No permission to install SP1?

I'm trying to install SP1 on my only W2k3 server. Whenever I try to install
it, I get a message that says:

"You do not have permission to update Windows Server 2003.
Please contact your system administrator."

The frustrating thing is that I am the system administrator and am logging
on locally with the administrator account. WTF?

I have a group policy that prevent users from installing SP2 for XP but that
policy is not applied to the servers.

This is what shows in the setup log:

0.610: 2005/04/01 08:30:54.464 (local)
0.610: D:\sp1\i386\update\update.exe (version 5.6.1013.0)
0.610: Failed To Enable SE_SECURITY_PRIVILEGE
0.610: Setup encountered an error: You do not have permission to update
Windows Server 2003.
Please contact your system administrator.
0.610: UnRegisterSpuninstForRecovery, failed to delete SpRecoverCmdLine
value, error 0x2
0.610: DoInstallation: Failed to unregistering spuninst.exe for recovery.
0.610: You do not have permission to update Windows Server 2003.
Please contact your system administrator.
1.813: Message displayed to the user: You do not have permission to update
Windows Server 2003.
Please contact your system administrator.
1.813: User Input: OK
1.813: Update.exe extended error code = 0xf004
1.813: Update.exe return code was masked to 0x643 for MSI custom action
compliance.

I found the solution.

I have an Exchange server and it modified the default domain policy so that
only Exchange Domain Servers and Backup could Manage Auditing & Security
Log.

Once I added Administrators, I could install the service pack.

[AlanLawrence]

Fast forward to November 2009. I rebuilt an older PC using the CD from 2004 and then wanted to apply service packs to bring the PC up to date. None of the Microsoft service packs or updates could be installed AFTER I joined the PC to our domain.

Eventually I discovered this note from early 2005:

"Brian S. Longworth" <blongworth@opalco.com> wrote in message
> I found the solution.
>
> I have an Exchange server and it modified the default domain policy so
> that only Exchange Domain Servers and Backup could Manage Auditing &
> Security Log.
>
> Once I added Administrators, I could install the service pack.


In my case, looking at gpedit.msc for "Manage auditing and security log"
below Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment I found that only our DOMAIN\Exchange Servers was listed. The option to modify the list of users was disabled. So I went to our domain controller and found the Exchange Servers entry and looked at it. It did not include the Administrator, so I added it.

And now I am able to do the updates.

[deview]

Start run gpedit.msc
Under Computer Configuration, click Windows Settings. Click Security Settings, click Local Policies, and then click User Rights Assignments
The user rights that are required by Update.exe
See http://support.microsoft.com/kb/888791

[vishwanath.kale]

I am trying the same solution mentioned here

I have an Exchange server and it modified the default domain policy so that
only Exchange Domain Servers and Backup could Manage Auditing & Security
Log.

Once I added Administrators, I could install the service pack.

But while adding administrators group i get an error of File access denied... file not saved... to the path -
\\dc\SYSVOL\domain.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}

Please Help

Thanks in advance

Vishwanath

+91 9922996169

[JAMES_911]

Originally Posted by vishwanath.kale

I am trying the same solution mentioned here

[i]
But while adding administrators group i get an error of File access denied... file not saved... to the path -
\\dc\SYSVOL\domain.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}

First of all you will need to obtain the latest service pack for your Windows Server 2003 from here. After you have applied this service pack, follow these steps:

• Click Start, click Run, type regedit in the Open box, and then click OK.
• In Registry Editor, locate the following registry subkey:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
• If the WaitForNetwork entry is missing, you must add the entry. To do this, follow these steps:
• Right-click the Winlogon subkey, click New, and then click Dword Value.
• In the Value name box, type WaitForNetwork.
• Right-click WaitForNetwork, and then click Modify.
• In the Edit DWORD Value dialog box, in the Value Data box, type 1, and then click OK.
• Close Registry Editor.

[vishwanath.kale]

Dear James 911

Thanks for the reply

Plese go through my query again... i am using the solution given by Brian S. Longworth and trying to solve my error at hotfix installations.

There i am getting an error while adding administrators group to the policy permissions "Manage auditing and security log"

I have an Exchange server and it modified the default domain policy so that
only Exchange Domain Servers and Backup could Manage Auditing & Security
Log.

Please Help.

Thanks in advance

Vishwanath

+91 - 9922996169