Re: any help installing KB840374 yet?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Andrew (someone_at_somewhere.com)
Date: 05/25/04 

Date: Tue, 25 May 2004 08:35:45 -0500

OK, I just checked the setting for "Manage auditing and security log" and
only the domain admins have this right (similar to adding workstations to a
domain). This seems to be the default config for a domain policy.

So, as all other updates install without needing this explicit user right,
is MS going to fix what appears to be a bug in theis patch?

Otherwise, the Domain admin has to install this patch for all users OR a new
Domain Security policy needs to be pushed out. But they shouldn't have this
right on a domain.

I am astounded this made it through QA.

"Lucy [MSFT]" <a-leby@online.microsoft.com> wrote in message
news:u5cu%23ncPEHA.680@TK2MSFTNGP11.phx.gbl...
> I really recommend contacting your System Administrator. A couple
> suggestions:
>
>
>
> 1) Check that rights for the "Manage auditing and security log" policy
> verify the "Administrators" built in local group is listed.
>
> 2) Ensure that only the local Administrators group has the Take ownership
of
> files or other objects user right.
>
>
>
> If error persists you can:
>
>
>
> 1) Consult with your System Administrator
>
> 2) Post on operating system related newsgroups
>
> Here's the link to all newsgroups:
>
> http://communities.microsoft.com/newsgroups/default.asp?icp=mscom
>
> 3) Contact support to review the Domain Policies
>
>
>
>
> Thanks,
> Lucy [MSFT]
>
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
>
> "Andrew" <someone@somewhere.com> wrote in message
> news:ewM1%23vaPEHA.2452@TK2MSFTNGP11.phx.gbl...
> > I am part of a domain, but I have no problems with any other updates. I
> have
> > local admin rights on the machine.
> >
> > What specific domain policy would cause this patch to fail?
> >
> > "Lucy [MSFT]" <a-leby@online.microsoft.com> wrote in message
> > news:%23dqZO9OPEHA.680@TK2MSFTNGP11.phx.gbl...
> > > Are you part of a Domain? Is this the only machine having problems
> > > installing the update? This error is typically caused due to
> insufficient
> > > permissions due to a domain policy.
> > >
> > >
> > > --
> > > Thanks,
> > > Lucy [MSFT]
> > >
> > > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > >
> > >
> > > "Andrew" <someone@somewhere.com> wrote in message
> > > news:%23M2qrlOPEHA.2976@TK2MSFTNGP10.phx.gbl...
> > > > I am having the same problem with this hot fix, it downloads but
won't
> > > > install via automatic updates or going through windows updates.
> > > >
> > > > Same error:
> > > >
> > > > 2004/05/17 07:18:30.786 (local)
> > > > 0.130: d:\e23585cf739aebe26e5804\sp2\update\update.exe (version
> > 5.4.15.0)
> > > > 0.130: Failed To Enable SE_SECURITY_PRIVILEGE
> > > > 0.130: Setup encountered an error: You do not have permission to
> > update
> > > > Windows XP.
> > > > Please contact your system administrator.
> > > > 0.130: You do not have permission to update Windows XP.
> > > > Please contact your system administrator.
> > > > 0.130: Update.exe extended error code = 0xf004
> > > >
> > > > I am administrator of my machine, but not domain admin. Doesn't MS
> have
> > a
> > > > way to manually set whatever security privilege is needed?
> > > >
> > > > Andrew
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Relevant Pages

  • Re: Unable to prevent OU deletion by Domain Admins?
    ... That's how ACLs work, or at ... Microsoft's own guidelines for parsing ACLs states that DENY ACLs ... I understand that domain admins have the delete and delete subtree ... I have a folder where Domain Users have Full control rights. ...
    (microsoft.public.win2000.active_directory)
  • Re: Prevent changes to Administrator password
    ... To add to what I already said: *ANY* member of a Domain Admins group *MUST* be trusted in what he does with his account. ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... * This posting is provided "AS IS" with no warranties and confers no rights! ...
    (microsoft.public.windows.server.active_directory)
  • Re: Log on Locally
    ... even if I do not have the rights to log on locally, ... > Logon to the machine as a standard user and use the runas command. ... > snapin to reset the policy. ... I didn't check very well and I add Domain admins to ...
    (microsoft.public.win2000.security)
  • Re: Delegate certain rights to a single Domain Controller
    ... Please note that this hack does not eliminate all possible security risks, ... > This posting is provided "as is" with no warranties and confers no rights ... >> If you think your domain admins can only modify stuff in their own ... >>> cannot modify DCs across domains. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Mailbox Security
    ... >> How did you convince him with Notes? ... >> By default I believe Domain Admins are given DENY rights to FULL ACCESS ... >> I don't see anyway of convincing him that you cannot read the emails. ...
    (microsoft.public.exchange.admin)