WindowsUpdate failing -- log

2004-09-17 14:06:53-0700 312 13c Out of proc datastore is shutting down
2004-09-17 14:06:54-0700 312 13c Out of proc datastore is now inactive
2004-09-17 14:08:36-0700 380 460 Checking for different Redirector at: http://download.windowsupdate.com/ms...ir/wuredir.cab
2004-09-17 14:08:36-0700 380 460 WinInet: Server file is not newer. Skipping download.
2004-09-17 14:08:36-0700 380 460 Successfully refreshed Redirector cab.
2004-09-17 14:08:36-0700 380 460 WinInet: Server file is not newer. Skipping download.
2004-09-17 14:08:36-0700 380 460 WinInet: Download speed is 1529497 bytes/sec
2004-09-17 14:08:36-0700 380 460 WinInet: Successfully downloaded http://v5.windowsupdate.microsoft.co...en/wusetup.cab to file
C:\WINDOWS\SoftwareDistribution\WebSetup\wusetup.c ab
2004-09-17 14:08:36-0700 380 460 Loading inf file C:\WINDOWS\SoftwareDistribution\WebSetup\wusetup.i nf
2004-09-17 14:08:36-0700 380 460 Section name: cdm: Index: 0
2004-09-17 14:08:36-0700 380 460 Section name: iuengine: Index: 1
2004-09-17 14:08:36-0700 380 460 Section name: wuapi: Index: 2
2004-09-17 14:08:36-0700 380 460 Section name: wuauclt: Index: 3
2004-09-17 14:08:36-0700 380 460 Section name: wuauclt1: Index: 4
2004-09-17 14:08:36-0700 380 460 Section name: wuaucpl: Index: 5
2004-09-17 14:08:36-0700 380 460 Section name: wuaueng_WebSetup: Index: 6
2004-09-17 14:08:36-0700 380 460 Section name: wuaueng1: Index: 7
2004-09-17 14:08:36-0700 380 460 Section name: wuauserv_WebSetup: Index: 8
2004-09-17 14:08:36-0700 380 460 Section name: wucltui: Index: 9
2004-09-17 14:08:36-0700 380 460 Section name: wups: Index: 10
2004-09-17 14:08:36-0700 380 460 Section name: winhttp: Index: 11
2004-09-17 14:08:36-0700 380 460 Required Version for binary C:\WINDOWS\system32\cdm.dll is: 5,5,3790,2182
2004-09-17 14:08:36-0700 380 460 Binary: C:\WINDOWS\system32\cdm.dll: Target version: 5.5.3790.2182 Required: 5.5.3790.2182
2004-09-17 14:08:36-0700 380 460 Required Version for binary C:\WINDOWS\system32\iuengine.dll is: 5,4,3790,2182
2004-09-17 14:08:36-0700 380 460 Binary: C:\WINDOWS\system32\iuengine.dll: Target version: 5.4.3790.2182 Required: 5.4.3790.2182
2004-09-17 14:08:36-0700 380 460 Required Version for binary C:\WINDOWS\system32\wuapi.dll is: 5,4,3790,2182
2004-09-17 14:08:36-0700 380 460 Binary: C:\WINDOWS\system32\wuapi.dll: Target version: 5.4.3790.2182 Required: 5.4.3790.2182
2004-09-17 14:08:36-0700 380 460 Required Version for binary C:\WINDOWS\system32\wuauclt.exe is: 5,4,3790,2182
2004-09-17 14:08:36-0700 380 460 Binary: C:\WINDOWS\system32\wuauclt.exe: Target version: 5.4.3790.2182 Required: 5.4.3790.2182
2004-09-17 14:08:36-0700 380 460 Required Version for binary C:\WINDOWS\system32\wuauclt1.exe is: 5,4,3790,2182
2004-09-17 14:08:36-0700 380 460 Binary: C:\WINDOWS\system32\wuauclt1.exe: Target version: 5.4.3790.2182 Required: 5.4.3790.2182
2004-09-17 14:08:36-0700 380 460 Required Version for binary C:\WINDOWS\system32\wuaucpl.cpl is: 5,4,3790,2182
2004-09-17 14:08:36-0700 380 460 Binary: C:\WINDOWS\system32\wuaucpl.cpl: Target version: 5.4.3790.2182 Required: 5.4.3790.2182
2004-09-17 14:08:36-0700 380 460 Required Version for binary C:\WINDOWS\system32\wuaueng.dll is: 5,4,3790,2182
2004-09-17 14:08:36-0700 380 460 Binary: C:\WINDOWS\system32\wuaueng.dll: Target version: 5.4.3790.2182 Required: 5.4.3790.2182
2004-09-17 14:08:36-0700 380 460 Required Version for binary C:\WINDOWS\system32\wuaueng1.dll is: 5,4,3790,2182
2004-09-17 14:08:36-0700 380 460 Binary: C:\WINDOWS\system32\wuaueng1.dll: Target version: 5.4.3790.2182 Required: 5.4.3790.2182
2004-09-17 14:08:36-0700 380 460 Required Version for binary C:\WINDOWS\system32\wucltui.dll is: 5,4,3790,2182
2004-09-17 14:08:36-0700 380 460 Binary: C:\WINDOWS\system32\wucltui.dll: Target version: 5.4.3790.2182 Required: 5.4.3790.2182
2004-09-17 14:08:36-0700 380 460 Required Version for binary C:\WINDOWS\system32\wups.dll is: 5,4,3790,2182
2004-09-17 14:08:36-0700 380 460 Binary: C:\WINDOWS\system32\wups.dll: Target version: 5.4.3790.2182 Required: 5.4.3790.2182
2004-09-17 14:08:38-0700 1096 31c WU client succeeds CClientCallRecorder::BeginFindUpdates from WindowsUpdate with call id {C0D9A9F8-B8D3-4578-BFB7-F490E8012755}
2004-09-17 14:08:38-0700 1096 570 WU client executing call {C0D9A9F8-B8D3-4578-BFB7-F490E8012755} of type Search Call
2004-09-17 14:08:39-0700 760 69c Trying to make out of proc datastore active
2004-09-17 14:08:39-0700 760 69c Out of proc datastore is now active
2004-09-17 14:08:40-0700 1096 570 PT: Using serverID {9482F4B4-E343-43B6-B170-9A65BC822C77}
2004-09-17 14:08:40-0700 1096 570 PT: Using server URL https://v5.windowsupdate.microsoft.c...ce/client.asmx
2004-09-17 14:08:40-0700 1096 570 Add header for accept-encoding: xpress succeeded
2004-09-17 14:08:40-0700 1096 570 DetectCompressionType returning type 1, hr=0x0
2004-09-17 14:08:40-0700 1096 570 Add header for accept-encoding: xpress succeeded
2004-09-17 14:08:42-0700 1096 570 DetectCompressionType returning type 1, hr=0x0
2004-09-17 14:08:42-0700 1096 570 PT: Using serverID {9482F4B4-E343-43B6-B170-9A65BC822C77}
2004-09-17 14:08:42-0700 1096 570 PT: Using server URL https://v5.windowsupdate.microsoft.c...ce/client.asmx
2004-09-17 14:08:42-0700 1096 570 Add header for accept-encoding: xpress succeeded
2004-09-17 14:08:42-0700 1096 570 DetectCompressionType returning type 1, hr=0x0
2004-09-17 14:08:42-0700 1096 570 WU client add update {76BAACDD-634F-487D-AC52-33CD061B49E7}.100 to search result
