Solved Unable to fully configure Windows Update

[recreaghmd]

This is a Lenovo T61p laptop running Windows 7 Ultimate SP1.
At present, I am unable to fully configure Windows Update which is updating automatically well but only windows files (Like Office, etc.)
1] The selection for simultaneously updating others Windows programs has disappeared.
2] I have previously selected to "Notify me of new updates only" so I can chose those I want at my convenience. Now is fixed on "Install Updates Automatically" and is not available for change. In the attachment, notice the message on the top "Some settings are managed by your System Administrator" which I believe is preventing me from choosing. This has been present for one month and is not my doing and it appeared after one update.
I shall appreciate very much advice as to how to resolve this two issues. An image of the configuration screen is attached.
Thanks!

 

[torchwood]

Hi

looks like a group policy rule is stopping it.

lets check

Group Policy Editor - Quickly View Enabled Policies in Windows

If none are present then its likely its not connecting to the correct server.
run this tool, copy/paste the output

http://go.microsoft.com/fwlink/?LinkID=52012


Roy

 

[recreaghmd]

Thanks for the prompt reply.
All the policies are "Non Configure"
Diagnostic tool. Here is the output:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-F6XH6-49K4J-CPQ8H
Windows Product Key Hash: 49pE9xlGYPWCxOfbvxzHrIEFLDU=
Windows Product ID: 00426-292-3256104-85518
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {0CC54590-0503-4C4F-93BC-4F07C71D211F}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_ldr_escrow.181228-0954
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{0CC54590-0503-4C4F-93BC-4F07C71D211F}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-CPQ8H</PKey><PID>00426-292-3256104-85518</PID><PIDType>5</PIDType><SID>S-1-5-21-4229128241-3885607801-2466799268</SID><SYSTEM><Manufacturer>LENOVO</Manufacturer><Model>64608WU</Model></SYSTEM><BIOS><Manufacturer>LENOVO</Manufacturer><Version>7LETC9WW (2.29 )</Version><SMBIOSVersion major="2" minor="4"/><Date>20110318000000.000000+000</Date></BIOS><HWID>B8663407018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>LENOVO</OEMID><OEMTableID>TP-7U </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00170-292-325610-00-1033-7601.0000-0892018
Installation ID: 005560977436554246004763380170913204126533634083948971
Processor Certificate URL: SpcService Web Service
Machine Certificate URL: RacService Web Service
Use License URL: UseLicenseService Web Service
Product Key Certificate URL: PkcService Web Service
Partial Product Key: CPQ8H
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 21-Jan-19 10:39:44
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 1:4:2019 15:38
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:

HWID Data-->
HWID Hash Current: OAAAAAEABQABAAEAAAACAAAAAwABAAEAln0QIhNWAC0an7BULghGg6Z7+hJGBgvUIQzMMtKZRso=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC LENOVO TP-7U
FACP LENOVO TP-7U
HPET LENOVO TP-7U
BOOT LENOVO TP-7U
MCFG LENOVO TP-7U
SSDT LENOVO TP-7U
ECDT LENOVO TP-7U
TCPA LENOVO TP-7U
SLIC LENOVO TP-7U
SLAC LENOVO TP-7U
ASF! LENOVO TP-7U
SSDT LENOVO TP-7U
SSDT LENOVO TP-7U
SSDT LENOVO TP-7U
SSDT LENOVO TP-7U

Hope it will help to solve the problem.
Thanks

 

[torchwood]

Hi

Nothing odd about that report.

Lets try resetting

1) Local group policy
Local Group Policy - Reset to Default

2) local security policies
Reset Local Security Policy Settings to Default in Windows | Tutorials

Thought
when your updating which account are you using
Administrator
User
Guest


Roy

 

[recreaghmd]

Ok, I believe I am the Adm. as far as I know.
Group Policy reset done with no problems.
Security Policy got one an extended error. Access denied at several registry entries and one path not found. At end state Adm. account is disable (?)
Here is the corresponding log file.
I had to delete quite a few hundreds of the identical 2 line error statement so that I could send you the text of the file.
-------------------------------------------
Monday, January 21, 2019 2:56:05 PM
----Configuration engine was initialized successfully.----
----Reading Configuration Template info...

----Configure User Rights...
SeImpersonatePrivilege must be assigned to administrators. This setting is adjusted.
SeImpersonatePrivilege must be assigned to SERVICE. This setting is adjusted.
Configure S-1-5-19.
Configure S-1-5-20.
Configure S-1-5-32-544.
Configure S-1-5-32-551.
Configure S-1-5-32-559.
Configure S-1-5-32-545.
Configure S-1-1-0.
Configure S-1-5-6.
Configure S-1-5-21-4229128241-3885607801-2466799268-501.
Configure S-1-5-32-555.
Configure S-1-5-80-0.
Configure S-1-5-80-3139157870-2983391045-3678747466-658725712-1809340420.
User Rights configuration was completed successfully.

