform name="ver_platform_win32_nt">
<processorArchitecture>x86</processorArchitecture>
<version major="5" minor="0" build="2195" servicePackMajor="4" servicePackMinor="0" />
</platform>
<downloadStatus value="COMPLETE" />
<downloadPath>C:\WUTemp\com_microsoft.DirectX_839643_W2K_9_0</downloadPath>
<client>IU_Site</client>
<installStatus value="FAILED" needsReboot="0" errorCode="-2146963452" />

Below is an excerpt of the KB839645.log file for this last attempt via website:

0.170: ================================================================================
0.170: 2004/07/28 09:24:21.116 (local)
0.170: c:\2a9f1fb20ffb27eb1352e2\update\update.exe (version 5.4.15.0)
0.170: Failed To Enable SE_RESTORE_PRIVILEGE
0.170: Setup encountered an error: You do not have permission to update Windows 2000.
Please contact your system administrator.
0.170: You do not have permission to update Windows 2000.
Please contact your system administrator.
0.170: Update.exe extended error code = 0xf004

--

 

[Chuck]

You seem rather knowledgeable, see if this helps:
"Administrators only" error message when you attempt to use the Windows Update site
http://support.microsoft.com/default.aspx?scid=kb;en-us;316524&Product=wupd

--
Chuck
{Subject renamed to be more accurate}

I have a Gateway 600YGR running Win2K Pro Version 5.0 (build 2195: Service Pack 4).

For roughly the last two or three months (it appears) the automatic (and manual, web based) Windows Updates have been failing. I did notice one or two that worked over the last few months but I believe they were drivers only. When I run the web update from v4.windowsupdate.microsoft.com the downloads work however the installations fail. The message on the resulting "failed to install" webpage is "No Updates Were Installed" and there are no error codes whatsoever. When I try to do the updates manually or one by one they all return the error message that "You do not have permission to update Windows 2000. Please contact your system administrator." I am the system administrator and have even made myself a domain administrator to try to fix this problem...

To the best of my knowledge and research there were no security policies/authorities changed since this last worked. Using secpol.msc (Local Policies-> User Rights Assignment) I verified that Administrators (and even my own user account and local machine Administrator) had the authority to:

Back up files and directories
Manage auditing and security log
Modify firmware environment values
Restore files and directories
Take ownership of files or other objects

It doesn't matter if I login as the Network Administrator, Local Administrator, or Domain Administrator - same behavior...

I've completely removed the WUTemp directory and have forced recreation of the WindowsUpdate\V4 directory as well. I do not have a firewall running on the machine and the network firewall protects dozens of other machines on which Windows Update works fine... Downloads of the update files are received fine and security permissions on them are as expected (meaning I have full control of them). I've turned off all real-time file protection in Symantec AV just in case there was something strange there but still no change...

I've search high and low for anything on Microsoft's site and the web in general for ANYTHING on the message that "You do not have permission to update Windows 2000" and while I have found a few for XP, I've found nothing for Win2K. Just in case, I verified all of the dll registrations, MS root certificate, etc as suggested there to no avail.

When I attempt to run the "repair Windows 2000" feature using the original CD, (by clicking on the Install Windows 2000 link), I receive the infamous message "You must be an administrator to run this application". Again, I'm about as much of an Administrator (authority-wise) as one can be... Note that when using the "Install Add-On Components" link from the Win2K Pro CD - I can install/remove components using the Windows Components Wizard apparently without any issues... (at least none that Windows complains about where I can see it...)

I sure could use a fresh perspective on this one as it has stumped me completely... I'll include excerpts from the WindowsUpdate.log file as well as the iuhist.xml file below... At the bottom I include an excerpt from the KB839645.log file (one that is failing and representative of all that are failing) and it has references in it to Update.exe issuing an error code of 0xf004 and indicates something about failing to enable SE_SECURITY_PRIVILEGE but for the life of me I can't tell why... Thoughts ...


Below is an excerpt of the WindowsUpdate.log file for this last attempt via website:

2004-07-28 09:22:57 16:22:57 Success IUCTL Starting
2004-07-28 09:22:57 16:22:57 Success IUCTL Downloaded iuident.cab from http://windowsupdate.microsoft.com/v4/ to C:\Program Files\WindowsUpdate\V4
2004-07-28 09:22:57 16:22:57 Success IUCTL Current iuengine.dll version: 5.4.3790.14
2004-07-28 09:22:57 16:22:57 Success IUCTL Current iuctl.dll version: 5.4.3790.14
2004-07-28 09:22:57 16:22:57 Success IUENGINE Starting
2004-07-28 09:22:57 16:22:57 Success IUENGINE Determining machine configuration
2004-07-28 09:22:57 16:22:57 Success IUENGINE Determining machine configuration
2004-07-28 09:23:00 16:23:00 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:01 16:23:01 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:02 16:23:02 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:07 16:23:07 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:08 16:23:08 Success IUENGINE Determining machine configuration
2004-07-28 09:23:09 16:23:09 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/consumerdrivers/getmanifest.asp
2004-07-28 09:23:51 16:23:51 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:52 16:23:52 Success IUENGINE Asynchronous Download started
2004-07-28 09:23:52 16:23:52 Success IUENGINE Download destination root folder is: C:\WUTemp
2004-07-28 09:23:59 16:23:59 Success IUENGINE Downloaded file http://download.windowsupdate.com/m...U-express_67a0bec57f33208902e15d3ae1968f9.exe
2004-07-28 09:23:59 16:23:59 Success IUENGINE Local path C:\WUTemp\com_microsoft.840315_W2K_SP5_WinSE_95927_Express\Windows2000-KB840315-x86-ENU-express.exe
2004-07-28 09:23:59 16:23:59 Success IUENGINE Downloaded file http://download.windowsupdate.com/m...U-express_2f310dd9e91121cb09b4de620d7ae33.EXE
...
2004-07-28 09:24:00 16:24:00 Success IUENGINE Local path C:\WUTemp\com_microsoft.839645_W2K_SP5_WinSE_96133_Express\Windows2000-KB839645-x86-ENU-express.exe
2004-07-28 09:24:01 16:24:01 Success IUENGINE See iuhist.xml for details: Download finished
2004-07-28 09:24:01 16:24:01 Success IUENGINE Asynchronous Install started
2004-07-28 09:24:01 16:24:01 Success IUENGINE Asynchronous Install completed startup
2004-07-28 09:24:01 16:24:01 Success IUENGINE Installing SOFTWARE item from publisher com_microsoft
2004-07-28 09:24:01 16:24:01 Success IUENGINE Installer Command Type: EXE
...
2004-07-28 09:24:21 16:24:21 Error IUENGINE See iuhist.xml for details: Install finished (Error 0x8007F004)