2004-09-17 14:08:42-0700 1096 570 WU client add update {B4B9471C-1A5E-4D9C-94EF-84B00592946A}.100 to search result
2004-09-17 14:08:42-0700 1096 570 WU client add update {AC94DB3B-E1A8-4E92-9FD0-E86F355E6A44}.100 to search result
2004-09-17 14:08:42-0700 1096 570 DeviceStatus: 0x180200a, DeviceProblemNumber: 00000000
2004-09-17 14:08:42-0700 1096 570 WU client add update {467ABF7F-A427-4CBF-B941-EC5C1E0608C3}.100 to search result
2004-09-17 14:08:42-0700 1096 570 WU client add update {D8679F70-0E4F-452E-825A-4CE7FA5C4F87}.100 to search result
2004-09-17 14:08:42-0700 1096 570 WU client found 5 updates and 10 categories in search
2004-09-17 14:08:42-0700 1096 570 WU client finished Searching for update
2004-09-17 14:08:42-0700 1096 570 WU client calls back to search call WindowsUpdate with code Call complete and error 0
2004-09-17 14:08:42-0700 1096 570 WU client completed and deleted call {C0D9A9F8-B8D3-4578-BFB7-F490E8012755}
2004-09-17 14:08:47-0700 1096 570 REPORT EVENT: {AE49530E-6CA1-4BC1-881F-69A735806646} 129 2004-09-17 14:08:42-0700 1 147 101
{00000000-0000-0000-0000-000000000000} 0 0 WindowsUpdate Success Software Synchronization Agent has finished detecting items.
2004-09-17 14:08:54-0700 1096 748 WU client persisted 1 download calls
2004-09-17 14:08:54-0700 1096 570 WU client executing call {C262512C-1E0A-4287-A8D1-5C682EDCF8E8} of type Download Call
2004-09-17 14:08:54-0700 1096 748 WU client succeeds CClientCallRecorder::BeginDownloadUpdates from WindowsUpdate with call id {C262512C-1E0A-4287-A8D1-5C682EDCF8E8}
2004-09-17 14:08:54-0700 1096 570 Dumping out update 1 of 1
2004-09-17 14:08:54-0700 1096 570 title = Update for Windows XP HighMAT Support in CD Writing Wizard (KB831240)
2004-09-17 14:08:54-0700 1096 570 dumping updateId {AC94DB3B-E1A8-4E92-9FD0-E86F355E6A44}.100 bundling 1 updates
2004-09-17 14:08:54-0700 1096 570 bundled update No. 1 is {7903EC9D-E130-4A23-B4E1-96580E3818F0}.100
2004-09-17 14:08:54-0700 1096 570 Failed to find token for SID S-1-5-21-849996735-2676242950-549133041-1007 with hr = 800704dd.
2004-09-17 14:08:54-0700 1096 570 Could not impersonate the user. Failed with 0x800704dd. Will continue in LS context to get proxy settings.
2004-09-17 14:09:08-0700 1096 570 Downloading from http://www.download.windowsupdate.co...d9b236ec85.exe to
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\566ec47adc9d26a271c24f31c063cd84\3e7fd44a1dad69 6f72269378987ce5aecfc4a276 (full file).
2004-09-17 14:09:08-0700 1096 570 WU client calls back to download call {C262512C-1E0A-4287-A8D1-5C682EDCF8E8} with code Call progress and error 0
2004-09-17 14:09:16-0700 1096 3d0 Download job for update {7903EC9D-E130-4A23-B4E1-96580E3818F0}, revision 100 completed successfully.
2004-09-17 14:09:17-0700 1096 3d0 Successfully downloaded file from
http://www.download.windowsupdate.co...d9b236ec85.exe to
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\566ec47adc9d26a271c24f31c063cd84\3e7fd44a1dad69 6f72269378987ce5aecfc4a276.
2004-09-17 14:09:17-0700 1096 3d0 WU client persisted 1 download calls
2004-09-17 14:09:17-0700 1096 3d0 WU client persisted 1 download calls
2004-09-17 14:09:17-0700 1096 47c WU client calls back to download call {C262512C-1E0A-4287-A8D1-5C682EDCF8E8} with code Call complete and error 0
2004-09-17 14:09:17-0700 1096 47c WU client completed and deleted call {C262512C-1E0A-4287-A8D1-5C682EDCF8E8}
2004-09-17 14:09:17-0700 1096 47c WU client persisted 0 download calls
2004-09-17 14:09:17-0700 1096 5b0 ISusInternal API failed CClientCallRecorder:isconnectCall with error 0x8024000c
2004-09-17 14:09:17-0700 380 460 ISusInternal:isconnectCall failed, hr=8024000C
2004-09-17 14:09:17-0700 1096 31c WU client succeeds CClientCallRecorder::BeginInstallUpdates from WindowsUpdate with call id {0BC5EE85-7549-495F-A957-E9D7954FABFF}
2004-09-17 14:09:17-0700 1096 47c WU client executing call {0BC5EE85-7549-495F-A957-E9D7954FABFF} of type Install call
2004-09-17 14:09:17-0700 1096 47c validate updates before Install
2004-09-17 14:09:17-0700 1096 47c prune update list before Install
2004-09-17 14:09:17-0700 1096 47c GetUserTokenFromSessionId failed with hr 0x800704dd
2004-09-17 14:09:17-0700 1096 47c WU client failed installing updates with error 0x80240020
2004-09-17 14:09:17-0700 1096 47c WU client calls back to install call {0BC5EE85-7549-495F-A957-E9D7954FABFF} with code Call failed and error 0x80240020
2004-09-17 14:09:17-0700 1096 47c WU client completed and deleted call {0BC5EE85-7549-495F-A957-E9D7954FABFF}
2004-09-17 14:09:18-0700 380 460 Operation completed due to earlier error. (hr=80240020)
2004-09-17 14:09:18-0700 1096 5b0 ISusInternal API failed CClientCallRecorder:isconnectCall with error 0x8024000c
2004-09-17 14:09:18-0700 380 460 ISusInternal:isconnectCall failed, hr=8024000C
2004-09-17 14:09:22-0700 1096 47c REPORT EVENT: {DC2AB1B2-CB57-4400-AAAB-065FD6B9F1D7} 130 2004-09-17 14:09:17-0700 1 162 101
{AC94DB3B-E1A8-4E92-9FD0-E86F355E6A44} 100 0 WindowsUpdate Success Content Download Download succeeded.
2004-09-17 14:09:22-0700 1096 47c REPORT EVENT: {96A74A2C-9143-4BF4-A09F-0EA13DA5B8A0} 131 2004-09-17 14:09:17-0700 1 162 101
{7903EC9D-E130-4A23-B4E1-96580E3818F0} 100 0 WindowsUpdate Success Content Download Download succeeded.
2004-09-17 14:10:56-0700 1096 5b0 ISusInternal API failed CClientCallRecorder:isconnectCall with error 0x8024000c
2004-09-17 14:10:56-0700 380 460 ISusInternal:isconnectCall failed, hr=8024000C

