Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having a problem with the deployment of Windows 7 from a server with Microsoft Toolkit 2010.

When deployment has finished I get a Windows error report which shows following message.

FAILURE (Er): 70: CreateObject(Microsoft.BDD.Utility) - Permission denied
Litetouch deployment failed, Return Code = - 2147023589 0x8007051B

I don't get it what Microsoft.BDD.Utility is exactly and when this utility is used (Tasksequence?) ?

Can anyone help me on this problem?

share|improve this question
up vote 1 down vote accepted

BDD 2007 is the older version of the Microsoft Deployment Toolkit 2010 (which is what you should be using to deploy Windows 7). Make sure you are running MDT 2010 instead of BDD 2007 (download here:

share|improve this answer
Just checked it, I am only running microsoft deployment toolkit 2010. Sorry for the wrong information, I thought you had to install the toolkit ontop of bdd 2007 – elhombre Dec 23 '09 at 8:07

I'm not familiar with this tool, but error 0x8007051B means the following:

ERROR_INVALID_OWNER                                           winerror.h
# This security ID may not be assigned as the owner of this
# object.

My guess is this is related to user rights and somebody needs the SE_RESTORE_NAME privilege, but on what, I don't know.

share|improve this answer

This happened to be because User Account Control (UAC) was enabled for the local Administrator account.

To fix:

  1. Click Start, then type: gpedit.msc
  2. In the search results, click on "gpedit". Confirm the UAC prompt.
  3. Navigate to: Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
  4. In the center, double-click on "User Account Control: Admin Approval Mode for the Built-in Administrator account". Select the "Disabled" radio button and click OK.
  5. Reboot the computer.

This setting is common when the Microsoft Security Baselines have been applied. If the original system was Windows 8 or newer and deployed using MDT, MDT will also turn UAC on for the local administrator account - it does this so that the local admin account can be used to access Universal/Modern/Metro applications.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.