Below is an excerpt of the iuhist.xml file for this last attempt via website:

<?xml version="1.0" ?>
- <items xmlns="x-schema:http://schemas.windowsupdate.com/iu/resultschema.xml">
- <itemStatus xmlns="" timestamp="2004-07-28T09:24:21">
- <identity itemID="win2k.windows2000.ver_platform_win32_nt.5.0.x86.en...2195.4.0.com_microsoft.839645_w2k_sp5_winse_96133_express." name="839645_W2K_SP5_WinSE_96133_Express">
<publisherName>com_microsoft</publisherName>
<language>en</language>
</identity>
- <description hidden="0">
- <descriptionText>
<title>Security Update for Windows 2000 (KB839645)</title>
<eula href="/msdownload/update/v3/static/eula/en/eula.htm" />
<details href="http://go.microsoft.com/fwlink/?LinkId=30585" />
</descriptionText>
</description>
- <platform name="ver_platform_win32_nt">
<processorArchitecture>x86</processorArchitecture>
<version major="5" minor="0" build="2195" servicePackMajor="4" servicePackMinor="0" />
</platform>
<downloadStatus value="COMPLETE" />
<downloadPath>C:\WUTemp\com_microsoft.839645_W2K_SP5_WinSE_96133_Express</downloadPath>
<client>IU_Site</client>
<installStatus value="FAILED" needsReboot="0" errorCode="-2146963452" />
</itemStatus>
- <itemStatus xmlns="" timestamp="2004-07-28T09:24:19">
- <identity itemID="win2k.windows2000.ver_platform_win32_nt.5.0.x86.en...2195.4.0.com_microsoft.directx_839643_w2k_9_0." name="DirectX_839643_W2K_9_0">
<publisherName>com_microsoft</publisherName>
<language>en</language>
</identity>
- <description hidden="0">
- <descriptionText>
<title>Security Update for DirectX 9.0 (KB839643)</title>
<eula href="/msdownload/update/v3/static/eula/en/eula.htm" />
<details href="http://go.microsoft.com/fwlink/?LinkId=27992" />
</descriptionText>
</description>
- <platform name="ver_platform_win32_nt">
<processorArchitecture>x86</processorArchitecture>
<version major="5" minor="0" build="2195" servicePackMajor="4" servicePackMinor="0" />
</platform>
<downloadStatus value="COMPLETE" />
<downloadPath>C:\WUTemp\com_microsoft.DirectX_839643_W2K_9_0</downloadPath>
<client>IU_Site</client>
<installStatus value="FAILED" needsReboot="0" errorCode="-2146963452" />

Below is an excerpt of the KB839645.log file for this last attempt via website:

0.170: ================================================================================
0.170: 2004/07/28 09:24:21.116 (local)
0.170: c:\2a9f1fb20ffb27eb1352e2\update\update.exe (version 5.4.15.0)
0.170: Failed To Enable SE_RESTORE_PRIVILEGE
0.170: Setup encountered an error: You do not have permission to update Windows 2000.
Please contact your system administrator.
0.170: You do not have permission to update Windows 2000.
Please contact your system administrator.
0.170: Update.exe extended error code = 0xf004

--

 

[Alan Illeman]

You seem rather knowledgeable, see if this helps:
"Administrators only" error message when you attempt to use the Windows
Update site
http://support.microsoft.com/default.aspx?scid=kb;en-us;316524&Product=wupd

--
Chuck
{Subject renamed to be more accurate}

I have a Gateway 600YGR running Win2K Pro Version 5.0 (build 2195: Service
Pack 4).

For roughly the last two or three months (it appears) the automatic (and
manual, web based) Windows Updates have been failing. I did notice one or
two that worked over the last few months but I believe they were drivers
only. When I run the web update from v4.windowsupdate.microsoft.com the
downloads work however the installations fail. The message on the resulting
"failed to install" webpage is "No Updates Were Installed" and there are no
error codes whatsoever. When I try to do the updates manually or one by one
they all return the error message that "You do not have permission to update
Windows 2000. Please contact your system administrator." I am the system
administrator and have even made myself a domain administrator to try to fix
this problem...

