Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

837272 & 839643 Updates won't install on W2K SP4 domain PCs - Permission Error

7 views
Skip to first unread message

John C. Verbosky

unread,
Jun 9, 2004, 10:41:29 AM6/9/04
to
Hi, I'm running into issues installing the latest Windows
2000 Updates, Update for Windows Media Player 9 Series
(KB837272) and Security Update for DirectX 7.0 (KB839643),
on a number of Windows 2000 SP4 PCs joined to our domain.
If users attempt installing the updates from the Windows
Updates website, the updates are downloaded but the
installation fails. I have downloaded each update manually
from the Microsoft Download Center, but when I try to
install manually (logged in as the local administrator and
as a user in the local administrator group) I get "You do
not have permission to update Windows 2000.Please contact
your system administrator". Same error after using
REGEDT32 to give the Everyone group full permissions to
HKLM\Software\Microsoft\Windows\Current Version\Windows
Update & HKLM\Software\Microsoft\Updates registry keys
(something I had to do to get a WinXP update to apply). I
have also tried disjoining a PC from the domain, joining
it to a workgroup and installing the updates logged in as
the local admin, but I'm still getting the same
permissions error. This is affecting approximately 1/4 of
the users in my company, so any other ideas to try would
be greatly appreciated.

Thanks!

John

Lucy [MSFT]

unread,
Jun 9, 2004, 11:16:27 AM6/9/04
to
Hi John,


Can you please some log information. We need to look at both the Windows
Update.log and KB839643.log or KB837272.log file.

To view the file:

Copy and paste "%windir%\windows update.log" (w/o the quotes)
into the Internet Explorer address bar and hit Enter.
Scroll down to the current date and look for the error being reported.
Please post the last 20 lines from the Windows Update.log file

The KB log files are located in the C:\winnt directory.


--
Thanks,
Lucy [MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights.


"John C. Verbosky" <john.v...@rescoproducts.com> wrote in message
news:242a01c44e2f$d9938650$3a01...@phx.gbl...

John C. Verbosky

unread,
Jun 9, 2004, 12:26:36 PM6/9/04
to
Hi Lucy,

Here are the last sections of the 837272 & 839643 logs, as
well as the last 20 lines from the Windows Update.log
file, as requested.

Thanks again!

John

KB837272.log

2.884:
===========================================================
=====================
2.964: 2004/06/09 10:00:22.000 (local)
3.455:
c:\e751be11136300a5303003f14d0c7caa\update\update.exe
(version 5.4.15.0)
3.455: Failed To Enable SE_BACKUP_PRIVILEGE
3.565: Setup encountered an error: You do not have

permission to update Windows 2000.
Please contact your system administrator.

3.675: You do not have permission to update Windows 2000.


Please contact your system administrator.

7.341: Message displayed to the user: You do not have

permission to update Windows 2000.
Please contact your system administrator.

7.341: User Input: OK
7.341: Update.exe extended error code = 0xf004
7.341: Update.exe return code was masked to 0x643 for MSI
custom action compliance.


KB839643-DirectX9.log

0.311:
===========================================================
=====================
0.311: 2004/06/09 08:08:07.293 (local)
0.341: c:\fd21ab875861fb4a786deb2a1ae5\update\update.exe
(version 6.1.1.0)
0.341: Failed To Enable SE_BACKUP_PRIVILEGE
0.361: Setup encountered an error: You do not have

permission to update Windows 2000.
Please contact your system administrator.

0.371: You do not have permission to update Windows 2000.


Please contact your system administrator.

5.638: Message displayed to the user: You do not have

permission to update Windows 2000.
Please contact your system administrator.

5.638: User Input: OK
5.638: Update.exe extended error code = 0xf004
5.638: Update.exe return code was masked to 0x643 for MSI
custom action compliance.


Windows Update log

2004-06-09 09:51:12 13:51:12 Success IUENGINE
Shutting down
2004-06-09 09:51:12 13:51:12 Success IUCTL
Shutting down
2004-06-09 09:59:16 13:59:16 Success IUCTL
Starting
2004-06-09 09:59:42 13:59:42 Success IUCTL
Downloaded iuident.cab from
http://www.windowsupdate.com/v4/ to C:\Program
Files\WindowsUpdate\V4
2004-06-09 09:59:47 13:59:47 Success IUCTL
Checking to see if new version of Windows Update software
available
2004-06-09 09:59:48 13:59:48 Success IUENGINE
Starting
2004-06-09 09:59:48 13:59:48 Success IUENGINE
Determining machine configuration
2004-06-09 09:59:53 13:59:53 Success IUENGINE
Querying software update catalog from
https://v4.windowsupdate.microsoft.com/autoupdate/getmanife
st.asp
2004-06-09 09:59:53 13:59:53 Success IUENGINE
Determining machine configuration
2004-06-09 09:59:54 13:59:54 Success IUENGINE
Querying software update catalog from
https://v4.windowsupdate.microsoft.com/autoupdate/getmanife
st.asp
2004-06-09 09:59:54 13:59:54 Success IUENGINE
Determining machine configuration
2004-06-09 09:59:56 13:59:56 Success IUENGINE
Querying software update catalog from
https://v4.windowsupdate.microsoft.com/autoupdate/getmanife
st.asp
2004-06-09 10:00:26 14:00:26 Success IUENGINE
Determining machine configuration
2004-06-09 10:00:26 14:00:26 Success IUENGINE
Querying software update catalog from
https://v4.windowsupdate.microsoft.com/autoupdate/getmanife
st.asp
2004-06-09 10:00:28 14:00:28 Success IUENGINE
Shutting down
2004-06-09 10:00:28 14:00:28 Success IUCTL
Shutting down
2004-06-09 10:22:56 14:22:56 Success CDM
Starting
2004-06-09 10:22:56 14:22:56 Success CDM
Shutting down
2004-06-09 10:26:46 14:26:46 Success CDM
Starting
2004-06-09 10:26:46 14:26:46 Success CDM
Shutting down

Here is the output from

>.
>

Lucy [MSFT]

unread,
Jun 9, 2004, 7:29:41 PM6/9/04
to
John,

Check the permissions on the Back up files and directories policy from
Domain, verify the administrators have permissions, then update the policy.

Default domain policy \ computer configuration\Windows Settings\local
policies\User

Rights Assignment\Back up files and directories


--
Thanks,
Lucy [MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights.


"John C. Verbosky" <john.v...@rescoproducts.com> wrote in message

news:1a00901c44e3e$88bf8c10$a601...@phx.gbl...

John C. Verbosky

unread,
Jun 10, 2004, 9:41:04 AM6/10/04
to
Lucy,

Our systems admin checked the policy and everything was
already set per your specifications. All administrators
and backup operators have permissions in this policy, but
we are still unable to apply these updates. Do you have
any other ideas?

Thanks,

John

>.
>

me

unread,
Jun 10, 2004, 2:45:03 PM6/10/04
to
Lucy,

I have the same problem and the log looks like:
2004-06-10 11:54:02 15:54:02 Error IUENGINE See iuhist.xml for details: Install finished (Error 0x8007F004)

and:

0.070: ================================================================================
0.070: 2004/06/10 11:47:41.962 (local)
0.070: c:\67f6d0e3a67f44e9ec77e80795a92423\update\update.exe (version 5.4.15.0)
0.080: Failed To Enable SE_BACKUP_PRIVILEGE
0.080: Setup encountered an error: You do not have permission to update Windows 2000.


Please contact your system administrator.

0.090: You do not have permission to update Windows 2000.


Please contact your system administrator.

4.166: Message displayed to the user: You do not have permission to update Windows 2000.


Please contact your system administrator.

4.166: User Input: OK
4.166: Update.exe extended error code = 0xf004
4.166: Update.exe return code was masked to 0x643 for MSI custom action compliance.
0.080: ================================================================================
0.080: 2004/06/10 11:54:40.042 (local)
0.080: c:\46ed8654279284f41471269a66443f\update\update.exe (version 5.4.15.0)
0.080: Failed To Enable SE_BACKUP_PRIVILEGE
0.080: Setup encountered an error: You do not have permission to update Windows 2000.


Please contact your system administrator.

0.080: You do not have permission to update Windows 2000.


Please contact your system administrator.

8.332: Message displayed to the user: You do not have permission to update Windows 2000.


Please contact your system administrator.

8.332: User Input: OK
8.332: Update.exe extended error code = 0xf004
8.332: Update.exe return code was masked to 0x643 for MSI custom action compliance.

anon...@discussions.microsoft.com

unread,
Jun 10, 2004, 2:58:21 PM6/10/04
to
Lucy,

One point I should stress again is that being joined to
the domain or not doesn't appear to make a difference.
When I disjoined one of the workstations from the domain
(which should have dropped the domain policies as well),
the updates would still not install. Is there a local
policy that I can check? Any other ideas?

Thanks,

John

>.
>

Lucy [MSFT]

unread,
Jun 10, 2004, 3:04:20 PM6/10/04
to
John,

It looks like to me there's a security policy that is preventing the
install. I highly recommend posting on OS specific newsgroups for possible
suggestions or you can contact support.

Here's the link to all newsgroups:
http://communities.microsoft.com/newsgroups/default.asp?icp=mscom


--
Thanks,
Lucy [MSFT]

This posting is provided "AS IS" with no warranties, and confers no rights.


"John C. Verbosky" <john.v...@rescoproducts.com> wrote in message

news:1aaee01c44ef0$93929030$a501...@phx.gbl...

me

unread,
Jun 11, 2004, 8:35:01 AM6/11/04
to
Found it... Start->Settings->Control Panel->Administrative Tools->Local Security Policy->Local Policy->User Rights Assignment->Back up files and directories

here you can add groups or accounts
i restarted and the updates installed w/ no problems!

Later,
Al

John C. Verbosky

unread,
Jun 11, 2004, 11:55:32 AM6/11/04
to

Lucy,

I found a fix for this issue. I had to add the local
admin account (and domain user account for the user to be
able to apply the update) to the local Backup Operators
group and reboot, then the updates installed smoothly.

I tried Al's suggestion to give the account permissions to
Back up files and directors and also tried giving
permissions to Restore files, but these left me with the
same error.

Anyways, the updates are working on the PCs that wouldn't
take them previously. You might want to pass this along
so that future updates won't require membership in the
local Backup Operators group to apply.

Thanks,

John

>-----Original Message-----
>John,
>

>.
>

ADD permission-USER RIGHTS ASSIGNM@discussions.microsoft.com Can't ADD permission-USER RIGHTS ASSIGNM

unread,
Jul 28, 2004, 10:30:05 AM7/28/04
to
I went to this area to change the user rights assignment but when I try to "ADD" permissions for Administrators.....nothing happens. When I click the "ADD" button I done't get the pop-up screen with the list of groups and users. How do I fix this????

Dawn

0 new messages