Windows XP SP3 - update.exe extended error code 0xf00d

Every once in a while an old Windows XP machine will make its way back onto our network – most of the time it’s an old laptop that has been sitting in someone’s desk or in some storage room. Machines are checked out for missing patches or Anti-Virus dat updates prior to the machine being added back onto our domain however once in a while a machine will be missed. For this reason we are still scanning for pre Windows XP SP3 machines and if one is detected SP3 is pushed to it so that the machine can catch up on patches. (We are looking at quarantine solution for rouge machines but that’s another story) The other day a Windows XP SP2 laptop was detected but the SP3 upgrade kept failing. The only sign of a problem in Event Viewer was an entry stating that the update had been cancelled and when I ran the update interactively, same thing.  When I checked the install log (C:\Windows\svcpack.log) it had the following entry: update.exe extended error code 0xf00d 

After some searching I found that if you browse to C:\Windows\System32 and rename spupdsvc.exe to something like spupdsvc.old and then reapply the update, spupdsvc.exe will get recreated and Service Pack 3 will complete successfully. 

Windows boot error NTOSKRNL.exe is Missing or Corrupt

If you have every spent any time supporting Windows boxes this error will be very familuar to you. Every once in while when you reboot a workstation or server you'll get the famous NTOSKRNL.exe is Missing or Corrupt error  Windows NT could not start because the following file is missing or corrupt:
         C:\Windows\System32\Ntoskrnl.exe
It's fairly straight forward to resolve this problem. Start by booting your machine from the install media when prompted follow these steps
- Boot to the recovery console (http://support.microsoft.com/kb/326215)
- Select your Windows installation that you want to recover
- When prompted provide the local administrator password
- Once you are into the recovery console you will probably be sitting at a C:\WINDOWS prompt
- Change the directory to the i386 folder on your CD / DVD drive (If you only have one partition it will most likely be D:\)
- Copy the following files to the C:\ drive
        copy ntldr C:
        copy ntdetect.com C:
- Change your source directory back to C:\Windows
- Next you will need to fix your boot record
       fixboot C:
- Most likely you will also have to fix the boot .ini using the bootcfg command
 bootcfg /rebuild
- Add the required Windows installation to your boot list
- Add the Load Identifier (Custom description)
- Add the OS Load Options (/fastdetect)
- Type exit to reboot the machine
Your machine should now be recovered from the NTOSKRNL.exe is Missing or Corrupt" error. If you are looking for a little more detail here is a pretty good post. Use this information at your own risk.

Chasing down DCOM errors

A while back one of my SMS servers started getting DCOM errors, it was consistent every couple of minutes there would 10 – 15 entries. Shorty there after another one of my SMS servers starting getting the errors. After a little investigation it was discovered that the launch and activation permissions for the SMS Agent Host component had been changed for one of the local IIS accounts – probably due to OS patching. The error that we were getting was:

The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {CLSID}
to the user <username>. This security permission can be modified using the Component Services administrative tool.

To resolve the issue I did the following:

• In the registry locate the CLSID that is being reported as having problems in the Event Viewer
• Make note of the application ID associated with the CLSID
• Open up the Components Services snap-in and navigate to Component Services /  Computers / My Computer / DCOM Config
• Highlight DCOM Config and select the Details view
• On the Security tab locate the Launch and Activation Permissions, select Customize and then Edit
• Give the user account specified in the event log the appropriate permissions to the component