----Configure Group Membership...
Configure Users.
Group Membership configuration was completed successfully.

----Configure 64-bit Registry Keys...
Configure users\.default.
Configure machine\software.
Configure machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.

Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Warning 5: Access is denied.
Error setting security on machine\software\classes.
Configure machine\software\classes\.hlp.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft.
Configure machine\software\microsoft\drm.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows\currentversion.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows\currentversion.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows\currentversion.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows\currentversion.
Warning 5: Access is denied.
Error setting security on machine\software\microsoft\windows\currentversion.
Configure machine\system.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control.
Configure machine\system\currentcontrolset\control\class.
Configure machine\system\currentcontrolset\control\keyboard layouts.
Warning 5: Access is denied.
Error setting security on machine\system\currentcontrolset\control\lsa.
Configure machine\system\currentcontrolset\control\lsa\data.
Configure machine\system\currentcontrolset\control\lsa\gbg.
Configure machine\system\currentcontrolset\control\lsa\jd.
Configure machine\system\currentcontrolset\control\lsa\skew1.
Configure machine\system\currentcontrolset\control\nsi.
Configure machine\system\currentcontrolset\control\nsi\{eb004a00-9b1a-11d4-9123-0050047759bc}\4.
Configure machine\system\currentcontrolset\control\nsi\{eb004a01-9b1a-11d4-9123-0050047759bc}\4.
Configure machine\system\currentcontrolset\control\nsi\{eb004a1c-9b1a-11d4-9123-0050047759bc}\0.
Configure machine\system\currentcontrolset\control\wmi\security.
Configure machine\system\currentcontrolset\services\appmgmt\security.
Configure machine\system\currentcontrolset\services\scardsvr\security.
Configure machine\system\currentcontrolset\services\stisvc\security.
Warning 2: The system cannot find the file specified.
Error enumerating info for machine\system\currentcontrolset\services\sysmonlog.
Configuration of Registry Keys was completed successfully.

----Configure 32-bit Registry Keys...
Configure machine\software.
Warning 1336: The access control list (ACL) structure is invalid.
Error setting security on machine\software\Licenses.
Configuration of Registry Keys was completed with one or more errors.

----Configure File Security...
Configure c:\program files (x86)\common files\speechengines\microsoft\tts.
Warning 2: The system cannot find the file specified.
Error setting security on c:\program files (x86)\common files\speechengines\microsoft\tts.
Configure c:\programdata\microsoft\windows\drm.
Configure c:\programdata\microsoft\windows\drm\cache.
Configure c:\windows\repair\default.
Warning 3: The system cannot find the path specified.
Error setting security on c:\windows\repair\default.
Configure c:\windows\repair\ntuser.dat.
Warning 3: The system cannot find the path specified.
Error setting security on c:\windows\repair\ntuser.dat.
Configure c:\windows\repair\sam.
Warning 3: The system cannot find the path specified.
Error setting security on c:\windows\repair\sam.
Configure c:\windows\repair\security.
Warning 3: The system cannot find the path specified.
Error setting security on c:\windows\repair\security.
Configure c:\windows\repair\software.
Warning 3: The system cannot find the path specified.
Error setting security on c:\windows\repair\software.
Configure c:\windows\repair\system.
Warning 3: The system cannot find the path specified.
Error setting security on c:\windows\repair\system.
Configure c:\windows\system32\windows media.
Warning 2: The system cannot find the file specified.
Error setting security on c:\windows\system32\windows media.
Configure c:\windows\syswow64\export.
Warning 2: The system cannot find the file specified.
Error setting security on c:\windows\syswow64\export.
Configure c:\windows\syswow64\ias.
Warning 2: The system cannot find the file specified.
Error setting security on c:\windows\syswow64\ias.
File Security configuration was completed successfully.

----Configure General Service Settings...
Configure sysmonlog.
Error 1060: The specified service does not exist as an installed service.
Error opening sysmonlog.
Configure SamSs.
Configure ntmssvc.
Error 1060: The specified service does not exist as an installed service.
Error opening ntmssvc.
Configure netddedsdm.
Error 1060: The specified service does not exist as an installed service.
Error opening netddedsdm.
Configure netdde.
Error 1060: The specified service does not exist as an installed service.
Error opening netdde.
Configure dmserver.
Error 1060: The specified service does not exist as an installed service.
Error opening dmserver.
Configure clipsrv.
Error 1060: The specified service does not exist as an installed service.
Error opening clipsrv.
Configure Browser.
General Service configuration was completed successfully.

