Service Pack 1 fails to install (error_file_not_found_0x80070002)

NoelDP · 29 Apr 2012

Please post the new CBS.log file - it will have changed now that you've attempted a new SFC.

According to the report, it's activated fine.If the System page says it's not activated then you have a problem with the WGA system.
Installing the WAT update may help identify the problem - you could always uninstall it later.
Yes it's KB971033 - but don't believe all the paranoid hype that was put about by hackers when it was first released.
Description of the update for Windows Activation Technologies

rawshark · 29 Apr 2012

Yeah i may just have to install the update, though i'm apprehensive when you read the numerous problems people have had with it even running a genuine copy of windows. I was also of the understanding that it couldn't be uninstalled but my options are dwindling anyway.

NoelDP · 29 Apr 2012

The problems are not becuase of the update - they already existed previous to its installation, and were simply brought to light by it.

There's been no change whatever in the CBS.log file - and it looks to me as if the only entries in it relate to the attempt to install SP1.

One thing that may cause this type of error is if permissions for system accounts have been borked, or the accounts themselves have been removed in some way.

Please run the following commands in an Elevated Command Prompt.

Code:

 ICACLS C:\Windows\ServiceProfiles\NetworkService
ICACLS C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
DIR C:\Windows\ServiceProfiles\NetworkService /as
DIR C:\Windows\ServiceProfiles\NetworkService /ah 
REG QUERY HKU
REG QUERY HKU\S-1-5-20
REG QUERY HKU\S-1-5-20\Environment
REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20"

Post the results

Here are some instructions to maike life easier
:)
1) To open an Elevated Command Prompt Window
(the CP window), click on Start, All Programs, Accessories – then right-click on
Command Prompt, and select Run as Administrator. Accept the UAC
prompt.

2) To run the commands easier, highlight the
block of commands, and right-click on the highlight – select Copy. In the CP
Windows, click on the black/white icon at top left – select Paste. The commands
will run but may not complete the last command, so hit the Enter Key
once.

3) To copy the results... click on the
Black/White icon in the top left, and select Edit... 'Select All', and hit the
Enter key - then use Ctrl+V or r-click+Paste to paste it into your
response.

rawshark · 29 Apr 2012

I only have 1 active user account on this system.

Code:

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService
C:\Windows\ServiceProfiles\NetworkService NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                                          BUILTIN\Administrators:(OI)(CI)(F)
                                          NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT NT AUTHORITY\SYSTEM:(I)(F)
                                                     BUILTIN\Administrators:(I)(F)
                                                     NT AUTHORITY\NETWORK SERVICE:(I)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>DIR C:\Windows\ServiceProfiles\NetworkService /as
 Volume in drive C has no label.
 Volume Serial Number is C497-8A22

 Directory of C:\Windows\ServiceProfiles\NetworkService

29/04/2012  22:57           262,144 NTUSER.DAT
14/07/2009  06:01            65,536 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
14/07/2009  06:01           524,288 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
14/07/2009  06:01           524,288 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
08/12/2011  03:02            65,536 NTUSER.DAT{278f5e6a-20fb-11e1-9293-6cf04973492d}.TM.blf
08/12/2011  03:02           524,288 NTUSER.DAT{278f5e6a-20fb-11e1-9293-6cf04973492d}.TMContainer00000000000000000001.regtrans-ms
08/12/2011  03:02           524,288 NTUSER.DAT{278f5e6a-20fb-11e1-9293-6cf04973492d}.TMContainer00000000000000000002.regtrans-ms
08/12/2011  07:25            65,536 NTUSER.DAT{a4dcbf61-213f-11e1-897d-6cf04973492d}.TM.blf
08/12/2011  07:25           524,288 NTUSER.DAT{a4dcbf61-213f-11e1-897d-6cf04973492d}.TMContainer00000000000000000001.regtrans-ms
08/12/2011  07:25           524,288 NTUSER.DAT{a4dcbf61-213f-11e1-897d-6cf04973492d}.TMContainer00000000000000000002.regtrans-ms
              10 File(s)      3,604,480 bytes
               0 Dir(s)  334,415,753,216 bytes free

C:\Windows\system32>DIR C:\Windows\ServiceProfiles\NetworkService /ah
 Volume in drive C has no label.
 Volume Serial Number is C497-8A22

 Directory of C:\Windows\ServiceProfiles\NetworkService

07/04/2010  23:12    <DIR>          AppData
29/04/2012  22:57           262,144 NTUSER.DAT
14/07/2009  08:12             1,024 NTUSER.DAT.LOG
29/04/2012  22:57           226,304 NTUSER.DAT.LOG1
14/07/2009  05:45                 0 NTUSER.DAT.LOG2
14/07/2009  06:01            65,536 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
14/07/2009  06:01           524,288 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
14/07/2009  06:01           524,288 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
08/12/2011  03:02            65,536 NTUSER.DAT{278f5e6a-20fb-11e1-9293-6cf04973492d}.TM.blf
08/12/2011  03:02           524,288 NTUSER.DAT{278f5e6a-20fb-11e1-9293-6cf04973492d}.TMContainer00000000000000000001.regtrans-ms
08/12/2011  03:02           524,288 NTUSER.DAT{278f5e6a-20fb-11e1-9293-6cf04973492d}.TMContainer00000000000000000002.regtrans-ms
08/12/2011  07:25            65,536 NTUSER.DAT{a4dcbf61-213f-11e1-897d-6cf04973492d}.TM.blf
08/12/2011  07:25           524,288 NTUSER.DAT{a4dcbf61-213f-11e1-897d-6cf04973492d}.TMContainer00000000000000000001.regtrans-ms
08/12/2011  07:25           524,288 NTUSER.DAT{a4dcbf61-213f-11e1-897d-6cf04973492d}.TMContainer00000000000000000002.regtrans-ms
              13 File(s)      3,831,808 bytes
               1 Dir(s)  334,415,753,216 bytes free

C:\Windows\system32>REG QUERY HKU

HKEY_USERS\.DEFAULT
HKEY_USERS\S-1-5-19
HKEY_USERS\S-1-5-20
HKEY_USERS\S-1-5-21-1713040681-1314412740-1622756178-1000
HKEY_USERS\S-1-5-21-1713040681-1314412740-1622756178-1000_Classes
HKEY_USERS\S-1-5-18

C:\Windows\system32>REG QUERY HKU\S-1-5-20

HKEY_USERS\S-1-5-20\AppEvents
HKEY_USERS\S-1-5-20\Console
HKEY_USERS\S-1-5-20\Control Panel
HKEY_USERS\S-1-5-20\Environment
HKEY_USERS\S-1-5-20\EUDC
HKEY_USERS\S-1-5-20\Keyboard Layout
HKEY_USERS\S-1-5-20\Network
HKEY_USERS\S-1-5-20\Printers
HKEY_USERS\S-1-5-20\Software
HKEY_USERS\S-1-5-20\System

C:\Windows\system32>REG QUERY HKU\S-1-5-20\Environment

HKEY_USERS\S-1-5-20\Environment
    TEMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp
    TMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp


C:\Windows\system32>REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20
    ProfileImagePath    REG_EXPAND_SZ    C:\Windows\ServiceProfiles\NetworkService
    Flags    REG_DWORD    0x0
    State    REG_DWORD    0x0


C:\Windows\system32>

NoelDP · 29 Apr 2012

The problem appears to be that the user account doesn't have permissions it should have -
I've seen this before, but don't know a specific fix for it.
I would suggest either a Repair install, or contacting MS for assistance - WU help is free (SP1 is a covered update)

rawshark · 29 Apr 2012

When you say a repair install, do you mean that option you get on the F8 boot menu? I went into that and i saw the option for repairing startup problems but didn't run it because i wasn't sure. Be interesting to know if this installation was borked when i activated it 2 years ago, it's a custom build though i didn't put it together myself, it was from an independent store.

NoelDP · 29 Apr 2012

No - see the Tutorial that Brink did for these forums....
Repair Install

rawshark · 29 Apr 2012

Oh yes, an in-place upgrade, i saw that as a solution somewhere else but the process was way more long winded than this one. I think i'll create a new user account first, log into it and see if that does anything.

Thank you for your help.

NoelDP · 29 Apr 2012

In my experience, a new User account won't solve the problem - but I agree it's worth trying.
Make sure that it's an Admin account, and once logged in, run the following command.
ICACLS C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
the response should be

Code:

C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
NT AUTHORITY\NETWORK SERVICE:(I)(F)
<username>:(I)(F)
 
Successfully processed 1 files; Failed processing 0 files

If not, the problem still exists

rawshark · 29 Apr 2012

I got this.

Code:

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT NT AUTHORITY\SYSTEM:(I)(F)
                                                     BUILTIN\Administrators:(I)(F)
                                                     NT AUTHORITY\NETWORK SERVICE:(I)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>

It was worth a short, i'll try the in-place upgrade at some point.