Error message when you use Windows Server Update Services Setup: "Error 0x80070643: Fatal error during installation" (920660)


The information in this article applies to:

  • Microsoft Windows Update
  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Datacenter Edition
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Home Edition
  • Microsoft Windows 2000 Advanced Server SP3
  • Microsoft Windows 2000 Server SP3
  • Microsoft Windows 2000 Professional SP3

SYMPTOMS

When you use Microsoft Windows Server Update Services (WSUS) Setup, you receive the following error message:
Error 0x80070643: Fatal error during installation.
Additionally, the Wsusca.txt file contains information that resembles the following: The Commit phase completed successfully.
***** 2005-09-12 13:06:18 17:06:18 Executing External Command: C:\Program Files\Update Services\\tools\osql\osql.exe -S WINSECSUSPARENT\WSUS -E -b -n -Q
"USE SUSDB
EXEC sp_grantlogin N'NT AUTHORITY\NETWORK SERVICE' EXEC
sp_grantdbaccess N'NT AUTHORITY\NETWORK SERVICE' EXEC
sp_addrolemember webService,N'NT AUTHORITY\NETWORK SERVICE'"
***** Msg 15247, Level 16, State 1, Server WINSECSUSPARENT\WSUS, Procedure sp_grantlogin, Line 12 User does not have permission to perform this action. Granted database access to 'NT AUTHORITY\NETWORK SERVICE'. 'NT AUTHORITY\NETWORK SERVICE' added to role 'webService'.
***** 2005-09-12 13:06:18 17:06:18 External Command Exited, Return Code: 1 *****
***** 2005-09-12 13:06:18 17:06:18 Executing External Command: C:\Program Files\Update Services\\tools\osql\osql.exe -S WINSECSUSPARENT\WSUS -E -b -n -Q
"USE SUSDB
EXEC sp_revokedbaccess N'NT AUTHORITY\NETWORK SERVICE'"
***** User has been dropped from current database.
***** 2005-09-12 13:06:18 17:06:18 External Command Exited, Return Code: 0 *****
***** 2005-09-12 13:06:18 17:06:18 Executing External Command: C:\Program Files\Update Services\\tools\osql\osql.exe -S WINSECSUSPARENT\WSUS -E -b -n -Q
"USE SUSDB
EXEC sp_revokedbaccess N'WINSECSUSPARENT\ASPNET'"
***** Msg 15008, Level 16, State 1, Server WINSECSUSPARENT\WSUS, Procedure sp_revokedbaccess, Line 36 User 'WINSECSUSPARENT\ASPNET' does not exist in the current database. ***** 2005-09-12 13:06:18 17:06:18 External Command Exited, Return Code: 1 *****
***** 2005-09-12 13:06:18 17:06:18 Executing External Command: C:\Program Files\Update Services\\tools\osql\osql.exe -S WINSECSUSPARENT\WSUS -E -b -n -Q
"USE SUSDB
EXEC sp_revokedbaccess N'WINSECSUSPARENT\WSUS Administrators'"
***** Msg 15008, Level 16, State 1, Server WINSECSUSPARENT\WSUS, Procedure sp_revokedbaccess, Line 36 User 'WINSECSUSPARENT\WSUS Administrators' does not exist in the current database.
***** 2005-09-12 13:06:18 17:06:18 External Command Exited, Return Code: 1 *****
***** 2005-09-12 13:06:18 17:06:18 Executing External Command: C:\Program Files\Update Services\\tools\osql\osql.exe -S WINSECSUSPARENT\WSUS -E -b -n -Q
"EXEC sp_revokelogin N'WINSECSUSPARENT\WSUS Administrators'"
***** Msg 15247, Level 16, State 1, Server WINSECSUSPARENT\WSUS, Procedure sp_revokelogin, Line 12 User does not have permission to perform this action.
***** 2005-09-12 13:06:18 17:06:18 External Command Exited, Return Code: 1
***** The uninstall is beginning.

CAUSE

WSUS Setup uses Microsoft SQL Server to perform the installation. This problem occurs because the user who is running WSUS Setup does not have System Administrator permissions in SQL Server.

RESOLUTION

To resolve this problem, grant System Administrator permissions to a user account or to a group account in SQL Server 2000 or in SQL Server 2005. To do this, use one of the following methods, and then rerun WSUS Setup.

Note You must have System Administrator permissions to use the following methods.

Method 1: Grant System Administrator permissions in SQL Server by using the osql utility

To use the osql utility to grant permissions to a new user account or to a new group account in SQL Server 2000 or in SQL Server 2005, follow these steps:
  1. Start Notepad, and then copy the following text into Notepad.
    EXEC sp_grantlogin '<ServerName>\<Login>'
Go
EXEC sp_addsrvrolemember '<ServerName>\<Login>', 'sysadmin'
Go
    Note If you are granting permissions to an existing user account or group account, copy the following text into Notepad.
    EXEC sp_addsrvrolemember '<ServerName>\<Login>', 'sysadmin'
Go
  2. Replace occurrences of <ServerName> with the name of your instance of SQL Server.
  3. Replace occurrences of <Login> with the name of the user account or with the name of the group account.
  4. Save the file as GrantPermission.sql.
  5. Click Start, click Run, type cmd, and then click OK.
  6. At the command prompt, type the following command, and then press ENTER.

    osql -E -i C:\path\GrantPermission.sql

    Note Substitute the correct directory location for path.

Method 2: Grant System Administrator permissions in SQL Server by using the sqlcmd utility

To use the sqlcmd utility to grant permissions to a new user account or to a new group account in SQL Server 2005, follow these steps:
  1. Follow steps 1 through 5 from Method 1 to grant permissions to a new user account or to a new group account.
  2. Type the following command, and then press ENTER:

    sqlcmd -i C:\<path>\GrantPermission.sql

    Note Substitute the correct directory location for path.

Method 3: Grant System Administrator permissions by using Enterprise Manager in SQL Server 2000

To grant permissions to a new user account or to a new group account, follow these steps:
  1. Click Start, point to All Programs, point to Microsoft SQL Server, and then click Enterprise Manager.
  2. Expand Microsoft SQL Servers, and then expand SQL Server Group.
  3. Expand (local), and then expand Security.
  4. Right-click Logins, and then click New Login.
  5. In the SQL Server Login Properties - New Login dialog box, click the General Tab, and then select a domain from the Domain list.
  6. Click Browse, and then select the user name or the group account name that you want to use from the Name list.
  7. Click Add, and then click OK.
  8. Click the Server Roles tab, click to select the System Administrators check box on the Server Roles list, and then click OK.
To grant permissions to an existing user account or to an existing group account, follow these steps:
  1. Click Start, point to All Programs, point to Microsoft SQL Server, and then click Enterprise Manager.
  2. Expand Microsoft SQL Servers, and then expand SQL Server Group.
  3. Expand (local), and then expand Security.
  4. Click Logins.
  5. In Logins, double-click the user name or the group account name that you want to use.
  6. In the SQL Server Login Properties - New Login dialog box, click the Server Roles tab, click to select the System Administrators check box on the Server Roles list, and then click OK.

Method 4: Grant System Administrator permissions by using Management Studio in SQL Server 2005

To grant permissions to a new user account or to a new group account, follow these steps:
  1. Click Start, point to All Programs, point to Microsoft SQL Server 2005, and then click SQL Server Management Studio.
  2. Select a server, and then click Connect.
  3. In Object Explorer, expand the server name, and then expand Security.
  4. Right-click Logins, and then click New Login.
  5. In the Login - New dialog box, click General Tab.
  6. In the Login name box, type the user name or the group account name that you want to use, or click Search to locate the user who you want to add.
  7. Click the Server Roles tab, click to select the sysadmin check box, and then click OK.
To grant permissions to an existing user account or to an existing group account, follow these steps:
  1. Click Start, point to All Programs, point to Microsoft SQL Server 2005, and then click SQL Server Management Studio.
  2. Select a server, and then click Connect.
  3. In Object Explorer, expand the server name, and then expand Security.
  4. Click Logins.
  5. In Logins, double-click the user name or the group account name that you want to add.
  6. Click the Server Roles tab, click to select the sysadmin check box, and then click OK.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

MORE INFORMATION

For information about software that is required before you install WSUS, visit the following Microsoft Web site:

http://technet2.microsoft.com/WindowsServer/f/?en/Library/140e6deb-8644-4b04-8eae-57694b3006a81033.mspx

For more information about how to manage server roles and permissions in SQL Server 2000, visit the following Microsoft Web site:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adminsql/ad_security_05bt.asp

For more information about how to manage server roles and permissions in SQL Server 2005, visit the following Microsoft Web site:

http://msdn2.microsoft.com/en-us/ms188659(SQL.90).aspx

Modification Type:MajorLast Reviewed:7/18/2006
Keywords:kbtshoot kbsetup kbwindowsupdate kbprb KB920660 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.