To the best of my knowledge and research there were no security
policies/authorities changed since this last worked. Using secpol.msc
(Local Policies-> User Rights Assignment) I verified that Administrators
(and even my own user account and local machine Administrator) had the
authority to:

Back up files and directories
Manage auditing and security log
Modify firmware environment values
Restore files and directories
Take ownership of files or other objects

It doesn't matter if I login as the Network Administrator, Local
Administrator, or Domain Administrator - same behavior...

I've completely removed the WUTemp directory and have forced recreation of
the WindowsUpdate\V4 directory as well. I do not have a firewall running on
the machine and the network firewall protects dozens of other machines on
which Windows Update works fine... Downloads of the update files are
received fine and security permissions on them are as expected (meaning I
have full control of them). I've turned off all real-time file protection
in Symantec AV just in case there was something strange there but still no
change...

I've search high and low for anything on Microsoft's site and the web in
general for ANYTHING on the message that "You do not have permission to
update Windows 2000" and while I have found a few for XP, I've found nothing
for Win2K. Just in case, I verified all of the dll registrations, MS root
certificate, etc as suggested there to no avail.

When I attempt to run the "repair Windows 2000" feature using the original
CD, (by clicking on the Install Windows 2000 link), I receive the infamous
message "You must be an administrator to run this application". Again, I'm
about as much of an Administrator (authority-wise) as one can be... Note
that when using the "Install Add-On Components" link from the Win2K Pro CD -
I can install/remove components using the Windows Components Wizard
apparently without any issues... (at least none that Windows complains about
where I can see it...)

I sure could use a fresh perspective on this one as it has stumped me
completely... I'll include excerpts from the WindowsUpdate.log file as well
as the iuhist.xml file below... At the bottom I include an excerpt from the
KB839645.log file (one that is failing and representative of all that are
failing) and it has references in it to Update.exe issuing an error code of
0xf004 and indicates something about failing to enable SE_SECURITY_PRIVILEGE
but for the life of me I can't tell why... Thoughts ...


Below is an excerpt of the WindowsUpdate.log file for this last attempt
via website:

2004-07-28 09:22:57 16:22:57 Success IUCTL Starting
2004-07-28 09:22:57 16:22:57 Success IUCTL Downloaded
iuident.cab from http://windowsupdate.microsoft.com/v4/ to C:\Program
Files\WindowsUpdate\V4
2004-07-28 09:22:57 16:22:57 Success IUCTL Current
iuengine.dll version: 5.4.3790.14
2004-07-28 09:22:57 16:22:57 Success IUCTL Current iuctl.dll
version: 5.4.3790.14
2004-07-28 09:22:57 16:22:57 Success IUENGINE Starting
2004-07-28 09:22:57 16:22:57 Success IUENGINE Determining
machine configuration
2004-07-28 09:22:57 16:22:57 Success IUENGINE Determining
machine configuration
2004-07-28 09:23:00 16:23:00 Success IUENGINE Querying software
update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:01 16:23:01 Success IUENGINE Querying software
update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:02 16:23:02 Success IUENGINE Querying software
update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:07 16:23:07 Success IUENGINE Querying software
update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:08 16:23:08 Success IUENGINE Determining
machine configuration
2004-07-28 09:23:09 16:23:09 Success IUENGINE Querying software
update catalog from
https://v4.windowsupdate.microsoft.com/consumerdrivers/getmanifest.asp
2004-07-28 09:23:51 16:23:51 Success IUENGINE Querying software
update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:52 16:23:52 Success IUENGINE Asynchronous
Download started
2004-07-28 09:23:52 16:23:52 Success IUENGINE Download
destination root folder is: C:\WUTemp
2004-07-28 09:23:59 16:23:59 Success IUENGINE Downloaded file
http://download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/Wind
ows2000-KB840315-x86-ENU-express_67a0bec57f33208902e15d3ae1968f9.exe
2004-07-28 09:23:59 16:23:59 Success IUENGINE Local path
C:\WUTemp\com_microsoft.840315_W2K_SP5_WinSE_95927_Express\Windows2000-KB840
315-x86-ENU-express.exe
2004-07-28 09:23:59 16:23:59 Success IUENGINE Downloaded file
http://download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/Wind
ows2000-KB842526-x86-ENU-express_2f310dd9e91121cb09b4de620d7ae33.EXE
...
2004-07-28 09:24:00 16:24:00 Success IUENGINE Local path
C:\WUTemp\com_microsoft.839645_W2K_SP5_WinSE_96133_Express\Windows2000-KB839
645-x86-ENU-express.exe
2004-07-28 09:24:01 16:24:01 Success IUENGINE See iuhist.xml
for details: Download finished
2004-07-28 09:24:01 16:24:01 Success IUENGINE Asynchronous
Install started
2004-07-28 09:24:01 16:24:01 Success IUENGINE Asynchronous
Install completed startup
2004-07-28 09:24:01 16:24:01 Success IUENGINE Installing
SOFTWARE item from publisher com_microsoft
2004-07-28 09:24:01 16:24:01 Success IUENGINE Installer Command
Type: EXE
...
2004-07-28 09:24:21 16:24:21 Error IUENGINE See iuhist.xml
for details: Install finished (Error 0x8007F004)


Below is an excerpt of the iuhist.xml file for this last attempt via
website:

<?xml version="1.0" ?>
- <items
xmlns="x-schema:http://schemas.windowsupdate.com/iu/resultschema.xml">
- <itemStatus xmlns="" timestamp="2004-07-28T09:24:21">
- <identity
itemID="win2k.windows2000.ver_platform_win32_nt.5.0.x86.en...2195.4.0.com_mi
crosoft.839645_w2k_sp5_winse_96133_express."
name="839645_W2K_SP5_WinSE_96133_Express">
<publisherName>com_microsoft</publisherName>
<language>en</language>
</identity>
- <description hidden="0">
- <descriptionText>
<title>Security Update for Windows 2000 (KB839645)</title>
<eula href="/msdownload/update/v3/static/eula/en/eula.htm" />
<details href="http://go.microsoft.com/fwlink/?LinkId=30585" />
</descriptionText>
</description>
- <platform name="ver_platform_win32_nt">
<processorArchitecture>x86</processorArchitecture>
<version major="5" minor="0" build="2195" servicePackMajor="4"
servicePackMinor="0" />
</platform>
<downloadStatus value="COMPLETE" />
<downloadPath>C:\WUTemp\com_microsoft.839645_W2K_SP5_WinSE_96133_Express
</downloadPath>
<client>IU_Site</client>
<installStatus value="FAILED" needsReboot="0" errorCode="-2146963452" />
</itemStatus>
- <itemStatus xmlns="" timestamp="2004-07-28T09:24:19">
- <identity
itemID="win2k.windows2000.ver_platform_win32_nt.5.0.x86.en...2195.4.0.com_mi
crosoft.directx_839643_w2k_9_0." name="DirectX_839643_W2K_9_0">
<publisherName>com_microsoft</publisherName>
<language>en</language>
</identity>
- <description hidden="0">
- <descriptionText>
<title>Security Update for DirectX 9.0 (KB839643)</title>
<eula href="/msdownload/update/v3/static/eula/en/eula.htm" />
<details href="http://go.microsoft.com/fwlink/?LinkId=27992" />
</descriptionText>
</description>
- <platform name="ver_platform_win32_nt">
<processorArchitecture>x86</processorArchitecture>
<version major="5" minor="0" build="2195" servicePackMajor="4"
servicePackMinor="0" />
</platform>
<downloadStatus value="COMPLETE" />
<downloadPath>C:\WUTemp\com_microsoft.DirectX_839643_W2K_9_0</downloadPa
th>
<client>IU_Site</client>
<installStatus value="FAILED" needsReboot="0" errorCode="-2146963452" />

Below is an excerpt of the KB839645.log file for this last attempt via
website:

0.170:
============================================================================
====
0.170: 2004/07/28 09:24:21.116 (local)
0.170: c:\2a9f1fb20ffb27eb1352e2\update\update.exe (version 5.4.15.0)
0.170: Failed To Enable SE_RESTORE_PRIVILEGE
0.170: Setup encountered an error: You do not have permission to update
Windows 2000.
Please contact your system administrator.
0.170: You do not have permission to update Windows 2000.
Please contact your system administrator.
0.170: Update.exe extended error code = 0xf004

--

Not much on Google for SE_RESTORE_PRIVILEGE

http://www.osronline.com/lists_archive/ntfsd/thread2032.html
Molly Brown of Microsoft
http://python.active-venture.com/lib/module--winreg.html
A call to LoadKey() fails if the calling process does not have
the SE_RESTORE_PRIVILEGE privilege. Note that privileges are
different than permissions - see the Win32 documentation for
more details.
http://www.talkaboutsoftware.com/group/microsoft.public.windowsxp.security_a
dmin/search.html?q=SE_RESTORE_PRIVILEGE&Submit.x=14&Submit.y=13

 

[Don Holmes]

Thanks for the reply Chuck.

I had seen this article and had completed the resolution recommendation through step 15 however step 16 didn't work because for whatever reason the Cryptographic Services (cryptsvc) isn't installed on the system (that I can determine). From what I've read, apparently it doesn't show up in Win2k using the administrators services application so I'm not sure it is "there". However since I can't stop/start it from the command line either I'll assume it isn't there (as a service anyway).

So, I'm left to conclude that it simply doesn't exist on the system. Neither does the catroot2 folder that this step suggests I rename. I've been searching for any info on why the cryptsvc may or may not exist but have had no luck yet. The odd thing is that I was able to unregister and reregister the DLL files that are apparently associated with the Cryptographic Services as suggested in Method 4 at: http://support.microsoft.com/default.aspx?scid=kb;EN-US;822798

Any thoughts on whether the "missing" cryptsvc and/or catroot2 folder are the problem and how that can be fixed?

Thx, D

--

You seem rather knowledgeable, see if this helps:
"Administrators only" error message when you attempt to use the Windows Update site
http://support.microsoft.com/default.aspx?scid=kb;en-us;316524&Product=wupd

--
Chuck
{Subject renamed to be more accurate}

I have a Gateway 600YGR running Win2K Pro Version 5.0 (build 2195: Service Pack 4).

For roughly the last two or three months (it appears) the automatic (and manual, web based) Windows Updates have been failing. I did notice one or two that worked over the last few months but I believe they were drivers only. When I run the web update from v4.windowsupdate.microsoft.com the downloads work however the installations fail. The message on the resulting "failed to install" webpage is "No Updates Were Installed" and there are no error codes whatsoever. When I try to do the updates manually or one by one they all return the error message that "You do not have permission to update Windows 2000. Please contact your system administrator." I am the system administrator and have even made myself a domain administrator to try to fix this problem...

To the best of my knowledge and research there were no security policies/authorities changed since this last worked. Using secpol.msc (Local Policies-> User Rights Assignment) I verified that Administrators (and even my own user account and local machine Administrator) had the authority to:

Back up files and directories
Manage auditing and security log
Modify firmware environment values
Restore files and directories
Take ownership of files or other objects

It doesn't matter if I login as the Network Administrator, Local Administrator, or Domain Administrator - same behavior...

I've completely removed the WUTemp directory and have forced recreation of the WindowsUpdate\V4 directory as well. I do not have a firewall running on the machine and the network firewall protects dozens of other machines on which Windows Update works fine... Downloads of the update files are received fine and security permissions on them are as expected (meaning I have full control of them). I've turned off all real-time file protection in Symantec AV just in case there was something strange there but still no change...

I've search high and low for anything on Microsoft's site and the web in general for ANYTHING on the message that "You do not have permission to update Windows 2000" and while I have found a few for XP, I've found nothing for Win2K. Just in case, I verified all of the dll registrations, MS root certificate, etc as suggested there to no avail.

When I attempt to run the "repair Windows 2000" feature using the original CD, (by clicking on the Install Windows 2000 link), I receive the infamous message "You must be an administrator to run this application". Again, I'm about as much of an Administrator (authority-wise) as one can be... Note that when using the "Install Add-On Components" link from the Win2K Pro CD - I can install/remove components using the Windows Components Wizard apparently without any issues... (at least none that Windows complains about where I can see it...)

I sure could use a fresh perspective on this one as it has stumped me completely... I'll include excerpts from the WindowsUpdate.log file as well as the iuhist.xml file below... At the bottom I include an excerpt from the KB839645.log file (one that is failing and representative of all that are failing) and it has references in it to Update.exe issuing an error code of 0xf004 and indicates something about failing to enable SE_SECURITY_PRIVILEGE but for the life of me I can't tell why... Thoughts ...


Below is an excerpt of the WindowsUpdate.log file for this last attempt via website:

2004-07-28 09:22:57 16:22:57 Success IUCTL Starting
2004-07-28 09:22:57 16:22:57 Success IUCTL Downloaded iuident.cab from http://windowsupdate.microsoft.com/v4/ to C:\Program Files\WindowsUpdate\V4
2004-07-28 09:22:57 16:22:57 Success IUCTL Current iuengine.dll version: 5.4.3790.14
2004-07-28 09:22:57 16:22:57 Success IUCTL Current iuctl.dll version: 5.4.3790.14
2004-07-28 09:22:57 16:22:57 Success IUENGINE Starting
2004-07-28 09:22:57 16:22:57 Success IUENGINE Determining machine configuration
2004-07-28 09:22:57 16:22:57 Success IUENGINE Determining machine configuration
2004-07-28 09:23:00 16:23:00 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:01 16:23:01 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:02 16:23:02 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:07 16:23:07 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:08 16:23:08 Success IUENGINE Determining machine configuration
2004-07-28 09:23:09 16:23:09 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/consumerdrivers/getmanifest.asp
2004-07-28 09:23:51 16:23:51 Success IUENGINE Querying software update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:52 16:23:52 Success IUENGINE Asynchronous Download started
2004-07-28 09:23:52 16:23:52 Success IUENGINE Download destination root folder is: C:\WUTemp
2004-07-28 09:23:59 16:23:59 Success IUENGINE Downloaded file http://download.windowsupdate.com/m...U-express_67a0bec57f33208902e15d3ae1968f9.exe
2004-07-28 09:23:59 16:23:59 Success IUENGINE Local path C:\WUTemp\com_microsoft.840315_W2K_SP5_WinSE_95927_Express\Windows2000-KB840315-x86-ENU-express.exe
2004-07-28 09:23:59 16:23:59 Success IUENGINE Downloaded file http://download.windowsupdate.com/m...U-express_2f310dd9e91121cb09b4de620d7ae33.EXE
...
2004-07-28 09:24:00 16:24:00 Success IUENGINE Local path C:\WUTemp\com_microsoft.839645_W2K_SP5_WinSE_96133_Express\Windows2000-KB839645-x86-ENU-express.exe
2004-07-28 09:24:01 16:24:01 Success IUENGINE See iuhist.xml for details: Download finished
2004-07-28 09:24:01 16:24:01 Success IUENGINE Asynchronous Install started
2004-07-28 09:24:01 16:24:01 Success IUENGINE Asynchronous Install completed startup
2004-07-28 09:24:01 16:24:01 Success IUENGINE Installing SOFTWARE item from publisher com_microsoft
2004-07-28 09:24:01 16:24:01 Success IUENGINE Installer Command Type: EXE
...
2004-07-28 09:24:21 16:24:21 Error IUENGINE See iuhist.xml for details: Install finished (Error 0x8007F004)


Below is an excerpt of the iuhist.xml file for this last attempt via website:

<?xml version="1.0" ?>
- <items xmlns="x-schema:http://schemas.windowsupdate.com/iu/resultschema.xml">
- <itemStatus xmlns="" timestamp="2004-07-28T09:24:21">
- <identity itemID="win2k.windows2000.ver_platform_win32_nt.5.0.x86.en...2195.4.0.com_microsoft.839645_w2k_sp5_winse_96133_express." name="839645_W2K_SP5_WinSE_96133_Express">
<publisherName>com_microsoft</publisherName>
<language>en</language>
</identity>
- <description hidden="0">
- <descriptionText>
<title>Security Update for Windows 2000 (KB839645)</title>
<eula href="/msdownload/update/v3/static/eula/en/eula.htm" />
<details href="http://go.microsoft.com/fwlink/?LinkId=30585" />
</descriptionText>
</description>
- <platform name="ver_platform_win32_nt">
<processorArchitecture>x86</processorArchitecture>
<version major="5" minor="0" build="2195" servicePackMajor="4" servicePackMinor="0" />
</platform>
<downloadStatus value="COMPLETE" />
<downloadPath>C:\WUTemp\com_microsoft.839645_W2K_SP5_WinSE_96133_Express</downloadPath>
<client>IU_Site</client>
<installStatus value="FAILED" needsReboot="0" errorCode="-2146963452" />
</itemStatus>
- <itemStatus xmlns="" timestamp="2004-07-28T09:24:19">
- <identity itemID="win2k.windows2000.ver_platform_win32_nt.5.0.x86.en...2195.4.0.com_microsoft.directx_839643_w2k_9_0." name="DirectX_839643_W2K_9_0">
<publisherName>com_microsoft</publisherName>
<language>en</language>
</identity>
- <description hidden="0">
- <descriptionText>
<title>Security Update for DirectX 9.0 (KB839643)</title>
<eula href="/msdownload/update/v3/static/eula/en/eula.htm" />
<details href="http://go.microsoft.com/fwlink/?LinkId=27992" />
</descriptionText>
</description>
- <platform name="ver_platform_win32_nt">
<processorArchitecture>x86</processorArchitecture>
<version major="5" minor="0" build="2195" servicePackMajor="4" servicePackMinor="0" />
</platform>
<downloadStatus value="COMPLETE" />
<downloadPath>C:\WUTemp\com_microsoft.DirectX_839643_W2K_9_0</downloadPath>
<client>IU_Site</client>
<installStatus value="FAILED" needsReboot="0" errorCode="-2146963452" />

Below is an excerpt of the KB839645.log file for this last attempt via website:

0.170: ================================================================================
0.170: 2004/07/28 09:24:21.116 (local)
0.170: c:\2a9f1fb20ffb27eb1352e2\update\update.exe (version 5.4.15.0)
0.170: Failed To Enable SE_RESTORE_PRIVILEGE
0.170: Setup encountered an error: You do not have permission to update Windows 2000.
Please contact your system administrator.
0.170: You do not have permission to update Windows 2000.
Please contact your system administrator.
0.170: Update.exe extended error code = 0xf004

--

 

[Don Holmes]

Thanks for the reply Alan - I'd run across the "SE_RESTORE_PRIVILEGE " snippets as well. Unfortunately with my "just enough to be dangerous" understanding of this domain there isn't much in these to be helpful... I can't help but think that the fact that a catroot2 folder doesn't exist and that since I can't "get to" the cryptsvc has something to do with the problem. Possibly a corrupted registry entry perhaps? Still searching...

Thx, Don

--


You seem rather knowledgeable, see if this helps:
"Administrators only" error message when you attempt to use the Windows
Update site
http://support.microsoft.com/default.aspx?scid=kb;en-us;316524&Product=wupd

--
Chuck
{Subject renamed to be more accurate}

I have a Gateway 600YGR running Win2K Pro Version 5.0 (build 2195: Service
Pack 4).

For roughly the last two or three months (it appears) the automatic (and
manual, web based) Windows Updates have been failing. I did notice one or
two that worked over the last few months but I believe they were drivers
only. When I run the web update from v4.windowsupdate.microsoft.com the
downloads work however the installations fail. The message on the resulting
"failed to install" webpage is "No Updates Were Installed" and there are no
error codes whatsoever. When I try to do the updates manually or one by one
they all return the error message that "You do not have permission to update
Windows 2000. Please contact your system administrator." I am the system
administrator and have even made myself a domain administrator to try to fix
this problem...

To the best of my knowledge and research there were no security
policies/authorities changed since this last worked. Using secpol.msc
(Local Policies-> User Rights Assignment) I verified that Administrators
(and even my own user account and local machine Administrator) had the
authority to:

Back up files and directories
Manage auditing and security log
Modify firmware environment values
Restore files and directories
Take ownership of files or other objects

It doesn't matter if I login as the Network Administrator, Local
Administrator, or Domain Administrator - same behavior...

I've completely removed the WUTemp directory and have forced recreation of
the WindowsUpdate\V4 directory as well. I do not have a firewall running on
the machine and the network firewall protects dozens of other machines on
which Windows Update works fine... Downloads of the update files are
received fine and security permissions on them are as expected (meaning I
have full control of them). I've turned off all real-time file protection
in Symantec AV just in case there was something strange there but still no
change...

I've search high and low for anything on Microsoft's site and the web in
general for ANYTHING on the message that "You do not have permission to
update Windows 2000" and while I have found a few for XP, I've found nothing
for Win2K. Just in case, I verified all of the dll registrations, MS root
certificate, etc as suggested there to no avail.

When I attempt to run the "repair Windows 2000" feature using the original
CD, (by clicking on the Install Windows 2000 link), I receive the infamous
message "You must be an administrator to run this application". Again, I'm
about as much of an Administrator (authority-wise) as one can be... Note
that when using the "Install Add-On Components" link from the Win2K Pro CD -
I can install/remove components using the Windows Components Wizard
apparently without any issues... (at least none that Windows complains about
where I can see it...)

I sure could use a fresh perspective on this one as it has stumped me
completely... I'll include excerpts from the WindowsUpdate.log file as well
as the iuhist.xml file below... At the bottom I include an excerpt from the
KB839645.log file (one that is failing and representative of all that are
failing) and it has references in it to Update.exe issuing an error code of
0xf004 and indicates something about failing to enable SE_SECURITY_PRIVILEGE
but for the life of me I can't tell why... Thoughts ...