Dan Epstein wrote:

> (snip)
> 2004-09-17 14:09:17-0700 1096 31c WU client succeeds CClientCallRecorder::BeginInstallUpdates from WindowsUpdate with call id {0BC5EE85-7549-495F-A957-E9D7954FABFF}
> 2004-09-17 14:09:17-0700 1096 47c WU client executing call {0BC5EE85-7549-495F-A957-E9D7954FABFF} of type Install call
> 2004-09-17 14:09:17-0700 1096 47c validate updates before Install
> 2004-09-17 14:09:17-0700 1096 47c prune update list before Install
> 2004-09-17 14:09:17-0700 1096 47c GetUserTokenFromSessionId failed with hr 0x800704dd
> 2004-09-17 14:09:17-0700 1096 47c WU client failed installing updates with error
> 2004-09-17 14:09:17-0700 1096 47c WU client calls back to install call {0BC5EE85-7549-495F-A957-E9D7954FABFF} with code Call failed and error 0x80240020
> 2004-09-17 14:09:17-0700 1096 47c WU client completed and deleted call {0BC5EE85-7549-495F-A957-E9D7954FABFF}
> 2004-09-17 14:09:18-0700 380 460 Operation completed due to earlier error. (hr=80240020)
> 2004-09-17 14:09:18-0700 1096 5b0 ISusInternal API failed CClientCallRecorder:isconnectCall with error 0x8024000c
> 2004-09-17 14:09:18-0700 380 460 ISusInternal:isconnectCall failed, hr=8024000C
> 2004-09-17 14:09:22-0700 1096 47c REPORT EVENT: {DC2AB1B2-CB57-4400-AAAB-065FD6B9F1D7} 130 2004-09-17 14:09:17-0700 1 162 101
> {AC94DB3B-E1A8-4E92-9FD0-E86F355E6A44} 100 0 WindowsUpdate Success Content Download Download succeeded.
> 2004-09-17 14:09:22-0700 1096 47c REPORT EVENT: {96A74A2C-9143-4BF4-A09F-0EA13DA5B8A0} 131 2004-09-17 14:09:17-0700 1 162 101
> {7903EC9D-E130-4A23-B4E1-96580E3818F0} 100 0 WindowsUpdate Success Content Download Download succeeded.
> 2004-09-17 14:10:56-0700 1096 5b0 ISusInternal API failed CClientCallRecorder:isconnectCall with error 0x8024000c
> 2004-09-17 14:10:56-0700 380 460 ISusInternal:isconnectCall failed, hr=8024000C
Hi

Error 0x800704dd is

Error_Not_Logged_On to network


Error 0x80240020is

SUS_E_NO_INTERACTIVE_USER
interactive user is missing to finish the operation


You don't run Windows Update using RunAs, do you?



--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

On Fri, 17 Sep 2004 23:37:32 +0200, "Torgeir Bakken \(MVP\)"
<Torgeir.Bakken-> wrote:

>Dan Epstein wrote:
>
>> (snip)
>> 2004-09-17 14:09:17-0700 1096 31c WU client succeeds CClientCallRecorder::BeginInstallUpdates from WindowsUpdate with call id {0BC5EE85-7549-495F-A957-E9D7954FABFF}
>> 2004-09-17 14:09:17-0700 1096 47c WU client executing call {0BC5EE85-7549-495F-A957-E9D7954FABFF} of type Install call
>> 2004-09-17 14:09:17-0700 1096 47c validate updates before Install
>> 2004-09-17 14:09:17-0700 1096 47c prune update list before Install
>> 2004-09-17 14:09:17-0700 1096 47c GetUserTokenFromSessionId failed with hr 0x800704dd
>> 2004-09-17 14:09:17-0700 1096 47c WU client failed installing updates with error
>> 2004-09-17 14:09:17-0700 1096 47c WU client calls back to install call {0BC5EE85-7549-495F-A957-E9D7954FABFF} with code Call failed and error 0x80240020
>> 2004-09-17 14:09:17-0700 1096 47c WU client completed and deleted call {0BC5EE85-7549-495F-A957-E9D7954FABFF}
>> 2004-09-17 14:09:18-0700 380 460 Operation completed due to earlier error. (hr=80240020)
>> 2004-09-17 14:09:18-0700 1096 5b0 ISusInternal API failed CClientCallRecorder:isconnectCall with error 0x8024000c
>> 2004-09-17 14:09:18-0700 380 460 ISusInternal:isconnectCall failed, hr=8024000C
>> 2004-09-17 14:09:22-0700 1096 47c REPORT EVENT: {DC2AB1B2-CB57-4400-AAAB-065FD6B9F1D7} 130 2004-09-17 14:09:17-0700 1 162 101
>> {AC94DB3B-E1A8-4E92-9FD0-E86F355E6A44} 100 0 WindowsUpdate Success Content Download Download succeeded.
>> 2004-09-17 14:09:22-0700 1096 47c REPORT EVENT: {96A74A2C-9143-4BF4-A09F-0EA13DA5B8A0} 131 2004-09-17 14:09:17-0700 1 162 101
>> {7903EC9D-E130-4A23-B4E1-96580E3818F0} 100 0 WindowsUpdate Success Content Download Download succeeded.
>> 2004-09-17 14:10:56-0700 1096 5b0 ISusInternal API failed CClientCallRecorder:isconnectCall with error 0x8024000c
>> 2004-09-17 14:10:56-0700 380 460 ISusInternal:isconnectCall failed, hr=8024000C
>Hi
>
>Error 0x800704dd is
>
>Error_Not_Logged_On to network

I'm certainly logged on to the network. In fact the log above shows
that I had just downloaded:

2004-09-17 14:09:17-0700 1096 3d0 Successfully downloaded
file from ...

>
>
>Error 0x80240020is
>
>SUS_E_NO_INTERACTIVE_USER
>interactive user is missing to finish the operation
>
>
>You don't run Windows Update using RunAs, do you?

No. I am logged in and use either Windows Update through Help and
Support or through IE.

Dan

"Dan Epstein" <> wrote in message
news:...
> On Fri, 17 Sep 2004 23:37:32 +0200, "Torgeir Bakken \(MVP\)"
> <Torgeir.Bakken-> wrote:
>
>>Dan Epstein wrote:
>>
>>> (snip)
....
>>> 2004-09-17 14:09:17-0700 1096 47c GetUserTokenFromSessionId failed with hr 0x800704dd
>>> 2004-09-17 14:09:17-0700 1096 47c WU client failed installing updates with error
....
>>Error 0x800704dd is
>>
>>Error_Not_Logged_On to network
>
> I'm certainly logged on to the network. In fact the log above shows
> that I had just downloaded:
>
> 2004-09-17 14:09:17-0700 1096 3d0 Successfully downloaded
> file from ...
>
>>
>>
>>Error 0x80240020is
>>
>>SUS_E_NO_INTERACTIVE_USER
>>interactive user is missing to finish the operation
>>
>>
>>You don't run Windows Update using RunAs, do you?
>
> No. I am logged in and use either Windows Update through Help and
> Support or through IE.

Try using more of the log to check your assumption.
Which account is being used on that connection?
Token is a keyword string to find the context in the log.

Do you see SID mentioned in there?
Is that SID the same as yours?

If you don't know of any better tools for finding out
you could use getsid. In a local context you have to duplicate
the arguments. E.g.

getsid <hostname> <account> <hostname> <account>


Going back to your original post I see these records in that regard:

>>> 2004-09-17 14:08:54-0700 1096 570 Failed to find token for SID S-1-5-21-849996735-2676242950-549133041-1007 with hr = 800704dd.
>>> 2004-09-17 14:08:54-0700 1096 570 Could not impersonate the user. Failed with 0x800704dd. Will continue in LS context to get
>>> proxy settings.
>>> 2004-09-17 14:09:08-0700 1096 570 Downloading from
>>> http://www.download.windowsupdate.co...d9b236ec85.exe
>>> to
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\566ec47adc9d26a271c24f31c063cd84\3e7fd44a1dad69 6f72269378987ce5aecfc4a276 (full
file).

Notice in particular that the SID seems to have changed to S-1-5-18
Which account is that?

Subsequently we have

>>> 2004-09-17 14:09:17-0700 1096 47c GetUserTokenFromSessionId failed with hr 0x800704dd
>>> 2004-09-17 14:09:17-0700 1096 47c WU client failed installing updates with error 0x80240020

My guess is that the failure is happening with that second account,
perhaps due to an authorization or authentication issue.
Also since the SID is being used as a subdirectory name
I'm wondering if WU might be getting confused about where
it is putting stuff and where it should be looking for it again.
From the SoftwareDistribution as current directory, try using
tree .
to see if that idea makes sense. You could also use the
command pipeline I suggested to Alain to see what changed.

dir/s/od | findstr "Directory 2004-09-18"


In case it matters have you made changes to the Log On tab
of the Automatic Updates Properties page? (via Services)
E.g. if you have checked Local System Account there is the
next checkbox Allow service to interact with desktop checked?
Has that account been customized?

Etc.


Note: this is speculative. I'm trying to interpret these traces
without the benefit of any other documentation.


HTH

Robert Aldwinckle
---

On Sun, 19 Sep 2004 10:32:17 -0400, "Robert Aldwinckle"
<> wrote:

>"Dan Epstein" <> wrote in message
>news:.. .
>> On Fri, 17 Sep 2004 23:37:32 +0200, "Torgeir Bakken \(MVP\)"
>> <Torgeir.Bakken-> wrote:
>>
>>>Dan Epstein wrote:
>>>
>>>> (snip)
>...
>>>> 2004-09-17 14:09:17-0700 1096 47c GetUserTokenFromSessionId failed with hr 0x800704dd
>>>> 2004-09-17 14:09:17-0700 1096 47c WU client failed installing updates with error
>...
>>>Error 0x800704dd is
>>>
>>>Error_Not_Logged_On to network
>>
>> I'm certainly logged on to the network. In fact the log above shows
>> that I had just downloaded:
>>
>> 2004-09-17 14:09:17-0700 1096 3d0 Successfully downloaded
>> file from ...
>>
>>>
>>>
>>>Error 0x80240020is
>>>
>>>SUS_E_NO_INTERACTIVE_USER
>>>interactive user is missing to finish the operation
>>>
>>>
>>>You don't run Windows Update using RunAs, do you?
>>
>> No. I am logged in and use either Windows Update through Help and
>> Support or through IE.
>
>Try using more of the log to check your assumption.
>Which account is being used on that connection?
>Token is a keyword string to find the context in the log.
>
>Do you see SID mentioned in there?
>Is that SID the same as yours?

I'm not sure. How to determine this? I'm running WinXP Home.

>
>If you don't know of any better tools for finding out
>you could use getsid. In a local context you have to duplicate
>the arguments. E.g.
>
> getsid <hostname> <account> <hostname> <account>

I don't have getsid on my system. I downloaded it and the SID reported
is indeed my SID.

>Going back to your original post I see these records in that regard:
>
>>>> 2004-09-17 14:08:54-0700 1096 570 Failed to find token for SID S-1-5-21-849996735-2676242950-549133041-1007 with hr = 800704dd.
>>>> 2004-09-17 14:08:54-0700 1096 570 Could not impersonate the user. Failed with 0x800704dd. Will continue in LS context to get
>>>> proxy settings.
>>>> 2004-09-17 14:09:08-0700 1096 570 Downloading from
>>>> http://www.download.windowsupdate.co...d9b236ec85.exe
>>>> to
>C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\566ec47adc9d26a271c24f31c063cd84\3e7fd44a1dad69 6f72269378987ce5aecfc4a276 (full
>file).
>
>Notice in particular that the SID seems to have changed to S-1-5-18
>Which account is that?

That is the SYSTEM account.

>
>Subsequently we have
>
>>>> 2004-09-17 14:09:17-0700 1096 47c GetUserTokenFromSessionId failed with hr 0x800704dd
>>>> 2004-09-17 14:09:17-0700 1096 47c WU client failed installing updates with error 0x80240020
>
>My guess is that the failure is happening with that second account,
>perhaps due to an authorization or authentication issue.

