wuauserv puzzle

I think I don't have access rights to wuauserv.dll. If I run "sc sdshow
wuauserv" I get "OpenService FAILED 5: Access is denied." I get the same
error if I try to set rights via "sc sdset wuauserv".

I get the same error if I go into Services and right-click on "Automatic
Updates". I also have no ability to start, stop, etc., the service.

If I look at the wuauserv.dll properties Security tab, I see Full Control
for Administrators, Power Users, SYSTEM and Users. Everything is selected
except for Special Permissions. Also, the Allow column for Administrators
and SYSTEM is grayed out.

I noticed this problem when I tried to manually do Windows Update and got
error 0x800A0046. I tried many suggested solutions, including verifying
that the "Impersonate a client after authentication" list contains
Administrators, ASPNET and SERVICE.

I am part of the Administrators group, and have also tried logging in as
Administrator when attempting Windows Update as well as "sc sdshow".

I've tried reinstalling by executing "c:\windows\system32\rundll32.exe
setupapi,InstallHinfSection DefaultInstall 132 C:\windows\inf\au.inf". I
get no errors, but it doesn't fix the problem.

I'm running XP Pro with SP2 and Windows Update v5. A probable hint is that
this machine is part of a domain and the IT administrator has tried to force
updates from a SUS server. He also wants to ensure that no one can turn off
auto-update, but he says that he didn't intend to block access to the
Windows Update site. I have these problems whether I'm on the domain or
logged in at home.

So, how do I restore access rights to wuauserv.dll, if that's my problem?

Thank you.

TT

Tom Treadway wrote:

> I think I don't have access rights to wuauserv.dll. If I run "sc sdshow
> wuauserv" I get "OpenService FAILED 5: Access is denied." I get the same
> error if I try to set rights via "sc sdset wuauserv".
>
> I get the same error if I go into Services and right-click on "Automatic
> Updates". I also have no ability to start, stop, etc., the service.
>
> If I look at the wuauserv.dll properties Security tab, I see Full Control
> for Administrators, Power Users, SYSTEM and Users. Everything is selected
> except for Special Permissions. Also, the Allow column for Administrators
> and SYSTEM is grayed out.
>
> I noticed this problem when I tried to manually do Windows Update and got
> error 0x800A0046. I tried many suggested solutions, including verifying
> that the "Impersonate a client after authentication" list contains
> Administrators, ASPNET and SERVICE.
>
> I am part of the Administrators group, and have also tried logging in as
> Administrator when attempting Windows Update as well as "sc sdshow".
>
> I've tried reinstalling by executing "c:\windows\system32\rundll32.exe
> setupapi,InstallHinfSection DefaultInstall 132 C:\windows\inf\au.inf". I
> get no errors, but it doesn't fix the problem.
>
> I'm running XP Pro with SP2 and Windows Update v5.
Hi

Please take a look at the following windows update
troubleshooter article:
http://v5.windowsupdate.microsoft.co...cleid=20&ln=en


If that doesn't work, see if the tip from Karl B/Melvin Salazar works
for you:

<quote>

From: "Karl B" <>
Subject: Possible solution to the windows update 0x800A0046 problem
Date: Sun, 30 May 2004 12:03:39 +0100
Newsgroups: microsoft.private.xpsp2.general

Firstly, I take no credit for this I was going though the network
newsgroup because my dialup network settings had vanished and a guy
named Melvin Salazar suggested the following which WORKED!

'You can also try doing the following, it worked for me:

Go to Services under the Administrative Tools folder.

Notice that the logon account is set to a NT/User account under the RPC
(remote procedure call) service. Change it to Local System account,
under the Logon tab, and restart the computer. Many of these services
depend on the RPC, but there was an error when it came to configuring
this paticular service.'

Now once I made these changes I was able to get my network icons back
as well as use Windows Update.

Thanks
Karl

</quote>



If that doesn't work out either, you might want to follow the
procedure here:

How To Reset Security Settings Back to the Defaults
http://support.microsoft.com/?kbid=313222

I suggest you add this to the secedit command line:

/areas SERVICES GROUP_MGMT USER_RIGHTS SECURITYPOLICY


--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

Karl's fix worked! Excellent. Thank you very much.

I'd love to know why it worked, if you have any ideas.

TT

"Torgeir Bakken (MVP)" <Torgeir.Bakken-> wrote in message
news:%23VZs$...
> Tom Treadway wrote:
>
>> I think I don't have access rights to wuauserv.dll. If I run "sc sdshow
>> wuauserv" I get "OpenService FAILED 5: Access is denied." I get the
>> same error if I try to set rights via "sc sdset wuauserv".
>>
>> I get the same error if I go into Services and right-click on "Automatic
>> Updates". I also have no ability to start, stop, etc., the service.
>>
>> If I look at the wuauserv.dll properties Security tab, I see Full Control
>> for Administrators, Power Users, SYSTEM and Users. Everything is
>> selected except for Special Permissions. Also, the Allow column for
>> Administrators and SYSTEM is grayed out.
>>
>> I noticed this problem when I tried to manually do Windows Update and got
>> error 0x800A0046. I tried many suggested solutions, including verifying
>> that the "Impersonate a client after authentication" list contains
>> Administrators, ASPNET and SERVICE.
>>
>> I am part of the Administrators group, and have also tried logging in as
>> Administrator when attempting Windows Update as well as "sc sdshow".
>>
>> I've tried reinstalling by executing "c:\windows\system32\rundll32.exe
>> setupapi,InstallHinfSection DefaultInstall 132 C:\windows\inf\au.inf". I
>> get no errors, but it doesn't fix the problem.
>>
>> I'm running XP Pro with SP2 and Windows Update v5.
>
snip
> From: "Karl B" <>
> Subject: Possible solution to the windows update 0x800A0046 problem
> Date: Sun, 30 May 2004 12:03:39 +0100
> Newsgroups: microsoft.private.xpsp2.general
>
> Firstly, I take no credit for this I was going though the network
> newsgroup because my dialup network settings had vanished and a guy
> named Melvin Salazar suggested the following which WORKED!
>
> 'You can also try doing the following, it worked for me:
>
> Go to Services under the Administrative Tools folder.
>
> Notice that the logon account is set to a NT/User account under the RPC
> (remote procedure call) service. Change it to Local System account,
> under the Logon tab, and restart the computer. Many of these services
> depend on the RPC, but there was an error when it came to configuring
> this paticular service.'
>
> Now once I made these changes I was able to get my network icons back
> as well as use Windows Update.
>
> Thanks
> Karl
snip

