BITS 2.0 Install Fails - Permission problem
Dave
Everytime I attempt to install KB842773 (BITS 2.0) update, I get the error
that it fails and the error code 0x8007F004.
SP2 also fails with a similar code (F004) and states that I don't have
permission to update the computer.
I've used Windows update sucessfully in the past and my domain account is in
the local administrators group. Even the local administrator account logged
on locally fails.
Is my domain admin responsible, he claims he's not? Is is some sort of
policy issue? I can't find any reference to the 8007F004 error.
Thanks
Dave
[KB842773.log]
1.453:
================================================================================
1.453: 2004/07/27 15:18:11.516 (local)
1.453: c:\a945e126824708d34bae\update\update.exe (version 5.4.15.0)
1.453: Failed To Enable SE_SECURITY_PRIVILEGE
1.493: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
1.493: You do not have permission to update Windows XP.
Please contact your system administrator.
1.493: Update.exe extended error code = 0xf004
10.906:
================================================================================
10.906: 2004/09/17 09:05:45.099 (local)
10.906:
C:\Windows\SoftwareDistribution\Download\62f994895b2e7156099353faaa0580c0\update\update.exe (version 5.4.15.0)
10.906: Failed To Enable SE_SHUTDOWN_PRIVILEGE
10.906: Failed To Enable SE_SECURITY_PRIVILEGE
10.946: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
10.946: You do not have permission to update Windows XP.
Please contact your system administrator.
10.946: Update.exe extended error code = 0xf004
3.615:
================================================================================
3.656: 2004/09/17 09:34:04.538 (local)
3.686:
C:\Windows\SoftwareDistribution\Download\62f994895b2e7156099353faaa0580c0\update\update.exe (version 5.4.15.0)
3.686: Failed To Enable SE_SHUTDOWN_PRIVILEGE
3.686: Failed To Enable SE_SECURITY_PRIVILEGE
3.696: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
3.756: You do not have permission to update Windows XP.
Please contact your system administrator.
3.756: Update.exe extended error code = 0xf004
3.896:
================================================================================
3.906: 2004/09/17 17:23:17.184 (local)
3.906:
C:\Windows\SoftwareDistribution\Download\62f994895b2e7156099353faaa0580c0\update\update.exe (version 5.4.15.0)
3.906: Failed To Enable SE_SHUTDOWN_PRIVILEGE
3.906: Failed To Enable SE_SECURITY_PRIVILEGE
3.926: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
3.926: You do not have permission to update Windows XP.
Please contact your system administrator.
3.926: Update.exe extended error code = 0xf004
1.472:
================================================================================
1.472: 2004/09/17 17:28:36.994 (local)
1.472: c:\8132d49b8867919aab66\update\update.exe (version 5.4.15.0)
1.472: Failed To Enable SE_SECURITY_PRIVILEGE
1.482: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
1.482: You do not have permission to update Windows XP.
Please contact your system administrator.
4.437: Message displayed to the user: You do not have permission to update
Windows XP.
Please contact your system administrator.
4.437: User Input: OK
4.437: Update.exe extended error code = 0xf004
4.437: Update.exe return code was masked to 0x643 for MSI custom action
compliance.
0.992:
================================================================================
0.992: 2004/09/17 17:34:32.459 (local)
0.992: c:\4859a419e045be3dea\update\update.exe (version 5.4.15.0)
0.992: Failed To Enable SE_SECURITY_PRIVILEGE
1.002: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
1.002: You do not have permission to update Windows XP.
Please contact your system administrator.
4.667: Message displayed to the user: You do not have permission to update
Windows XP.
Please contact your system administrator.
4.667: User Input: OK
4.667: Update.exe extended error code = 0xf004
4.667: Update.exe return code was masked to 0x643 for MSI custom action
compliance.
0.932:
================================================================================
0.932: 2004/09/17 17:34:56.784 (local)
0.932:
C:\Windows\SoftwareDistribution\Download\62f994895b2e7156099353faaa0580c0\update\update.exe (version 5.4.15.0)
0.932: Failed To Enable SE_SHUTDOWN_PRIVILEGE
0.932: Failed To Enable SE_SECURITY_PRIVILEGE
0.932: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
0.932: You do not have permission to update Windows XP.
Please contact your system administrator.
0.932: Update.exe extended error code = 0xf004
1.011:
================================================================================
1.011: 2004/09/17 17:40:23.381 (local)
1.011: c:\689953cbe55ecd08ba\update\update.exe (version 5.4.15.0)
1.011: Failed To Enable SE_SECURITY_PRIVILEGE
1.011: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
1.011: You do not have permission to update Windows XP.
Please contact your system administrator.
3.775: Message displayed to the user: You do not have permission to update
Windows XP.
Please contact your system administrator.
3.775: User Input: OK
3.775: Update.exe extended error code = 0xf004
3.775: Update.exe return code was masked to 0x643 for MSI custom action
compliance.
0.941:
================================================================================
0.941: 2004/09/17 17:50:12.990 (local)
0.941:
C:\Windows\SoftwareDistribution\Download\62f994895b2e7156099353faaa0580c0\update\update.exe (version 5.4.15.0)
0.941: Failed To Enable SE_SHUTDOWN_PRIVILEGE
0.941: Failed To Enable SE_SECURITY_PRIVILEGE
0.941: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
0.941: You do not have permission to update Windows XP.
Please contact your system administrator.
0.941: Update.exe extended error code = 0xf004
3.465:
================================================================================
3.495: 2004/09/20 08:45:15.820 (local)
3.495:
C:\Windows\SoftwareDistribution\Download\62f994895b2e7156099353faaa0580c0\update\update.exe (version 5.4.15.0)
3.495: Failed To Enable SE_SHUTDOWN_PRIVILEGE
3.495: Failed To Enable SE_SECURITY_PRIVILEGE
3.495: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
3.495: You do not have permission to update Windows XP.
Please contact your system administrator.
3.495: Update.exe extended error code = 0xf004
1.062:
================================================================================
1.062: 2004/09/20 09:20:53.212 (local)
1.062:
C:\Windows\SoftwareDistribution\Download\62f994895b2e7156099353faaa0580c0\update\update.exe (version 5.4.15.0)
1.062: Failed To Enable SE_SHUTDOWN_PRIVILEGE
1.062: Failed To Enable SE_SECURITY_PRIVILEGE
1.062: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
1.062: You do not have permission to update Windows XP.
Please contact your system administrator.
1.062: Update.exe extended error code = 0xf004
1.131:
================================================================================
1.131: 2004/09/20 09:22:30.220 (local)
1.131:
C:\Windows\SoftwareDistribution\Download\62f994895b2e7156099353faaa0580c0\update\update.exe (version 5.4.15.0)
1.131: Failed To Enable SE_SHUTDOWN_PRIVILEGE
1.131: Failed To Enable SE_SECURITY_PRIVILEGE
1.131: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
1.131: You do not have permission to update Windows XP.
Please contact your system administrator.
1.131: Update.exe extended error code = 0xf004
1.092:
================================================================================
1.092: 2004/09/20 09:24:19.846 (local)
1.092:
C:\Windows\SoftwareDistribution\Download\62f994895b2e7156099353faaa0580c0\update\update.exe (version 5.4.15.0)
1.092: Failed To Enable SE_SHUTDOWN_PRIVILEGE
1.092: Failed To Enable SE_SECURITY_PRIVILEGE
1.092: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
1.092: You do not have permission to update Windows XP.
Please contact your system administrator.
1.092: Update.exe extended error code = 0xf004
1.402:
================================================================================
1.432: 2004/09/20 09:31:30.052 (local)
1.432:
C:\Windows\SoftwareDistribution\Download\62f994895b2e7156099353faaa0580c0\update\update.exe (version 5.4.15.0)
1.432: Failed To Enable SE_SHUTDOWN_PRIVILEGE
1.432: Failed To Enable SE_SECURITY_PRIVILEGE
1.432: Setup encountered an error: You do not have permission to update
Windows XP.
Please contact your system administrator.
1.432: You do not have permission to update Windows XP.
Please contact your system administrator.
1.432: Update.exe extended error code = 0xf004
Robert Aldwinckle
news:957A95C1-3AA2-403B...@microsoft.com...
> Hi,
>
> Everytime I attempt to install KB842773 (BITS 2.0) update, I get the error
> that it fails and the error code 0x8007F004.
Please specify how you are doing your update, using AU, WU
or doing it manually. I suspect that only by doing it manually
can you guarantee that all of the procedure is going to be run under
your local account.
To test this idea you could use FileMon and monitor the log file
or the subdirectory where the install is going to go. Highlight WRITE.
Then notice the PID of the process doing the write. Check the account
that that PID is running under using Task Manager. If it isn't being done
under your account you would have to change your assumptions and
start considering the permissions of the account that was doing it.
BTW my standard Google Groups search shows that this symptom
has been a problem with V4 too and so far seems to be unresolved.
(Google Groups search for
8007F004 OR 0x8007F004 MSFT OR MVP group:microsoft.*
)
Good luck
Robert Aldwinckle
---
Gijs
Bits Friend
"Dave" <Da...@discussions.microsoft.com> wrote in message news:<957A95C1-3AA2-403B...@microsoft.com>...
Narayana Mahankali [MSFT]
can be verified by launching the "Local Security Settings" policy editor.
Type the following command to launch this editor:
secpol.msc
Go to "SecPol.msc > Local Policies > User Rights Assignment"
The following permissions are required:
1. Back up files and directories
2. Debug programs
3. Restore files and directories
4. Manage auditing and security log
5. Take ownership of files or other objects
If after enabling these permissions you still cannot install the update then
post the contents of the file %windir%\KB842773.log.
--
Narayana Mahankali
Microsoft, BITS
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Bits Friend" <bits_...@hotmail.com> wrote in message
news:9b36214e.04092...@posting.google.com...
Michel Guillet
cannot change the permissions as suggested (they are greyed out in the
"Local Security Settings" policy editor). I have been able to use WU
until last June, after which all attempts to install new updates
failed. I have gone through all threads discussing this issue, but no
suggestion has solved the issue so far, mostly I guess because of this
permission issue.
Any idea on what might be causing this and a solution besides
reformatting the computer would be highly appreciated. Note that I use
XP Pro but I don't connect to a domain (only workgroup).
Michel
"Narayana Mahankali [MSFT]" <nara...@online.microsoft.com> wrote in message news:<u4KDiZCp...@TK2MSFTNGP15.phx.gbl>...
Narayana Mahankali [MSFT]
the problem:
%windir%\KB842773.log
%windir%\bitssetup.log
%windir%\setupapi.log
%windir% is usually c:\windows but might differ on your machine depending on
how you installed the OS.
You can send these files directly to me at "narayanm at microsoft.com"
You don't have to reformat the computer to fix this problem.
--
Narayana Mahankali
Microsoft, BITS
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Michel Guillet" <michel....@m4x.org> wrote in message
news:62743c8b.0410...@posting.google.com...
Ben Askew
back and checked. The "manage auditing and security log" item has been
changed to only allow Exchange Enterprise Servers. The Administrator is not
in the list for this item. This explains why I am not able to view the
Security Event Log on my W2K server (which is an AD domain controller also).
I would love to figure out how to add the Administrator to this list but that
option is greyed out in the Local Policy screen. I've managed to change it
somewhere else (domain controller policy, perhaps?) but it keeps changing
back to just the single entry of Exchange Enterprise Servers.
Does this shed any light?
Thanks again,
Ben Askew
Houston, TX
Ben Askew
same problems on an SBS2003 Server and a W2K Advanced Server. The update
failures occur whether I'm logged in locally as the Administrator, using
Terminal Services and logging in the same way, manually running Windows
Update or simply attempting to install updates that are automatically
downloaded.
I would be happy to send files to you if that would help. Just let me know
which ones you'd like and I'll get them to you.
