client windows updates fail

[Guest Leonard]

we run 2 windows 2003 server one of which is an exchange server 2003

 

we had about 15 client xp pro clients

 

when I run windows updates on the xp clients and the exchange server all the

updates fail, even if I try and download individual updates from microsoft

and install them I get the message that i do not have permission to install

these

 

Even though I am logged on as an administrator

 

the windwos 2003 DC downloads and installs updates on

 

this it might be the group policy but have no idea how to check this and or

rectify it

 

hope you can help

[Guest Ace Fekay [MVP]]

Re: client windows updates fail

 

In news:61DEC743-3D82-4D89-927C-1AEC7FF124DF@microsoft.com,

Leonard <Leonard@discussions.microsoft.com> typed:

> we run 2 windows 2003 server one of which is an exchange server 2003

>

> we had about 15 client xp pro clients

>

> when I run windows updates on the xp clients and the exchange server

> all the updates fail, even if I try and download individual updates

> from microsoft and install them I get the message that i do not have

> permission to install these

>

> Even though I am logged on as an administrator

>

> the windwos 2003 DC downloads and installs updates on

>

> this it might be the group policy but have no idea how to check this

> and or rectify it

>

> hope you can help

 

It would have been much easier to research this for you if you posted the

*exact* error message along with the error number.

 

What is the error number? Is it 0x8007F004, 0x80092026, 0x800b0004 or

0x8DDD0002?

 

Hmm, every machine in the domain? It sounds like the default security

settings at the domain level were altered to increase security or something

else installed that increased security. Were the default drive permissions

altered on each machine? Is there a policy in place in the Default Domain

GPO with increased security restrictions?

 

How to reset security settings back to the defaults:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;313222

 

It could also be something simple as the clocks are not synched up and it is

failing authentication. Are you seeing any W32Time errors in the event logs?

Kerberos authentication uses the clock as one of the checks to insure the

authentication traffic is not being replayed. Are you having other problems

such as netlogon issues on the DC? Are you only pointing to your internal

DNS server in all of your machines or is there an ISP's DNS address in your

machine's IP properties?

 

If error 0x8DDD0002

You receive an "Administrators only" error message when you try to visit the

Windows Update Web site or the Microsoft Update Web site:

http://support.microsoft.com/?id=316524

 

 

--

Regards,

Ace

 

This posting is provided "AS-IS" with no warranties or guarantees and

confers no rights.

 

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,

MVP Microsoft MVP - Directory Services

Microsoft Certified Trainer

 

Infinite Diversities in Infinite Combinations

[Guest Leonard]

Re: client windows updates fail

 

well I am making progress

 

reset security setting on 1 pc and that seamed to work but on a 2nd pc I

have to manually install the windows genuine advantage tool kb892130

 

IE7 now loaded ok and installed

 

then I ran windows update again and the following updates fail to install

and they all have the same error code :Error Code: 0x8007F004

 

Update for Windows XP (KB896344)

Update for WMDRM-enabled Media Players (KB891122)

Microsoft Base Smart Card Cryptographic Service Provider Package: x86

(KB909520)

Update for Windows XP (KB920342)

Remote Desktop Connection (Terminal Services Client 6.0) for Windows XP

(KB925876)

Security Update for Internet Explorer 7 for Windows XP (KB938127)Error Code:

0x8007F004

Microsoft .NET Framework 3.0: x86 (KB928416)Error Code: 0x8007F004

Windows Media Player 11 Error Code: 0x8007F004

 

 

hope you can help further

 

thanks for your help so far

 

"Ace Fekay [MVP]" wrote:

> In news:61DEC743-3D82-4D89-927C-1AEC7FF124DF@microsoft.com,

> Leonard <Leonard@discussions.microsoft.com> typed:

> > we run 2 windows 2003 server one of which is an exchange server 2003

> >

> > we had about 15 client xp pro clients

> >

> > when I run windows updates on the xp clients and the exchange server

> > all the updates fail, even if I try and download individual updates

> > from microsoft and install them I get the message that i do not have

> > permission to install these

> >

> > Even though I am logged on as an administrator

> >

> > the windwos 2003 DC downloads and installs updates on

> >

> > this it might be the group policy but have no idea how to check this

> > and or rectify it

> >

> > hope you can help

>

> It would have been much easier to research this for you if you posted the

> *exact* error message along with the error number.

>

> What is the error number? Is it 0x8007F004, 0x80092026, 0x800b0004 or

> 0x8DDD0002?

>

> Hmm, every machine in the domain? It sounds like the default security

> settings at the domain level were altered to increase security or something

> else installed that increased security. Were the default drive permissions

> altered on each machine? Is there a policy in place in the Default Domain

> GPO with increased security restrictions?

>

> How to reset security settings back to the defaults:

> http://support.microsoft.com/default.aspx?scid=kb;EN-US;313222

>

> It could also be something simple as the clocks are not synched up and it is

> failing authentication. Are you seeing any W32Time errors in the event logs?

> Kerberos authentication uses the clock as one of the checks to insure the

> authentication traffic is not being replayed. Are you having other problems

> such as netlogon issues on the DC? Are you only pointing to your internal

> DNS server in all of your machines or is there an ISP's DNS address in your

> machine's IP properties?

>

> If error 0x8DDD0002

> You receive an "Administrators only" error message when you try to visit the

> Windows Update Web site or the Microsoft Update Web site:

> http://support.microsoft.com/?id=316524

>

>

> --

> Regards,

> Ace

>

> This posting is provided "AS-IS" with no warranties or guarantees and

> confers no rights.

>

> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,

> MVP Microsoft MVP - Directory Services

> Microsoft Certified Trainer

>

> Infinite Diversities in Infinite Combinations

>

>

>

>

[Guest Ace Fekay [MVP]]

Re: client windows updates fail

 

In news:F63749AA-E63A-46C1-A51E-FDA819942887@microsoft.com,

Leonard <Leonard@discussions.microsoft.com> typed:

> well I am making progress

>

> reset security setting on 1 pc and that seamed to work but on a 2nd

> pc I have to manually install the windows genuine advantage tool

> kb892130

>

> IE7 now loaded ok and installed

>

> then I ran windows update again and the following updates fail to

> install and they all have the same error code :Error Code: 0x8007F004

>

> Update for Windows XP (KB896344)

> Update for WMDRM-enabled Media Players (KB891122)

> Microsoft Base Smart Card Cryptographic Service Provider Package: x86

> (KB909520)

> Update for Windows XP (KB920342)

> Remote Desktop Connection (Terminal Services Client 6.0) for Windows

> XP (KB925876)

> Security Update for Internet Explorer 7 for Windows XP

> (KB938127)Error Code: 0x8007F004

> Microsoft .NET Framework 3.0: x86 (KB928416)Error Code: 0x8007F004

> Windows Media Player 11 Error Code: 0x8007F004

>

>

> hope you can help further

>

> thanks for your help so far

 

My pleasure. Let's see if I can help. It seems error 0x8007F004 points to an

IE issue, possibly trusted zones, IE security levels too high, ActiveX not

allowed, or digital sigs control is damaged, but on the whole domain?

 

That's why I am still thinking you have domain level security set really

high. f you had to set it on one workstation and it partially worked, it's

telling me you set something domain wide. Was there a high secure template

set at the domain level? What exactly did you do at the domain level as far

as security?

 

Maybe when you restarted after the IE7 install, the domain security settings

applied again at logon and/or startup and locked itself down.

 

 

For what it's worth, error 0x8007F004 points to the following hits. Try the

Microsoft one first.

 

Error 0x800B0004 The subject is not trusted for the specified action:

http://support.microsoft.com/kb/555334

 

Windows Update Fails - Error 0x800B0004 - PDF version:

http://www.updatexp.com/support-files/0x800b0004.pdf

 

Windows Update Fails - Error 0x800B0004:

http://www.updatexp.com/0x800B0004.html

 

Ace