Share via

Windows Update fails with 8000FFFF (E_UNEXPECTED)

  • Article

Quick Solution:   Check the permissions on  the root of C: and ensure that BUILTIN\Users have Read access.

Long Story:

8000FFFF == E_UNEXPECTED, not very helpful…

Had a client where windows update was continually failing with the error code 8000FFFF. When looking in the Windows Update log we’d see errors like this:

WARNING: PTError: 0x80248014
Handler FATAL: CBS called Error with 0x8000ffff, <— Checked the CBS.log file but that didn’t give any clues.
Handler FATAL: Error source is 106.
DnldMgr Error 0x8000ffff occurred while downloading update; notifying dependent calls.
AU # WARNING: Download failed, error = 0x8000FFFF
AU # WARNING: Download failed, error = 0x8000FFFF
AU WARNING: BeginInteractiveInstall failed, error = 0x8024000C
CltUI WARNING: AU directive Interactive Progress is exiting due to error 8024000C

 

And in the event viewer upon each run we’d see these events:

Log Name: Application
Source: ESENT
Date: 7/2/2008 3:05:16 PM
Event ID: 491
Task Category: General
Level: Error
Keywords: Classic
User: N/A
Computer: XXXX
Description:
Catalog Database (1560) Catalog Database: An attempt to determine the minimum I/O block size for the volume "C:\" containing "C:\Windows\system32\CatRoot2\" failed with system error 5 (0x00000005): "Access is denied. ". The operation will fail with error -1032 (0xfffffbf8).

Log Name: Application
Source: Microsoft-Windows-CAPI2
Date: 7/2/2008 3:05:16 PM
Event ID: 257
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: XXXX
Description:
The Cryptographic Services service failed to initialize the Catalog Database. The ESENT error was: -1032.

After seeing this data I did a stare and compare between my root permissions and his and found that he’d modified the c:\ permissions on his system:

His machine:
c:\temp\xcacls c:
C:\ NT AUTHORITY\SYSTEM:(OI)(CI)F
BUILTIN\Administrators:(OI)(CI)F

Mine:
C:\>xcacls c:\
c:\ BUILTIN\Administrators:F
BUILTIN\Administrators:(OI)(CI)(IO)F
NT AUTHORITY\SYSTEM:F
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
BUILTIN\Users:(OI)(CI)R <— This is the key one missing that was causing the headache.
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)C
NT AUTHORITY\Authenticated Users:(special access:)
FILE_APPEND_DATA

The Cryptographic Services runs under “Network Service” which would require Users to have read access.  I added BUILTIN\Users with read access to C and all worked again.

Hopefully this post will guide others with similar issues to the solution quickly.

 

Technorati Tags: Vista,Windows Update,WSUS,Windows 2008

Comments

  • Anonymous
    January 01, 2003
    Recently, I was helping a colleague troubleshoot an installation error in the .NET Framework 3.5 SP1

  • Anonymous
    January 01, 2003
    yep - saved me too - thanks

  • Anonymous
    January 01, 2003
    Careful though, you can always crew up omre stuff if you adjust permissions on the root and then apply it to all folder/subfolders.   Make sure you backup that machine before doing this!

  • Anonymous
    January 01, 2003
    This has been plaguing me for over a month. Never would have connected the Cryptographic problem with this. Great article, nice work!

  • Anonymous
    January 01, 2003
    @scott:  The fix is to add BUILTINUsers to the ACL on the C drive and give it read access.  If you dont understand what this means I'd suggest finding someone to help you as adjusting the permissions can be dangerous (if done wrong).    If you're familar with Windows, then it's simply going to the security tab and adding in BUILTINUsers.

  • Anonymous
    January 01, 2003
    @scott, thje windows update does not run as your account.  The Cryptographic Services runs under “Network Service” which would require Users to have read access.

  • Anonymous
    January 01, 2003
    That's why I put 'em out here!

  • Anonymous
    July 14, 2008
    Thanks , solved my problem, hardening W2K8 is not that straight forward.

  • Anonymous
    August 20, 2008
    The comment has been removed

  • Anonymous
    August 22, 2008
    Any tech note / kb from Microsoft on this issue? I am going to try this now and if it works, remove the BUILTINUsers (R) from root again. Hopefully, it is a one off for updates.

  • Anonymous
    September 27, 2008
    I spent a lot of time trying to research this, and finally something works!  Thanks!!!

  • Anonymous
    November 12, 2008
    The comment has been removed

  • Anonymous
    December 23, 2008
    Thank you very much for this.. I couldn't work out why either, and most people have no idea what they are talking about, or post irrelevant information. This was spot on, cheers!

  • Anonymous
    February 26, 2009
    dude you are the man!!.. wasted 2 hours on this and finally worked.

