Troubleshooting Permission Errors While Updating Software

Change log:

  • Updated on April 8, 2008, with information on Norton Internet Security and Windows Installer 3.1.

 

A number of people are reporting errors when running software update tools. The tools include Windows Update, Windows Defender Updates, Installshield, Adobe Updater, and probably others as well. The errors include 80070005 (from Windows tools) and c0000005 (from others). To see if we can help people get their software updates, Steve Wechsler helped me put together some troubleshooting steps. If these steps help, and more so if they don't, we'd like to hear about it. If you find something else that helps, let us know by posting a comment.

 

All these errors indicate a permissions issue of some kind. All of them basically mean "Access Denied". However, determining exactly what the cause is can be difficult. There seem to be two main reasons why this is happening: multiple firewalls on the same computer, and a permissions issue, usually in the registry.

 

Multiple Firewalls
Several people with this problem report that it disappeared when the shut down one of the several firewalls they had on their computer. If you have installed a security suite, such as Norton Internet Security, on a Windows Vista computer, you have multiple firewalls. That, in and of itself, is not a problem as long as only one of them is running. However, if two, or more, are running at the same time, you will run into trouble. Some third-party firewalls appear to fail to properly disable the built-in Windows Firewall. If you have a third-party security suite installed, take the following steps to ensure the Windows Firewall with Advanced Security is turned off:

  1. Click the Window button (the start menu)
  2. In the search dialog, type "Windows Firewall"
  3. In a few seconds you will have a couple of results, including one that says "Windows Firewall". Click that one
  4. If the right-hand window says "Windows Firewall is on" click "Change settings"
  5. Accept the User Account Control prompt by clicking "Continue"
  6. Select the "Off (not recommended)" radio button and click OK. WARNING: do not do this unless you are sure you have a third-party firewall!
  7. Attempt to run the updater that failed again.

If this resolves the problem you can resolve it permanently by either leaving Windows Firewall off, or by disabling the third-party firewall. For the most part, they perform the same function, although the built-in firewall typically is far less intrusive and more stable. To disable the third-party firewall refer to the manufacturer's documentation.

 

Permissions Problems

If you do not have two firewalls the problem is almost certainly permissions related. If this is your case you need to resort to advanced troubleshooting tools.

 

Follow these steps carefully. They are written for Windows Vista, but the problem has also affected Windows XP. With only minor modifications (such as the ommission of the UAC elevation-related steps) they work on Windows XP as well.

 

Keep in mind that setting incorrect permissions can significantly harm your computer, to the point where it is either completely insecure, will not boot, or both. There are multiple recommendations out on the Internet that recommend that you change the permissions on large parts of the registry and the operating system. Doing so will render your computer unsupported and disable significant parts of the security sub-system. Surgical precision is key when modifying permissions.

 

  1. First, download Microsoft/System Internals Process Monitor from http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx. Save it somewhere you can remember, such as your Downloads directory or the desktop.
  2. Open the Downloads directory in Windows Explorer (the easiest way is to hold down the Window key and hit E, click your name, and click Downloads)
  3. Right-click ProcessMonitor and select "Extract all..." Walk through the wizard to extract the files
  4. In the window that opens when the extraction is complete, double-click "procmon" or "procmon.exe"
  5. In the "Open File - Security Warning" prompt, uncheck the box that says "Always ask before opening this file" and click Run
  6. Accept the User Account Control prompt by selecting Continue
  7. Accept the license agreement (no, the next time you run the tool you will only have the User Account Control prompt, not all three)
  8. Maximize the window
  9. Hold the CTRL key and hit L
  10. In the drop-down that says "Architecture" select "Result"
  11. In the text box next to "Is" type "ACCESS DENIED" (without the quotes). Here is what it should look like:

  12. Hit the Add button
  13. Hit OK
  14. Hold CTRL and hit X to clear the output window

You now have Process Monitor monitoring all operations on the computer. At this point, retry the updater that fails. If the updater fails with a permissions problem, you should get entries in the Process Monitor window. Each one indicates a potential problem that could harm your ability to install updates, although they may also be unrelated.

 

Here is an example of the types of ACCESS DENIED errors you may see. Note that your process name would not be regedit.exe.
 


To fix the problem you need to set permissions. If you are not comfortable with exactly how to do that, I can help you if you send me the keys that are causing the error. You can do that most easily by clicking CTRL+A in Process Monitor, and then clicking CTRL+C to copy it. Then click the "Comments" link on the right side of the blog to send me a message, and paste the output into it.

 

To fix the problem yourself you can also change the permissions on the registry key (typically) or file that is a problem. I have not yet seen this happen because of file permissions, but if it does, it would be interesting to know. To fix registry permissions problems, do this:

 

  1. Right click the event and select “Jump to...”
  2. Right-click the key that is listed and select “Permissions...”
  3. Click Advanced
  4. Make sure that permissions are at least Full Control for TrustedInstaller, and Read for Administrators and SYSTEM. If that is what you have, and you are using a non-Windows installer (such as Adobe Updater), close the Advanced window, select the Administrators entry, and click the Full Control checkbox
  5. Click OK to close the dialogs.
  6. Retry the update

This will work under the assumption that the proper permissions were overridden on that particular key. In general, permissions on these keys should be Read for everyone except Trusted Installer, as follows:

You may, however, see Administrators have Full Control, or SYSTEM having Full Control. Those are both typically acceptable.

 

If this helps you, and you do not mind, could you please post a comment with the key that was a problem? It would be very interesting if we could figure out if this is caused by some particular piece of software that modifies some particular value.

 

Problems Installing Windows Installer 3.1

After I wrote the original post I was contacted by a gentleman who was getting access violation errors when trying to install Windows Installer 3.1. He had Norton Internet Security (NIS) 2007 installed, and had upgraded the computer from Windows XP Home to Windows XP Pro.

 

After some basic troubleshooting I suggested he remove NIS to see if that resolved the issue. Unfortunately, it would not uninstall because it required Windows Installer to uninstall.

 

As it turns out, Symantec has an article on how to resolve this. It basically involves deleting the old Windows Installer manually.

 

On Windows XP, start by downloading the Windows Installer 3.1 files. Then, open a command prompt running as an administrator and rename/delete these files:

  1. msi.dll
  2. msihnd.dll
  3. msiexec.exe

After that, restart, and install the Windows Installer 3.1 file you downloaded. I have a concern with this approach, however. The DLLs are in use, by at least two processes. Thus, while you can rename them, they will actually remain in place, as shown by this command line output:

C:\WINDOWS\system32>ren msi.dll msi.dll.old

C:\WINDOWS\system32>ren msihnd.dll msihnd.dll.old

C:\WINDOWS\system32>ren msiexec.exe msiexec.exe.old

C:\WINDOWS\system32>dir msi.dll
 Volume in drive C has no label.
 Volume Serial Number is 6050-9DD5

 Directory of C:\WINDOWS\system32

08/04/2004  12:56 AM         2,804,224 msi.dll
               1 File(s)      2,804,224 bytes
               0 Dir(s)  14,033,321,984 bytes free

 

The file gets put back where it belongs even after you do this and reboot. On some systems, those files are under System File Protection:

C:\WINDOWS>dir /s /b msi.dll
C:\WINDOWS\ServicePackFiles\i386\msi.dll
C:\WINDOWS\system32\msi.dll
C:\WINDOWS\system32\dllcache\msi.dll

 

In other words, I do not buy the solution Symantec is listing as a viable solution on all computers. On at least some computers those files will be under System File Protection. Once you try to delete them, the OS will enter them into System File Protection, making it very difficult to get rid of them. Thus, your mileage with Symantec's solution will vary. Personally, I would instead suggest you try the Windows Vista solution, regardless of which OS you are on.

 

From an elevated command prompt, run:

msiexec /unregister

 

Followed by:

msiexec /regserver

 

Now try to update the Windows Installer (if you are on XP. If you are on Vista, you already have the latest version). Then try to remove Norton Internet Security, and see if your problems go away. If they do, you can, optionally, reinstall Norton Internet Security.

Published Mon, Mar 31 2008 7:30 PM by jesper
Filed under: ,

Comments

# Allan said on 02 April, 2008 06:36 AM

I had some conflict of sofware, I do have time or the traing to try & find out why or to fix anything. I just deleat one of the two sides, & live with out the one.

I don't eveon go to blogs much to say anything or to read whats what.  Software os so domoit (ms) I just remove it. I look at it like this. This is my computer.

Not some software co.'s computer. The software does what I like & is not the most inportan software on the computer. It maybe,but it does what i like it to do. Its time to update now & I must stop what Iam doing just to go up date. I like it when it ask do you what to do. Do you whate to up date now or later? I now have a choise. If not given a choise on when, how,why, ect... I just do one thing . *** can it.

Thank you     allan

ps *** is an acronem (ms) comeing from an old sailing turm for "Ship High In Trancit" in the old sailing days when shipping bat gewono (ms) and bird droppings back to Europ.  Verry high in potasum nitra used in making black power that the old cannos uesd lbs of.

# GV said on 29 July, 2008 06:53 AM

Good morning.

Yesterday I went through these steps and now, this morning, I cannot access any of the permissions as when I click "Jump To" I get the message that I do not have permission to.

How do I change my Administrator permissions back so that I can have access?

Thanks,

TV

# Paul said on 21 August, 2008 03:16 AM

1353188 9.51.19,6353941 svchost.exe 1068 RegOpenKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update ACCESS DENIED Desired Access: Set Value

# Davide said on 03 January, 2009 03:32 AM

Thanks God I solved my problems thanks to you!! I was unable to update my Vista system from last summer!!The problem was an error code 80070005, that is a permission issue! I knew Process Monitor, and I tried to use it to find out the break ACL, but I was using the wrong filter. Thank to your guide I set the filter, and found immediately two registry keys with Access Denied. Unfortunately my happyness was too big to copy and paste the broken keys, and I hurried up to fix them: from registry editor, I chosen to inherit the ACL from the parent object, and it was enough. Now it's quite one hour that the system is installing the 45 patches, 183 MB!! Thank you so much.

# Em said on 21 January, 2009 08:41 PM

Excellent resource you have created here. Permissions Errors are a real headache. 250 users + and over 15 different Applications,etc, Let alone Groups?GPO's!!

I have really had a technical breakthrough in troubleshooting these errors thanks to your articulate article.

A green PC technologist - XP.

# Bernt said on 17 February, 2009 10:09 AM

> To fix the problem yourself you can also change the permissions on the registry key (typically) or file that is a problem. I have not yet seen this happen because of file permissions, but if it does, it would be interesting to know.

Brilliant article! However, it does not solve my problem, which is file related.

Lenovo T61p, WinXP Pro SP3. The problem is installing an update to the NVIDIA Quatro FX 570M video driver.

Using Process Monitor as suggested shows ACCESS DENIED on five file writes, most notably (I believe) a denied CreateFile call for the file C:\WINDOWS\inf\oem66.PNF. This file exists and is 0 bytes long. Renaming the file doesn't work - I get the same error with the new filename. Some caching or intelligent tracking must be used here somewhere!

I can't get the exact errors right now (trying a reinstall will remove the old driver and leave me without one, and that's a pain). But if more exact information could help clarify this, I'll go through the process of installing/rebooting/backtracking to the current driver....

I would like some comments on this if anyone could be so nice! My current driver (6.14.11.5685) has some defects that might have been rectified.

Thanks!

# Bernt said on 17 February, 2009 05:22 PM

Update:

The Lenovo Update Service managed to install an update for me... Windows update failed to install 6.14.11.7471, but Lenovo installed 6.14.11.7715 without a hitch. First time I've seen anything even remotely positive from that company...

- Bernt