[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

XPSP3 - Automatic Updates service permissions say DENY - how can I get back to allow?

Posted on 2013-10-29
8
Medium Priority
?
396 Views
Last Modified: 2013-11-06
Earlier today, I set the permissions for the Automatic Updates service (wuauserv) to DENY. I've tried:

regsvc32.dll command lines in safe mode
Multiple user accounts

Any ideas?

Thanks
automatic-update.JPG
0
Comment
Question by:triphen
  • 5
  • 2
8 Comments
 

Author Comment

by:triphen
ID: 39610204
Thinking about using SubInACL to grant full permissions to admin.
0
 
LVL 44

Expert Comment

by:Davis McCarn
ID: 39611348
How did you set the permissions to deny, exactly?
0
 
LVL 26

Assisted Solution

by:Lionel MM
Lionel MM earned 1500 total points
ID: 39611380
try this--I use it from time to time when windows updates fail--copy to a batch file and run

@echo off
Net Send * You are about to permissions
pause

secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose

secedit.exe /analyze /db C:\WINDOWS\sectest.db /cfg C:\WINDOWS\inf\defltwk.inf /log C:\WINDOWS\security\logs\secanalyze.log

secedit.exe /configure /db C:\WINDOWS\sectest.db /cfg C:\WINDOWS\inf\defltwk.inf /log C:\WINDOWS\security\logs\secrepair.log

cipher /A /D c:\windows\system32\catroot\*.*

cipher /A /D C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\*.*

Subinacl /service wuauserv /sddl=D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)

Sc sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f

subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f

subinacl /subdirectories %SystemDrive% /grant=administrators=f

 subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f

subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f

subinacl /subdirectories %SystemDrive% /grant=system=f

@Echo =========================
@Echo Finished.
@Echo =========================
@pause
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:triphen
ID: 39612441
To Davis: Process explorer>svchost process properties>services>permissions>deny
0
 

Author Comment

by:triphen
ID: 39612444
Lionel: your script ran and now I am waiting for Microsoft Update to check for updates.
0
 

Author Comment

by:triphen
ID: 39614618
Unfortunately, MS Update hung at Checking for Updates... overnight. Tried to restart it this morning, got the same error.
0
 
LVL 26

Accepted Solution

by:
Lionel MM earned 1500 total points
ID: 39616389
Try this--I have had some success but not always
http://support.microsoft.com/mats/windows_update/
0
 

Author Comment

by:triphen
ID: 39628529
Ended up unregistering the windows update .dll.
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this post we will be converting StringData saved within a text file into a hash table. This can be further used in a PowerShell script for replacing settings that are dynamic in nature from environment to environment.
Unable to change the program that handles the scan event from a network attached Canon/Brother printer/scanner. This means you'll always have to choose which program handles this action, e.g. ControlCenter4 (in the case of a Brother).
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question