Windows Server 2003 SP2 Fails - 'Access is Denied' (PLEASE HELP)

SteveR · 04-12-2007

I have search high and low for any anwswer to my Windows Server 2003 SP2
upgrade, but I have not been able to find an answer.

I am trying to upgrade my server from RTM to SP2. Each time I try to apply
SP2 it fails with 'Access is Denied'. Then the system rolls back its changes.

I have reviewed the svcpack.log file. Here is a copy of the tail end of the
file.

1030.390: Starting process: C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\sysdm.cpl,EnableExecuteProtectionSupport
1031.937: Return Code = 0
1031.937: Num Ticks for Copying files : 417797
1031.937: Starting process: C:\WINNT\uddisp.exe install
"c:\winnt\softwaredistribution\download\997d565a9b554014a4a76b1acff3b71d\i386\\"
1032.609: Return Code = 0
1032.953: DoRegistryUpdates:UpdSpInstallFromInfSection Failed for
ProductInstall.GlobalRegistryChanges.Install error: 0x5
1032.953: INF_REGISTRY Failed
1032.953: DoInstallation:DoRegistryUpdates failed
1053.125: Unregistration of sprecovr successful
1053.359: Access is denied.
31416.718: Message displayed to the user: Access is denied.
31416.718: User Input: OK
31416.734: Service Pack 2 installation did not complete.

Select 'OK' to undo the changes that have been made.
31417.390: Message displayed to the user: Service Pack 2 installation did
not complete.

Select 'OK' to undo the changes that have been made.
31417.390: User Input: OK
31417.390: Starting process:
C:\WINNT\$NtServicePackUninstall$\spuninst\spuninst.exe /~ -u -z
31919.500: Software Update Rollback has completed with return code 0xbc2.
This rollback requires a reboot.
31919.515: Service Pack 2 installation did not complete.

As you can see, it is not very helpful.

I then tried modifying the
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\LogLevel entry. I tried
changing this value to xFFFF in order to get more versbose information in the
setupapi.log file, but nothing help appeared in this file. In fact, prior to
starting the SP2 upgrade, the value of LogLevel was xFFFF. After starting
the SP2 upgrade, LogLevel was changed to x200000000. This overrides my xFFFF.

I am at a loss, any help would be appreciated.

Jabez Gan [MVP] · 04-12-2007

Hmm... What permission does the user account has? Have you tried using the
built in Administrator account to do the installation?

Also try renaming the softwaredistribution folder to softwaredistribution_
and re-run the installer...

SteveR · 05-12-2007

i am running the sp2 update as a member of the local adminstrators group. I
have even tried to run under the administrator username but this did not work
either.

I tried your suggestion of renaming SoftwareDistibution. Unforatunately,
something had a lock on this folder. I checked permissions and
administrators had full-access. So, I renamed each of the sub-folders within
SD. For example, DataStore became DataStore_.

This update still failed.

This time I have a different error message.

1186.062: Starting process: C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\sysdm.cpl,EnableExecuteProtectionSupport
1188.172: Return Code = 0
1188.172: Num Ticks for Copying files : 491203
1188.172: Starting process: C:\WINNT\uddisp.exe install
"c:\22bc4df21616c092ee65fc\i386\\"
1189.172: Return Code = 0
1189.422: DoRegistryUpdates:UpdSpInstallFromInfSection Failed for
ProductInstall.GlobalRegistryChanges.Install error: 0x5
1189.422: INF_REGISTRY Failed
1189.422: DoInstallation:DoRegistryUpdates failed
1211.406: Unregistration of sprecovr successful
1211.656: Access is denied.
1321.281: Message displayed to the user: Access is denied.
1321.281: User Input: OK
1321.312: Service Pack 2 installation did not complete.

Select 'OK' to undo the changes that have been made.
1326.703: Message displayed to the user: Service Pack 2 installation did not
complete.

Select 'OK' to undo the changes that have been made.
1326.703: User Input: OK
1326.719: Starting process:
C:\WINNT\$NtServicePackUninstall$\spuninst\spuninst.exe /~ -u -z
1873.047: Software Update Rollback has completed with return code 0xbc2.
This rollback requires a reboot.
1873.047: Service Pack 2 installation did not complete.

What can I do to get more information? I have read on the web that by
setting the LogLevel to xFFFF you can get more detail information. All these
tips referred to XP. This does not seem to work for WS 2003.

Thanks again for your help.

Jabez Gan [MVP] · 05-12-2007

Please stop the service Automatic update and rename the SoftwareDistribution
folder, and re-start the Automatic Update service.

If it still fails, try rebootign to safe mode and see if you can do the
installation there... If it fails, post the latest 2 log files ;)

Please zip the log file and email to me at mingteikg [ at ] mvps. org

It could take some time before I respond back through email, so please be
patient ;)

No problem. Which files do you want me to include?

Just the latest log file and tell me how did you try to install the last
time :)

Seemed to me that one or more of your registry key do not have the
permission to be modified by your current user.

I havent try this program yet but, please backup your registry and use this
registry fix software: http://www.freeregistryfix.com/

Once done, try installign again.

Since verbose logging has been reported that it doesn't work on Sp2, you
might need to use a registry monitoring tool: Process monitor. Whle the
setup is running, please run Process monitorto catch all registry read/write
access. Filter out the process to only show update.exe (if you are running
this file to isntall).

Process monitor can be found at:
http://www.microsoft.com/technet/sys...ssmonitor.mspx

For secedit, it is used to compare security templates. You can try that but
it might not work - if the registry is corrupted and not caused by the any
group policy security template.

SteveR · 09-12-2007

I rebooted in SAFE Mode so that I could rename the SoftwareDistribution
folder. After renaming the folder, I rebooted my server in standard mode. I
then went to Windows Update, had the service check for the latest updates, it
detected Windows Server 2003 SP2. I downloaded it (i wanted to get a fresh
copy). Then I went through the update process and it Failed again. :-(
Bummer...

Is there some type of security audit I can run that reset registry settings
to the defaults (e.g., secedit)

I tried including the log files but there is a little to the size of an
email you can post. Is it possible I can email you the files?

here is the latest update.

As you suggested, I downloaded the freeRegistryFix program. I ended up
purchasing the tool because the free version does not clean beyond a certain
number of errors. I ran the utility a few times to clear out all of the
irregularities in the registry. There were quite a few.

I tried running the Sp2 update again and it failed again.

I was not able to get the Process MOnitor running (it could not load the
device driver). So I loaded the RegMon tool instead. I believe it will give
the same info.

I saved the log file. Below is the "tail -14 RegMon.log" of the log file.
When the process name switches from update.exe:3908 to explorer.exe:2416,
that is when the "Access is defined" message appears.

178488 1433.25622559 update.exe:3908 OpenKey HKLM\System\CurrentControlSet\Control\ComputerName REPARSE
178489 1433.25622559 update.exe:3908 OpenKey HKLM\SYSTEM\ControlSet001\Control\ComputerName SUCCESS
178490 1433.25634766 update.exe:3908 OpenKey HKLM\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName SUCCESS
178491 1433.25634766 update.exe:3908 QueryValue HKLM\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName\ComputerName SUCCESS "HOMER"
178492 1433.25634766 update.exe:3908 CloseKey HKLM\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName SUCCESS
178493 1433.25646973 update.exe:3908 CloseKey HKLM\SYSTEM\ControlSet001\Control\ComputerName SUCCESS
178494 1433.28466797 explorer.exe:2416 OpenKey HKCU\Software\Classes\Applications\update.exe NOT FOUND
178495 1433.28479004 explorer.exe:2416 OpenKey HKCR\Applications\update.exe NOT FOUND
178496 1433.28491211 explorer.exe:2416 QueryValue HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINNT\SoftwareDistribution\Download\997d565a 9b554014a4a76b1acff3b71d\i386\update\update.exe SUCCESS "Windows
Service Pack Setup"
178497 1433.28527832 explorer.exe:2416 OpenKey HKCU\Software\Classes\Applications\update.exe NOT FOUND
178498 1433.28527832 explorer.exe:2416 OpenKey HKCR\Applications\update.exe NOT FOUND
178499 1433.28540039 explorer.exe:2416 QueryValue HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINNT\SoftwareDistribution\Download\997d565a 9b554014a4a76b1acff3b71d\i386\update\update.exe SUCCESS "Windows
Service Pack Setup"
178500 1433.28662109 explorer.exe:2416 OpenKey HKCU\Software\Classes\Applications\update.exe NOT FOUND
178501 1433.28662109 explorer.exe:2416 OpenKey HKCR\Applications\update.exe NOT FOUND

Jabez Gan [MVP] · 10-12-2007

sorry to hear that it didn't work...

Can you do a quick check of which process that is giving the access is
denied? Im asking this because explorer.exe is showing NOT FOUND instead of
ACCESS DENIED.

