Windows Update on Server 2000 through Terminal Services

When running windows update on a server 2000 with SP4 when administering the
server through terminal services, the security patches will not install
failing with an error. When running windows update from the console of the
same server, all installs Ok. Although we can work around the proplem we
would prefer to install through terminal services. Does anybody know how to
resolve this issue?

What is the error number, and what is the content of windowsupdate.log?

"Cap in hand" wrote:

> When running windows update on a server 2000 with SP4 when administering the
> server through terminal services, the security patches will not install
> failing with an error. When running windows update from the console of the
> same server, all installs Ok. Although we can work around the proplem we
> would prefer to install through terminal services. Does anybody know how to
> resolve this issue?

Error number is: 0x8024401b

The proxy is configured for anonymous access to the Windows Update Web site.
The following destinations are included in the destination setfor Windows
Update:
• http://download.windowsupdate.com
• https://*.windowsupdate.microsoft.com
• http://*.windowsupdate.microsoft.com
• http://update.microsoft.com

The update works from the console so rules out a proxy issue.

The windows update log is as follows:

2005-08-05 09:44:03 2044 1180 DnldMgr *************
2005-08-05 09:44:03 2044 1180 DnldMgr ** START ** DnldMgr: Downloading
updates [CallerId = WindowsUpdate]
2005-08-05 09:44:03 2044 1180 DnldMgr *********
2005-08-05 09:44:03 2044 1180 DnldMgr * Priority = 3, ServiceId =
{9482F4B4-E343-43B6-B170-9A65BC822C77}
2005-08-05 09:44:03 2044 1180 DnldMgr * Updates to download = 3
2005-08-05 09:44:03 2044 1180 Agent * Title = Security Update for
Windows 2000 (KB901214)
2005-08-05 09:44:03 2044 1180 Agent * UpdateId =
{D49F8CD9-750B-410D-91FA-BD8DEC51D9A6}.102
2005-08-05 09:44:03 2044 1180 Agent * Bundles 1 updates:
2005-08-05 09:44:03 2044 1180 Agent *
{76D6D2AF-930A-4A5D-A0EB-DB83C873304D}.102
2005-08-05 09:44:03 2044 1180 Agent * Title = Windows Malicious Software
Removal Tool - July 2005 (KB890830)
2005-08-05 09:44:03 2044 1180 Agent * UpdateId =
{32BC69AD-E033-4000-9613-0604FFF996D2}.100
2005-08-05 09:44:03 2044 1180 Agent * Bundles 1 updates:
2005-08-05 09:44:03 2044 1180 Agent *
{8E7F26E6-3735-43D4-9812-0CD2E8FEB937}.100
2005-08-05 09:44:03 2044 1180 Agent * Title = Security Update for JView
Profiler (KB903235)
2005-08-05 09:44:03 2044 1180 Agent * UpdateId =
{C5E60BC2-721C-40BB-94EC-D3CFF054871D}.101
2005-08-05 09:44:03 2044 1180 Agent * Bundles 1 updates:
2005-08-05 09:44:03 2044 1180 Agent *
{9AFFA28E-4E3F-48E7-80C7-B3502E7E153B}.101
2005-08-05 09:44:03 2044 1180 DtaStor Update service properties: service
registered with AU is {9482F4B4-E343-43B6-B170-9A65BC822C77}
2005-08-05 09:44:03 2044 1180 DtaStor WARNING: Update Service: Failed to
update backup store
2005-08-05 09:44:03 2044 1180 DnldMgr *********** DnldMgr: New download job
[UpdateId = {76D6D2AF-930A-4A5D-A0EB-DB83C873304D}.102] ***********
2005-08-05 09:44:03 2044 1180 DnldMgr WARNING: SetCredentials for NEGOTIATE
AUTH proxy failed with 0x800704dd

2005-08-05 09:44:03 2044 1180 DnldMgr FATAL:
DM:CAgentDownloadManager:ownloadUpdate: pDownloadJob->Init failed with
0x8024401b.
2005-08-05 09:44:03 2044 1180 DnldMgr WARNING: Got error (hr = 8024401b)
starting update 0 in call 15. Notifying call.
2005-08-05 09:44:03 2044 1180 DnldMgr Error 0x8024401b occurred while
downloading update; notifying dependent calls.
2005-08-05 09:44:03 2044 1180 DnldMgr *********** DnldMgr: New download job
[UpdateId = {8E7F26E6-3735-43D4-9812-0CD2E8FEB937}.100] ***********
2005-08-05 09:44:04 2044 1180 DnldMgr WARNING: SetCredentials for NEGOTIATE
AUTH proxy failed with 0x800704dd

2005-08-05 09:44:04 2044 1180 DnldMgr FATAL:
DM:CAgentDownloadManager:ownloadUpdate: pDownloadJob->Init failed with
0x8024401b.
2005-08-05 09:44:04 2044 1180 DnldMgr WARNING: Got error (hr = 8024401b)
starting update 1 in call 15. Notifying call.
2005-08-05 09:44:04 2044 1180 DnldMgr Error 0x8024401b occurred while
downloading update; notifying dependent calls.
2005-08-05 09:44:04 2044 1180 DnldMgr *********** DnldMgr: New download job
[UpdateId = {9AFFA28E-4E3F-48E7-80C7-B3502E7E153B}.101] ***********
2005-08-05 09:44:04 2044 1180 DnldMgr WARNING: SetCredentials for NEGOTIATE
AUTH proxy failed with 0x800704dd