OK. Any ideas why? Both accounts have administrative privileges under
WinXP Home. Everything else seems to work.

>Also since the SID is being used as a subdirectory name
>I'm wondering if WU might be getting confused about where
>it is putting stuff and where it should be looking for it again.
>From the SoftwareDistribution as current directory, try using
> tree .
>to see if that idea makes sense. You could also use the
>command pipeline I suggested to Alain to see what changed.
>
> dir/s/od | findstr "Directory 2004-09-18"
>
>
>In case it matters have you made changes to the Log On tab
>of the Automatic Updates Properties page? (via Services)

No.

>E.g. if you have checked Local System Account there is the
>next checkbox Allow service to interact with desktop checked?
>Has that account been customized?

I just looked at this and "Allow service to interact with desktop" was
unchecked. I tried checking it but it didn't help.

What should these settings be? I've seen no description of this.

>
>Etc.
>
>
>Note: this is speculative. I'm trying to interpret these traces
>without the benefit of any other documentation.
>
>
>HTH
>
>Robert Aldwinckle
>---
>

"Dan Epstein" <> wrote in message
news:...
> On Sun, 19 Sep 2004 10:32:17 -0400, "Robert Aldwinckle"
> <> wrote:
>
>>"Dan Epstein" <> wrote in message
>>news:. ..
>>> On Fri, 17 Sep 2004 23:37:32 +0200, "Torgeir Bakken \(MVP\)"
>>> <Torgeir.Bakken-> wrote:
>>>
>>>>Dan Epstein wrote:

(Summary of where we have been)

>>>>Error 0x80240020is
>>>>
>>>>SUS_E_NO_INTERACTIVE_USER
>>>>interactive user is missing to finish the operation
>>>>
>>>>
>>>>You don't run Windows Update using RunAs, do you?
>>>
>>> No. I am logged in and use either Windows Update through Help and
>>> Support or through IE.
>>
>>Try using more of the log to check your assumption.
>>Which account is being used on that connection?
>>Token is a keyword string to find the context in the log.
>>
>>Do you see SID mentioned in there?
>>Is that SID the same as yours?
....
> is indeed my SID.
>
>>Going back to your original post I see these records in that regard:
>>
>>>>> 2004-09-17 14:08:54-0700 1096 570 Failed to find token for SID S-1-5-21-849996735-2676242950-549133041-1007 with hr =
>>>>> 800704dd.
>>>>> 2004-09-17 14:08:54-0700 1096 570 Could not impersonate the user. Failed with 0x800704dd. Will continue in LS context to get
>>>>> proxy settings.
>>>>> 2004-09-17 14:09:08-0700 1096 570 Downloading from
>>>>> http://www.download.windowsupdate.co...d9b236ec85.exe
>>>>> to
>>C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\566ec47adc9d26a271c24f31c063cd84\3e7fd44a1dad69 6f72269378987ce5aecfc4a276 (full
>>file).
>>
>>Notice in particular that the SID seems to have changed to S-1-5-18
>>Which account is that?
>
> That is the SYSTEM account.
>
>>
>>Subsequently we have
>>
>>>>> 2004-09-17 14:09:17-0700 1096 47c GetUserTokenFromSessionId failed with hr 0x800704dd
>>>>> 2004-09-17 14:09:17-0700 1096 47c WU client failed installing updates with error 0x80240020
>>
>>My guess is that the failure is happening with that second account,
>>perhaps due to an authorization or authentication issue.
>
> OK. Any ideas why? Both accounts have administrative privileges under
> WinXP Home. Everything else seems to work.

Then perhaps that only leaves my last guess about the directory structure
which you haven't reported on yet.

Did you look at your directory tree?
Also, in case you don't like the command pipeline I suggested
you may have noticed that I am now suggesting a "Windows way"
for getting the same information about "what changed" in the
SoftwareDistribution directory:

<quote>
BTW I have figured out a "Windows way" of summarizing what
an execution of wuauclt does: use Search Companion (Win-F)
to search for all files in %windir%\SoftwareDistribution modified today;
then sort the list by Date Modified. (Alt-V,I,M) This method also
makes it easy to see what is in any .cab files that were downloaded.
</quote>

If your symptoms are reproducible you would also find it very informative
to use FileMon (freeware from SysInternals) to monitor that directory
and highlight WRITE.


>
>>Also since the SID is being used as a subdirectory name
>>I'm wondering if WU might be getting confused about where
>>it is putting stuff and where it should be looking for it again.
>>From the SoftwareDistribution as current directory, try using
>> tree .
>>to see if that idea makes sense. You could also use the
>>command pipeline I suggested to Alain to see what changed.
>>
>> dir/s/od | findstr "Directory 2004-09-18"
>>
>>
>>In case it matters have you made changes to the Log On tab
>>of the Automatic Updates Properties page? (via Services)
>
> No.
>
>>E.g. if you have checked Local System Account there is the
>>next checkbox Allow service to interact with desktop checked?
>>Has that account been customized?
>
> I just looked at this and "Allow service to interact with desktop" was
> unchecked. I tried checking it but it didn't help.
>
> What should these settings be? I've seen no description of this.

Neither have I. For now I am discounting that "Allow service to interact..."
idea and have restored all those settings to their defaults on all services
that I made that experiment on.


