Software Update service will not start

[Monte Seifers]

I have SUS installed on the AD Domain Controller and it
ran OK prior to 10/7/03 according to logs on client
machines. Sometime since then (I don't know of any change
that would have affected it) the service "Software
Updates" will not start on the SUS server nor the client
machines.
On the client machines, the message window says that "The
Automatic Updates service on Local Computer started and
then stopped. Some services stop automatically if they
have no work to do, for example, the Preformance Logs and
Alerts service."
On the SUS server the message window says "Could not
start the Automatic Updates service on Local Computer.
The service did not return an error. This could be an
internal Windows error or and internal service
error. ...."
I've checked all GP Objects and they appear OK. On client
machines, the Automatic Updates window is greyed out.

 

[Monte Seifers]

When I drilled down in
\windows\security\logs\winlogon.log on a client machine,
I discovered that under "Configure wuauserv" I was
getting the "Warning 5: Access is denied." message. When
I went to the Group Policy and navigated to Computer
Configuration\Windows Settings\Security Settings\System
Services and checked on Automatic Update service security
I found that full control was not granted to System and
Administrators. After I changed these settings and forced
replication to client machines with gpupdate, the
Automatic Update service would start and seems now to
work fine. I am at a loss as to how the security settings
in System Services for this was changed.