Performing cleanup fails when installing security patch

[Jonas Back_2]

We have a bunch of Win 2003 servers running on HP ProLiant hardware. We have tightened security on them with GPO-settings recommended by Microsoft in the Windows 2003 Security Guide. When we apply those settings, installing security patches HANGS on "Performing Cleanup". This doesn't happened before we apply the GPO.

My first thought it was a problem with the GPO but the Microsoft cannot confirm this is a general problem so I was thinking if this might be something to do with ProLiant hardware and/or drivers/software installed together with a ProLiant server.

But before looking any further - is there anyone else who have had this problem?

[Rune J. Winje]

Check if the user account or admin group that performs the update have the "Debug Programs" user right.

If not, try granting it.


Cheers,
Rune

[Jonas Back_2]

Thanks for helping out! I've done that already. I've been spending MANY hours trying to figure out why this happends. I've figured out the following:

- I do a standard Unattend installation - patch works
- I do a standard Unattend installation and apply the policy - patch works
- I do a standard Unattend installation and install HP Support Pack 7.10A (with setupc.exe /f /use-latest) and apply the policy - patch works
- I do a standard Unattend installation and install HP Support Pack 7.10A (with setupc.exe /f /use-latest), apply policy and also rise the pagefile to our company standard which is max-min 2048-2048 MB. Patch hangs!

Of course, reboot between each step.

Can this really be the case? For me it sounds VERY strange.

I'll do some more testing to really find out if this is the problem or not but if you have time to try it out, please do.

[dcourey · Accepted solution]

Hi Jonas

I have seen your posts and we are suffering the same anomaly installing patches. I have seen your posts on other forums (mcse.ms and tekforums).

Did you ever find a fix for this problem?

Regards
Dave Wyatt

[Jonas Back_2]

Hi Dave,

It would be nice to stay in contact with you since I'm arguing with Microsoft that the problem is in Windows and they say no. The thing is that I'm in contact with three other users out there with the same problem so it would be nice to have contct details to everyone for the future in case MS admit the problem is with their product. If you're interested to stay in contact, email me at jonas.back(at)home.se.

Anyway, the solution, for us and the other guys, is to put the service "Microsoft Transaction Coordinator" (DTC) to Automatic (might work with Manual and manually starting it). See if that works and let me know.

We are installing patches to about 50 systems this and next week so then we'll really see if this is the problem. So far I've just done tests in our lab.

[Jonas Back_2]

Just want to inform that this has now been confirmed by MS that it's a problem if you put the DTC (Distribution Transaction Coordinator) to DISABLED.

If you try to install Windows 2003 SP1 it will tell you that you have to enable that service before installing - so apparently this is a problem.

However, I don't know if you after SP1 can put it to disabled and future patches can be successfully installed with the DTC service set to DISABLED.