Solved Service Pack 1 fails to install (error_file_not_found_0x80070002)

rawshark · Apr 29, 2012

I've never been offered SP1 through windows update for some reason so i decided to download the standalone installer and i went through the following steps:

1. Ran the system update readiness tool - no errors found.
2. Went through following steps before installing - Steps to follow before you install Windows 7 SP1 and Windows Server 2008 R2 SP1 from the Microsoft Download Center - though in the third step listed the updates suggested failed to install saying they were not applicable to my computer even though i got the x64 versions.
3. Ran a full virus scan - found one infected script file so deleted.
4. Went ahead and tried installing SP1 but after going through the preparing computer process it came up unsuccessful with the message 'ERROR_FILE_NOT_FOUND_0x80070002'.

Here is where i got the service pack from - http://www.microsoft.com/en-us/download/details.aspx?displaylang=en&id=5842 -the x64 version which i believe is 'windows6.1-KB976932-X64.exe'.

So after this i ran through the following steps:

1. Ran the Fix It tool which again found no errors to repair.
2. Stopped the windows update service, renamed the SoftwareDistribution folder and restarted windows update service so as to re-download updates.
3. I also followed one solution whereby you boot into safe mode and allow permissions for [SOFTWARE\Microsoft\Windows\CurrentVersion\Setup] because a section of the CBS file says this registry root could not be opened. Rebooting again into safe mode and running the SP1 installer.

None of this worked so now i am completely stumped, i might just have to do a full restore when i can be bothered. Though i've attached the CBS file if anyone can shed some light on the problem. Thanks.

NoelDP · Apr 29, 2012

Your CBS.log file appeared to contain no data from an SFC - this may be because the log was archived on a reboot.
Please post the latest persist log, or run another SFC and post the new CBS.log file

kegobeer · Apr 29, 2012

Instead of renaming the folder, I'd follow all of the steps outline in the MS article.

http://windows.microsoft.com/en-US/windows7/Windows-Update-error-80070002

rawshark · Apr 29, 2012

NoelDP said:
Your CBS.log file appeared to contain no data from an SFC - this may be because the log was archived on a reboot.
Please post the latest persist log, or run another SFC and post the new CBS.log file

Is that where you run 'sfc /scannow' from a command prompt? I tried that and it returns the message 'windows resource protection could not start the repair service' despite running cmd as administrator. Where do i find the persist log?

kegobeer said:
Instead of renaming the folder, I'd follow all of the steps outline in the MS article.

Windows Update error 80070002

Won't that just re-download updates once the service is restarted? I did that yesterday and got a bunch of updates i've had before. But i will try it. Though no updates have ever been listed under 'installed updates' only under 'view update history'. Which makes me believe i've had a borked windows installation from the very beginning.

NoelDP · Apr 29, 2012

If SFC is failing that badly, it means that there are some fairly fundamental things wrong with the OS.
The persist files are in the same folder as the CBS.log file

I wonder..... Please post an MGADiag report - I have a supicion I may know what's happening.

download and save the MGADiag tool to your desktop - http://go.microsoft.com/fwlink/?linkid=52012
Once saved, run the tool.
Click on the Continue button, which will produce the report.
To copy the report to your response, click on the Copy button in the tool (ignore any error messages at this point), and then paste (using either r-click/Paste, or Ctrl+V ) into your response.
- **in your own thread**, please
Please also state the Version and Edition of Windows quoted on your COA sticker (if you have one) on the case of your machine (or inside the battery compartment), but do NOT quote the Key on the sticker!
How to Tell

rawshark · Apr 29, 2012

Yeah, it does seem like there is something fundamentally wrong even though i have had no problems with it until just recently started getting a BSOD occasionally, which might be resolved now. Here are the persist files, which i doubt can tell you much. I'll run that MGADiag report shortly.

NoelDP · Apr 29, 2012

Odd - there's no CBS persist log, only the CheckSUR files.
Since the current CBS log only holds data from today, please run another SFC /SCANNOW, and post the new CBS.log file immediately afterwards (after a reboot)- and check to see if a CBS persist log has been created.

rawshark · Apr 29, 2012

But it won't let me run an sfc scan. I only got that CBS file from trying to install SP1.

