locked
Intermittent access denied errors when using windows update RRS feed

  • Question

  • I have been struggling for a while to resolve a problem with some manually intiated windows update tasks failing with access denied errors. I have tried many of the suggested fixes to registry acls, dcom permissions etc, all to no avail.

    A common feature of all the various failures is that the following error message is logged in windowsupdate.log.

    2009-04-21 13:21:09:552 1224 1400 Service WARNING: GetUserTokenFromSessionId failed with error 80070005 for session 1

    The simplest sequence of events I can use to provoke this error, is to go to the windows update in the control panel and select "Check for updates". This displays an information box saying that "administrator permission is required" even though the login I am using has that permission, and logs the above message. I can also get the same message logged if I select "View Update History", in this case no message box is displayed but the subsequent history display is empty.

    However, on some occassions, when I do these tests, they work exactly as expected and no error messages are logged. I have not yet been able to determine exactly what circumstances appear to in force when the tests work, but it does appear that it has something to do with wuausrv already being active processing an automatically initiated task.

    This is giving me great concern as it appears that there are some circumstances when and access control check is being performed (and failing) and some when it either not being performed at all or being performed and working with the same set of credentials that previously failed!

    Does anyone have any idea of what is going on here and how I can fix it? Preferably without having reinstall the OS (Vista Home Premium).

    I am speculating that at some point wuausrv is making a call to something like WTSQueryUserToken and this is (sometimes) failing because the current context that wuauserv is running in does not have SE_TCB_NAME privilege. But how this can occur intermittently I don't have a clue about.

    Help.

    Roger

    Tuesday, April 21, 2009 2:29 PM

Answers

  • Hi Roger, as this forum focuses on Windows Vista security specific issues, I recommend you submit a support incident to our Windows Update support group:

     

    https://support.microsoft.com/oas/default.aspx?gprid=6527

     

    The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction with us.  Thank you for your understanding.


    Sean Zhu - MSFT
    Thursday, April 23, 2009 6:10 AM
    Moderator

All replies

  • Hi Roger, as this forum focuses on Windows Vista security specific issues, I recommend you submit a support incident to our Windows Update support group:

     

    https://support.microsoft.com/oas/default.aspx?gprid=6527

     

    The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction with us.  Thank you for your understanding.


    Sean Zhu - MSFT
    Thursday, April 23, 2009 6:10 AM
    Moderator
  • Hi Roger, as this forum focuses on Windows Vista security specific issues, I recommend you submit a support incident to our Windows Update support group:

     

    https://support.microsoft.com/oas/default.aspx?gprid=6527

     

    The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction with us.  Thank you for your understanding.


    Sean Zhu - MSFT

    Sean,

    I am afraid I already tried submitting a support incident. It was quite detailed and included a list of the things I had already tried. I got a vanilla response which  suggested a number of things I should try, all of which where in the list I had already submitted. I have also a posted a similar question on the Windows Update forum and got no response. I was trying here because the problem appears to be related to access control. Anyway thanks for at least giving me a reply! I will try raising a support incident again.

    Roger
    Thursday, April 23, 2009 5:45 PM
  • Hi Roger,

    please ask for help also in the Microsoft Windows Update specific newsgroup.

    In your newsreader:
    news://msnews.microsoft.com/microsoft.public.windowsupdate

    Via Web:

    http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.windowsupdate

    Hope this helps! :-)

    Vincenzo Di Russo - Microsoft MVP Windows Internet Explorer, Windows Desktop Experience & Security - Since 2003. ~ My Blog: http://blogs.dotnethell.it/vincent/
    Friday, April 24, 2009 11:57 AM