Windows XP - updates fail with 8007F004

I work in a company running a domain controller. All of the users access
their machines with their domain accounts. Most of the users workstations
are running Windows XP, some SP1 and some SP2. We push windows updates out
to our users with SUS. They all get the updates fine, but after then install
an update, they get a notification later for the same update again. Closer
examination of the windows update log and iuhist.xml shows that they're
getting an error during the update install, 8007F004, which, if I'm not
mistaken, translates to Insufficient Privilege. Sure enough, if we login to
that user's machine as a domain administrator and apply the patch, we don't
get the error. As far as I understand, these users should have local machine
administrator rights and should be able to apply the updates themselves.

What would cause an insufficent privilege error with Windows Update and a
domain user account? Is there are particular group policy or something that
needs to be set?

Thanks,

T.

try
0x8007F004
STATUS_INSUFFICIENT_PRIVS
You do not have permission to update . Please contact your system
administrator.
If available use SECPOL.MSC
go to local policies\user rights assignment and set the administrators

Manage Auditing and Security Log policy
take ownership of files and objects policy
restore files and folders policy

Jim,

Thanks for the response.

I checked the Local Security Settings on several machines.

Restore Files and Directories and Manage Auditing and Security Log are
already assigned to the Administrators group. Take Ownership of Files or
Other Objects wasn't. For us, that's a domain level policy, so I went and
added one of our user groups to the domain policy. It was set for just
Domain Admins. After setting, I went back to one of the workstations and ran
gpupdate to ensure that the workstation got the new policy. I double-checked
in Local Security Settings again and, sure enough, that group showed as
having that right. Logged in as a user from that group, I tried again to run
windows update. Again, the update failed. I also tried logging completely
out and back in and then running windows update and still no luck.

Do you or does anyone else have another suggestion?

Thanks,

Tim

I stand corrected. That policy change does work. The trick seems to be
getting the policy to apply to that particular machine/user account. As I
mentioned, it seems that some combination of gpupdate, gpupdate /force and
login/logout gets the policy applied, but I haven't hit on a reliable
method. I'm not even sure that any of these are having an effect and that it
isn't just waiting enough time for it to propagate naturally.

Anyway, problem solved unless someone wants to tell me a reliable way to get
a domain group policy to apply.

Thanks,

T.