Lots of instances of that error message in the MGADiag test though, i can see this being a full restore but then if it's been broken since installation would that even resolve any issues.

The COA sticker says:

Windows 7 Home Prem
OEM Software

Seems like a genuine sticker to me, it has a holographic strip running through the centre lengthwise.

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-W874H-4HYVM-KVKXT
Windows Product Key Hash: DgCAhHPpvlQr7Cp2mDJGfa4A4Tg=
Windows Product ID: 00359-OEM-8702972-85523
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7600.2.00010300.0.0.003
ID: {455C5BD8-CD16-46CF-9CDB-EF58FF81E6C7}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7600.win7_gdr.100226-1909
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\npwatweb.dll[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watux.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watweb.dll[Hr = 0x80070003]

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{455C5BD8-CD16-46CF-9CDB-EF58FF81E6C7}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010300.0.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-KVKXT</PKey><PID>00359-OEM-8702972-85523</PID><PIDType>3</PIDType><SID>S-1-5-21-1713040681-1314412740-1622756178</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>P55M-UD2</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F8</Version><SMBIOSVersion major="2" minor="4"/><Date>20100211000000.000000+000</Date></BIOS><HWID>FEBA3607018400FE</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7600.16385

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: 586bc076-c93d-429a-afe5-a69fbc644e88
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00174-029-785523-02-2057-7600.0000-0982010
Installation ID: 003981792652014032789763381721731813168690594375186323
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: KVKXT
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 29/04/2012 22:22:10

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: N/A
HealthStatus: 0x0000000000000000
Event Time Stamp: N/A
ActiveX: Not Registered - 0x80040154
Admin Service: Not Registered - 0x80040154
HealthStatus Bitmask Output:

HWID Data-->
HWID Hash Current: NgAAAAEABgABAAEAAAACAAAAAQABAAEA6GFGCKgYdo2AlihgQsYIhcKP5KIQBmI99Jh0OnZW

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC GBT GBTUACPI
FACP GBT GBTUACPI
HPET GBT GBTUACPI
MCFG GBT GBTUACPI
EUDS GBT
TAMG GBT GBT B0
SSDT INTEL PPM RCM

NoelDP · Apr 29, 2012

Don't worry about the errror codes in the MGADiag report - most of them are perfectly normal.
The only two 'unusual problems' are related -
1) You haven't installed the WAT Update - (which causes the File Mismatches we see here)
2) You appear never to have validated the install.

Neither of them are related to your current problem, and can be ignored.

I was expecting to see a long list of file mismatches - but since there are none, my earlier thoughts will have to be discarded.

Please attempt the SFC /SCANNOW anyhow - it will place data into the CBS.log file which may allow us to troubleshoot it.

rawshark · Apr 29, 2012

Ahh yes, the WAT update, is that KB971033? I remember at the time i purposely rejected that update because i didn't like the idea of windows 'calling home'. Is this what would be needed to validate the install because it says it's activated in system properties.

I've rebooted but i simply cannot run sfc, it's still saying 'windows resource protection could not start the repair service'. I opened the command prompt as administrator unless there's another way to do it.

NoelDP · Apr 29, 2012

Please post the new CBS.log file - it will have changed now that you've attempted a new SFC.

According to the report, it's activated fine.If the System page says it's not activated then you have a problem with the WGA system.
Installing the WAT update may help identify the problem - you could always uninstall it later.
Yes it's KB971033 - but don't believe all the paranoid hype that was put about by hackers when it was first released.
Description of the update for Windows Activation Technologies

rawshark · Apr 29, 2012

Yeah i may just have to install the update, though i'm apprehensive when you read the numerous problems people have had with it even running a genuine copy of windows. I was also of the understanding that it couldn't be uninstalled but my options are dwindling anyway.

NoelDP · Apr 29, 2012

The problems are not becuase of the update - they already existed previous to its installation, and were simply brought to light by it.

There's been no change whatever in the CBS.log file - and it looks to me as if the only entries in it relate to the attempt to install SP1.

