Discussion:
WSUS Services
(too old to reply)
Dunko
2005-06-22 20:46:04 UTC
Permalink
On the WSUSAdmin home page, there is the following message under the TO DO
LIST:

Check your server configuration
One or more Update Service components could not be contacted. Check your
server status and ensure that the Windows Server Update Service is running.
Non-running services: WSUSService

I looked in SERVICES, the only thing about WSUSService is Update Services
(Description: Enables the download of Windows Updates to this Windows Server
Update Services Server) which if I attempt to START I receive a permission
denied message.

Found in the service folder (Program files\Update Services\service), under
the BIN folder, there is a file called wsusservice.exe

I attempt to run it I get the following error:
"Cannot start service from the command line or a debugger. A Windows Service
must first be installed (using installutil.exe) and then started with the
ServerExplorer, windows Services Administrative tool or the NET START
command."

I can not find the installutil program, but I did find wsusutil.exe. Have
no idea if they are the same, but they don't seem to be.

After snooping around some more...

According to
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx

when using MSDE, the SQL service should be MSSQLSERVER and when using a SQL
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using MSDE and
the service is MSSQL$WSUS.

THEN, accroding to
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx

I attempted to do:
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n –Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.

and received this error:
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).

Any help would be greatly appreciated as my fustration continues to grow.

Thank you.
Danny Sanders
2005-06-22 21:21:38 UTC
Permalink
Had the same problem. See "To Do list" post from me (Danny Sanders) for
6/20/05. The steps Neo outlined helped me out.

hth
DDS W 2k MVP MCSE
Post by Dunko
On the WSUSAdmin home page, there is the following message under the TO DO
Check your server configuration
One or more Update Service components could not be contacted. Check your
server status and ensure that the Windows Server Update Service is running.
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update Services
(Description: Enables the download of Windows Updates to this Windows Server
Update Services Server) which if I attempt to START I receive a permission
denied message.
Found in the service folder (Program files\Update Services\service), under
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows Service
must first be installed (using installutil.exe) and then started with the
ServerExplorer, windows Services Administrative tool or the NET START
command."
I can not find the installutil program, but I did find wsusutil.exe. Have
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
when using MSDE, the SQL service should be MSSQLSERVER and when using a SQL
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using MSDE and
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration continues to grow.
Thank you.
Dunko
2005-06-22 21:51:03 UTC
Permalink
Hey Dan,

Thanks for the reference, but the service you are referring to is differnt
then the service I am having issues with. The WUSService is my issue, not
the SelfUpdate (at least not yet).

Just to add, if I attempt to sync, it never syncs. Says it is running 0%,
but does nothing. Also, if i try to change the download settings to English
only, it says "Please wait while settings are saved..." and the entire
options page is grayed out, but nothing happens. I will come back a day
later and it still says the same thing.

something seriously is wrong and I have no clue what.
Post by Danny Sanders
Had the same problem. See "To Do list" post from me (Danny Sanders) for
6/20/05. The steps Neo outlined helped me out.
hth
DDS W 2k MVP MCSE
Post by Dunko
On the WSUSAdmin home page, there is the following message under the TO DO
Check your server configuration
One or more Update Service components could not be contacted. Check your
server status and ensure that the Windows Server Update Service is running.
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update Services
(Description: Enables the download of Windows Updates to this Windows Server
Update Services Server) which if I attempt to START I receive a permission
denied message.
Found in the service folder (Program files\Update Services\service), under
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows Service
must first be installed (using installutil.exe) and then started with the
ServerExplorer, windows Services Administrative tool or the NET START
command."
I can not find the installutil program, but I did find wsusutil.exe. Have
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
when using MSDE, the SQL service should be MSSQLSERVER and when using a SQL
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using MSDE and
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration continues to grow.
Thank you.
Dunko
2005-06-22 23:34:02 UTC
Permalink
Just an update...noticed everytime I restart the server (2003 SP1) in the
event log:

Noticed everytime I restart in the eventlog:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
Description:
The Update Services service failed to start due to the following error:
Access is denied.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message under the TO DO
Check your server configuration
One or more Update Service components could not be contacted. Check your
server status and ensure that the Windows Server Update Service is running.
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update Services
(Description: Enables the download of Windows Updates to this Windows Server
Update Services Server) which if I attempt to START I receive a permission
denied message.
Found in the service folder (Program files\Update Services\service), under
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows Service
must first be installed (using installutil.exe) and then started with the
ServerExplorer, windows Services Administrative tool or the NET START
command."
I can not find the installutil program, but I did find wsusutil.exe. Have
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
when using MSDE, the SQL service should be MSSQLSERVER and when using a SQL
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using MSDE and
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n –Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration continues to grow.
Thank you.
Trevor Seward
2005-06-23 00:07:00 UTC
Permalink
Random....but who is the Update Service running as?

Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003 SP1) in the
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message under the TO DO
Check your server configuration
One or more Update Service components could not be contacted. Check your
server status and ensure that the Windows Server Update Service is running.
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update Services
(Description: Enables the download of Windows Updates to this Windows Server
Update Services Server) which if I attempt to START I receive a permission
denied message.
Found in the service folder (Program files\Update Services\service), under
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows Service
must first be installed (using installutil.exe) and then started with the
ServerExplorer, windows Services Administrative tool or the NET START
command."
I can not find the installutil program, but I did find wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER and when using a SQL
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using MSDE and
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration continues to grow.
Thank you.
Dunko
2005-06-23 00:17:01 UTC
Permalink
didn't even think to look at that...it was running as Network Service.
Changed it to Local System and seems to start now.

THanks for bringing this to my attention!
Post by Trevor Seward
Random....but who is the Update Service running as?
Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003 SP1) in the
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message under the TO
DO
Post by Dunko
Post by Dunko
Check your server configuration
One or more Update Service components could not be contacted. Check your
server status and ensure that the Windows Server Update Service is
running.
Post by Dunko
Post by Dunko
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update
Services
Post by Dunko
Post by Dunko
(Description: Enables the download of Windows Updates to this Windows
Server
Post by Dunko
Post by Dunko
Update Services Server) which if I attempt to START I receive a
permission
Post by Dunko
Post by Dunko
denied message.
Found in the service folder (Program files\Update Services\service),
under
Post by Dunko
Post by Dunko
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows
Service
Post by Dunko
Post by Dunko
must first be installed (using installutil.exe) and then started with
the
Post by Dunko
Post by Dunko
ServerExplorer, windows Services Administrative tool or the NET START
command."
I can not find the installutil program, but I did find wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER and when using a
SQL
Post by Dunko
Post by Dunko
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using MSDE
and
Post by Dunko
Post by Dunko
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration continues to
grow.
Post by Dunko
Post by Dunko
Thank you.
Trevor Seward
2005-06-23 00:25:59 UTC
Permalink
If you want to fix this the 'proper' way, you could probably modify the
permissions in Admin Tools -> Component Manager ->Comp Services ->
Computers -> My COmputer -> DCOM Config.

Give Network Service the same Launch permissions as Administrators. You may
need to modify Configuration Permissions as well.

That might do the trick.

Trevor

Find wsusservice, go to Properties -> Security tab.
Post by Dunko
didn't even think to look at that...it was running as Network Service.
Changed it to Local System and seems to start now.
THanks for bringing this to my attention!
Post by Trevor Seward
Random....but who is the Update Service running as?
Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003 SP1) in the
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message under the TO
DO
Post by Dunko
Post by Dunko
Check your server configuration
One or more Update Service components could not be contacted. Check your
server status and ensure that the Windows Server Update Service is
running.
Post by Dunko
Post by Dunko
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update
Services
Post by Dunko
Post by Dunko
(Description: Enables the download of Windows Updates to this Windows
Server
Post by Dunko
Post by Dunko
Update Services Server) which if I attempt to START I receive a
permission
Post by Dunko
Post by Dunko
denied message.
Found in the service folder (Program files\Update Services\service),
under
Post by Dunko
Post by Dunko
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows
Service
Post by Dunko
Post by Dunko
must first be installed (using installutil.exe) and then started with
the
Post by Dunko
Post by Dunko
ServerExplorer, windows Services Administrative tool or the NET START
command."
I can not find the installutil program, but I did find wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Trevor Seward
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER and when using a
SQL
Post by Dunko
Post by Dunko
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using MSDE
and
Post by Dunko
Post by Dunko
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Trevor Seward
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration continues to
grow.
Post by Dunko
Post by Dunko
Thank you.
TimM
2005-06-24 08:01:03 UTC
Permalink
I tried the following but still wsusservice.exe did not start automatically:

1. In Admin Tools -> Component Manager ->Comp Services -> Computers -> My
Computer -> DCOM Config

I added "Network Service" in Security for:

a. Launch and Activation Permissions
b. Access Permissions

2. In Services > Update Services (i.e. wsusservice.exe) the logon
permissions are set for User Account "NT AUTHORITY\NetworkService" - There
appears to be no such User created by WSUS installation
Post by Trevor Seward
If you want to fix this the 'proper' way, you could probably modify the
permissions in Admin Tools -> Component Manager ->Comp Services ->
Computers -> My COmputer -> DCOM Config.
Give Network Service the same Launch permissions as Administrators. You may
need to modify Configuration Permissions as well.
That might do the trick.
Trevor
Find wsusservice, go to Properties -> Security tab.
Post by Dunko
didn't even think to look at that...it was running as Network Service.
Changed it to Local System and seems to start now.
THanks for bringing this to my attention!
Post by Trevor Seward
Random....but who is the Update Service running as?
Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003 SP1) in
the
Post by Dunko
Post by Trevor Seward
Post by Dunko
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
The Update Services service failed to start due to the following
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message under the
TO
Post by Dunko
Post by Trevor Seward
DO
Post by Dunko
Post by Dunko
Check your server configuration
One or more Update Service components could not be contacted. Check
your
Post by Dunko
Post by Trevor Seward
Post by Dunko
Post by Dunko
server status and ensure that the Windows Server Update Service is
running.
Post by Dunko
Post by Dunko
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update
Services
Post by Dunko
Post by Dunko
(Description: Enables the download of Windows Updates to this
Windows
Post by Dunko
Post by Trevor Seward
Server
Post by Dunko
Post by Dunko
Update Services Server) which if I attempt to START I receive a
permission
Post by Dunko
Post by Dunko
denied message.
Found in the service folder (Program files\Update Services\service),
under
Post by Dunko
Post by Dunko
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows
Service
Post by Dunko
Post by Dunko
must first be installed (using installutil.exe) and then started
with
Post by Dunko
Post by Trevor Seward
the
Post by Dunko
Post by Dunko
ServerExplorer, windows Services Administrative tool or the NET
START
Post by Dunko
Post by Trevor Seward
Post by Dunko
Post by Dunko
command."
I can not find the installutil program, but I did find wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Trevor Seward
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER and when
using a
Post by Dunko
Post by Trevor Seward
SQL
Post by Dunko
Post by Dunko
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using
MSDE
Post by Dunko
Post by Trevor Seward
and
Post by Dunko
Post by Dunko
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Trevor Seward
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration continues to
grow.
Post by Dunko
Post by Dunko
Thank you.
Lawrence Garvin
2005-06-23 01:42:42 UTC
Permalink
This is an /incorrect/ configuration.

The Update Service /should/ be runnign as NTAUTHORITY\NetworkService, and by
changing it to Local System you have granted the service significantly more
permission than it needs or is designed to have, and effectively created a
security hole on your server.

Suggest returning the Log On credentials back to NTAUTHORITY\NetworkService
where they belong and continuing troubleshooting appropriately.

Most likely if the service cannot start up it is because some folder(s) it
needs to run do not have appropriate permissions set for the
NTAUTHORITY\NetworkService account.

Since I now know this is Windows Server 2003, I suggest the following steps:


(1) NET STOP WSUSService
NET STOP MSSQL$WSUS

(2) Use Add/Remove Programs to uninstall WSUS.
Also, remove the \Program Files\Update Services folder
the \Program Files\Microsoft SQL Server folder
the \WSUS folder
and any virtual servers created by the WSUS install.

Also remove the /selfupdate and /clientwebservice virtual directories
from the Default Web Server, if WSUS was originally installed on an
alternate virtual server.

(2) Restart the system.

(3) Verify that the .NET Framework v1.1 Service Pack 1 is installed.

(4) Verify that the Default Web Server has anonymous access permissions
enabled.

(5) If you're installing any portion of WSUS on a non-system drive, verify
that the NTAUTHORITY\NetworkService account has READ permissions on the
non-system drive (e.g. drive D:, E:, etc.)

(6) Reinstall WSUS.
Post by Dunko
didn't even think to look at that...it was running as Network Service.
Changed it to Local System and seems to start now.
THanks for bringing this to my attention!
Post by Trevor Seward
Random....but who is the Update Service running as?
Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003 SP1) in the
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message under the TO
DO
Post by Dunko
Post by Dunko
Check your server configuration
One or more Update Service components could not be contacted. Check your
server status and ensure that the Windows Server Update Service is
running.
Post by Dunko
Post by Dunko
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update
Services
Post by Dunko
Post by Dunko
(Description: Enables the download of Windows Updates to this Windows
Server
Post by Dunko
Post by Dunko
Update Services Server) which if I attempt to START I receive a
permission
Post by Dunko
Post by Dunko
denied message.
Found in the service folder (Program files\Update Services\service),
under
Post by Dunko
Post by Dunko
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows
Service
Post by Dunko
Post by Dunko
must first be installed (using installutil.exe) and then started with
the
Post by Dunko
Post by Dunko
ServerExplorer, windows Services Administrative tool or the NET START
command."
I can not find the installutil program, but I did find wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER and when using a
SQL
Post by Dunko
Post by Dunko
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using MSDE
and
Post by Dunko
Post by Dunko
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration continues to
grow.
Post by Dunko
Post by Dunko
Thank you.
Fabrice LETARD
2005-06-24 09:22:02 UTC
Permalink
Hi all,

I've the same problem here for WSUSservices not starting at all.
It happens already to me with a clean install on Windows2000 srv during RTM
stage.
It happens again here with final version, still on Windows 2000 srv during
the procedure to migrate from SUS to Wsus.

( It never happened on Windows 2003 srv where it worked like a charm)

Configuration was installed CORRECTLY, on the 2000 srv ASP.net 1.1SP1 /BITS
/ MSDE2000a + hotfix.

but Lawrence just to let you know that WSUS Service run with local system
rights on Windows 2000 after the standard install.

I still have to figure out why it 's still not starting, if anybody find a
solution I hope it will be post here,

Regards,
Fabrice LETARD
Post by Lawrence Garvin
This is an /incorrect/ configuration.
The Update Service /should/ be runnign as NTAUTHORITY\NetworkService, and by
changing it to Local System you have granted the service significantly more
permission than it needs or is designed to have, and effectively created a
security hole on your server.
Suggest returning the Log On credentials back to NTAUTHORITY\NetworkService
where they belong and continuing troubleshooting appropriately.
Most likely if the service cannot start up it is because some folder(s) it
needs to run do not have appropriate permissions set for the
NTAUTHORITY\NetworkService account.
(1) NET STOP WSUSService
NET STOP MSSQL$WSUS
(2) Use Add/Remove Programs to uninstall WSUS.
Also, remove the \Program Files\Update Services folder
the \Program Files\Microsoft SQL Server folder
the \WSUS folder
and any virtual servers created by the WSUS install.
Also remove the /selfupdate and /clientwebservice virtual directories
from the Default Web Server, if WSUS was originally installed on an
alternate virtual server.
(2) Restart the system.
(3) Verify that the .NET Framework v1.1 Service Pack 1 is installed.
(4) Verify that the Default Web Server has anonymous access permissions
enabled.
(5) If you're installing any portion of WSUS on a non-system drive, verify
that the NTAUTHORITY\NetworkService account has READ permissions on the
non-system drive (e.g. drive D:, E:, etc.)
(6) Reinstall WSUS.
Post by Dunko
didn't even think to look at that...it was running as Network Service.
Changed it to Local System and seems to start now.
THanks for bringing this to my attention!
Post by Trevor Seward
Random....but who is the Update Service running as?
Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003 SP1) in the
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message under the TO
DO
Post by Dunko
Post by Dunko
Check your server configuration
One or more Update Service components could not be contacted. Check your
server status and ensure that the Windows Server Update Service is
running.
Post by Dunko
Post by Dunko
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update
Services
Post by Dunko
Post by Dunko
(Description: Enables the download of Windows Updates to this Windows
Server
Post by Dunko
Post by Dunko
Update Services Server) which if I attempt to START I receive a
permission
Post by Dunko
Post by Dunko
denied message.
Found in the service folder (Program files\Update Services\service),
under
Post by Dunko
Post by Dunko
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows
Service
Post by Dunko
Post by Dunko
must first be installed (using installutil.exe) and then started with
the
Post by Dunko
Post by Dunko
ServerExplorer, windows Services Administrative tool or the NET START
command."
I can not find the installutil program, but I did find wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER and when using a
SQL
Post by Dunko
Post by Dunko
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using MSDE
and
Post by Dunko
Post by Dunko
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration continues to
grow.
Post by Dunko
Post by Dunko
Thank you.
Lawrence Garvin
2005-06-24 09:46:54 UTC
Permalink
Post by Fabrice LETARD
but Lawrence just to let you know that WSUS Service run with local system
rights on Windows 2000 after the standard install.
This is correct, Fabrice. On Windows 2000 Server there is no
NTAUTHORITY\NetworkService account. Anything that is configured with that
account on Win2003 would be configured with the Local System account on
Win2000.
Post by Fabrice LETARD
I still have to figure out why it 's still not starting, if anybody find a
solution I hope it will be post here,
Do you get any error messages if you execute NET START WSUSSERVICE at a
command prompt?
Post by Fabrice LETARD
Regards,
Fabrice LETARD
Post by Lawrence Garvin
This is an /incorrect/ configuration.
The Update Service /should/ be runnign as NTAUTHORITY\NetworkService, and by
changing it to Local System you have granted the service significantly more
permission than it needs or is designed to have, and effectively created a
security hole on your server.
Suggest returning the Log On credentials back to
NTAUTHORITY\NetworkService
where they belong and continuing troubleshooting appropriately.
Most likely if the service cannot start up it is because some folder(s) it
needs to run do not have appropriate permissions set for the
NTAUTHORITY\NetworkService account.
(1) NET STOP WSUSService
NET STOP MSSQL$WSUS
(2) Use Add/Remove Programs to uninstall WSUS.
Also, remove the \Program Files\Update Services folder
the \Program Files\Microsoft SQL Server folder
the \WSUS folder
and any virtual servers created by the WSUS install.
Also remove the /selfupdate and /clientwebservice virtual directories
from the Default Web Server, if WSUS was originally installed on an
alternate virtual server.
(2) Restart the system.
(3) Verify that the .NET Framework v1.1 Service Pack 1 is installed.
(4) Verify that the Default Web Server has anonymous access permissions
enabled.
(5) If you're installing any portion of WSUS on a non-system drive, verify
that the NTAUTHORITY\NetworkService account has READ permissions on the
non-system drive (e.g. drive D:, E:, etc.)
(6) Reinstall WSUS.
Post by Dunko
didn't even think to look at that...it was running as Network Service.
Changed it to Local System and seems to start now.
THanks for bringing this to my attention!
Post by Trevor Seward
Random....but who is the Update Service running as?
Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003 SP1)
in
the
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message under
the
TO
DO
Post by Dunko
Post by Dunko
Check your server configuration
One or more Update Service components could not be contacted.
Check
your
server status and ensure that the Windows Server Update Service is
running.
Post by Dunko
Post by Dunko
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update
Services
Post by Dunko
Post by Dunko
(Description: Enables the download of Windows Updates to this Windows
Server
Post by Dunko
Post by Dunko
Update Services Server) which if I attempt to START I receive a
permission
Post by Dunko
Post by Dunko
denied message.
Found in the service folder (Program files\Update
Services\service),
under
Post by Dunko
Post by Dunko
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows
Service
Post by Dunko
Post by Dunko
must first be installed (using installutil.exe) and then started with
the
Post by Dunko
Post by Dunko
ServerExplorer, windows Services Administrative tool or the NET START
command."
I can not find the installutil program, but I did find
wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER and when
using
a
SQL
Post by Dunko
Post by Dunko
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using MSDE
and
Post by Dunko
Post by Dunko
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration continues to
grow.
Post by Dunko
Post by Dunko
Thank you.
Fabrice LETARD
2005-06-24 11:35:03 UTC
Permalink
currently not a message leading to somewhere :

The service is not responding to the control function.
More help is available by typing NET HELPMSG 2186.

I'm checking basic things first,

MSSQL$WSUS is automatic and started
Background Intelligent Transfer Service is manual and started

then I checked some NTFS rights as previously stated,
repository as installed on Windows 2000 is everyone full controll <SIC>
I check rights for ASPNET account to write under framework/SQLdatabase/logs,
...

I'm still wondering if the issue is not Msde Related, as in the Sql server
management tools I can't see the instance...
(But I'm not an SQL specialist, and don't know if it was not one of the
security restriction included in the SQL patch not to allow a discoevry of
the instance on every SQL server)

I'll go to ntfilemon/regmon to see if something comes up...



Damn !
on Windows 2003 it was smooth install and directly working, but I have 13
SUS server to UPDATE that are running on Windows 2000 server !
:(
Post by Lawrence Garvin
Post by Fabrice LETARD
but Lawrence just to let you know that WSUS Service run with local system
rights on Windows 2000 after the standard install.
This is correct, Fabrice. On Windows 2000 Server there is no
NTAUTHORITY\NetworkService account. Anything that is configured with that
account on Win2003 would be configured with the Local System account on
Win2000.
Post by Fabrice LETARD
I still have to figure out why it 's still not starting, if anybody find a
solution I hope it will be post here,
Do you get any error messages if you execute NET START WSUSSERVICE at a
command prompt?
Post by Fabrice LETARD
Regards,
Fabrice LETARD
Post by Lawrence Garvin
This is an /incorrect/ configuration.
The Update Service /should/ be runnign as NTAUTHORITY\NetworkService, and by
changing it to Local System you have granted the service significantly more
permission than it needs or is designed to have, and effectively created a
security hole on your server.
Suggest returning the Log On credentials back to
NTAUTHORITY\NetworkService
where they belong and continuing troubleshooting appropriately.
Most likely if the service cannot start up it is because some folder(s) it
needs to run do not have appropriate permissions set for the
NTAUTHORITY\NetworkService account.
(1) NET STOP WSUSService
NET STOP MSSQL$WSUS
(2) Use Add/Remove Programs to uninstall WSUS.
Also, remove the \Program Files\Update Services folder
the \Program Files\Microsoft SQL Server folder
the \WSUS folder
and any virtual servers created by the WSUS install.
Also remove the /selfupdate and /clientwebservice virtual directories
from the Default Web Server, if WSUS was originally installed on an
alternate virtual server.
(2) Restart the system.
(3) Verify that the .NET Framework v1.1 Service Pack 1 is installed.
(4) Verify that the Default Web Server has anonymous access permissions
enabled.
(5) If you're installing any portion of WSUS on a non-system drive, verify
that the NTAUTHORITY\NetworkService account has READ permissions on the
non-system drive (e.g. drive D:, E:, etc.)
(6) Reinstall WSUS.
Post by Dunko
didn't even think to look at that...it was running as Network Service.
Changed it to Local System and seems to start now.
THanks for bringing this to my attention!
Post by Trevor Seward
Random....but who is the Update Service running as?
Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003 SP1)
in
the
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message under
the
TO
DO
Post by Dunko
Post by Dunko
Check your server configuration
One or more Update Service components could not be contacted.
Check
your
server status and ensure that the Windows Server Update Service is
running.
Post by Dunko
Post by Dunko
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update
Services
Post by Dunko
Post by Dunko
(Description: Enables the download of Windows Updates to this Windows
Server
Post by Dunko
Post by Dunko
Update Services Server) which if I attempt to START I receive a
permission
Post by Dunko
Post by Dunko
denied message.
Found in the service folder (Program files\Update
Services\service),
under
Post by Dunko
Post by Dunko
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows
Service
Post by Dunko
Post by Dunko
must first be installed (using installutil.exe) and then started with
the
Post by Dunko
Post by Dunko
ServerExplorer, windows Services Administrative tool or the NET START
command."
I can not find the installutil program, but I did find wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER and when
using
a
SQL
Post by Dunko
Post by Dunko
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using MSDE
and
Post by Dunko
Post by Dunko
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration continues to
grow.
Post by Dunko
Post by Dunko
Thank you.
Fabrice LETARD
2005-06-27 14:06:02 UTC
Permalink
hello again Lawrence ...
I just tried something nasty ...
adding ASPNET account into local administrator of the WSUS server ...

==> WSUSservice starts.

so it's a problem of privilege with ASPNET account somewhere ...

I'll try to find what ...
because it is not acceptable to run with these privileges ...

Fabrice LETARD
Post by Lawrence Garvin
Post by Fabrice LETARD
but Lawrence just to let you know that WSUS Service run with local system
rights on Windows 2000 after the standard install.
This is correct, Fabrice. On Windows 2000 Server there is no
NTAUTHORITY\NetworkService account. Anything that is configured with that
account on Win2003 would be configured with the Local System account on
Win2000.
Post by Fabrice LETARD
I still have to figure out why it 's still not starting, if anybody find a
solution I hope it will be post here,
Do you get any error messages if you execute NET START WSUSSERVICE at a
command prompt?
Post by Fabrice LETARD
Regards,
Fabrice LETARD
Post by Lawrence Garvin
This is an /incorrect/ configuration.
The Update Service /should/ be runnign as NTAUTHORITY\NetworkService, and by
changing it to Local System you have granted the service significantly more
permission than it needs or is designed to have, and effectively created a
security hole on your server.
Suggest returning the Log On credentials back to
NTAUTHORITY\NetworkService
where they belong and continuing troubleshooting appropriately.
Most likely if the service cannot start up it is because some folder(s) it
needs to run do not have appropriate permissions set for the
NTAUTHORITY\NetworkService account.
(1) NET STOP WSUSService
NET STOP MSSQL$WSUS
(2) Use Add/Remove Programs to uninstall WSUS.
Also, remove the \Program Files\Update Services folder
the \Program Files\Microsoft SQL Server folder
the \WSUS folder
and any virtual servers created by the WSUS install.
Also remove the /selfupdate and /clientwebservice virtual directories
from the Default Web Server, if WSUS was originally installed on an
alternate virtual server.
(2) Restart the system.
(3) Verify that the .NET Framework v1.1 Service Pack 1 is installed.
(4) Verify that the Default Web Server has anonymous access permissions
enabled.
(5) If you're installing any portion of WSUS on a non-system drive, verify
that the NTAUTHORITY\NetworkService account has READ permissions on the
non-system drive (e.g. drive D:, E:, etc.)
(6) Reinstall WSUS.
Post by Dunko
didn't even think to look at that...it was running as Network Service.
Changed it to Local System and seems to start now.
THanks for bringing this to my attention!
Post by Trevor Seward
Random....but who is the Update Service running as?
Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003 SP1)
in
the
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message under
the
TO
DO
Post by Dunko
Post by Dunko
Check your server configuration
One or more Update Service components could not be contacted.
Check
your
server status and ensure that the Windows Server Update Service is
running.
Post by Dunko
Post by Dunko
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update
Services
Post by Dunko
Post by Dunko
(Description: Enables the download of Windows Updates to this Windows
Server
Post by Dunko
Post by Dunko
Update Services Server) which if I attempt to START I receive a
permission
Post by Dunko
Post by Dunko
denied message.
Found in the service folder (Program files\Update
Services\service),
under
Post by Dunko
Post by Dunko
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows
Service
Post by Dunko
Post by Dunko
must first be installed (using installutil.exe) and then started with
the
Post by Dunko
Post by Dunko
ServerExplorer, windows Services Administrative tool or the NET START
command."
I can not find the installutil program, but I did find wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER and when
using
a
SQL
Post by Dunko
Post by Dunko
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using MSDE
and
Post by Dunko
Post by Dunko
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration continues to
grow.
Post by Dunko
Post by Dunko
Thank you.
Lawrence Garvin
2005-06-27 15:45:39 UTC
Permalink
The ASP.NET account should only need to be a member of Domain Users. Check
to make sure it does have Domain Users membership, as that would definitely
cause a problem. Adding to the LA group would 'fix' the missing membership
in the DU group, but the latter is the desired 'fix'.

Otherwise, if the ASP.NET account is a member of the Domain Users, and
adding to Local Administrators fixed something, that would be an indication
that there are permissions missing for the Domain Users group, that are not
filtering down to ASP.NET.

Alternatively, it could be a resource specifically granted to ASP.NET that
is missing, but I ran CACLS on my system and it found no instances where
ASP.NET had been granted specific access to a resource.
Post by Fabrice LETARD
hello again Lawrence ...
I just tried something nasty ...
adding ASPNET account into local administrator of the WSUS server ...
==> WSUSservice starts.
so it's a problem of privilege with ASPNET account somewhere ...
I'll try to find what ...
because it is not acceptable to run with these privileges ...
Fabrice LETARD
Post by Lawrence Garvin
Post by Fabrice LETARD
but Lawrence just to let you know that WSUS Service run with local system
rights on Windows 2000 after the standard install.
This is correct, Fabrice. On Windows 2000 Server there is no
NTAUTHORITY\NetworkService account. Anything that is configured with that
account on Win2003 would be configured with the Local System account on
Win2000.
Post by Fabrice LETARD
I still have to figure out why it 's still not starting, if anybody find a
solution I hope it will be post here,
Do you get any error messages if you execute NET START WSUSSERVICE at a
command prompt?
Post by Fabrice LETARD
Regards,
Fabrice LETARD
Post by Lawrence Garvin
This is an /incorrect/ configuration.
The Update Service /should/ be runnign as NTAUTHORITY\NetworkService,
and
by
changing it to Local System you have granted the service significantly more
permission than it needs or is designed to have, and effectively
created
a
security hole on your server.
Suggest returning the Log On credentials back to
NTAUTHORITY\NetworkService
where they belong and continuing troubleshooting appropriately.
Most likely if the service cannot start up it is because some
folder(s)
it
needs to run do not have appropriate permissions set for the
NTAUTHORITY\NetworkService account.
(1) NET STOP WSUSService
NET STOP MSSQL$WSUS
(2) Use Add/Remove Programs to uninstall WSUS.
Also, remove the \Program Files\Update Services folder
the \Program Files\Microsoft SQL Server folder
the \WSUS folder
and any virtual servers created by the WSUS install.
Also remove the /selfupdate and /clientwebservice virtual directories
from the Default Web Server, if WSUS was originally installed on an
alternate virtual server.
(2) Restart the system.
(3) Verify that the .NET Framework v1.1 Service Pack 1 is installed.
(4) Verify that the Default Web Server has anonymous access permissions
enabled.
(5) If you're installing any portion of WSUS on a non-system drive, verify
that the NTAUTHORITY\NetworkService account has READ permissions on the
non-system drive (e.g. drive D:, E:, etc.)
(6) Reinstall WSUS.
Post by Dunko
didn't even think to look at that...it was running as Network Service.
Changed it to Local System and seems to start now.
THanks for bringing this to my attention!
Post by Trevor Seward
Random....but who is the Update Service running as?
Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003 SP1)
in
the
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message under
the
TO
DO
Post by Dunko
Post by Dunko
Check your server configuration
One or more Update Service components could not be contacted.
Check
your
server status and ensure that the Windows Server Update Service is
running.
Post by Dunko
Post by Dunko
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update
Services
Post by Dunko
Post by Dunko
(Description: Enables the download of Windows Updates to this Windows
Server
Post by Dunko
Post by Dunko
Update Services Server) which if I attempt to START I receive a
permission
Post by Dunko
Post by Dunko
denied message.
Found in the service folder (Program files\Update
Services\service),
under
Post by Dunko
Post by Dunko
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows
Service
Post by Dunko
Post by Dunko
must first be installed (using installutil.exe) and then
started
with
the
Post by Dunko
Post by Dunko
ServerExplorer, windows Services Administrative tool or the NET START
command."
I can not find the installutil program, but I did find wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER and when
using
a
SQL
Post by Dunko
Post by Dunko
Server database, the service shoudl be MSSQL$WSUS. Well, i'm
using
MSDE
and
Post by Dunko
Post by Dunko
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update
Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration
continues
to
grow.
Post by Dunko
Post by Dunko
Thank you.
Fabrice LETARD
2005-06-27 16:35:04 UTC
Permalink
hum...

Does server's "local User" member is sufficient for ASPNET account ?
because i still not want to see any ASPNET account inside my AD Forest ...

worked like a charm on a windows 2003 srv,
whithout any ASPNET account in the same forest



Fabrice
Post by Lawrence Garvin
The ASP.NET account should only need to be a member of Domain Users. Check
to make sure it does have Domain Users membership, as that would definitely
cause a problem. Adding to the LA group would 'fix' the missing membership
in the DU group, but the latter is the desired 'fix'.
Otherwise, if the ASP.NET account is a member of the Domain Users, and
adding to Local Administrators fixed something, that would be an indication
that there are permissions missing for the Domain Users group, that are not
filtering down to ASP.NET.
Alternatively, it could be a resource specifically granted to ASP.NET that
is missing, but I ran CACLS on my system and it found no instances where
ASP.NET had been granted specific access to a resource.
Post by Fabrice LETARD
hello again Lawrence ...
I just tried something nasty ...
adding ASPNET account into local administrator of the WSUS server ...
==> WSUSservice starts.
so it's a problem of privilege with ASPNET account somewhere ...
I'll try to find what ...
because it is not acceptable to run with these privileges ...
Fabrice LETARD
Post by Lawrence Garvin
Post by Fabrice LETARD
but Lawrence just to let you know that WSUS Service run with local system
rights on Windows 2000 after the standard install.
This is correct, Fabrice. On Windows 2000 Server there is no
NTAUTHORITY\NetworkService account. Anything that is configured with that
account on Win2003 would be configured with the Local System account on
Win2000.
Post by Fabrice LETARD
I still have to figure out why it 's still not starting, if anybody find a
solution I hope it will be post here,
Do you get any error messages if you execute NET START WSUSSERVICE at a
command prompt?
Post by Fabrice LETARD
Regards,
Fabrice LETARD
Post by Lawrence Garvin
This is an /incorrect/ configuration.
The Update Service /should/ be runnign as NTAUTHORITY\NetworkService,
and
by
changing it to Local System you have granted the service significantly more
permission than it needs or is designed to have, and effectively
created
a
security hole on your server.
Suggest returning the Log On credentials back to
NTAUTHORITY\NetworkService
where they belong and continuing troubleshooting appropriately.
Most likely if the service cannot start up it is because some
folder(s)
it
needs to run do not have appropriate permissions set for the
NTAUTHORITY\NetworkService account.
(1) NET STOP WSUSService
NET STOP MSSQL$WSUS
(2) Use Add/Remove Programs to uninstall WSUS.
Also, remove the \Program Files\Update Services folder
the \Program Files\Microsoft SQL Server folder
the \WSUS folder
and any virtual servers created by the WSUS install.
Also remove the /selfupdate and /clientwebservice virtual directories
from the Default Web Server, if WSUS was originally installed on an
alternate virtual server.
(2) Restart the system.
(3) Verify that the .NET Framework v1.1 Service Pack 1 is installed.
(4) Verify that the Default Web Server has anonymous access permissions
enabled.
(5) If you're installing any portion of WSUS on a non-system drive, verify
that the NTAUTHORITY\NetworkService account has READ permissions on the
non-system drive (e.g. drive D:, E:, etc.)
(6) Reinstall WSUS.
Post by Dunko
didn't even think to look at that...it was running as Network Service.
Changed it to Local System and seems to start now.
THanks for bringing this to my attention!
Post by Trevor Seward
Random....but who is the Update Service running as?
Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003 SP1)
in
the
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
The Update Services service failed to start due to the following
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message under
the
TO
DO
Post by Dunko
Post by Dunko
Check your server configuration
One or more Update Service components could not be contacted.
Check
your
server status and ensure that the Windows Server Update Service
is
running.
Post by Dunko
Post by Dunko
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update
Services
Post by Dunko
Post by Dunko
(Description: Enables the download of Windows Updates to this
Windows
Server
Post by Dunko
Post by Dunko
Update Services Server) which if I attempt to START I receive a
permission
Post by Dunko
Post by Dunko
denied message.
Found in the service folder (Program files\Update
Services\service),
under
Post by Dunko
Post by Dunko
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A
Windows
Service
Post by Dunko
Post by Dunko
must first be installed (using installutil.exe) and then
started
with
the
Post by Dunko
Post by Dunko
ServerExplorer, windows Services Administrative tool or the NET
START
command."
I can not find the installutil program, but I did find
wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER and when
using
a
SQL
Post by Dunko
Post by Dunko
Server database, the service shoudl be MSSQL$WSUS. Well, i'm
using
MSDE
and
Post by Dunko
Post by Dunko
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update
Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC
set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration
continues
to
grow.
Post by Dunko
Post by Dunko
Thank you.
Lawrence Garvin
2005-06-27 17:06:01 UTC
Permalink
Well, Fabrice.. I can appreciate what you don't want....

but if you plan to use ASP.NET applications, then the DOMAIN\ASP.NET account
is going to have to exist and it will have to be a member of the Domain
Users group.

That's just how it's designed.

Note: This is probably a function of whether your ASP.NET server is a DC or
not.

If it's not a DC, then I'll guess that the ASP.NET account can be maintained
as a local account. But if the WSUS server is a DC (as it is in my case, and
I suspect yours too), then the ASP.NET account cannot exist as a local
account on a DC.
Post by Fabrice LETARD
hum...
Does server's "local User" member is sufficient for ASPNET account ?
because i still not want to see any ASPNET account inside my AD Forest ...
worked like a charm on a windows 2003 srv,
whithout any ASPNET account in the same forest
Fabrice
Post by Lawrence Garvin
The ASP.NET account should only need to be a member of Domain Users. Check
to make sure it does have Domain Users membership, as that would definitely
cause a problem. Adding to the LA group would 'fix' the missing membership
in the DU group, but the latter is the desired 'fix'.
Otherwise, if the ASP.NET account is a member of the Domain Users, and
adding to Local Administrators fixed something, that would be an indication
that there are permissions missing for the Domain Users group, that are not
filtering down to ASP.NET.
Alternatively, it could be a resource specifically granted to ASP.NET that
is missing, but I ran CACLS on my system and it found no instances where
ASP.NET had been granted specific access to a resource.
Post by Fabrice LETARD
hello again Lawrence ...
I just tried something nasty ...
adding ASPNET account into local administrator of the WSUS server ...
==> WSUSservice starts.
so it's a problem of privilege with ASPNET account somewhere ...
I'll try to find what ...
because it is not acceptable to run with these privileges ...
Fabrice LETARD
Post by Lawrence Garvin
Post by Fabrice LETARD
but Lawrence just to let you know that WSUS Service run with local system
rights on Windows 2000 after the standard install.
This is correct, Fabrice. On Windows 2000 Server there is no
NTAUTHORITY\NetworkService account. Anything that is configured with that
account on Win2003 would be configured with the Local System account on
Win2000.
Post by Fabrice LETARD
I still have to figure out why it 's still not starting, if anybody find a
solution I hope it will be post here,
Do you get any error messages if you execute NET START WSUSSERVICE at a
command prompt?
Post by Fabrice LETARD
Regards,
Fabrice LETARD
Post by Lawrence Garvin
This is an /incorrect/ configuration.
The Update Service /should/ be runnign as
NTAUTHORITY\NetworkService,
and
by
changing it to Local System you have granted the service
significantly
more
permission than it needs or is designed to have, and effectively
created
a
security hole on your server.
Suggest returning the Log On credentials back to
NTAUTHORITY\NetworkService
where they belong and continuing troubleshooting appropriately.
Most likely if the service cannot start up it is because some
folder(s)
it
needs to run do not have appropriate permissions set for the
NTAUTHORITY\NetworkService account.
Since I now know this is Windows Server 2003, I suggest the
following
(1) NET STOP WSUSService
NET STOP MSSQL$WSUS
(2) Use Add/Remove Programs to uninstall WSUS.
Also, remove the \Program Files\Update Services folder
the \Program Files\Microsoft SQL Server folder
the \WSUS folder
and any virtual servers created by the WSUS install.
Also remove the /selfupdate and /clientwebservice virtual directories
from the Default Web Server, if WSUS was originally installed on an
alternate virtual server.
(2) Restart the system.
(3) Verify that the .NET Framework v1.1 Service Pack 1 is installed.
(4) Verify that the Default Web Server has anonymous access permissions
enabled.
(5) If you're installing any portion of WSUS on a non-system drive, verify
that the NTAUTHORITY\NetworkService account has READ permissions on the
non-system drive (e.g. drive D:, E:, etc.)
(6) Reinstall WSUS.
Post by Dunko
didn't even think to look at that...it was running as Network Service.
Changed it to Local System and seems to start now.
THanks for bringing this to my attention!
Post by Trevor Seward
Random....but who is the Update Service running as?
Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003 SP1)
in
the
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
The Update Services service failed to start due to the following
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message
under
the
TO
DO
Post by Dunko
Post by Dunko
Check your server configuration
One or more Update Service components could not be contacted.
Check
your
server status and ensure that the Windows Server Update Service
is
running.
Post by Dunko
Post by Dunko
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is
Update
Services
Post by Dunko
Post by Dunko
(Description: Enables the download of Windows Updates to this
Windows
Server
Post by Dunko
Post by Dunko
Update Services Server) which if I attempt to START I receive a
permission
Post by Dunko
Post by Dunko
denied message.
Found in the service folder (Program files\Update
Services\service),
under
Post by Dunko
Post by Dunko
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A
Windows
Service
Post by Dunko
Post by Dunko
must first be installed (using installutil.exe) and then
started
with
the
Post by Dunko
Post by Dunko
ServerExplorer, windows Services Administrative tool or the NET
START
command."
I can not find the installutil program, but I did find
wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER and when
using
a
SQL
Post by Dunko
Post by Dunko
Server database, the service shoudl be MSSQL$WSUS. Well, i'm
using
MSDE
and
Post by Dunko
Post by Dunko
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update
Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update
tbConfigurationC
set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration
continues
to
grow.
Post by Dunko
Post by Dunko
Thank you.
Fabrice LETARD
2005-06-28 08:03:12 UTC
Permalink
The rules here are that a DC is a DC...
and it will not host any other role not directly related to it but
DHCP/DNS/WINS.

All my SUS server are actually W2K SP4 member server ( 12 SUS servers ) And
it is why i'm very interested in resolving the issue of not working like a
charm on W2K server ;)

ASPNET account will be publicated into AD when we will need it as
application prerequisite.


WSUS is working like a charm on a Windows 2003 member server whithout an
ASPNET domain account.

I'll try to continue to check this on a new test server. I'll just continue
to evaluate migration process from SUS to WSUS on the "modified server"

I'll let know everybody if I found something.

