Unable to Patch Server - Access is Denied

I faced this issue a few months back, where I could not patch one of our servers. Whenever I tried, I will got this :


Error : 
Windows Update Standalone Installer

Installer encountered an error :  0x80070005

Access is denied.







Troubleshooting :

Troubleshooting 101 - check the service. Turned out, Windows Update service could not be found in the server...

Resolution :

There are 2 easy ways to resolve this....

Method 01 :

1) Go to a working server.

2) launch REGEDIT.

3) export below Registry key.
Registry key : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv

4) import to the target server

5) restart the server

Method 02 : 

1) Apply below Registry Keys to the server :

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv]
"PreshutdownTimeout"=dword:036ee800
"DisplayName"="Windows Update"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
  74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"Start"=dword:00000002
"Type"=dword:00000020
"Description"="@%systemroot%\\system32\\wuaueng.dll,-106"
"DependOnService"=hex(7):72,00,70,00,63,00,73,00,73,00,00,00,00,00
"ObjectName"="LocalSystem"
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,41,00,75,00,64,00,69,00,74,00,50,00,72,\
  00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,\
  65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,\
  00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,\
  61,00,74,00,65,00,50,00,61,00,67,00,65,00,46,00,69,00,6c,00,65,00,50,00,72,\
  00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,54,00,63,00,\
  62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\
  00,41,00,73,00,73,00,69,00,67,00,6e,00,50,00,72,00,69,00,6d,00,61,00,72,00,\
  79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\
  00,67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,\
  6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\
  00,00,00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,73,00,65,00,51,00,\
  75,00,6f,00,74,00,61,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\
  00,00,00,53,00,65,00,53,00,68,00,75,00,74,00,64,00,6f,00,77,00,6e,00,50,00,\
  72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
"FailureActions"=hex:00,00,00,00,01,00,00,00,01,00,00,00,03,00,00,00,14,00,00,\
  00,01,00,00,00,60,ea,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"Group"=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Parameters]
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceMain"="WUServiceMain"
"ServiceDll"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\
  00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  77,00,75,00,61,00,75,00,65,00,6e,00,67,00,2e,00,64,00,6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\Security]
"Security"=hex:01,00,14,80,78,00,00,00,84,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,00,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,48,00,03,00,00,00,00,00,14,00,9d,00,02,00,01,01,00,00,00,00,00,\
  05,0b,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,ff,01,0f,00,01,01,00,00,00,00,00,05,12,00,00,00,01,\
  01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\TriggerInfo]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\TriggerInfo\0]
"Type"=dword:00000005
"Action"=dword:00000001
"Guid"=hex:e6,ca,9f,65,db,5b,a9,4d,b1,ff,ca,2a,17,8d,46,e0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv\TriggerInfo\1]
"Type"=dword:00000005
"Action"=dword:00000001
"Guid"=hex:c8,46,fb,54,89,f0,4c,46,b1,fd,59,d1,b6,2c,3b,50

2) Outcomes...

3) Restart server once done

4) Windows Update service is visible now.

Read More

Installing an Internal CA on Server 2012

Certificate Authority is a server role introduced by Microsoft, to issue digital certificates to target recipients. These digital certificates enable the environment to communicate securely between each other. 

Installing an internal CA server is not too hard and pretty much straight forward I believe. 

Description :

Installing an Internal CA on Server 2012.

How To Do :

1.  Launch Server Manager, Go to Manage | Add Roles and Features
   
   
   
   
   
   
   
   
   
   
   
   
   
2.  Click Next >
   
   
   
   
   
   
   
   
   
   
   
3.  Ensure Role-based or feature-based installation is chosen, and click Next >
   
   
   
   
   
   
   
   
   
     
4.  Ensure the target server is selected from the server pool, and click Next >
   
   
   
   
   
   
   
   
   
   
   
5.  Check / tick Active Directory Certificate Services role
   
   
   
   
   
   
   
   
   
   
   
6.  The Add Roles and Features Wizard appeared. Click at Add Features button.
   
   
   
   
   
   
   
   
   
   
   
7.  Click Next > 
   
   
   
   
   
   
   
   
   
   
   
8.  Select additional features if needed, then click Next >
   
   
   
   
   
   
   
   
   
   
   
9.  Click Next >
   
   
   
   
   
   
   
   
   
   
   
10.  Check / tick Certificate Authority role service
    
    
    
    
    
    
    
    
    
    
    
11.  To enable web enrollment, Certificate Authority Web Enrollment role service needs to be enabled as well. Check / tick at it, then click Next > 
    
    
    
    
    
    
    
    
    
    
    
12. Once all confirmed, click Install
    
    
    
    
    
    
    
    
    
    
    
13. Installing...
    
    
    
    
    
    
    
    
    
    
    
14.  At Server Manager, hover to Notification, and click at at Post-Deployment Configuration to configure Certificate Services role.
    
    
    
    
    
    
    
    
    
    
    
15.  Click Change... if you want to change the credential used, then click Next >
    
    
    
    
    
    
    
    
    
    
    
16. Select which role services need to be configured, in this case the first two.
    
    
    
    
    
    
    
    
    
    
    
17.  Specify type of CA to be configured, either Enterprise CA or Standalone CA. Click Next > once done.You may refer to below links for better understanding :
    
    
    
    
    Enterprise CA : https://technet.microsoft.com/en-us/library/cc771443(v=ws.11).aspx
    
    
    Stand-Alone CA : https://technet.microsoft.com/en-us/library/cc755290(v=ws.11).aspx
    
    
    
    
    
    
    
    
    
    
    
18.  Specify whether the server should be a Root CA or Subordinate CA. In this case, Root CA is chosen as this is the  first CA in the environment. Click Next > 
    
    
    
    
    
    
    
    
    
    
    
19.  Specify whether to create a new private key or to use existing private key. You may refer to below link for better understanding on Private Key. Click Next > once done.
    
    
    Link : http://go.microsoft.com/fwlink/?LinkId=218060
    
    
    
    
    
    
    
    
    
    
    
20.  Choose Cryptographic provider, key length, and hash algorithm. Refer to below link for more info on cryptography. Click Next > 
    
    
    Link : http://go.microsoft.com/fwlink/?LinkId=218061
    
    
    
    
    
    
    
    
    
    
    
21.  Specify the name of the CA, then click Next >
    
    
    
    
    
    
    
    
    
    
    
22.  Specify the validity period of the Certificate, then click Next > 
    
    
    
    
    
    
    
    
    
    
    
23.  Specify the database locations, then click Next >
    
    
    
    
    
    
    
    
    
    
    
24.  Review the information populated, then click Configure.
    
    
    
    
    
    
    
    
    
    
    
25.  Configuring...
    
    
    
    
    
    
    
    
    
    
    
26. Done, click Close.
    
    
    
    
    
    
    
    
    
    
    
27.  CA Configured.
    
    

Read More

Server 2012 - No User Interface Available

On one fine day when I was busy with one of my project, one of my collegue tapped my shoulder, a bit panicking.

He : Heiry, take a look at this...

Me : Dude, what on earth have you done? (serious face)

He : I dont know man, I uninstalled .Net Fx 4.5, reboot the machine and this happened

Me : Dude, What on earth was the reason you uninstalled .Net Fx 4.5?

He : Well, I thought ....

Me : (Evil Smile)

So here is the thing. When we uninstalling .Net Fx 4.5, those related features would be uninstalled as well, including a feature called User Interfaces and Infrastructure. Please refer to here.

There are 2 ways to get it done - locally or remotely. For the purpose of this post, I will do it remotely from another Windows Server 2012 member server.



Issues :

Unable to view GUI in Server 2012.