2005-08-05 09:44:05 2044 1180 DnldMgr FATAL:
DM:CAgentDownloadManager:ownloadUpdate: pDownloadJob->Init failed with
0x8024401b.
2005-08-05 09:44:05 2044 1180 DnldMgr WARNING: Got error (hr = 8024401b)
starting update 2 in call 15. Notifying call.
2005-08-05 09:44:05 2044 1180 DnldMgr Error 0x8024401b occurred while
downloading update; notifying dependent calls.
2005-08-05 09:44:05 2044 1180 DtaStor Update service properties: service
registered with AU is {9482F4B4-E343-43B6-B170-9A65BC822C77}
2005-08-05 09:44:05 2044 1180 DtaStor WARNING: Update Service: Failed to
update backup store
2005-08-05 09:44:05 2044 1180 Agent *********
2005-08-05 09:44:05 2044 1180 Agent ** END ** Agent: Downloading updates
[CallerId = WindowsUpdate]
2005-08-05 09:44:05 2044 1180 Agent *************
2005-08-05 09:44:05 1228 1428 COMAPI >>-- RESUMED -- COMAPI: Download
[ClientId = WindowsUpdate]
2005-08-05 09:44:05 1228 1428 COMAPI - Download call complete (succeeded =
0, succeeded with errors = 0, failed = 3, unaccounted = 0)
2005-08-05 09:44:05 1228 1428 COMAPI - WARNING: Exit code = 0x00000000;
Call error code = 0x80240022
2005-08-05 09:44:05 1228 1428 COMAPI ---------
2005-08-05 09:44:05 1228 1428 COMAPI -- END -- COMAPI: Download [ClientId
= WindowsUpdate]
2005-08-05 09:44:05 1228 1428 COMAPI -------------
2005-08-05 09:44:08 2044 1180 Report REPORT EVENT:
{AAC118DA-D1A8-40D0-ABC4-9610BDF5E76B} 2005-08-05
09:44:03+0100 1 161 101 {D49F8CD9-750B-410D-91FA-BD8DEC51D9A6} 102 8024401b WindowsUpdate Failure Content Download Error: Download failed.
2005-08-05 09:44:08 2044 1180 Report REPORT EVENT:
{CE5AE42E-B255-4062-A60F-44FE0ED1767D} 2005-08-05
09:44:04+0100 1 161 101 {32BC69AD-E033-4000-9613-0604FFF996D2} 100 8024401b WindowsUpdate Failure Content Download Error: Download failed.
2005-08-05 09:44:08 2044 1180 Report REPORT EVENT:
{ED3553D1-01E7-4142-A37E-F58F0A8072F1} 2005-08-05
09:44:05+0100 1 161 101 {C5E60BC2-721C-40BB-94EC-D3CFF054871D} 101 8024401b WindowsUpdate Failure Content Download Error: Download failed.

"Cap in hand" <> wrote in message
news:BB721377-E04E-4938-8339-...
> Error number is: 0x8024401b
>
> The proxy is configured for anonymous access to the Windows Update Web site.

Doesn't look like it...


> [UpdateId = {76D6D2AF-930A-4A5D-A0EB-DB83C873304D}.102] ***********
> 2005-08-05 09:44:03 2044 1180 DnldMgr WARNING: SetCredentials for NEGOTIATE
> AUTH proxy failed with 0x800704dd


Can you bypass the proxy?

If not it looks as if you could use AU in its prompt mode or WU Custom
to inform yourself about which updates they think you need and then
use the WU Catalog to download them and install them manually.


HTH

Robert Aldwinckle
---

I have the same problem (Win 2000 Server SP4, TS in admin mode) & can confirm
that it is NOT a proxy problem. When logged in as domain admin via terminal
services I get 0x8024401B error for all downloads it attempts (the scan
functionality works correctly). However when logged in as domain admin on
the console (without any changes to the system or user) the patches all
downloaded and installed correctly. I have since returned to the TS session
(same login) and tried to install an optional hardware update ... and it
fails with 0x8024401B error.

Example Details from WindowsUpdate.log for successful item (Console):

2005-08-11 10:56:47 432 2b4 DnldMgr *********** DnldMgr: New download job
[UpdateId = {ECE36A54-7D3A-4935-AD93-D85B77137D15}.100] ***********
2005-08-11 10:56:47 432 2b4 DnldMgr * BITS job initialized, JobId =
{70D2F24F-C995-4499-98DF-005D89497FBC}
2005-08-11 10:56:47 432 2b4 DnldMgr BITS job
{70D2F24F-C995-4499-98DF-005D89497FBC} using proxy = gtproxy2:80;gtproxy2:80,
bypass = <local>;<local>
2005-08-11 10:56:47 432 2b4 DnldMgr * Downloading from
http://www.download.windowsupdate.co...1743f0b198.psf
to
C:\WINNT\SoftwareDistribution\Download\S-1-5-21-1390067357-1177238915-682003330-500\13b2a74dd74e724931de0d368835e7fa\download\Wind ows2000-KB899591-x86-ENU.psf.blob (1 subranges).
2005-08-11 10:56:48 432 2b4 DnldMgr BITS job
{70D2F24F-C995-4499-98DF-005D89497FBC} completed successfully


Details from WindowsUpdate.log for failed item (TS Session):

2005-08-11 11:07:38 1176 b28 DnldMgr *********** DnldMgr: New download job
[UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
2005-08-11 11:07:39 1176 b28 DnldMgr * BITS job initialized, JobId =
{C9022E6C-8770-402D-9B4F-BBFDB22D61B8}
2005-08-11 11:07:39 1176 b28 DnldMgr BITS job
{C9022E6C-8770-402D-9B4F-BBFDB22D61B8} using proxy = gtproxy2:80;gtproxy2:80,
bypass = <local>;<local>
2005-08-11 11:07:39 1176 b28 DnldMgr * Downloading from
http://www.download.windowsupdate.co...l/10784089.cab
to
C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f (full file).
2005-08-11 11:07:39 1176 344 DnldMgr WARNING: BITS job
{C9022E6C-8770-402D-9B4F-BBFDB22D61B8} failed, updateId =
{1A525ACB-FF8E-4973-AA47-598AD84DE645}.100, hr = 0x80190197, BG_ERROR_CONTEXT
= 5
2005-08-11 11:07:39 1176 344 DnldMgr Progress failure bytes total =
196362, bytes transferred = 0
2005-08-11 11:07:39 1176 344 DnldMgr Failed job file: URL =
http://www.download.windowsupdate.co...l/10784089.cab,
local path =
C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f
2005-08-11 11:07:39 1176 344 DnldMgr WARNING: Download job failed because of
proxy auth or server auth.
2005-08-11 11:07:39 1176 344 DnldMgr *********** DnldMgr: New download job
[UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
2005-08-11 11:07:39 1176 344 DnldMgr WARNING: SetCredentials for NEGOTIATE
AUTH proxy failed with 0x800704dd

2005-08-11 11:07:39 1176 344 DnldMgr FATAL:
DM:CAgentDownloadManager:ownloadUpdate: pDownloadJob->Init failed with
0x8024401b.
2005-08-11 11:07:39 1176 344 DnldMgr WARNING: Got error (hr = 8024401b)
starting update 0 in call 3. Notifying call.
2005-08-11 11:07:39 1176 344 DnldMgr Error 0x8024401b occurred while
downloading update; notifying dependent calls.



"Robert Aldwinckle" wrote:

> "Cap in hand" <> wrote in message
> news:BB721377-E04E-4938-8339-...
> > Error number is: 0x8024401b
> >
> > The proxy is configured for anonymous access to the Windows Update Web site.
>
> Doesn't look like it...
>
>
> > [UpdateId = {76D6D2AF-930A-4A5D-A0EB-DB83C873304D}.102] ***********
> > 2005-08-05 09:44:03 2044 1180 DnldMgr WARNING: SetCredentials for NEGOTIATE
> > AUTH proxy failed with 0x800704dd
>
>
> Can you bypass the proxy?
>
> If not it looks as if you could use AU in its prompt mode or WU Custom
> to inform yourself about which updates they think you need and then
> use the WU Catalog to download them and install them manually.
>
>
> HTH
>
> Robert Aldwinckle
> ---
>
>
>

An additional discovery I just made:

The problem with terminal services doesn't happen when logged on as a local
administrator (rather than domain admin). However, when logged on as a local
administrator, I do not have the domain credentials required to use the proxy
and so it requests a domain username and password several times throughout
the process.

Although it required me to enter a fully qualified username (domain\user)
and corresponding password 2-3 times during the process, it did successfully
update the optional hardware update that it failed on earlier (when logged in
as a Domain Admin that has the credentials required to use the proxy).

It's a bit of a pain if you have to enter username and password for each
download ... but at least it works.

The issue seems to me to be some difference between console & TS sessions as
to how the user's credentials are retrieved and applied for proxy access.

The following extract from WindowsUpdate.log shows that it fails the first
attempt due to lack of authorisation (local admin doesn't have domain
credentials), but the second attemp succeeds after domain username and
password are entered when requested:

2005-08-11 11:29:46 1176 b28 DnldMgr *********** DnldMgr: New download job
[UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
2005-08-11 11:29:46 1176 b28 DnldMgr * BITS job initialized, JobId =
{8054EB02-9DCD-448F-9B61-D85CC681957C}
2005-08-11 11:29:46 1176 b28 DnldMgr BITS job
{8054EB02-9DCD-448F-9B61-D85CC681957C} using proxy = gtproxy2:80;gtproxy2:80,
bypass = 127.0.0.1;*.local;192.9.*;<local>;<local>
2005-08-11 11:29:46 1176 b28 DnldMgr * Downloading from
http://www.download.windowsupdate.co...l/10784089.cab
to
C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f (full file).
2005-08-11 11:29:46 1176 698 DnldMgr WARNING: BITS job
{8054EB02-9DCD-448F-9B61-D85CC681957C} failed, updateId =
{1A525ACB-FF8E-4973-AA47-598AD84DE645}.100, hr = 0x80190197, BG_ERROR_CONTEXT
= 5
2005-08-11 11:29:46 1176 698 DnldMgr Progress failure bytes total =
196362, bytes transferred = 0
2005-08-11 11:29:46 1176 698 DnldMgr Failed job file: URL =
http://www.download.windowsupdate.co...l/10784089.cab,
local path =
C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f
2005-08-11 11:29:46 1176 698 DnldMgr WARNING: Download job failed because of
proxy auth or server auth.
2005-08-11 11:29:46 1176 698 DnldMgr *********** DnldMgr: New download job
[UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
2005-08-11 11:29:46 1176 698 DnldMgr * BITS job initialized, JobId =
{AD0A9CFA-E983-4027-B02B-91A5E638DC61}
2005-08-11 11:29:46 1176 698 DnldMgr BITS job
{AD0A9CFA-E983-4027-B02B-91A5E638DC61} using proxy = gtproxy2:80;gtproxy2:80,
bypass = 127.0.0.1;*.local;192.9.*;<local>;<local>
2005-08-11 11:29:46 1176 698 DnldMgr * Downloading from
http://www.download.windowsupdate.co...l/10784089.cab
to
C:\WINNT\SoftwareDistribution\Download\S-1-5-21-1708537768-329068152-682003330-1001\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6 aded5598b009787817f91d70e12f (full file).
2005-08-11 11:29:55 1176 834 DnldMgr BITS job
{AD0A9CFA-E983-4027-B02B-91A5E638DC61} completed successfully



"Neil Price" wrote:

> I have the same problem (Win 2000 Server SP4, TS in admin mode) & can confirm
> that it is NOT a proxy problem. When logged in as domain admin via terminal
> services I get 0x8024401B error for all downloads it attempts (the scan
> functionality works correctly). However when logged in as domain admin on
> the console (without any changes to the system or user) the patches all
> downloaded and installed correctly. I have since returned to the TS session
> (same login) and tried to install an optional hardware update ... and it
> fails with 0x8024401B error.
>
> Example Details from WindowsUpdate.log for successful item (Console):
>
> 2005-08-11 10:56:47 432 2b4 DnldMgr *********** DnldMgr: New download job
> [UpdateId = {ECE36A54-7D3A-4935-AD93-D85B77137D15}.100] ***********
> 2005-08-11 10:56:47 432 2b4 DnldMgr * BITS job initialized, JobId =
> {70D2F24F-C995-4499-98DF-005D89497FBC}
> 2005-08-11 10:56:47 432 2b4 DnldMgr BITS job
> {70D2F24F-C995-4499-98DF-005D89497FBC} using proxy = gtproxy2:80;gtproxy2:80,
> bypass = <local>;<local>
> 2005-08-11 10:56:47 432 2b4 DnldMgr * Downloading from
> http://www.download.windowsupdate.co...1743f0b198.psf
> to
> C:\WINNT\SoftwareDistribution\Download\S-1-5-21-1390067357-1177238915-682003330-500\13b2a74dd74e724931de0d368835e7fa\download\Wind ows2000-KB899591-x86-ENU.psf.blob (1 subranges).
> 2005-08-11 10:56:48 432 2b4 DnldMgr BITS job
> {70D2F24F-C995-4499-98DF-005D89497FBC} completed successfully
>
>
> Details from WindowsUpdate.log for failed item (TS Session):
>
> 2005-08-11 11:07:38 1176 b28 DnldMgr *********** DnldMgr: New download job
> [UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
> 2005-08-11 11:07:39 1176 b28 DnldMgr * BITS job initialized, JobId =
> {C9022E6C-8770-402D-9B4F-BBFDB22D61B8}
> 2005-08-11 11:07:39 1176 b28 DnldMgr BITS job
> {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} using proxy = gtproxy2:80;gtproxy2:80,
> bypass = <local>;<local>
> 2005-08-11 11:07:39 1176 b28 DnldMgr * Downloading from
> http://www.download.windowsupdate.co...l/10784089.cab
> to
> C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f (full file).
> 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: BITS job
> {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} failed, updateId =
> {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100, hr = 0x80190197, BG_ERROR_CONTEXT
> = 5
> 2005-08-11 11:07:39 1176 344 DnldMgr Progress failure bytes total =
> 196362, bytes transferred = 0
> 2005-08-11 11:07:39 1176 344 DnldMgr Failed job file: URL =
> http://www.download.windowsupdate.co...l/10784089.cab,
> local path =
> C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f
> 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: Download job failed because of
> proxy auth or server auth.
> 2005-08-11 11:07:39 1176 344 DnldMgr *********** DnldMgr: New download job
> [UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
> 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: SetCredentials for NEGOTIATE
> AUTH proxy failed with 0x800704dd
>
> 2005-08-11 11:07:39 1176 344 DnldMgr FATAL:
> DM:CAgentDownloadManager:ownloadUpdate: pDownloadJob->Init failed with
> 0x8024401b.
> 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: Got error (hr = 8024401b)
> starting update 0 in call 3. Notifying call.
> 2005-08-11 11:07:39 1176 344 DnldMgr Error 0x8024401b occurred while
> downloading update; notifying dependent calls.
>
>
>
> "Robert Aldwinckle" wrote:
>
> > "Cap in hand" <> wrote in message
> > news:BB721377-E04E-4938-8339-...
> > > Error number is: 0x8024401b
> > >
> > > The proxy is configured for anonymous access to the Windows Update Web site.
> >
> > Doesn't look like it...
> >
> >
> > > [UpdateId = {76D6D2AF-930A-4A5D-A0EB-DB83C873304D}.102] ***********
> > > 2005-08-05 09:44:03 2044 1180 DnldMgr WARNING: SetCredentials for NEGOTIATE
> > > AUTH proxy failed with 0x800704dd
> >
> >
> > Can you bypass the proxy?
> >
> > If not it looks as if you could use AU in its prompt mode or WU Custom
> > to inform yourself about which updates they think you need and then
> > use the WU Catalog to download them and install them manually.
> >
> >
> > HTH
> >
> > Robert Aldwinckle
> > ---
> >
> >
> >