Below is an excerpt of the WindowsUpdate.log file for this last attempt
via website:

2004-07-28 09:22:57 16:22:57 Success IUCTL Starting
2004-07-28 09:22:57 16:22:57 Success IUCTL Downloaded
iuident.cab from http://windowsupdate.microsoft.com/v4/ to C:\Program
Files\WindowsUpdate\V4
2004-07-28 09:22:57 16:22:57 Success IUCTL Current
iuengine.dll version: 5.4.3790.14
2004-07-28 09:22:57 16:22:57 Success IUCTL Current iuctl.dll
version: 5.4.3790.14
2004-07-28 09:22:57 16:22:57 Success IUENGINE Starting
2004-07-28 09:22:57 16:22:57 Success IUENGINE Determining
machine configuration
2004-07-28 09:22:57 16:22:57 Success IUENGINE Determining
machine configuration
2004-07-28 09:23:00 16:23:00 Success IUENGINE Querying software
update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:01 16:23:01 Success IUENGINE Querying software
update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:02 16:23:02 Success IUENGINE Querying software
update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:07 16:23:07 Success IUENGINE Querying software
update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:08 16:23:08 Success IUENGINE Determining
machine configuration
2004-07-28 09:23:09 16:23:09 Success IUENGINE Querying software
update catalog from
https://v4.windowsupdate.microsoft.com/consumerdrivers/getmanifest.asp
2004-07-28 09:23:51 16:23:51 Success IUENGINE Querying software
update catalog from https://v4.windowsupdate.microsoft.com/getmanifest.asp
2004-07-28 09:23:52 16:23:52 Success IUENGINE Asynchronous
Download started
2004-07-28 09:23:52 16:23:52 Success IUENGINE Download
destination root folder is: C:\WUTemp
2004-07-28 09:23:59 16:23:59 Success IUENGINE Downloaded file
http://download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/Wind
ows2000-KB840315-x86-ENU-express_67a0bec57f33208902e15d3ae1968f9.exe
2004-07-28 09:23:59 16:23:59 Success IUENGINE Local path
C:\WUTemp\com_microsoft.840315_W2K_SP5_WinSE_95927_Express\Windows2000-KB840
315-x86-ENU-express.exe
2004-07-28 09:23:59 16:23:59 Success IUENGINE Downloaded file
http://download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/Wind
ows2000-KB842526-x86-ENU-express_2f310dd9e91121cb09b4de620d7ae33.EXE
...
2004-07-28 09:24:00 16:24:00 Success IUENGINE Local path
C:\WUTemp\com_microsoft.839645_W2K_SP5_WinSE_96133_Express\Windows2000-KB839
645-x86-ENU-express.exe
2004-07-28 09:24:01 16:24:01 Success IUENGINE See iuhist.xml
for details: Download finished
2004-07-28 09:24:01 16:24:01 Success IUENGINE Asynchronous
Install started
2004-07-28 09:24:01 16:24:01 Success IUENGINE Asynchronous
Install completed startup
2004-07-28 09:24:01 16:24:01 Success IUENGINE Installing
SOFTWARE item from publisher com_microsoft
2004-07-28 09:24:01 16:24:01 Success IUENGINE Installer Command
Type: EXE
...
2004-07-28 09:24:21 16:24:21 Error IUENGINE See iuhist.xml
for details: Install finished (Error 0x8007F004)


Below is an excerpt of the iuhist.xml file for this last attempt via
website:

<?xml version="1.0" ?>
- <items
xmlns="x-schema:http://schemas.windowsupdate.com/iu/resultschema.xml">
- <itemStatus xmlns="" timestamp="2004-07-28T09:24:21">
- <identity
itemID="win2k.windows2000.ver_platform_win32_nt.5.0.x86.en...2195.4.0.com_mi
crosoft.839645_w2k_sp5_winse_96133_express."
name="839645_W2K_SP5_WinSE_96133_Express">
<publisherName>com_microsoft</publisherName>
<language>en</language>
</identity>
- <description hidden="0">
- <descriptionText>
<title>Security Update for Windows 2000 (KB839645)</title>
<eula href="/msdownload/update/v3/static/eula/en/eula.htm" />
<details href="http://go.microsoft.com/fwlink/?LinkId=30585" />
</descriptionText>
</description>
- <platform name="ver_platform_win32_nt">
<processorArchitecture>x86</processorArchitecture>
<version major="5" minor="0" build="2195" servicePackMajor="4"
servicePackMinor="0" />
</platform>
<downloadStatus value="COMPLETE" />
<downloadPath>C:\WUTemp\com_microsoft.839645_W2K_SP5_WinSE_96133_Express
</downloadPath>
<client>IU_Site</client>
<installStatus value="FAILED" needsReboot="0" errorCode="-2146963452" />
</itemStatus>
- <itemStatus xmlns="" timestamp="2004-07-28T09:24:19">
- <identity
itemID="win2k.windows2000.ver_platform_win32_nt.5.0.x86.en...2195.4.0.com_mi
crosoft.directx_839643_w2k_9_0." name="DirectX_839643_W2K_9_0">
<publisherName>com_microsoft</publisherName>
<language>en</language>
</identity>
- <description hidden="0">
- <descriptionText>
<title>Security Update for DirectX 9.0 (KB839643)</title>
<eula href="/msdownload/update/v3/static/eula/en/eula.htm" />
<details href="http://go.microsoft.com/fwlink/?LinkId=27992" />
</descriptionText>
</description>
- <platform name="ver_platform_win32_nt">
<processorArchitecture>x86</processorArchitecture>
<version major="5" minor="0" build="2195" servicePackMajor="4"
servicePackMinor="0" />
</platform>
<downloadStatus value="COMPLETE" />
<downloadPath>C:\WUTemp\com_microsoft.DirectX_839643_W2K_9_0</downloadPa
th>
<client>IU_Site</client>
<installStatus value="FAILED" needsReboot="0" errorCode="-2146963452" />

