Update Rollup 1 for Windows 2000 SP4 - Access Denied Error

I am trying to run Update Rollup 1 for Windows 2000 SP4 on my servers. Each
time I run it it gets as far as "updating registry" and then it pops open a
window that says "Access Denied" and uninstalls itself. I have looked at the
install logs and it seems to be failing when it trys to write to the
registry. Here is snippet from the log:

49.063: Num Ticks for Copying files : 30391
49.407: DoRegistryUpdates:UpdSpInstallFromInfSection Failed for
ProductInstall.GlobalRegistryChanges.Install error: 0x5
49.407: INF_REGISTRY Failed
49.407: DoInstallationoRegistryUpdates failed
49.407: Failed Deleting C:\WINNT\system32\msiinst.tmp 2
49.453: VerifySize: Unable to verify size: Source = NULL: c:\winnt\oem31.cat
49.641: Access is denied.
53.032: Message displayed to the user: Access is denied.
53.032: User Input: OK
53.032: Update Rollup 1 installation did not complete.

Select 'OK' to undo the changes that have been made.
54.313: Message displayed to the user: Update Rollup 1 installation did not
complete.

Select 'OK' to undo the changes that have been made.
54.313: User Input: OK
54.313: Starting process:
C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\sp uninst.exe /~ -u -z
82.719: Software Update Rollback has completed with return code 0xbc2. This
rollback requires a reboot.
82.719: Update Rollup 1 installation did not complete.

If I check the setupapi.log, it does not report anything until it tries to
uninstall and then logs the following:

[2005/12/12 13:30:43 3944.1]
Munged cmdline: C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\sp uninst.exe
/~ -u -z
EXE name: C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\sp uninst.exe
@ 13:30:43.578 : Opened INF
"C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\s puninst.inf".
[2005/12/12 13:30:45 3948.1]
Munged cmdline: C:\WINNT\system32\regsvr32.exe /s /u
C:\WINNT\system32\winhttp.dll
EXE name: C:\WINNT\system32\regsvr32.exe
@ 13:30:45.203 : Opened INF "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RGI251.tmp ".
[2005/12/12 13:30:45 3948.2]
@ 13:30:45.218 : Opened INF "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RGI251.tmp ".
[2005/12/12 13:30:45 3948.3]
@ 13:30:45.218 : Install Files (nothing in queue): Verifying catalogs/infs.
@ 13:30:45.218 : Install Files (nothing in queue): Verifying catalogs/infs
completed.
[2005/12/12 13:30:45 3944.2]
@ 13:30:45.312 : Opened INF
"C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\s puninst.inf".

I see that there are a few people in the newsgroups posting similar
problems, but I have not found a solution. Does anyone know where this is
breaking on the reg update, and how to fix it. Thanks in advance for your
help.

By the way I have tried the following troubleshooting steps:

1) I have tried installing from the exe several times using two different
administrator accounts.
2) I have tried installing in Safe Mode.
3) I have updated to MDAC 2.8 SP1 and MSXML 4.0 SP2 as per Dave Hawley's
posting.
4) I have disabled and even uninstalled my antivirus software.
5) I have run regmon and filemon looking for any evidence of which keys it
is failing on but there is nothing there.

I am sure it is a registry permission problem, as that is where is always
fails and the logs say that the DoRegistryUpdates:UpdSpInstallFromInfSection
Failed. When I run regmon I can see it dreating hte registry keys fo rht
einstall, but there is no failures reported when it tries to update the
existing keys.

"Kim Huartson" <Kim > wrote in message
news:4822C737-AE4E-484A-87BB-...
>I am trying to run Update Rollup 1 for Windows 2000 SP4 on my servers. Each
> time I run it it gets as far as "updating registry" and then it pops open a
> window that says "Access Denied" and uninstalls itself. I have looked at the
> install logs and it seems to be failing when it trys to write to the
> registry. Here is snippet from the log:
>
> 49.063: Num Ticks for Copying files : 30391
> 49.407: DoRegistryUpdates:UpdSpInstallFromInfSection Failed for
> ProductInstall.GlobalRegistryChanges.Install error: 0x5
> 49.407: INF_REGISTRY Failed
> 49.407: DoInstallationoRegistryUpdates failed
> 49.407: Failed Deleting C:\WINNT\system32\msiinst.tmp 2
> 49.453: VerifySize: Unable to verify size: Source = NULL: c:\winnt\oem31.cat
> 49.641: Access is denied.
> 53.032: Message displayed to the user: Access is denied.
> 53.032: User Input: OK


There are supposed to be verbose logs which might help supplement
these messages with some specifiic details. (Note: Dave Hawley claimed
he was unable to get them to work.) Instead what you could try is using
your FileMon to find out where the source of the .inf file is located
and before replying to this prompt examine the source.

Another alternative would be to compare your log with the log of an
otherwise identical install which didn't have any problem symptoms.
E.g. the "Source = NULL:" seems potentially problematic to me.


> 53.032: Update Rollup 1 installation did not complete.
>
> Select 'OK' to undo the changes that have been made.
> 54.313: Message displayed to the user: Update Rollup 1 installation did not
> complete.
>
> Select 'OK' to undo the changes that have been made.
> 54.313: User Input: OK
> 54.313: Starting process:
> C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\sp uninst.exe /~ -u -z
> 82.719: Software Update Rollback has completed with return code 0xbc2. This
> rollback requires a reboot.
> 82.719: Update Rollup 1 installation did not complete.
>
> If I check the setupapi.log, it does not report anything until it tries to
> uninstall and then logs the following:
>
> [2005/12/12 13:30:43 3944.1]
> Munged cmdline: C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\sp uninst.exe
> /~ -u -z
> EXE name: C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\sp uninst.exe
> @ 13:30:43.578 : Opened INF
> "C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\s puninst.inf".
> [2005/12/12 13:30:45 3948.1]
> Munged cmdline: C:\WINNT\system32\regsvr32.exe /s /u
> C:\WINNT\system32\winhttp.dll
> EXE name: C:\WINNT\system32\regsvr32.exe


Yikes. I would try the same trick here too. What was "munged"?
More importantly is winhttp.dll not a module which is normally
registered on your OS? Does it ever get re-registered after this?


> @ 13:30:45.203 : Opened INF "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RGI251.tmp ".
> [2005/12/12 13:30:45 3948.2]
> @ 13:30:45.218 : Opened INF "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RGI251.tmp ".
> [2005/12/12 13:30:45 3948.3]
> @ 13:30:45.218 : Install Files (nothing in queue): Verifying catalogs/infs.
> @ 13:30:45.218 : Install Files (nothing in queue): Verifying catalogs/infs
> completed.
> [2005/12/12 13:30:45 3944.2]
> @ 13:30:45.312 : Opened INF
> "C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\s puninst.inf".
>
> I see that there are a few people in the newsgroups posting similar
> problems, but I have not found a solution. Does anyone know where this is
> breaking on the reg update, and how to fix it. Thanks in advance for your
> help.
>


Good luck

Robert Aldwinckle
---

"Kim Huartson" <Kim > wrote in message
news:4BCDB4B5-9FD6-4EE3-ACDE-
....
> By the way I have tried the following troubleshooting steps:
....
> 5) I have run regmon and filemon looking for any evidence of which keys it
> is failing on but there is nothing there.


What filters were you using?

Did you at least include the writes to the install log so you can get
some supplementary context for each of its messages?
(And using options Show Milleseconds and Clock Time on both
so you can correlate all three traces more easily?)


>
> I am sure it is a registry permission problem, as that is where is always
> fails and the logs say that the DoRegistryUpdates:UpdSpInstallFromInfSection
> Failed. When I run regmon I can see it dreating hte registry keys fo rht
> einstall, but there is no failures reported when it tries to update the
> existing keys.


HTH

Robert
---

Did you enable verbose logging?
http://support.microsoft.com/kb/873148

"Kim Huartson" wrote:

> By the way I have tried the following troubleshooting steps:
>
> 1) I have tried installing from the exe several times using two different
> administrator accounts.
> 2) I have tried installing in Safe Mode.
> 3) I have updated to MDAC 2.8 SP1 and MSXML 4.0 SP2 as per Dave Hawley's
> posting.
> 4) I have disabled and even uninstalled my antivirus software.
> 5) I have run regmon and filemon looking for any evidence of which keys it
> is failing on but there is nothing there.
>
> I am sure it is a registry permission problem, as that is where is always
> fails and the logs say that the DoRegistryUpdates:UpdSpInstallFromInfSection
> Failed. When I run regmon I can see it dreating hte registry keys fo rht
> einstall, but there is no failures reported when it tries to update the
> existing keys.