"Neil Price" <> wrote in message
news:BB656805-8737-4038-8B19-
....
> Details from WindowsUpdate.log for failed item (TS Session):
>
> 2005-08-11 11:07:38 1176 b28 DnldMgr *********** DnldMgr: New download job
> [UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
> 2005-08-11 11:07:39 1176 b28 DnldMgr * BITS job initialized, JobId =
> {C9022E6C-8770-402D-9B4F-BBFDB22D61B8}
> 2005-08-11 11:07:39 1176 b28 DnldMgr BITS job
> {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} using proxy = gtproxy2:80;gtproxy2:80,
> bypass = <local>;<local>
> 2005-08-11 11:07:39 1176 b28 DnldMgr * Downloading from
> http://www.download.windowsupdate.co...l/10784089.cab
> to
> C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f (full
> file).
> 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: BITS job
> {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} failed, updateId =
> {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100, hr = 0x80190197, BG_ERROR_CONTEXT
> = 5


S-1-5-18 is the SID for the System Account.

0x80190197 is your intermediate server (whatever you want to call it)
telling WU (in an HTTP 407 response) that it is not authorized
to use the link.

You need to get your server to allow anonymous connections
for the services. There is provision for specific logons in the
services' properties pages but supposedly it is not supported.

http://www.microsoft.com/technet/pro...ateauthen.mspx

(Courtesy suraj )


HTH

Robert
---


>I have the same problem (Win 2000 Server SP4, TS in admin mode) & can confirm
> that it is NOT a proxy problem. When logged in as domain admin via terminal
> services I get 0x8024401B error for all downloads it attempts (the scan
> functionality works correctly). However when logged in as domain admin on
> the console (without any changes to the system or user) the patches all
> downloaded and installed correctly. I have since returned to the TS session
> (same login) and tried to install an optional hardware update ... and it
> fails with 0x8024401B error.
>
> Example Details from WindowsUpdate.log for successful item (Console):
>
> 2005-08-11 10:56:47 432 2b4 DnldMgr *********** DnldMgr: New download job
> [UpdateId = {ECE36A54-7D3A-4935-AD93-D85B77137D15}.100] ***********
> 2005-08-11 10:56:47 432 2b4 DnldMgr * BITS job initialized, JobId =
> {70D2F24F-C995-4499-98DF-005D89497FBC}
> 2005-08-11 10:56:47 432 2b4 DnldMgr BITS job
> {70D2F24F-C995-4499-98DF-005D89497FBC} using proxy = gtproxy2:80;gtproxy2:80,
> bypass = <local>;<local>
> 2005-08-11 10:56:47 432 2b4 DnldMgr * Downloading from
> http://www.download.windowsupdate.co...1743f0b198.psf
> to
> C:\WINNT\SoftwareDistribution\Download\S-1-5-21-1390067357-1177238915-682003330-500\13b2a74dd74e724931de0d368835e7fa\download\Wind ows2000-KB899591-x86-ENU.psf.blob
> (1 subranges).
> 2005-08-11 10:56:48 432 2b4 DnldMgr BITS job
> {70D2F24F-C995-4499-98DF-005D89497FBC} completed successfully
>
>
> Details from WindowsUpdate.log for failed item (TS Session):
>
> 2005-08-11 11:07:38 1176 b28 DnldMgr *********** DnldMgr: New download job
> [UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
> 2005-08-11 11:07:39 1176 b28 DnldMgr * BITS job initialized, JobId =
> {C9022E6C-8770-402D-9B4F-BBFDB22D61B8}
> 2005-08-11 11:07:39 1176 b28 DnldMgr BITS job
> {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} using proxy = gtproxy2:80;gtproxy2:80,
> bypass = <local>;<local>
> 2005-08-11 11:07:39 1176 b28 DnldMgr * Downloading from
> http://www.download.windowsupdate.co...l/10784089.cab
> to
> C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f (full
> file).
> 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: BITS job
> {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} failed, updateId =
> {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100, hr = 0x80190197, BG_ERROR_CONTEXT
> = 5
> 2005-08-11 11:07:39 1176 344 DnldMgr Progress failure bytes total =
> 196362, bytes transferred = 0
> 2005-08-11 11:07:39 1176 344 DnldMgr Failed job file: URL =
> http://www.download.windowsupdate.co...l/10784089.cab,
> local path =
> C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f
> 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: Download job failed because of
> proxy auth or server auth.
> 2005-08-11 11:07:39 1176 344 DnldMgr *********** DnldMgr: New download job
> [UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
> 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: SetCredentials for NEGOTIATE
> AUTH proxy failed with 0x800704dd
>
> 2005-08-11 11:07:39 1176 344 DnldMgr FATAL:
> DM:CAgentDownloadManager:ownloadUpdate: pDownloadJob->Init failed with
> 0x8024401b.
> 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: Got error (hr = 8024401b)
> starting update 0 in call 3. Notifying call.
> 2005-08-11 11:07:39 1176 344 DnldMgr Error 0x8024401b occurred while
> downloading update; notifying dependent calls.

....

And yet using the same login on the console (instead of TS), the logs show
that it correctly uses S-1-5-21-1390067357-1177238915-682003330-500 not
S-1-5-18 & it works correctly.

I don't have control over the proxy & in any case this isn't a proxy problem
- as the content in the link you gave states, this is a WU problem
(attempting to auth with null credentials).

Personally I prefer the workaround I found (see my 2nd message yesterday) -
where logging onto TS as a user without proxy access forces it to request
user/password on each connection. That removes the need for meddling with
our proxy.

Regarding your comment about service login settings - I did also try setting
the BITS service logon account to a domain admin (this was before discovering
this thread on the newsgroup & trying it from the console). However, this
just caused it to produce a different error number (relating to RPC failures
as far as I remember), so I set it back to the system account.

Regards,
Neil

"Robert Aldwinckle" wrote:

> "Neil Price" <> wrote in message
> news:BB656805-8737-4038-8B19-
> ....
> > Details from WindowsUpdate.log for failed item (TS Session):
> >
> > 2005-08-11 11:07:38 1176 b28 DnldMgr *********** DnldMgr: New download job
> > [UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
> > 2005-08-11 11:07:39 1176 b28 DnldMgr * BITS job initialized, JobId =
> > {C9022E6C-8770-402D-9B4F-BBFDB22D61B8}
> > 2005-08-11 11:07:39 1176 b28 DnldMgr BITS job
> > {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} using proxy = gtproxy2:80;gtproxy2:80,
> > bypass = <local>;<local>
> > 2005-08-11 11:07:39 1176 b28 DnldMgr * Downloading from
> > http://www.download.windowsupdate.co...l/10784089.cab
> > to
> > C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f (full
> > file).
> > 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: BITS job
> > {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} failed, updateId =
> > {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100, hr = 0x80190197, BG_ERROR_CONTEXT
> > = 5
>
>
> S-1-5-18 is the SID for the System Account.
>
> 0x80190197 is your intermediate server (whatever you want to call it)
> telling WU (in an HTTP 407 response) that it is not authorized
> to use the link.
>
> You need to get your server to allow anonymous connections
> for the services. There is provision for specific logons in the
> services' properties pages but supposedly it is not supported.
>
> http://www.microsoft.com/technet/pro...ateauthen.mspx
>
> (Courtesy suraj )
>
>
> HTH
>
> Robert
> ---
>
>
> >I have the same problem (Win 2000 Server SP4, TS in admin mode) & can confirm
> > that it is NOT a proxy problem. When logged in as domain admin via terminal
> > services I get 0x8024401B error for all downloads it attempts (the scan
> > functionality works correctly). However when logged in as domain admin on
> > the console (without any changes to the system or user) the patches all
> > downloaded and installed correctly. I have since returned to the TS session
> > (same login) and tried to install an optional hardware update ... and it
> > fails with 0x8024401B error.
> >
> > Example Details from WindowsUpdate.log for successful item (Console):
> >
> > 2005-08-11 10:56:47 432 2b4 DnldMgr *********** DnldMgr: New download job
> > [UpdateId = {ECE36A54-7D3A-4935-AD93-D85B77137D15}.100] ***********
> > 2005-08-11 10:56:47 432 2b4 DnldMgr * BITS job initialized, JobId =
> > {70D2F24F-C995-4499-98DF-005D89497FBC}
> > 2005-08-11 10:56:47 432 2b4 DnldMgr BITS job
> > {70D2F24F-C995-4499-98DF-005D89497FBC} using proxy = gtproxy2:80;gtproxy2:80,
> > bypass = <local>;<local>
> > 2005-08-11 10:56:47 432 2b4 DnldMgr * Downloading from
> > http://www.download.windowsupdate.co...1743f0b198.psf
> > to
> > C:\WINNT\SoftwareDistribution\Download\S-1-5-21-1390067357-1177238915-682003330-500\13b2a74dd74e724931de0d368835e7fa\download\Wind ows2000-KB899591-x86-ENU.psf.blob
> > (1 subranges).
> > 2005-08-11 10:56:48 432 2b4 DnldMgr BITS job
> > {70D2F24F-C995-4499-98DF-005D89497FBC} completed successfully
> >
> >
> > Details from WindowsUpdate.log for failed item (TS Session):
> >
> > 2005-08-11 11:07:38 1176 b28 DnldMgr *********** DnldMgr: New download job
> > [UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
> > 2005-08-11 11:07:39 1176 b28 DnldMgr * BITS job initialized, JobId =
> > {C9022E6C-8770-402D-9B4F-BBFDB22D61B8}
> > 2005-08-11 11:07:39 1176 b28 DnldMgr BITS job
> > {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} using proxy = gtproxy2:80;gtproxy2:80,
> > bypass = <local>;<local>
> > 2005-08-11 11:07:39 1176 b28 DnldMgr * Downloading from
> > http://www.download.windowsupdate.co...l/10784089.cab
> > to
> > C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f (full
> > file).
> > 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: BITS job
> > {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} failed, updateId =
> > {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100, hr = 0x80190197, BG_ERROR_CONTEXT
> > = 5
> > 2005-08-11 11:07:39 1176 344 DnldMgr Progress failure bytes total =
> > 196362, bytes transferred = 0
> > 2005-08-11 11:07:39 1176 344 DnldMgr Failed job file: URL =
> > http://www.download.windowsupdate.co...l/10784089.cab,
> > local path =
> > C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f
> > 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: Download job failed because of
> > proxy auth or server auth.
> > 2005-08-11 11:07:39 1176 344 DnldMgr *********** DnldMgr: New download job
> > [UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
> > 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: SetCredentials for NEGOTIATE
> > AUTH proxy failed with 0x800704dd
> >
> > 2005-08-11 11:07:39 1176 344 DnldMgr FATAL:
> > DM:CAgentDownloadManager:ownloadUpdate: pDownloadJob->Init failed with
> > 0x8024401b.
> > 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: Got error (hr = 8024401b)
> > starting update 0 in call 3. Notifying call.
> > 2005-08-11 11:07:39 1176 344 DnldMgr Error 0x8024401b occurred while
> > downloading update; notifying dependent calls.
>
> ....
>
>
>
>

