I am looking for some advice on how to troubleshoot a failing installation without any additional tools - this means I can't use Sysinternals software. All computers are running Windows Server 2003.

Here's the situation: I am currently troubleshooting a remote installation in which a monitoring server (A) fails to remotely install a monitoring agent on the client system (B). Both A and B are members of the same domain, and A is attempting the install with a user that is a member of the admin group on B and A. The monitoring agent consists of two windows services.

I was able to get the install to work on B by running it under the local system account, which leads me to believe there is some sort of security issue. As I have several more systems for this installation, I would like to find what is failing.

I can use failure auditing on the HKLM registry hive to see if the install is failing because of some sort of registry security.

How can I see if the install fails to "grant log on as a service" and if the new service is unable to "log on as a service". I don't see any failure audits in the security log. Any other ideas would be appreciated.


Check the local security policy to make sure the appropriate logging is turned on. If it's not turned on, that's why you're not seeing the audit failure in the security event log. However, that would only occur if the installation completed. Is the installation failing as the install is running or is it failing after the install completes?

  • The install is failing as it's running. I had auditing for the file system turned on, so I saw files being written to the program's directory. After the files were copied, something happened to make the install fail, after which I saw log entries for the files being deleted. The install isn't an msi; therefore, msi logging didn't show anything. – Eric H May 8 '09 at 17:41
  • Okay, under Audit Policy I have everything ON, except for "Audit process tracking". I'll activate that and see what kind of results I get. – Eric H May 8 '09 at 18:16
  • Audit process tracking isn't it. Sounds like something else is going on. Is there are a particular reason processmon can't be used? – K. Brian Kelley May 8 '09 at 20:15
  • I activated "Audit process tracking" and ran the install on another system. For some reason it worked, which leads me to a server configuration question that I may ask in a few days. Logging shows me the install process was granted SeTakeOwnershipPrivilege and SeServiceLogonRight. I bet those grants failed on the system that was having problems. I'll find out after a few more installs. – Eric H May 8 '09 at 21:13
  • It's a production server, so I'd have to jump through several hoops to get authorization for processmon. The people who could grant that authorization are out of the office, seeing as it's Friday ;^) – Eric H May 8 '09 at 21:15

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.