Also, run the installer with /verbose /ER /log:%userprofile%\desktop

It will force the installer to run with verbose and will show detailed error
message. Have the file Zipped and send to my email again :)

Alan Hardisty · 12-12-2007

I had a similar problem (for the first time ever updating a customers server) and found the following microsoft KB article, which I followed and it resolved my problem.

The KB article is KB873148 (http://support.microsoft.com/kb/873148/en-us) and I completed the section below:

Method 2: Reset your operating system back to the default settings

To reset your operating system back to original installation default security settings, follow these steps:1. Click Start, click Run, type cmd, and then press ENTER.

2. Type secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose, and then press ENTER.

You receive a "Task is completed" message, and a warning message that something could not be done. You can safely ignore this message. For more information about this message, view the %windir%\Security\Logs\Scesrv.log file.

SP2 happily installed after this.

I have seen this problem and found out it was because the local administrator account was renamed, screwing with registry permissions...

It's your registry. The account your using to install the service pack doesn't have permission to certain keys. The long way to fix this is to enable verbose (microsoft has an article on how to do this) reinstall the pack, then read the logs and see which keys are failing. Then goto those keys highlight the key, right click select permissions and make sure the account your using has full rights.

Or the easy way and fastest is to just open regedit, highlight every root key, select permissions and give your account full permissions to every hive. I did this and it worked. Once complete. undo what you did.

**fpilo** · 08-07-2010

I have the same problem, but after doing all I saw in this thread I still am not able to install the SP2 in my server.

below the svcpack.log i receive:

[svcpack.log]
2.203: ================================================================================
2.203: 2010/07/08 10:51:33.171 (local)
2.203: d:\7127ed239e03e7ddedff\i386\update\update.exe (version 6.3.4.1)
2.218: Service Pack started with following command line:
2.234: In Function GetBuildType, line 1170, RegOpenKeyEx failed with error 0x2
2.500: Return Value From OnACPower = 1
2.500: OnACPower returned value( 0x1 ) which is Equal To 0x1
2.500: Condition succeeded for section OnACPower.Section in Line 1 of PreRequisite
2.640: InternalFileName of C:\WINDOWS\system32\HAL.DLL is Not Equal To halcmpx.dll
2.640: Condition succeeded for section CustomHalUnisysBlock.Section in Line 2 of PreRequisite
2.640: InternalFileName of C:\WINDOWS\system32\HAL.DLL is Not Equal To Unisys CMP Server ACPI HAL
2.640: First Condition in CustomHalUniSysBlock.Section2 Succeeded
2.640: Condition succeeded for section CustomHalUniSysBlock.Section2 in Line 3 of PreRequisite
2.656: InternalFileName of C:\WINDOWS\system32\HAL.DLL is Not Equal To HALSRAAC.DLL
2.656: Condition succeeded for section CustomHalStratusBlock.Section in Line 4 of PreRequisite
2.656: InternalFileName of C:\WINDOWS\system32\HAL.DLL is Not Equal To halce52.dll
2.656: Condition succeeded for section CustomHalMarathonBlock.Section in Line 5 of PreRequisite
2.656: Service SpUpdSvc Not Registered in SCM 0x424
2.656: Condition succeeded for section SpUpdSvcBlock.Section in Line 6 of PreRequisite
2.656: Start is Present
2.656: SYSTEM\CurrentControlSet\Services\MSDTC\Start is Not Equal To Specified Value
2.656: Second Condition in MSDTC.Not.Disabled Succeeded
2.656: Condition succeeded for section MDSTC.Check.Disabled in Line 7 of PreRequisite
2.656: C:\WINDOWS\system32\DRIVERS\elxsli2.sys is Not Present
2.656: First Condition in Emulex.Driver.Compat.Check.Section Succeeded
2.656: Condition succeeded for section Emulex.Driver.Compat.Check.Section in Line 8 of PreRequisite
2.656: C:\WINDOWS\system32\DRIVERS\ql40xx.sys is Not Present
2.656: First Condition in Qlogic.Driver.Compat.Check.Section Succeeded
2.656: Condition succeeded for section Qlogic.Driver.Compat.Check.Section in Line 9 of PreRequisite
2.656: HotfixRefreshRequired is Not Present

**beyeneabdu** · 05-12-2011

Thank You !! I can update SP2 after i used the Method 2: Reset your operating system back to the default settings. But with the Method 1 of microsoft (http://support.microsoft.com/kb/873148) can not be done( for Me, in fact)