Fabrice
Post by Lawrence Garvin
Well, Fabrice.. I can appreciate what you don't want....
but if you plan to use ASP.NET applications, then the DOMAIN\ASP.NET account
is going to have to exist and it will have to be a member of the Domain
Users group.
That's just how it's designed.
Note: This is probably a function of whether your ASP.NET server is a DC or
not.
If it's not a DC, then I'll guess that the ASP.NET account can be maintained
as a local account. But if the WSUS server is a DC (as it is in my case, and
I suspect yours too), then the ASP.NET account cannot exist as a local
account on a DC.
Post by Fabrice LETARD
hum...
Does server's "local User" member is sufficient for ASPNET account ?
because i still not want to see any ASPNET account inside my AD Forest ...
worked like a charm on a windows 2003 srv,
whithout any ASPNET account in the same forest
Fabrice
Post by Lawrence Garvin
The ASP.NET account should only need to be a member of Domain Users. Check
to make sure it does have Domain Users membership, as that would definitely
cause a problem. Adding to the LA group would 'fix' the missing membership
in the DU group, but the latter is the desired 'fix'.
Otherwise, if the ASP.NET account is a member of the Domain Users, and
adding to Local Administrators fixed something, that would be an indication
that there are permissions missing for the Domain Users group, that are not
filtering down to ASP.NET.
Alternatively, it could be a resource specifically granted to ASP.NET that
is missing, but I ran CACLS on my system and it found no instances where
ASP.NET had been granted specific access to a resource.
Post by Fabrice LETARD
hello again Lawrence ...
I just tried something nasty ...
adding ASPNET account into local administrator of the WSUS server ...
==> WSUSservice starts.
so it's a problem of privilege with ASPNET account somewhere ...
I'll try to find what ...
because it is not acceptable to run with these privileges ...
Fabrice LETARD
Post by Lawrence Garvin
Post by Fabrice LETARD
but Lawrence just to let you know that WSUS Service run with local system
rights on Windows 2000 after the standard install.
This is correct, Fabrice. On Windows 2000 Server there is no
NTAUTHORITY\NetworkService account. Anything that is configured with that
account on Win2003 would be configured with the Local System account on
Win2000.
Post by Fabrice LETARD
I still have to figure out why it 's still not starting, if anybody find a
solution I hope it will be post here,
Do you get any error messages if you execute NET START WSUSSERVICE at a
command prompt?
Post by Fabrice LETARD
Regards,
Fabrice LETARD
Post by Lawrence Garvin
This is an /incorrect/ configuration.
The Update Service /should/ be runnign as
NTAUTHORITY\NetworkService,
and
by
changing it to Local System you have granted the service
significantly
more
permission than it needs or is designed to have, and effectively
created
a
security hole on your server.
Suggest returning the Log On credentials back to
NTAUTHORITY\NetworkService
where they belong and continuing troubleshooting appropriately.
Most likely if the service cannot start up it is because some
folder(s)
it
needs to run do not have appropriate permissions set for the
NTAUTHORITY\NetworkService account.
Since I now know this is Windows Server 2003, I suggest the
following
(1) NET STOP WSUSService
NET STOP MSSQL$WSUS
(2) Use Add/Remove Programs to uninstall WSUS.
Also, remove the \Program Files\Update Services folder
the \Program Files\Microsoft SQL Server folder
the \WSUS folder
and any virtual servers created by the WSUS install.
Also remove the /selfupdate and /clientwebservice virtual directories
from the Default Web Server, if WSUS was originally installed on an
alternate virtual server.
(2) Restart the system.
(3) Verify that the .NET Framework v1.1 Service Pack 1 is installed.
(4) Verify that the Default Web Server has anonymous access permissions
enabled.
(5) If you're installing any portion of WSUS on a non-system drive,
verify
that the NTAUTHORITY\NetworkService account has READ permissions on the
non-system drive (e.g. drive D:, E:, etc.)
(6) Reinstall WSUS.
Post by Dunko
didn't even think to look at that...it was running as Network
Service.
Changed it to Local System and seems to start now.
THanks for bringing this to my attention!
Post by Trevor Seward
Random....but who is the Update Service running as?
Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003
SP1)
in
the
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
The Update Services service failed to start due to the
following
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following message
under
the
TO
DO
Post by Dunko
Post by Dunko
Check your server configuration
One or more Update Service components could not be
contacted.
Check
your
server status and ensure that the Windows Server Update
Service
is
running.
Post by Dunko
Post by Dunko
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is
Update
Services
Post by Dunko
Post by Dunko
(Description: Enables the download of Windows Updates to
this
Windows
Server
Post by Dunko
Post by Dunko
Update Services Server) which if I attempt to START I
receive a
permission
Post by Dunko
Post by Dunko
denied message.
Found in the service folder (Program files\Update
Services\service),
under
Post by Dunko
Post by Dunko
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A
Windows
Service
Post by Dunko
Post by Dunko
must first be installed (using installutil.exe) and then
started
with
the
Post by Dunko
Post by Dunko
ServerExplorer, windows Services Administrative tool or the
NET
START
command."
I can not find the installutil program, but I did find
wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER and
when
using
a
SQL
Post by Dunko
Post by Dunko
Server database, the service shoudl be MSSQL$WSUS. Well, i'm
using
MSDE
and
Post by Dunko
Post by Dunko
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update
Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update
tbConfigurationC
set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration
Lawrence Garvin
2005-06-28 13:49:19 UTC
Permalink
See comments inline...
Post by Fabrice LETARD
The rules here are that a DC is a DC...
and it will not host any other role not directly related to it but
DHCP/DNS/WINS.
Cool.
Post by Fabrice LETARD
All my SUS server are actually W2K SP4 member server ( 12 SUS servers ) And
it is why i'm very interested in resolving the issue of not working like a
charm on W2K server ;)
I'd start, then, with whatever migth have been published concerning the
proper installation and configuration of ASP.NET v1.1 on Windows 2000 Server
w/IIS5. That's where the ASPNET account comes from.
Post by Fabrice LETARD
ASPNET account will be publicated into AD when we will need it as
application prerequisite.
Just understand that it's certainly permissable for you to set company
policies as to the creation and location of accounts, but if those policies
conflict with the design of a platform (like ASP.NET), or a particular
application (like WSUS), you'll have to make the decision whether to stick
to your policy and abandon the platform/application, or adapt the policy to
reflect reality.
Post by Fabrice LETARD
WSUS is working like a charm on a Windows 2003 member server whithout an
ASPNET domain account.
Okay... as I said.. my ASPNET account may well be in the domain because I
have WSUS installed on a DC.

I don't have a Windows 2000 Server member-server to compare with, but there
are a lot of variables at work here, the most significant of which is
ASP.NET on IIS5.

In addition, starting Friday, if you run into any issues with those Windows
2000 Server WSUS boxes... PSS is not going to talk to you because the
Windows 2000 Server's mainstream support lifecycle expires on Friday. I
would /strongly/ consider upgrading to Windows Server 2003 for supporting a
WSUS platform -- especially considering the apparent size of your
organization (you did say you have 12 SUS servers!).
Post by Fabrice LETARD
I'll try to continue to check this on a new test server. I'll just continue
to evaluate migration process from SUS to WSUS on the "modified server"
It may also be a function of installing WSUS on Windows 2000 Server
directly. Try installing and testing ASP.NET v1.1 before installing WSUS.
Post by Fabrice LETARD
I'll let know everybody if I found something.
Fabrice
Post by Lawrence Garvin
Well, Fabrice.. I can appreciate what you don't want....
but if you plan to use ASP.NET applications, then the DOMAIN\ASP.NET account
is going to have to exist and it will have to be a member of the Domain
Users group.
That's just how it's designed.
Note: This is probably a function of whether your ASP.NET server is a DC or
not.
If it's not a DC, then I'll guess that the ASP.NET account can be maintained
as a local account. But if the WSUS server is a DC (as it is in my case, and
I suspect yours too), then the ASP.NET account cannot exist as a local
account on a DC.
Post by Fabrice LETARD
hum...
Does server's "local User" member is sufficient for ASPNET account ?
because i still not want to see any ASPNET account inside my AD Forest ...
worked like a charm on a windows 2003 srv,
whithout any ASPNET account in the same forest
Fabrice
Post by Lawrence Garvin
The ASP.NET account should only need to be a member of Domain Users. Check
to make sure it does have Domain Users membership, as that would definitely
cause a problem. Adding to the LA group would 'fix' the missing membership
in the DU group, but the latter is the desired 'fix'.
Otherwise, if the ASP.NET account is a member of the Domain Users, and
adding to Local Administrators fixed something, that would be an indication
that there are permissions missing for the Domain Users group, that
are
not
filtering down to ASP.NET.
Alternatively, it could be a resource specifically granted to ASP.NET that
is missing, but I ran CACLS on my system and it found no instances where
ASP.NET had been granted specific access to a resource.
Post by Fabrice LETARD
hello again Lawrence ...
I just tried something nasty ...
adding ASPNET account into local administrator of the WSUS server ...
==> WSUSservice starts.
so it's a problem of privilege with ASPNET account somewhere ...
I'll try to find what ...
because it is not acceptable to run with these privileges ...
Fabrice LETARD
Post by Lawrence Garvin
Post by Fabrice LETARD
but Lawrence just to let you know that WSUS Service run with
local
system
rights on Windows 2000 after the standard install.
This is correct, Fabrice. On Windows 2000 Server there is no
NTAUTHORITY\NetworkService account. Anything that is configured
with
that
account on Win2003 would be configured with the Local System
account
on
Win2000.
Post by Fabrice LETARD
I still have to figure out why it 's still not starting, if
anybody
find a
solution I hope it will be post here,
Do you get any error messages if you execute NET START WSUSSERVICE
at
a
command prompt?
Post by Fabrice LETARD
Regards,
Fabrice LETARD
Post by Lawrence Garvin
This is an /incorrect/ configuration.
The Update Service /should/ be runnign as
NTAUTHORITY\NetworkService,
and
by
changing it to Local System you have granted the service
significantly
more
permission than it needs or is designed to have, and effectively
created
a
security hole on your server.
Suggest returning the Log On credentials back to
NTAUTHORITY\NetworkService
where they belong and continuing troubleshooting appropriately.
Most likely if the service cannot start up it is because some
folder(s)
it
needs to run do not have appropriate permissions set for the
NTAUTHORITY\NetworkService account.
Since I now know this is Windows Server 2003, I suggest the
following
(1) NET STOP WSUSService
NET STOP MSSQL$WSUS
(2) Use Add/Remove Programs to uninstall WSUS.
Also, remove the \Program Files\Update Services folder
the \Program Files\Microsoft SQL Server folder
the \WSUS folder
and any virtual servers created by the WSUS install.
Also remove the /selfupdate and /clientwebservice virtual
directories
from the Default Web Server, if WSUS was originally installed on an
alternate virtual server.
(2) Restart the system.
(3) Verify that the .NET Framework v1.1 Service Pack 1 is installed.
(4) Verify that the Default Web Server has anonymous access permissions
enabled.
(5) If you're installing any portion of WSUS on a non-system drive,
verify
that the NTAUTHORITY\NetworkService account has READ permissions
on
the
non-system drive (e.g. drive D:, E:, etc.)
(6) Reinstall WSUS.
Post by Dunko
didn't even think to look at that...it was running as Network
Service.
Changed it to Local System and seems to start now.
THanks for bringing this to my attention!
Post by Trevor Seward
Random....but who is the Update Service running as?
Trevor
Post by Dunko
Just an update...noticed everytime I restart the server (2003
SP1)
in
the
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 6/22/2005
Time: 4:24:14 PM
User: N/A
Computer: SERVER NAME
The Update Services service failed to start due to the
following
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Post by Dunko
On the WSUSAdmin home page, there is the following
message
under
the
TO
DO
Post by Dunko
Post by Dunko
Check your server configuration
One or more Update Service components could not be
contacted.
Check
your
server status and ensure that the Windows Server Update
Service
is
running.
Post by Dunko
Post by Dunko
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is
Update
Services
Post by Dunko
Post by Dunko
(Description: Enables the download of Windows Updates to
this
Windows
Server
Post by Dunko
Post by Dunko
Update Services Server) which if I attempt to START I
receive a
permission
Post by Dunko
Post by Dunko
denied message.
Found in the service folder (Program files\Update
Services\service),
under
Post by Dunko
Post by Dunko
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a
debugger. A
Windows
Service
Post by Dunko
Post by Dunko
must first be installed (using installutil.exe) and then
started
with
the
Post by Dunko
Post by Dunko
ServerExplorer, windows Services Administrative tool or
the
NET
START
command."
I can not find the installutil program, but I did find
wsusutil.exe.
Have
Post by Dunko
Post by Dunko
no idea if they are the same, but they don't seem to be.
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
Post by Dunko
Post by Dunko
when using MSDE, the SQL service should be MSSQLSERVER
and
when
using
a
SQL
Post by Dunko
Post by Dunko
Server database, the service shoudl be MSSQL$WSUS. Well,
i'm
using
MSDE
and
Post by Dunko
Post by Dunko
the service is MSSQL$WSUS.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
Post by Dunko
Post by Dunko
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update
Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update
tbConfigurationC
set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Any help would be greatly appreciated as my fustration
Lawrence Garvin
2005-06-23 01:35:22 UTC
Permalink
See responses inline... also suggest you spend some more time reading the
Deployment Guide and Operations Guide very carefully -- as your comments
suggest a significant lack of familiarity with the components of WSUS and
the administration of Windows servers.
Post by Dunko
On the WSUSAdmin home page, there is the following message under the TO DO
Check your server configuration
One or more Update Service components could not be contacted. Check your
server status and ensure that the Windows Server Update Service is running.
Non-running services: WSUSService
I looked in SERVICES, the only thing about WSUSService is Update Services
(Description: Enables the download of Windows Updates to this Windows Server
Update Services Server)
One and the same. The textual description in the Services.MMC is "Update
Services", but the name given to the service is WSUSService (as reported by
the error message).
Post by Dunko
which if I attempt to START I receive a permission denied message.
This would indicate some dysfunction in the installation of WSUS.
The Update Services service should be configured to start Automatic,
it should be Started,
and it should be configured to Log On with the NTAUTHORITY\NetworkService
account.

I'm also assuming that you're logged on with an Administrator account.
Post by Dunko
Found in the service folder (Program files\Update Services\service), under
the BIN folder, there is a file called wsusservice.exe
"Cannot start service from the command line or a debugger. A Windows Service
must first be installed (using installutil.exe) and then started with the
ServerExplorer, windows Services Administrative tool or the NET START
command."
You cannot start a service by executing the EXE command at the command
prompt. You must use the NET START or NET STOP comman with the service name.

e.g. NET START WSUSService or NET STOP WSUSService
Post by Dunko
I can not find the installutil program, but I did find wsusutil.exe. Have
no idea if they are the same, but they don't seem to be.
They are not. Wsusutil.exe is copiously documented in the Deployment Guide.
Reading that document will establish its purpose and uses. Installation of a
service (with installutil.exe) is not something a System Administrator would
normally do. This is a function of the installation of the software, and
this type of dysfunction is normally fixed by uninstalling the software, and
then reinstalling the software.

Also note that the WSUS software has several prerequisites, including the
installation of the .NET Framework v1.1 and the .NET Framework v1.1 Service
Pack 1. If you're using Windows Server 2003, you only need to apply the
Framework Service Pack. If you're using Windows 2000 Server, you need to
install both if you have not done so already.
Post by Dunko
After snooping around some more...
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/e677317d-533b-41ce-96c5-4b9ad75cbf48.mspx
when using MSDE, the SQL service should be MSSQLSERVER and when using a SQL
Server database, the service shoudl be MSSQL$WSUS. Well, i'm using MSDE and
the service is MSSQL$WSUS.
You've significantly misunderstood that article.

First, if you /manually/ installed SQL Server 2000, then you're using the
default instance of SQL Server 2000 and the SQL Service is MSSQLSERVER.

Second, if you /manually/ installed MSDE2000 Rel A on Windows 2000 Server,
then you either installed it as a default instance, in which case the
service name is MSSQLSERVER, or you installed it as a named instance (which
would be "WSUS") and the service name is MSSQL$WSUS.

Third, if you installed WSUS on Windows Server 2003, then you did not
install MSDE, the WSUS installation installed WMSDE, and it creates a named
instance, and the service name will be MSSQL$WSUS.

Fourth, if by some chance you /manually/ installed MSDE on Windows Server
2003, then you definitely need to start over.
Post by Dunko
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/WSUS/WSUSOperationsGuideTC/5b2a029a-34bf-47ba-94e3-e0e93b4f825b.mspx
1. Type: net stop WSUSService, and then press ENTER.
2. Type: "%programfiles%\Update Services\tools\osql\osql.exe" -S
SQL_InstanceName -E -b -n -Q "USE SUSDB update tbConfigurationC set
BitsDownloadPriorityForeground=1" and then press ENTER.
2. Type: net start WSUSService.
This procedure only applies if you are unable to download updates from
microsoft.com because you are encountering the Range Protocol Header error
message. It would seem that you're still a long way from achieving anything
that might trigger that error.
Post by Dunko
[DBNETLIB]SQL Server does not exist or access denied.
[DBNETLIB]ConnectionOpen (Connect()).
Did you substitute your actual instance name for the phrase
"SQL_InstanceName" in the command, or did you instruct the osql command to
try to use the non-existant SQL_InstanceName instance?

The above command also requires that you're logged on with an Administrator
account (see previous issues with starting the WSUSService).
Post by Dunko
Any help would be greatly appreciated as my fustration continues to grow.
The best source of help is to read the supplied documentation.

The next best source of help is my recommendation to uninstall ALL of the
WSUS you've installed, and reinstall it following the supplied documentation
step-by-step exactly as it's written.
Continue reading on narkive:
Loading...