----Configure available attachment engines...
Configuration of attachment engines was completed successfully.

----Configure Security Policy...
Configure password information.
Administrator account is disabled.
Guest account is disabled.
System Access configuration was completed successfully.
LSA anonymous lookup names setting : existing SD = DD;;0x800;;;AN)(A;;0xf1fff;;;BA)(A;;0x20801;;;WD)(A;;0x801;;;AN)(A;;0x1000;;;LS)(A;;0x1000;;;NS)(A;;0x1000;;;S-1-5-17).
Configure LSA anonymous lookup setting.
Configure machine\software\microsoft\windows nt\currentversion\setup\recoveryconsole\securitylevel.
Configure machine\software\microsoft\windows nt\currentversion\setup\recoveryconsole\setcommand.
Configure machine\software\microsoft\windows nt\currentversion\winlogon\scremoveoption.
Configure machine\software\microsoft\windows\currentversion\policies\system\dontdisplaylastusername.
Configure machine\software\microsoft\windows\currentversion\policies\system\legalnoticecaption.
Configure machine\software\microsoft\windows\currentversion\policies\system\legalnoticetext.
Configure machine\software\microsoft\windows\currentversion\policies\system\scforceoption.
Configure machine\software\microsoft\windows\currentversion\policies\system\shutdownwithoutlogon.
Configure machine\software\microsoft\windows\currentversion\policies\system\undockwithoutlogon.
Configure machine\software\policies\microsoft\windows\safer\codeidentifiers\authenticodeenabled.
Configure machine\system\currentcontrolset\control\lsa\auditbaseobjects.
Configure machine\system\currentcontrolset\control\lsa\crashonauditfail.
Configure machine\system\currentcontrolset\control\lsa\disabledomaincreds.
Configure machine\system\currentcontrolset\control\lsa\everyoneincludesanonymous.
Configure machine\system\currentcontrolset\control\lsa\fipsalgorithmpolicy\enabled.
Configure machine\system\currentcontrolset\control\lsa\forceguest.
Configure machine\system\currentcontrolset\control\lsa\fullprivilegeauditing.
Configure machine\system\currentcontrolset\control\lsa\nolmhash.
Configure machine\system\currentcontrolset\control\lsa\restrictanonymous.
Configure machine\system\currentcontrolset\control\lsa\restrictanonymoussam.
Configure machine\system\currentcontrolset\control\print\providers\lanman print services\servers\addprinterdrivers.
Configure machine\system\currentcontrolset\control\session manager\kernel\obcaseinsensitive.
Configure machine\system\currentcontrolset\control\session manager\memory management\clearpagefileatshutdown.
Configure machine\system\currentcontrolset\control\session manager\protectionmode.
Configure machine\system\currentcontrolset\services\lanmanserver\parameters\autodisconnect.
Configure machine\system\currentcontrolset\services\lanmanserver\parameters\enableforcedlogoff.
Configure machine\system\currentcontrolset\services\lanmanserver\parameters\enablesecuritysignature.
Configure machine\system\currentcontrolset\services\lanmanserver\parameters\requiresecuritysignature.
Configure machine\system\currentcontrolset\services\lanmanserver\parameters\restrictnullsessaccess.
Configure machine\system\currentcontrolset\services\lanmanworkstation\parameters\enableplaintextpassword.
Configure machine\system\currentcontrolset\services\lanmanworkstation\parameters\enablesecuritysignature.
Configure machine\system\currentcontrolset\services\lanmanworkstation\parameters\requiresecuritysignature.
Configure machine\system\currentcontrolset\services\ldap\ldapclientintegrity.
Configuration of Registry Values was completed successfully.
Configure log settings.
Audit/Log configuration was completed successfully.

----Configure available attachment engines...
Configuration of attachment engines was completed successfully.

----Un-initialize configuration engine..
Thanks very much..

 

[torchwood]

Hi

you appear to be running from a User account.

Which could explain all the Access denied entries.

Enable your administrator account and try Updating.

Please also run Eset on line (a malware AV - dissable what your currently using)
and Malwarebytes
and sfc /scannow

Do you have any Tune-up type programs installed

Roy

 

[torchwood]

Hi Doc,

out of interest where did you get your install media??

Could you also download another copy on a DIFFERENT machine direct from MS
(you will need your product key - DO NOT post it)

If you dont know it - run Belarc it will identify all your licence keys

Roy

 

[recreaghmd]

Ok, thanks.
Besides sfc (Ok) I have use 3 more different ATV and I am clear.
In a previous life of my OS I had a separate Admin account. I did a clean install two years ago and never activated it.
I created an Admin. now but is not logging. I will keep on working on this.
Do not understand your question about my media or the download (of what?) in a different machine. I do know my product and license key.
Thanks again.