  • Anonymous
    May 24, 2009
    Thank you soooo much! I spent almost all day trying to figure this out! I never would have figured this out!! You saved my day and about 100 hours! Thanks again!

  • Anonymous
    August 26, 2009
    Wow.... after MONTHS of searching, finally an answer that works! We removed the Users group from the root for security purposes, and that's been stopping our updates since February!! THANK YOU!!!!!!

  • Anonymous
    November 02, 2009
    The comment has been removed

  • Anonymous
    November 05, 2009
    I agree you rock, I've been messing with this error for a couple months off and on.

  • Anonymous
    November 09, 2009
    Thank you very much for this.. You Rock ||

  • Anonymous
    November 23, 2009
    You are great! Thank you so much for posting this!

  • Anonymous
    January 11, 2010
    Thanks for the Quick Solution, it worked with my Windows 2008 SP1 x64 server

  • Anonymous
    February 16, 2010
    you sir a genius, thanks a million :-)

  • Anonymous
    March 18, 2010
    good job, this advice saved a lot of time thanks

  • Anonymous
    March 24, 2010
    Grand, thanks for this post it saved me from a huge headache.

  • Anonymous
    April 15, 2010
    This guy needs a buy me a beer button.  Thank you!

  • Anonymous
    May 06, 2010
    Even microsoft havent worked this one out yet

  • Anonymous
    May 11, 2010
    please write the solution again please

  • Anonymous
    June 21, 2010
    Awesome.  Finally a fix that worked.  Great job.

  • Anonymous
    June 25, 2010
    The comment has been removed

  • Anonymous
    June 26, 2010
    Thanks!

  • Anonymous
    July 18, 2010
    Checked... Mine has BUILTINUsers: (OI)(CI)(RX) And it's having problem when updating. More specifically, installing the Vista SP2. Any clue?

  • Anonymous
    September 16, 2010
    Yay, thanks so much for this!!!  Now, if only I understood what this meant I could finally install SP2.... Can anyone explain for us stupid people :D  Simple step-by-step directions such as checking if I even have this thing to begin with.  It'd be much appreciated!

  • Anonymous
    October 14, 2010
    That worked. Thanks!

  • Anonymous
    October 15, 2010
    The comment has been removed

  • Anonymous
    October 23, 2010
    Hi, I'm in the same boat and would appreciate if someone could help me with how to restore the permissions for the builtinusers. I have tried everything else I could find on this problem and this is the last thing to try. It seems from the comments that this would work!

  • Anonymous
    December 27, 2010
    I inherited a server with messed up permissions and could not figure out why it could not update. You had it right! Thank you!

  • Anonymous
    February 09, 2011
    Brad, all I can do is echo the sentiments that have already been expressed. Thanks for resolving and then posting, as this ends a long and frustrating issue!

  • Anonymous
    February 15, 2011
    Thanks you are the best!!!!

  • Anonymous
    November 07, 2011
    Brad, I can't seem to get through the concept of this but think it would fix my problem.  What exactly does your fix entail?

  • Anonymous
    November 07, 2011
    Ok, I was just getting direction.  Thanks.  I will try to do this and see if it works.  BTW if I am logged in as administrator shouldn't the builtinadministrator account preside the builtinuser account?

  • Anonymous
    November 08, 2011
    We faced this now, i would think that this should have been fixed already...

  • Anonymous
    November 11, 2011
    THANK YOU!!!

  • Anonymous
    January 04, 2012
    This worked like a charm for me.

  • Anonymous
    November 18, 2013
    How can i open this permission windows and add the string?

  • Anonymous
    March 02, 2014
    Thank you! Fantastic..

  • Anonymous
    April 11, 2014
    THANK YOU!!! THANK YOU!!!
    THANK YOU!!! THANK YOU!!!

  • Anonymous
    July 04, 2014
    You can add "users", it will accomplish same result (worked for me, same issue). I didn't check eventvwr, I just assumed the error windows update was reporting was all I'd see but looking now I see it's specific about the permission error. Good grief, I'd like to beat the idiot with a stick who did this to our one server...! :)

  • Anonymous
    November 19, 2014
    Great article. Thank you. it solved my problem.

  • Anonymous
    February 11, 2015
    This worked for me. Thank you very much.
    I have spent many hours searching for a way to solve this problem. I really appreciate your post.

  • Anonymous
    March 17, 2015
    Its work's- thanks.
    After "added BUILTINUsers with read access to C" - I must restart service Windows update and it work's

  • Anonymous
    July 05, 2015
    Your a liar. None of that *** is on my computer. I just reset it to factory. And nothing. You liar.

  • Anonymous
    August 06, 2015
    The comment has been removed

  • Anonymous
    August 10, 2015
    This is it. This solution worked for me as well.
    Well done!