Below is an excerpt of the KB839645.log file for this last attempt via
website:

0.170:
============================================================================
====
0.170: 2004/07/28 09:24:21.116 (local)
0.170: c:\2a9f1fb20ffb27eb1352e2\update\update.exe (version 5.4.15.0)
0.170: Failed To Enable SE_RESTORE_PRIVILEGE
0.170: Setup encountered an error: You do not have permission to update
Windows 2000.
Please contact your system administrator.
0.170: You do not have permission to update Windows 2000.
Please contact your system administrator.
0.170: Update.exe extended error code = 0xf004

--

Not much on Google for SE_RESTORE_PRIVILEGE

http://www.osronline.com/lists_archive/ntfsd/thread2032.html
Molly Brown of Microsoft
http://python.active-venture.com/lib/module--winreg.html
A call to LoadKey() fails if the calling process does not have
the SE_RESTORE_PRIVILEGE privilege. Note that privileges are
different than permissions - see the Win32 documentation for
more details.
http://www.talkaboutsoftware.com/group/microsoft.public.windowsxp.security_a
dmin/search.html?q=SE_RESTORE_PRIVILEGE&Submit.x=14&Submit.y=13

 

[Alan Illeman]

Thanks for the reply Alan - I'd run across the "SE_RESTORE_PRIVILEGE "
snippets as well. Unfortunately with my "just enough to be dangerous"
understanding of this domain there isn't much in these to be helpful... I
can't help but think that the fact that a catroot2 folder doesn't exist and
that since I can't "get to" the cryptsvc has something to do with the
problem. Possibly a corrupted registry entry perhaps? Still searching...

Thx, Don

This is offered as a solution:
<http://www.google.ca/search?q=cache:eQbB1uR9Z68J:www.usenetarchive.org/Dir1
8/File283.html++%22SE_RESTORE_PRIVILEGE%22&hl=en&ie=UTF-8>
(www.usenetarchive.org/Dir18/File283.html )
<quote>
It has nothing to do with security!
I had this problem on a Windows Server 2003 box, so you 95, 98 and
ME users may not be able to do this. XP and all 2000 users should
have no probs.
1.Click start, then run
2.Type in gpedit.msc
3.In the left side, click Computer Configuration, Windows Settings,
Security Settings, Software Restriction Policies.
4.In the right side, double click Trusted Publishers
5.Make sure the top radio button says End Users'
6. Click OK and close gpedit
7. Try Windows Update again. You may have to do some of the
other fixes presented on this site after that, but this should cure the
problem!
</quote>

Maybe worth a try.

 

[Don Holmes]

Thanks again Alan - unfortunately when I attempt to follow the recommended steps using gpedit.msc I run into a wall at step three in that this version does not have a "software restriction policies" item under computer configuration:windows settings:security settings. In fact, it doesn't have it at all... I expanded all items under both Computer Configuration and User Configuration... Perhaps it doesn't work on Win2K?

Thx, Don

--


Thanks for the reply Alan - I'd run across the "SE_RESTORE_PRIVILEGE "
snippets as well. Unfortunately with my "just enough to be dangerous"
understanding of this domain there isn't much in these to be helpful... I
can't help but think that the fact that a catroot2 folder doesn't exist and
that since I can't "get to" the cryptsvc has something to do with the
problem. Possibly a corrupted registry entry perhaps? Still searching...

Thx, Don

This is offered as a solution:
<http://www.google.ca/search?q=cache:eQbB1uR9Z68J:www.usenetarchive.org/Dir1
8/File283.html++%22SE_RESTORE_PRIVILEGE%22&hl=en&ie=UTF-8>
(www.usenetarchive.org/Dir18/File283.html )
<quote>
It has nothing to do with security!
I had this problem on a Windows Server 2003 box, so you 95, 98 and
ME users may not be able to do this. XP and all 2000 users should
have no probs.
1.Click start, then run
2.Type in gpedit.msc
3.In the left side, click Computer Configuration, Windows Settings,
Security Settings, Software Restriction Policies.
4.In the right side, double click Trusted Publishers
5.Make sure the top radio button says End Users'
6. Click OK and close gpedit
7. Try Windows Update again. You may have to do some of the
other fixes presented on this site after that, but this should cure the
problem!
</quote>

Maybe worth a try.

 

[Alan Illeman]

Thanks again Alan - unfortunately when I attempt to follow the recommended
steps using gpedit.msc I run into a wall at step three in that this version
does not have a "software restriction policies" item under computer
configuration:windows settings:security settings. In fact, it doesn't have
it at all... I expanded all items under both Computer Configuration and
User Configuration... Perhaps it doesn't work on Win2K?

Thx, Don

Yes you're right (I should have tried it). Under Local Policies
=>Security Options, there is "Audit use of Backup and Restore
privilege" - which on my system (single user, no network,
Win2K Pro, SP4) is "Disabled"

That's the nearest I could find to SE_RESTORE_PRIVILEDGE
but maybe it only audits that condition. What we really need is
an MVP in this conversation ;-)

Alan