Re: Failed To Install Any Update From Web Only

"Raymond" <Raymond@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1F509980-DD0F-444A-9B7B-3C7D812213C9@xxxxxxxxxxxxxxxx
> Hi Robert,
>
> Did the Filemon concurent with Regmon.
> Filemon filter "wuauclt; Update; svhost.exe" as suggested.
> Regmon same as before, "wuauclt"
> Update tried : KB899587
>
> The Regmon result basically the same.
> Tried to understand how to compare/read/analysis the log from both sources
> from yr post with Fortunatov...sorry, really don't understand....
>
> What I did is delete most of the "Success" lines from Filemon and include
> those lines that has the same time value from Regmon.....hope that is ok...
> If you need more detailed entries, please let me know and I'll post as much
> as possible.


Raymond,

The most important information that we can get from the FileMon log
is the length of the Writes associated with WindowsUpdate.log
I think that you may be deleting most of those records with your cull
of "Success" lines. ;)

See, here is the only such line you have left

> 1446 12:57:11.988 wuauclt.exe:1800 WRITE C:\WINNT\WindowsUpdate.log SUCCESS Offset: 153635 Length: 107

The timestamp and the length of 107 tells me that if I found a record
in your log with 106 characters in it which had a log timestamp of
12:57:11 then chances are that this would have been the write for it.
Making that linkage would then allow us to say that the real timestamp
of that log record was 12:57:11.988 (i.e. we could infer the milleseconds
for the log's timestamp.) Also we would then have a more accurate timestamp
to go into the RegMon trace with and see if anything interesting happened
there just before that time.

Unfortunately by doing that for this record all I can see is this hint from
the RegMon trace that diagnostics were being considered just before this

> 156 12:57:11.727 wuauclt.exe:1800 OpenKey HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace NOTFOUND

However, since there are no internals guides for us we can't know whether
that would be occurring in a recovery event or just as a normal part of this
thread's processing.

I think if we could somehow activate the install program's verbose trace
we would have more effective diagnostics than what FileMon and RegMon
appear to be giving us. I.e., it is beginning to look to me more like a logic
error which is being covered up with a bogus code than a real permissions
problem. If it really was a permissions problem I would expect that either
RegMon or FileMon would expose it (provided we aren't excluding that
possibility with a too restrictive filter by either RegMon or FileMon.)

Presumably those diagnostics implied by the attempted registry accesses
would be ways of invoking the verbose logging even on automatic installs.
E.g. we suspect that invoking verbose logging on a manual install will not
be useful because you already know that you do not have a problem doing
a manual install. Unfortunately, applying verbose logging on a manual
install is the only option that I have found documented.

Sorry this didn't work out for you.


Robert
---



.

Relevant Pages

  • Re: Please recommend a newsreader that can d
    ... files nec to install some of the larger programs to a flash drive manually. ... I guess I'm going to have to also look up filemon, regmon, and mojopac, ... Filemon and regmon track access to the file system and Windows registry in ...
    (rec.gambling.poker)
  • RE: OWA Error
    ... type the following command in order to register the .dll file. ... f) Test again whether the OWA works now. ... Please go to the following web sites to download and run Filemon and Regmon ...
    (microsoft.public.windows.server.sbs)
  • Re: Administrator Help
    ... The process can be a little effort, when using the filemon ... ability to write in the install area on disk (and to destroy the ... the applications area in the registry, ... For finding these the regmon and filemon tools are a great ...
    (microsoft.public.security)
  • Re: Remote Access Wizard - SBS 2003 SP1
    ... Could you please rerun Filemon and Regmon ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • RE: Impact of removing administrative rights in an enterprise running XP
    ... Regmon and Filemon are very useful tools - among others you can find at ... Impact of removing administrative rights in an enterprise ... You would be surprised the apps that require privilege to run... ...
    (Focus-Microsoft)
Loading