 

[recreaghmd]

Created the Admin account and I still get the access denied error.
Cheers

 

[torchwood]

Hi Doc,

Hope your not using 3 AV's at the same time - That causes big problems.

About the OS, you said you clean installed - thats what i was talking about where did you get it??
(im wondering if its corrupt thats why i suggested you download directly from MS, you have a Retail key)

Am of the opinion that a repair install is the way to go, using the download media.
(NO loss of YOUR data)

Roy

 

[recreaghmd]

My OS was clean installed from retail DVD the first time. Two years ago from the SP1 downloaded from MS and the same key.
I do not use antivirals simultaneously and they are not the full installed programs. They are only the portable kind. The only one installed is the MS Security Essential, properly turned off.
At one time I tried a repair install but failed to work because it said that I had a newer version and could not get the appropriate one. (Version 6.1.7601).
I will work on it again.
Thanks.

 

[torchwood]

Hi Doc,

Which user do you generally login as -if its not Admin then login with it and check windows update,
we can check your current users and rights using this tool, copy/paste the output - both please

Download Farbar Recovery Scan Tool


As for your previous attempt at a repair install, you likely used a W7 image not W7 SP1
(you can download W7 SP1 from MS)

Roy

 

[Paul Black]

Hi recreaghmd,

I do know my product and license key.

On a laptop, it will either be on a sticker on the bottom, or in the battery compartment. If the sticker is too worn to read, or there isn't one, then you can retrieve it by either using Belarc Advisor or Magic Jelly Bean. Write this Product Key down and keep it in a safe place.

I hope this helps!

 

[recreaghmd]

Ok, I downloaded the iso file from MS with my key from the W7-DVD. The key was not previously necessary but is Ok. My older downloads are also iso and of exactly the same size. They are not image.
Do you happened to know the current version? Properties gives no clues.
You appears to assume I am a neophyte, kindly give me a break. I gave you the model of my laptop and the key in it is for XP.
I am 84 years old and I learn on a Commodore 64.
Thanks very much for your assistance.
Cheers.

 

[torchwood]

Hi Doc,

i can only go on the info provided.

The error message you posted stated a newer version is installed.
W7 has only 2 iterrations either W7 (7600) or W7 SP1 (7601).

can you post the 2 logs from Farbar (FRST).

Roy

 

[bikeopeli]

How to fix Security Issue upgrading to W10 (Or even upgrades to W7 if you are still running that OS) Cannot apply the security template for the new OS. Error: 0x800704B8

Note this is not for the non-technical user and does require manually editing the Registry so be certain to set a System Restore Checkpoint and backup your registry before you begin. Just sayin.

Open a CMD prompt with administrator privileges
run the command:

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

Look at secsrv log file in %windir$\security\logs and identify the specific registry entries with Access Denied issues. There may be lots of them. (We are not as concerned about entries where "...cannot find the file or path specified") You will need to check the permissions and set Owner for each Access Denied entry individually. Permissions/Ownership within a higher level entry may differ as they cascade from level to level so don't just set a top level entry to save the time of hitting each lower level entry individually. If you try to take shortcuts you may make Windows stop working altogether.

Open Regedit, find each of those "Access Denied" entries, Rt Click and under Permissions check the Permissions are correct (use a functional PC to compare) and under Advanced set Owner for each noted reg entry with an Access Denied issue to what it is supposed to be. The entry should generally still show what the owner is ie: SYSTEM or Administrators Group, but again you may want to compare against a working PC. Then use " Replace owner on subcontainers and objects" to push the Correct Ownership down from that Access Denied entry through the nested reg entries. If you get errors doing so at a high level, keep drilling down until you are able to reset the Ownership. Run the secedit command again and check the log file for more errors. Once you are able to run the secedit command cleanly, and you get to where there are no Access Denied errors you should be in good shape. Note you may have to run RegEdt32 if there are specific 32bit entry Access Denied issues that affect your situation. In my case there were still a few errors in the 32bit specific entries but those actually didn't affect my OS upgrade.

Then you should be able to update Windows to the next version.

I believe in the case of the machines I'm seeing with this issue, malware had run some kind of permissions change policy against the registry and made a mess of the default permissions. Removing the malware long ago apparently didn't undo the permissions changes to the registry so I was left to cope with that manually. It's a bit tedious but if you absolutely cannot wipe and reload from scratch it might be worth doing. Worked for me.