Troubleshooting :

it is straight forward, GUI is disabled, RDP to the server, the only screen one can see is :

Resolution :

1.  RDP to another Server 2012 member server.
   
   
2.  Launch Server Manager, and click at Add other servers to manage
   
   
   
   
   
3. Put the target server name at Name (CN) column, and press Find Now. Once the target server appeared in the table, click at the server name and press the arrow button marked with green box as below. The target server will appeared in the right column.
   
   
4. Then, click kat Manage | Add Roles and Feature

   

   
   

   
   
5. Ensure to choose Select a server from the server pool, and choose the target server. Press Next.
   
   
6. At Server Roles option, skip it by pressing Next
   
   
7. At Feature option, enable a feature called User Interface and Infrastructure. Press Next.
   
   
   
8. Ensure all info are correct, and press Install to proceed.

Read More

Windows Activation - KMS : Access Is Denied

There are 2 types of Windows Activation - KMS and MAK. However, for this post, I won't be discussing on what are those or their differences, as this post is to discuss an error in regards to KMS implementation. 

Issues :

The following error has occurred. Please resolve the error and try again.

Description :

Access is denied

Troubleshooting 

1.  Used multiple IDs (Domain Admins as well as Local Admins), however issue stll persist. Thus, it is safe to rule out User ID privilege from the root cause. 
2. UAC is enabled.

Resolution :

1.  Go to Volume Activation Tools again, but right click at it and choose Run as Administrator (not Pin to taskbar, sorry for that)
   
   
   
   
   
2. Browse to your server name,and press Next. Punch in alternative credential if needed.
   
   
   
   
   
3.  If you need to activate your KMS, get it activated. In this case, I already activated my KMS, so I will skip to Configuration.
   
   
   
   
   
4.  Once all steps above completed, there hould not be any issue in accessing to the Configuration, "Access Denied" error should not appear anymore.
   

Read More

Failed to Delete / Move Organizational Unit in Active Directory

I think I rarely touch about Active Directory, so let's start with a basic one. Let say, one day you want to housekeep your OU structure, delete or maybe move some OUs to different locations, but you got an error :

You do not have sufficient privilages to delete <OUName>, or this onject is protected from accidental deletion.

or

Windows cannot move object <OUName> because:

Access is denied.

Well, if we look at the first error, it is clear cut, the object is protected from accidental deletion, so the object needs to stay there. Whereas for second error, it just mentioned "access is denied". 

Issues :

• Can't delete or move OU, either one of above errors prompted.

Troubleshooting 

1.  Right click at the target OU, and click at Properties
   

Read More

Server 2012 - Failed to Turn On .Net 3.5 Fx Features

I am using Windows Server 2012 for my XenDesktop 7 lab test. During the installation of SQL server, it prompted an error, asking for .Net 3.5 Framework to be turned on. I tried to enable it, but failed. Thinking and thinking, until I realized what was the issue

Issues :

Received below error while trying to enabling .Net 3.5 Framework feature in Windows Server 2012.

Error :

Installation of one or more roles. role services, or features failed.

The source files could not be found. Try installing the roles, role services, or features again in a new Add Roles and Features Wizard session, and on the confirmation page of the wizard, click "Specify an alternate source path" to specify a valid location of the source files that are required for the installation. The location must be accessible by the computer account of the destination server.

Troubleshooting 

It turns out that to enable the feature, the source is needed. In this case, it will grab the source from internet.

Resolution :

Mount the Windows Server 2012 CD / ISO to the drive

Open command prompt as administrator, and launch this command :
dism.exe /online /enable-feature /all /featurename:NetFX3 /Source:D:\sources\sxs /LimitAccess

running...

Complete!

Launch Server Maanger, and check the Roles and Features. the newly installed feature will appeared.

Reference 

http://social.technet.microsoft.com/Forums/en-US/5a786052-38a1-46f9-add2-e6487bc6a8aa/net-framework-20-and-35-feature-install-fails-on-windows-server-2012-rc?forum=winserver8setup

Posted via Blogaway

Read More