I finally got a chance to revisit this problem and found the solution (at
least on my servers). After running Regmon again and sifting through the
many pages of output, I discovered that the registry update was failing on 2
keys. They were:

HKLM/Software/Microsoft/Works/6.0/Calendar &
HKLM/Software/Microsoft/Works/7.0/Calendar

Once I set these keys to allow the administrator to write to them, the
Update rollup installed correctly. I am not sure why these keys were locked
down, and I don't even run MS Works on my servers, so I am not sure what
happened to cause this. You certainly have to wonder why a couple of unused
registry keys' permissions can block the install of such an important
security update. However, changing the permissions on these keys to allow
full access to administrators allowed the install to complete.

It sure would have been nice if the Windows error message had contained some
useful information rather than just a generic Access Denied error. The
update knows which key it is writing to when it fails. Would it be all that
difficult for Windows to say "Access denied when writing to the following
registry key ...." It would have saved me many days of troubleshooting if
that little bit of intelligence was added to the Windows error messages.
Anyways, I hope that others will find this post useful in solving this
problem. Good Luck!

"Kim Huartson" wrote:

> I am trying to run Update Rollup 1 for Windows 2000 SP4 on my servers. Each
> time I run it it gets as far as "updating registry" and then it pops open a
> window that says "Access Denied" and uninstalls itself. I have looked at the
> install logs and it seems to be failing when it trys to write to the
> registry. Here is snippet from the log:
>
> 49.063: Num Ticks for Copying files : 30391
> 49.407: DoRegistryUpdates:UpdSpInstallFromInfSection Failed for
> ProductInstall.GlobalRegistryChanges.Install error: 0x5
> 49.407: INF_REGISTRY Failed
> 49.407: DoInstallationoRegistryUpdates failed
> 49.407: Failed Deleting C:\WINNT\system32\msiinst.tmp 2
> 49.453: VerifySize: Unable to verify size: Source = NULL: c:\winnt\oem31.cat
> 49.641: Access is denied.
> 53.032: Message displayed to the user: Access is denied.
> 53.032: User Input: OK
> 53.032: Update Rollup 1 installation did not complete.
>
> Select 'OK' to undo the changes that have been made.
> 54.313: Message displayed to the user: Update Rollup 1 installation did not
> complete.
>
> Select 'OK' to undo the changes that have been made.
> 54.313: User Input: OK
> 54.313: Starting process:
> C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\sp uninst.exe /~ -u -z
> 82.719: Software Update Rollback has completed with return code 0xbc2. This
> rollback requires a reboot.
> 82.719: Update Rollup 1 installation did not complete.
>
> If I check the setupapi.log, it does not report anything until it tries to
> uninstall and then logs the following:
>
> [2005/12/12 13:30:43 3944.1]
> Munged cmdline: C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\sp uninst.exe
> /~ -u -z
> EXE name: C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\sp uninst.exe
> @ 13:30:43.578 : Opened INF
> "C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\s puninst.inf".
> [2005/12/12 13:30:45 3948.1]
> Munged cmdline: C:\WINNT\system32\regsvr32.exe /s /u
> C:\WINNT\system32\winhttp.dll
> EXE name: C:\WINNT\system32\regsvr32.exe
> @ 13:30:45.203 : Opened INF "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RGI251.tmp ".
> [2005/12/12 13:30:45 3948.2]
> @ 13:30:45.218 : Opened INF "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RGI251.tmp ".
> [2005/12/12 13:30:45 3948.3]
> @ 13:30:45.218 : Install Files (nothing in queue): Verifying catalogs/infs.
> @ 13:30:45.218 : Install Files (nothing in queue): Verifying catalogs/infs
> completed.
> [2005/12/12 13:30:45 3944.2]
> @ 13:30:45.312 : Opened INF
> "C:\WINNT\$NtUpdateRollupPackUninstall$\spuninst\s puninst.inf".
>
> I see that there are a few people in the newsgroups posting similar
> problems, but I have not found a solution. Does anyone know where this is
> breaking on the reg update, and how to fix it. Thanks in advance for your
> help.
>