Many thanks,
Ben Askew
Houston, TX
Amit
I just opened up a brand new Dell computer out of the box. Joined it to the
domain and then logged in as local admin and tried to do the windowsupdate.
And I get the same problem: Error Code: 8007F004 when installing the BITS
2.0 and HTTP5.1
I have checked the local policy as you suggested and here is what I found:
On # 5. Take ownership of files or other objects, local admin is not in
there. Instead I have domain\domain admins and the box is greyed out. Can't
do anything. I logged in as domain admin thinking that I can add local admin
group. But still no dice.
Seems, many folks have this issue. I will end up re-doing the OS, even
though this is a brand new PC out of the box.
Thanx
A
Technocrat
domain admin & enterprise admin. Changing the local security settings as
suggested above did not help either. I'm doing this on a newly formated pc
with W2K but have users with XP who cannot get the updates to patch the
security holes. Please inform me of the solution.
Thanx.
Jeff Roberts [MSFT]
don't think that even a domain admin can override it by editing the local
user-rights policy...it would need to be done in the domain policy.
--
This posting is provided "AS IS" with no warranties, and confers no rights.
"Amit" <Am...@discussions.microsoft.com> wrote in message
news:703167D0-EDE0-4F30...@microsoft.com...
Technocrat
occuring.
This seems to be a fairly common problem now. Has MS been able to recreate
it and develop the exact changes that need to be made to allow the automatic
updates to run?
Also on a related note, we found that the our XP machines can no longer
perform system restore citing insufficient security privleges.
Thanx.
Jeff Roberts [MSFT]
required for System Restore to work.
. Manage auditing and security log
. Take ownership of files or other objects
. Shut down the system
. Back up files and directories
. Restore files and directories
I would recommend that you double-check your domain policy to be sure that
the proper users have these rights as well as the ones that Narayana listed.
Jeff
--
This posting is provided "AS IS" with no warranties, and confers no rights.
"Technocrat" <Techn...@discussions.microsoft.com> wrote in message
news:10D0EF96-CC4B-4A09...@microsoft.com...
Jas
DOMAIN CONTROLLER that was the problem.
It seems Exchange Server changed permissions on the "Manage Auditing and
Security Log" policy located under Computer configuration - Windows settings
- Security settings - Local policies - User rights assignments
It added Exchange Enterprise Servers to the policy, but there is no
Administrator permissions set. Naturally, all the workstations on the domain
were picking up this policy and could not be overidden at the workstation.
I added "Administrators" to the permissions and forced a policy refresh on
the workstations (you will need to reboot after this).
Once i logged on to the workstation with admin rights i could complete all
my updates and it fixed a problem i was having with the system restore not
functioning due to permission errors.
I am not sure why or when the permissions were changed, but it seems to be a
common problem.
Amit
you were correct. I checked my domain policy and that setting on my domain
policy only allowed the domain admins/enterprise admins the "Take ownership
of files or other objects".
Funny thing is, my account is domain admin/enterprise admin, so if I login
to the computer, theoritically, I should be able to update without any
problems. But that wasn't so.
In the domain policy, I had to undo the definition of that policy. I
basically put it back to "Not defined" by removing the domain
admins/enterprise admins.
This worked.
I could have just put "administrators" in it and it should have worked but
better safe then sorry.
Thank You.
Amit
Matt
In my case it was a group policy that was interfering with the updates.
The computer I was trying to update was in an OU that had a GP setting to
auto download Windows updates from one of the servers on our network. The
policy was in Computer Configuration>Administrative Templates> Windows
Components/Windows Updates>.
The name of the policy in that container was "Specify intranet Microsoft
update service location" and it was set to enabled and was pointing to one of
our servers on our local intranet.
To fix the problem I moved the computer that I was trying to install on to a
OU that had no Group Policy and the updates went fine after that.
So in short, you may want to have a look at your domain Group Policy not
your local.
CTMV
http://v5.windowsupdate.microsoft.com/v5consumer/showarticle.aspx?articleid=10&1n=en