Repeat: Note: this is speculative. I'm trying to interpret these traces
without the benefit of any other documentation.


HTH

Robert
---

For clarity, I am deleting the beginning of this exchange -- anyone can
retrieve it through google.

On Thu, 23 Sep 2004 09:16:22 -0400, "Robert Aldwinckle"
<> wrote:

>
>Then perhaps that only leaves my last guess about the directory structure
>which you haven't reported on yet.
>
>Did you look at your directory tree?

Yes, and I thought that guess was related to the SYSTEM user. However,
the problem with the hierarchy info. is that in attempting to solve this
problem I have numerous times deleted the SoftwareDistribution directory
and allowed WindowsUpdate to rebuilt it, and I therefore lost the
history (I also cleaned it out of my Recycle Bin).

I can only view the last few days of activity, and that is distributed
between SoftwareDistribution.old (renamed yesterday) and
SoftwareDistribution.

I don't think the info would be helpful, but let me know if you think it
will. I still think the best clue is the log file, which (after once
again renaming SoftwareDistribution and allowing it to be recreated, and
then running WindowUpdate) reports the following errors:

ISusInternal API failed CClientCallRecorder:isconnectCall with error
0x8024000c
WU client failed installing updates with error 0x80240020
WU client calls back to install call
{FE542022-4DA9-4BF9-A4CE-C376FE27C105} with code Call failed and error
0x80240020
Operation completed due to earlier error. (hr=80240020)
SusInternal API failed CClientCallRecorder:isconnectCall with error
0x8024000c

Thanks for all your help, Robert,
Dan

"Dan Epstein" <> wrote in message
news:...
> For clarity, I am deleting the beginning of this exchange -- anyone can
> retrieve it through google.
>
> On Thu, 23 Sep 2004 09:16:22 -0400, "Robert Aldwinckle"
> <> wrote:
>
>>
>>Then perhaps that only leaves my last guess about the directory structure
>>which you haven't reported on yet.
>>
>>Did you look at your directory tree?
>
> Yes, and I thought that guess was related to the SYSTEM user.

No it was both. I was seeing the SID of each account used in a
"download to" message so I thought it would be interesting to know
what each subdirectory contained.

> However,
> the problem with the hierarchy info. is that in attempting to solve this
> problem I have numerous times deleted the SoftwareDistribution directory
> and allowed WindowsUpdate to rebuilt it, and I therefore lost the
> history (I also cleaned it out of my Recycle Bin).

Ok. That's great. I was worrying that files created by different
versions of the software were being mixed in that directory.
By clearing it you will ensure that there is no inconsistency due to
version differences.


>
> I can only view the last few days of activity, and that is distributed
> between SoftwareDistribution.old (renamed yesterday) and
> SoftwareDistribution.

My idea is only to match up the messages in the log with the current
contents of the SD directory.


>
> I don't think the info would be helpful, but let me know if you think it
> will.

It's up to you. I found it much easier to follow the log after seeing
the contents of my SD directory. Further I think that there are things
in the log which are not explicitly tied to files in the directory but whose
associations can be inferred by examining its contents. The example
I gave from my case was expanding a .cab file and finding an .xml
file in it. The .xml file in turn contained URLs which the log did reference.


> I still think the best clue is the log file, which (after once
> again renaming SoftwareDistribution and allowing it to be recreated, and
> then running WindowUpdate) reports the following errors:
>
> ISusInternal API failed CClientCallRecorder:isconnectCall with error
> 0x8024000c
> WU client failed installing updates with error 0x80240020
> WU client calls back to install call
> {FE542022-4DA9-4BF9-A4CE-C376FE27C105} with code Call failed and error
> 0x80240020
> Operation completed due to earlier error. (hr=80240020)
> SusInternal API failed CClientCallRecorder:isconnectCall with error
> 0x8024000c

Possibly but I don't know how to interpret that outside of its context.


>
> Thanks for all your help, Robert,
> Dan


Happy to help

Robert
---

On Fri, 24 Sep 2004 18:01:42 -0400, "Robert Aldwinckle"
<> wrote:

>"Dan Epstein" <> wrote in message
>news:.. .
>> For clarity, I am deleting the beginning of this exchange -- anyone can
>> retrieve it through google.
>>
>> On Thu, 23 Sep 2004 09:16:22 -0400, "Robert Aldwinckle"
>> <> wrote:
>>
>>>
>>>Then perhaps that only leaves my last guess about the directory structure
>>>which you haven't reported on yet.
>>>
>>>Did you look at your directory tree?
>>
>> Yes, and I thought that guess was related to the SYSTEM user.
>
>No it was both. I was seeing the SID of each account used in a
>"download to" message so I thought it would be interesting to know
>what each subdirectory contained.
>
>> However,
>> the problem with the hierarchy info. is that in attempting to solve this
>> problem I have numerous times deleted the SoftwareDistribution directory
>> and allowed WindowsUpdate to rebuilt it, and I therefore lost the
>> history (I also cleaned it out of my Recycle Bin).
>
>Ok. That's great. I was worrying that files created by different
>versions of the software were being mixed in that directory.
>By clearing it you will ensure that there is no inconsistency due to
>version differences.
>
>
>>
>> I can only view the last few days of activity, and that is distributed
>> between SoftwareDistribution.old (renamed yesterday) and
>> SoftwareDistribution.
>
>My idea is only to match up the messages in the log with the current
>contents of the SD directory.


see below.

>>
>> I don't think the info would be helpful, but let me know if you think it
>> will.
>
>It's up to you. I found it much easier to follow the log after seeing
>the contents of my SD directory. Further I think that there are things
>in the log which are not explicitly tied to files in the directory but whose
>associations can be inferred by examining its contents. The example
>I gave from my case was expanding a .cab file and finding an .xml
>file in it. The .xml file in turn contained URLs which the log did reference.
>
>
>> I still think the best clue is the log file, which (after once
>> again renaming SoftwareDistribution and allowing it to be recreated, and
>> then running WindowUpdate) reports the following errors:
>>
>> ISusInternal API failed CClientCallRecorder:isconnectCall with error
>> 0x8024000c
>> WU client failed installing updates with error 0x80240020
>> WU client calls back to install call
>> {FE542022-4DA9-4BF9-A4CE-C376FE27C105} with code Call failed and error
>> 0x80240020
>> Operation completed due to earlier error. (hr=80240020)
>> SusInternal API failed CClientCallRecorder:isconnectCall with error
>> 0x8024000c
>
>Possibly but I don't know how to interpret that outside of its context.

I'm not sure what you're getting at here, but here are the results from
running dir/s/od | findstr "Directory" in the three SoftwareDistribution
directories (in chronological order):

Old0

Directory of C:\WINDOWS\SoftwareDistribution.old
Directory of C:\WINDOWS\SoftwareDistribution.old\DataStore
Directory of C:\WINDOWS\SoftwareDistribution.old\DataStore\Logs
Directory of C:\WINDOWS\SoftwareDistribution.old\Download
Directory of C:\WINDOWS\SoftwareDistribution.old\EventCache
Directory of C:\WINDOWS\SoftwareDistribution.old\SelfUpdate
Directory of C:\WINDOWS\SoftwareDistribution.old\WebSetup
Directory of C:\WINDOWS\SoftwareDistribution.old\WuRedir
Directory of
C:\WINDOWS\SoftwareDistribution.old\WuRedir\9482F4 B4-E343-43B6-B170-9A65BC822C77

Old1

Directory of C:\WINDOWS\SoftwareDistribution.Old1
Directory of C:\WINDOWS\SoftwareDistribution.Old1\DataStore
Directory of C:\WINDOWS\SoftwareDistribution.Old1\DataStore\Log s
Directory of C:\WINDOWS\SoftwareDistribution.Old1\Download
Directory of C:\WINDOWS\SoftwareDistribution.Old1\EventCache
Directory of C:\WINDOWS\SoftwareDistribution.Old1\SelfUpdate
Directory of C:\WINDOWS\SoftwareDistribution.Old1\WebSetup
Directory of C:\WINDOWS\SoftwareDistribution.Old1\WuRedir
Directory of
C:\WINDOWS\SoftwareDistribution.Old1\WuRedir\9482F 4B4-E343-43B6-B170-9A65BC822C77

current:

Directory of C:\WINDOWS\SoftwareDistribution
Directory of C:\WINDOWS\SoftwareDistribution\DataStore
Directory of C:\WINDOWS\SoftwareDistribution\DataStore\Logs
Directory of C:\WINDOWS\SoftwareDistribution\Download
Directory of C:\WINDOWS\SoftwareDistribution\EventCache
Directory of C:\WINDOWS\SoftwareDistribution\SelfUpdate
Directory of C:\WINDOWS\SoftwareDistribution\WebSetup
Directory of C:\WINDOWS\SoftwareDistribution\WuRedir
Directory of
C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77

Thanks,
Dan

>
>>
>> Thanks for all your help, Robert,
>> Dan
>
>
>Happy to help
>
>Robert
>---
>

"Dan Epstein" <> wrote in message
news:...
> On Fri, 24 Sep 2004 18:01:42 -0400, "Robert Aldwinckle"
> <> wrote:

>>My idea is only to match up the messages in the log with the current
>>contents of the SD directory.
>
>
> see below.
....

That's unexpected. You're showing me the same 8 subdirectories
that I have and I'm not getting any errors.

Have your symptom and log changed? I was expecting to see
a directory tree structure which included the subdirectories implied
by these messages taken from your opening post. (There would
be 9 levels of quotes if I included those lines conventionally. Let's
just pretend they are there? <g>)

>9> 2004-09-17 14:09:08-0700 1096 570 Downloading from
>http://www.download.windowsupdate.co...d9b236ec85.exe to
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\566ec47adc9d26a271c24f31c063cd84\3e7fd44a1dad69 6f72269378987ce5aecfc4a276 (full
file).

>9> 2004-09-17 14:09:17-0700 1096 3d0 Successfully downloaded file from
>http://www.download.windowsupdate.co...d9b236ec85.exe to
>C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\566ec47adc9d26a271c24f31c063cd84\3e7fd44a1dad69 6f72269378987ce5aecfc4a276.

Remember the discussion about SID? There's the SID for your System
Account clearly being used as a subdirectory level. Before that there was
the error concerning your SID so I was thinking that there might be a
subdirectory level for it as well. In addition if there were any files inserted
in that directory level which weren't in the System's SID's directory level
I would imagine that that would be a big clue. That's why I was suggesting
you list the files which were changed on the date of the update attempt.


HTH

Robert
---