I found that if we using TS on Server2003 with windows update v6 and
firewall. I couldn't produce the same problem. I did encounter the problem
discussed in this thread with TS on Server 2000 after upgrade to windows
update v6. When I did it with Server 2000 and TS with windows update v4, I
didn't find this problem. As a result, I suspect that it's windows update
v6's problem.

"Neil Price" wrote:

> And yet using the same login on the console (instead of TS), the logs show
> that it correctly uses S-1-5-21-1390067357-1177238915-682003330-500 not
> S-1-5-18 & it works correctly.
>
> I don't have control over the proxy & in any case this isn't a proxy problem
> - as the content in the link you gave states, this is a WU problem
> (attempting to auth with null credentials).
>
> Personally I prefer the workaround I found (see my 2nd message yesterday) -
> where logging onto TS as a user without proxy access forces it to request
> user/password on each connection. That removes the need for meddling with
> our proxy.
>
> Regarding your comment about service login settings - I did also try setting
> the BITS service logon account to a domain admin (this was before discovering
> this thread on the newsgroup & trying it from the console). However, this
> just caused it to produce a different error number (relating to RPC failures
> as far as I remember), so I set it back to the system account.
>
> Regards,
> Neil
>
> "Robert Aldwinckle" wrote:
>
> > "Neil Price" <> wrote in message
> > news:BB656805-8737-4038-8B19-
> > ....
> > > Details from WindowsUpdate.log for failed item (TS Session):
> > >
> > > 2005-08-11 11:07:38 1176 b28 DnldMgr *********** DnldMgr: New download job
> > > [UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
> > > 2005-08-11 11:07:39 1176 b28 DnldMgr * BITS job initialized, JobId =
> > > {C9022E6C-8770-402D-9B4F-BBFDB22D61B8}
> > > 2005-08-11 11:07:39 1176 b28 DnldMgr BITS job
> > > {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} using proxy = gtproxy2:80;gtproxy2:80,
> > > bypass = <local>;<local>
> > > 2005-08-11 11:07:39 1176 b28 DnldMgr * Downloading from
> > > http://www.download.windowsupdate.co...l/10784089.cab
> > > to
> > > C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f (full
> > > file).
> > > 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: BITS job
> > > {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} failed, updateId =
> > > {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100, hr = 0x80190197, BG_ERROR_CONTEXT
> > > = 5
> >
> >
> > S-1-5-18 is the SID for the System Account.
> >
> > 0x80190197 is your intermediate server (whatever you want to call it)
> > telling WU (in an HTTP 407 response) that it is not authorized
> > to use the link.
> >
> > You need to get your server to allow anonymous connections
> > for the services. There is provision for specific logons in the
> > services' properties pages but supposedly it is not supported.
> >
> > http://www.microsoft.com/technet/pro...ateauthen.mspx
> >
> > (Courtesy suraj )
> >
> >
> > HTH
> >
> > Robert
> > ---
> >
> >
> > >I have the same problem (Win 2000 Server SP4, TS in admin mode) & can confirm
> > > that it is NOT a proxy problem. When logged in as domain admin via terminal
> > > services I get 0x8024401B error for all downloads it attempts (the scan
> > > functionality works correctly). However when logged in as domain admin on
> > > the console (without any changes to the system or user) the patches all
> > > downloaded and installed correctly. I have since returned to the TS session
> > > (same login) and tried to install an optional hardware update ... and it
> > > fails with 0x8024401B error.
> > >
> > > Example Details from WindowsUpdate.log for successful item (Console):
> > >
> > > 2005-08-11 10:56:47 432 2b4 DnldMgr *********** DnldMgr: New download job
> > > [UpdateId = {ECE36A54-7D3A-4935-AD93-D85B77137D15}.100] ***********
> > > 2005-08-11 10:56:47 432 2b4 DnldMgr * BITS job initialized, JobId =
> > > {70D2F24F-C995-4499-98DF-005D89497FBC}
> > > 2005-08-11 10:56:47 432 2b4 DnldMgr BITS job
> > > {70D2F24F-C995-4499-98DF-005D89497FBC} using proxy = gtproxy2:80;gtproxy2:80,
> > > bypass = <local>;<local>
> > > 2005-08-11 10:56:47 432 2b4 DnldMgr * Downloading from
> > > http://www.download.windowsupdate.co...1743f0b198.psf
> > > to
> > > C:\WINNT\SoftwareDistribution\Download\S-1-5-21-1390067357-1177238915-682003330-500\13b2a74dd74e724931de0d368835e7fa\download\Wind ows2000-KB899591-x86-ENU.psf.blob
> > > (1 subranges).
> > > 2005-08-11 10:56:48 432 2b4 DnldMgr BITS job
> > > {70D2F24F-C995-4499-98DF-005D89497FBC} completed successfully
> > >
> > >
> > > Details from WindowsUpdate.log for failed item (TS Session):
> > >
> > > 2005-08-11 11:07:38 1176 b28 DnldMgr *********** DnldMgr: New download job
> > > [UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
> > > 2005-08-11 11:07:39 1176 b28 DnldMgr * BITS job initialized, JobId =
> > > {C9022E6C-8770-402D-9B4F-BBFDB22D61B8}
> > > 2005-08-11 11:07:39 1176 b28 DnldMgr BITS job
> > > {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} using proxy = gtproxy2:80;gtproxy2:80,
> > > bypass = <local>;<local>
> > > 2005-08-11 11:07:39 1176 b28 DnldMgr * Downloading from
> > > http://www.download.windowsupdate.co...l/10784089.cab
> > > to
> > > C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f (full
> > > file).
> > > 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: BITS job
> > > {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} failed, updateId =
> > > {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100, hr = 0x80190197, BG_ERROR_CONTEXT
> > > = 5
> > > 2005-08-11 11:07:39 1176 344 DnldMgr Progress failure bytes total =
> > > 196362, bytes transferred = 0
> > > 2005-08-11 11:07:39 1176 344 DnldMgr Failed job file: URL =
> > > http://www.download.windowsupdate.co...l/10784089.cab,
> > > local path =
> > > C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6ad ed5598b009787817f91d70e12f
> > > 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: Download job failed because of
> > > proxy auth or server auth.
> > > 2005-08-11 11:07:39 1176 344 DnldMgr *********** DnldMgr: New download job
> > > [UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
> > > 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: SetCredentials for NEGOTIATE
> > > AUTH proxy failed with 0x800704dd
> > >
> > > 2005-08-11 11:07:39 1176 344 DnldMgr FATAL:
> > > DM:CAgentDownloadManager:ownloadUpdate: pDownloadJob->Init failed with
> > > 0x8024401b.
> > > 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: Got error (hr = 8024401b)
> > > starting update 0 in call 3. Notifying call.
> > > 2005-08-11 11:07:39 1176 344 DnldMgr Error 0x8024401b occurred while
> > > downloading update; notifying dependent calls.
> >
> > ....
> >
> >
> >
> >

I have the same feeling. Same problem, and only on W2k server Sp4. Here we
have Win2k only on servers, so I can't tell if this occurs also on Win 2k
Pro. But I can tell it does not happen with XP, whatever Service Pack.
Luckily we can manage working directly from the console, but I agree it's
not the best way...


"Nigel H. Lin" wrote:

> I found that if we using TS on Server2003 with windows update v6 and
> firewall. I couldn't produce the same problem. I did encounter the problem
> discussed in this thread with TS on Server 2000 after upgrade to windows
> update v6. When I did it with Server 2000 and TS with windows update v4, I
> didn't find this problem. As a result, I suspect that it's windows update
> v6's problem.
>