One thing that may cause this type of error is if permissions for system accounts have been borked, or the accounts themselves have been removed in some way.

Please run the following commands in an Elevated Command Prompt.

Code:

 ICACLS C:\Windows\ServiceProfiles\NetworkService
ICACLS C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
DIR C:\Windows\ServiceProfiles\NetworkService /as
DIR C:\Windows\ServiceProfiles\NetworkService /ah 
REG QUERY HKU
REG QUERY HKU\S-1-5-20
REG QUERY HKU\S-1-5-20\Environment
REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20"

Post the results

Here are some instructions to maike life easier

1) To open an Elevated Command Prompt Window
(the CP window), click on Start, All Programs, Accessories – then right-click on
Command Prompt, and select Run as Administrator. Accept the UAC
prompt.

2) To run the commands easier, highlight the
block of commands, and right-click on the highlight – select Copy. In the CP
Windows, click on the black/white icon at top left – select Paste. The commands
will run but may not complete the last command, so hit the Enter Key
once.

3) To copy the results... click on the
Black/White icon in the top left, and select Edit... 'Select All', and hit the
Enter key - then use Ctrl+V or r-click+Paste to paste it into your
response.

rawshark · Apr 29, 2012

I only have 1 active user account on this system.

Code:

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService
C:\Windows\ServiceProfiles\NetworkService NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                                          BUILTIN\Administrators:(OI)(CI)(F)
                                          NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT NT AUTHORITY\SYSTEM:(I)(F)
                                                     BUILTIN\Administrators:(I)(F)
                                                     NT AUTHORITY\NETWORK SERVICE:(I)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>DIR C:\Windows\ServiceProfiles\NetworkService /as
 Volume in drive C has no label.
 Volume Serial Number is C497-8A22

 Directory of C:\Windows\ServiceProfiles\NetworkService

29/04/2012  22:57           262,144 NTUSER.DAT
14/07/2009  06:01            65,536 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
14/07/2009  06:01           524,288 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
14/07/2009  06:01           524,288 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
08/12/2011  03:02            65,536 NTUSER.DAT{278f5e6a-20fb-11e1-9293-6cf04973492d}.TM.blf
08/12/2011  03:02           524,288 NTUSER.DAT{278f5e6a-20fb-11e1-9293-6cf04973492d}.TMContainer00000000000000000001.regtrans-ms
08/12/2011  03:02           524,288 NTUSER.DAT{278f5e6a-20fb-11e1-9293-6cf04973492d}.TMContainer00000000000000000002.regtrans-ms
08/12/2011  07:25            65,536 NTUSER.DAT{a4dcbf61-213f-11e1-897d-6cf04973492d}.TM.blf
08/12/2011  07:25           524,288 NTUSER.DAT{a4dcbf61-213f-11e1-897d-6cf04973492d}.TMContainer00000000000000000001.regtrans-ms
08/12/2011  07:25           524,288 NTUSER.DAT{a4dcbf61-213f-11e1-897d-6cf04973492d}.TMContainer00000000000000000002.regtrans-ms
              10 File(s)      3,604,480 bytes
               0 Dir(s)  334,415,753,216 bytes free

C:\Windows\system32>DIR C:\Windows\ServiceProfiles\NetworkService /ah
 Volume in drive C has no label.
 Volume Serial Number is C497-8A22

