I had this problem on my Windows Server 2003 R2 SP2 too, after contacting Microsoft they emailed me the following instructions. I followed until suggestion 3 and after restarting my Windows Update is working again!
Note: I didn't try Suggestion 4, I did Suggestion 3 and it works for me.
Warning: Doing Suggestion 3 will reset all security settings with the following side effects (pretty easy to solve though)
- My ASP website stopped working (had to go to ASP folders and enable access to NETWORK SERVICE).
- MS SQL Server also fails to start. I had to repair my SQL Server installation using the SQL Server installer to make it work again.
You have been warned, so here goes...
Suggestion 1: Login as Administrator (doh!)
Suggestion 2: Temporarily disabled Antivirus (doh!)
Suggestion 3: Automatically restore security settings to the default
==================================================
Access the link http://support.microsoft.com/?kbid=313222
Follow the Windows XP steps.
Restart your computer and try to do Windows Update again to see if the issue has been resolved.
Suggestion 4: Reset permissions
==================================================
This step will reset the permission settings on this system, which may take some time. Your patience is highly appreciated.
Step 1: Download SubInACL (SubInACL.exe)
- Please download the "subinacl.msi" from the following link and save the installation patch on the Desktop:
http://www.microsoft.com/downloads/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en#AffinityDownloads
Please go to the Desktop and double click the downloaded file to install it.
Please select "C:\Windows\System32" as the destination folder during the installation (Note: We assume C:\ is the system partition). Later we will use this tool to reset the current permission settings on the machine.
Step 2:
Click "Start", "Run", type: "notepad C:\reset.cmd" (without quotations) and press "Enter". Choose "Yes" when you are prompted.
Copy the following commands and then paste them into the opened Notepad window:
@echo off
secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose
secedit.exe /analyze /db C:\WINDOWS\sectest.db /cfg C:\WINDOWS\inf\defltwk.inf /log C:\WINDOWS\security\logs\secanalyze.log
secedit.exe /configure /db C:\WINDOWS\sectest.db /cfg C:\WINDOWS\inf\defltwk.inf /log C:\WINDOWS\security\logs\secrepair.log
cipher /A /D c:\windows\system32\catroot*.*
cipher /A /D C:\WINDOWS\system32\CatRoot{F750E6C3-38EE-11D1-85E5-00C04FC295EE}*.*
Subinacl /service wuauserv /sddl=D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
Sc sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f
subinacl /subdirectories %SystemDrive% /grant=system=f
@Echo =========================
@Echo Finished.
@Echo =========================
@pause
After pasting the above commands, please close the "Notepad" window. Choose "Yes" when prompted to save the file.
Click "Start", "Run", type: "C:\reset.cmd" (without quotations) and press "Enter" to run the commands pasted.
You will see a DOS-like window processing the request.
(NOTE: This step may take several minutes, please be patient. When it is finished, you will be prompted with "Finished, press any key to continue".)
After completing the above steps, restart and refer to the Windows Update website to install the update again.