Tom Treadway wrote:

> Karl's fix worked! Excellent. Thank you very much.
>
> I'd love to know why it worked, if you have any ideas.
Hi

I have no idea why changing the logon account for the RPC service
solves this problem (error 0x800A0046) in some cases, but I know
it have fixed this error for several people.

Pre-WinXP SP2, the logon account for the RPC service was default set
to "Local System Account". To tighten security, SP2 changes this to
"NT Authority\NetworkService", and this sometimes causes trouble.


--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

One other bit of info that may help other folks:

With these fix I was able to run update. However I noticed that I still
couldn't control the wuauserv service. My rights still didn't allow it. I
found that I could fix it in two steps:

(1) Remove the key
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\wuauserv]

(2) Reinstall Windows Update by running "c:\windows\system32\rundll32.exe
setupapi,InstallHinfSection DefaultInstall 132 C:\windows\inf\au.inf".

After this, you'll notice that the Security key under wuauserv will change.
So I suppose it's possible to probably just replace the key instead of
deleting and reinstalling, but I haven't tried that yet.

I'm sure that once I put my machine back on the domain at work, the AD
server will change my rights back. But for now, I can control wuauserv.

Enjoy,
TT

"Torgeir Bakken (MVP)" <Torgeir.Bakken-> wrote in message
news:...
> Tom Treadway wrote:
>
>> Karl's fix worked! Excellent. Thank you very much.
>>
>> I'd love to know why it worked, if you have any ideas.
> Hi
>
> I have no idea why changing the logon account for the RPC service
> solves this problem (error 0x800A0046) in some cases, but I know
> it have fixed this error for several people.
>
> Pre-WinXP SP2, the logon account for the RPC service was default set
> to "Local System Account". To tighten security, SP2 changes this to
> "NT Authority\NetworkService", and this sometimes causes trouble.
>
>
> --
> torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/scr...r/default.mspx

Tom Treadway wrote:

> One other bit of info that may help other folks:
>
> With these fix I was able to run update. However I noticed that I still
> couldn't control the wuauserv service. My rights still didn't allow it. I
> found that I could fix it in two steps:
>
> (1) Remove the key
> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\wuauserv]
>
> (2) Reinstall Windows Update by running "c:\windows\system32\rundll32.exe
> setupapi,InstallHinfSection DefaultInstall 132 C:\windows\inf\au.inf".
>
> After this, you'll notice that the Security key under wuauserv will change.
> So I suppose it's possible to probably just replace the key instead of
> deleting and reinstalling, but I haven't tried that yet.
>
> I'm sure that once I put my machine back on the domain at work, the AD
> server will change my rights back.

Maybe, but my gut feeling says that it will not, time
will tell though ;-)


--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

I hope you're right. :-) But unfortunately I got this working once before
(using a random method of just hacking around, so I'm not sure what I did to
fix it before) and as soon as I took the machine back to work, voila! The
rights were set back and I couldn't run update.

I saved my "good" registry settings, so I'm looking forward to simply
reapplying those and seeing if it fixes the problem.

BTW, is the Security key the place where the DACL is saved?

TT


"Torgeir Bakken (MVP)" <Torgeir.Bakken-> wrote in message
news:...
> Tom Treadway wrote:
>
>> One other bit of info that may help other folks:
>>
>> With these fix I was able to run update. However I noticed that I still
>> couldn't control the wuauserv service. My rights still didn't allow it.
>> I found that I could fix it in two steps:
>>
>> (1) Remove the key
>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\wuauserv]
>>
>> (2) Reinstall Windows Update by running "c:\windows\system32\rundll32.exe
>> setupapi,InstallHinfSection DefaultInstall 132 C:\windows\inf\au.inf".
>>
>> After this, you'll notice that the Security key under wuauserv will
>> change. So I suppose it's possible to probably just replace the key
>> instead of deleting and reinstalling, but I haven't tried that yet.
>>
>> I'm sure that once I put my machine back on the domain at work, the AD
>> server will change my rights back.
>
> Maybe, but my gut feeling says that it will not, time
> will tell though ;-)
>
>
> --
> torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/scr...r/default.mspx

Tom Treadway wrote:

> I hope you're right. :-) But unfortunately I got this working once before
> (using a random method of just hacking around, so I'm not sure what I did to
> fix it before) and as soon as I took the machine back to work, voila! The
> rights were set back and I couldn't run update.
>
> I saved my "good" registry settings, so I'm looking forward to simply
> reapplying those and seeing if it fixes the problem.
>
> BTW, is the Security key the place where the DACL is saved?
Hi

I don't know...


--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx