Re: SP2 errors after Install

From: Jim Vierra (jvierra_at_msn.com)
Date: 06/09/05 

Date: Wed, 8 Jun 2005 20:18:03 -0400

Do NOT! do this.

Permissions on specific resources may be missing from the net service
account and placing this in the admin group proves this. Te NW Service
account should NEVE be given admin privileges. It exists for exactly this
reason - "Security".

Carroll - You need to escalate this up the chain at MS tech. The answers
you are getting are not good or correct.

I have been through many go-arounds with this type of issue. Either the NET
service account is missing DCOM privileges or security on key folders is
missing this account. Start with DCOM permissions and work out from there.

In my experience some piece of software you have installed before the SP2
upgrade has altered the DCOM or other COM permissions.

Working with MS support to get these permissions set correctly will
guarantee that you do not reduce the security of your systems. 

-- 
Jim Vierra
<Carroll.IversonAT@REMOVEncmail.net> wrote in message 
news:OlcJyQIbFHA.3328@TK2MSFTNGP09.phx.gbl...
> To whom it may concern;
>
> I am an engineer with a large seat management company.  We ran into 
> considerable problems with deploying sp2.  In short the service pack 
> installs with no errors but key services never reached a started state. 
> The services were shell hardware detection, network connections and com+ 
> event system.
> We spent a significant amount of time running down the exact cause and 
> finally resorted to calling Micrsoft tech support.  The tech support folks 
> were unable to find any reason why it would not work.  After fixing 
> everything that could be an issue I noticed that a protected service 
> account was being rejected in the security event log.  I placed that 
> service in the admin group and the issues magically disappeared.
> I called and spoke to the escalation engineer assigned to our ticket and 
> he said that they (support) suspected something like this but that the 
> software writers were refusing to release information about the security 
> changes so that a work around could be found.  I let him know I was going 
> to post to the newsgroups and let them know the resolution that I found. 
> The tech admitted that there were several distinct problems like ours that 
> had been unable to come to a resolution.
> I personally find that to be abject stupidity not to release information 
> on this type of issue.  I urge all admins, users and/or groups having a 
> problem remotely like what I described to place the "NT Authority\Network 
> Service" in the admin group and see if your issues are resolved on the 
> next boot. The indicated account should have the correct rights and 
> Microsoft could not tell me why it needed to be done this way.
> If you are having issues like this and don't understand what I am 
> addressing as a fix, send me an email and I will help you as much as I 
> can.
>
> Thanks for listening,
>
> Carroll Iverson
> Senior Systems Consultant
>
>
>

Relevant Pages

  • Re: securing files in a public PC
    ... XP provides the best default NTFS and registry permissions ... With XP one can look at using Software Restriction Policy ... applications so that the public use account has not been granted ... Microsoft MVP (Windows Security) ...
    (microsoft.public.win2000.security)
  • Re: Why does Everyone have Full Control of everthing?
    ... Analysis snap-in to apply the Setup Security template to my machine, ... Perhaps I should have only applied the file permissions ... using the personal account created at setup. ... >list of default NTFS permissions for Windows 2000. ...
    (microsoft.public.windowsxp.general)
  • Re: unrestricted access to a file share
    ... Windows 2003 with increased default security as several users that have ... accessing a share when guest is enabled and everyone has permissions though ... account out to those at the location. ... fileshare that have never been defined on the server (neither the user ...
    (microsoft.public.security)
  • Re: Domain groups show up as a SID
    ... I believe that is the way security ... If you logon as a member of a Domain Admins group, but the Local Admins group is ... So if the Domain Admin group has an account named Administrator and the Local ... SID's for all Permissions viewed and granted to any Domain Account. ...
    (microsoft.public.win2000.security)
  • Re: Allow update of properties without allowing password changes, etc
    ... the people who are in that group very likely have enough permissions now to escalate themselves to domain or enterprise admins. ... First I added the "assistant" to the "Account Operators" group. ... Drilling into the Advanced security properties and clicking "Add", after adding the account in question, change the "Apply Onto" dropdown to "User Objects" and add the "Deny" permission for: ... Change Password ...
    (microsoft.public.windows.server.security)