 Directory of C:\Windows\ServiceProfiles\NetworkService

07/04/2010  23:12    <DIR>          AppData
29/04/2012  22:57           262,144 NTUSER.DAT
14/07/2009  08:12             1,024 NTUSER.DAT.LOG
29/04/2012  22:57           226,304 NTUSER.DAT.LOG1
14/07/2009  05:45                 0 NTUSER.DAT.LOG2
14/07/2009  06:01            65,536 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
14/07/2009  06:01           524,288 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
14/07/2009  06:01           524,288 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
08/12/2011  03:02            65,536 NTUSER.DAT{278f5e6a-20fb-11e1-9293-6cf04973492d}.TM.blf
08/12/2011  03:02           524,288 NTUSER.DAT{278f5e6a-20fb-11e1-9293-6cf04973492d}.TMContainer00000000000000000001.regtrans-ms
08/12/2011  03:02           524,288 NTUSER.DAT{278f5e6a-20fb-11e1-9293-6cf04973492d}.TMContainer00000000000000000002.regtrans-ms
08/12/2011  07:25            65,536 NTUSER.DAT{a4dcbf61-213f-11e1-897d-6cf04973492d}.TM.blf
08/12/2011  07:25           524,288 NTUSER.DAT{a4dcbf61-213f-11e1-897d-6cf04973492d}.TMContainer00000000000000000001.regtrans-ms
08/12/2011  07:25           524,288 NTUSER.DAT{a4dcbf61-213f-11e1-897d-6cf04973492d}.TMContainer00000000000000000002.regtrans-ms
              13 File(s)      3,831,808 bytes
               1 Dir(s)  334,415,753,216 bytes free

C:\Windows\system32>REG QUERY HKU

HKEY_USERS\.DEFAULT
HKEY_USERS\S-1-5-19
HKEY_USERS\S-1-5-20
HKEY_USERS\S-1-5-21-1713040681-1314412740-1622756178-1000
HKEY_USERS\S-1-5-21-1713040681-1314412740-1622756178-1000_Classes
HKEY_USERS\S-1-5-18

C:\Windows\system32>REG QUERY HKU\S-1-5-20

HKEY_USERS\S-1-5-20\AppEvents
HKEY_USERS\S-1-5-20\Console
HKEY_USERS\S-1-5-20\Control Panel
HKEY_USERS\S-1-5-20\Environment
HKEY_USERS\S-1-5-20\EUDC
HKEY_USERS\S-1-5-20\Keyboard Layout
HKEY_USERS\S-1-5-20\Network
HKEY_USERS\S-1-5-20\Printers
HKEY_USERS\S-1-5-20\Software
HKEY_USERS\S-1-5-20\System

C:\Windows\system32>REG QUERY HKU\S-1-5-20\Environment

HKEY_USERS\S-1-5-20\Environment
    TEMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp
    TMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp


C:\Windows\system32>REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20
    ProfileImagePath    REG_EXPAND_SZ    C:\Windows\ServiceProfiles\NetworkService
    Flags    REG_DWORD    0x0
    State    REG_DWORD    0x0


C:\Windows\system32>

NoelDP · Apr 29, 2012

The problem appears to be that the user account doesn't have permissions it should have -
I've seen this before, but don't know a specific fix for it.
I would suggest either a Repair install, or contacting MS for assistance - WU help is free (SP1 is a covered update)

rawshark · Apr 29, 2012

When you say a repair install, do you mean that option you get on the F8 boot menu? I went into that and i saw the option for repairing startup problems but didn't run it because i wasn't sure. Be interesting to know if this installation was borked when i activated it 2 years ago, it's a custom build though i didn't put it together myself, it was from an independent store.

NoelDP · Apr 29, 2012

No - see the Tutorial that Brink did for these forums....
http://www.sevenforums.com/tutorials/3413-repair-install.html?ltr=R

rawshark · Apr 29, 2012

Oh yes, an in-place upgrade, i saw that as a solution somewhere else but the process was way more long winded than this one. I think i'll create a new user account first, log into it and see if that does anything.

Thank you for your help.

NoelDP · Apr 29, 2012

In my experience, a new User account won't solve the problem - but I agree it's worth trying.
Make sure that it's an Admin account, and once logged in, run the following command.
ICACLS C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
the response should be

Code:

C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
NT AUTHORITY\NETWORK SERVICE:(I)(F)
<username>:(I)(F)
 
Successfully processed 1 files; Failed processing 0 files

If not, the problem still exists

rawshark · Apr 29, 2012

I got this.

Code:

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT NT AUTHORITY\SYSTEM:(I)(F)
                                                     BUILTIN\Administrators:(I)(F)
                                                     NT AUTHORITY\NETWORK SERVICE:(I)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>

It was worth a short, i'll try the in-place upgrade at some point.

Solved Service Pack 1 fails to install (error_file_not_found_0x80070002)

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

Google-Fu black belt

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

Attachments

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer