MSI Error 1920 Insufficient Access Unable to Start Service
Hi,
When installing my MSI file I am getting an MSI Error 1920 Access Denied unable to start service. The Startname field is left blank in the ServiceInstall table, which, according to the documentation means the LocalSystem account will be used. But this doesn't seem to be enough to do it. Any suggestions gratefully appreaciated.
M
When installing my MSI file I am getting an MSI Error 1920 Access Denied unable to start service. The Startname field is left blank in the ServiceInstall table, which, according to the documentation means the LocalSystem account will be used. But this doesn't seem to be enough to do it. Any suggestions gratefully appreaciated.
M
0 Comments
[ + ] Show comments
Answers (13)
Please log in to answer
Posted by:
WiseUser
19 years ago
Posted by:
MSI_repackager
19 years ago
Hi,
The Service is IISADMIN. It does work when manually installed.
Here are the registry keys you asked for from a working machine:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IISADMIN]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,\
5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,69,00,6e,00,65,\
00,74,00,73,00,72,00,76,00,5c,00,69,00,6e,00,65,00,74,00,69,00,6e,00,66,00,\
6f,00,2e,00,65,00,78,00,65,00,00,00
"DisplayName"="IIS Admin"
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,53,00,61,00,6d,00,\
53,00,53,00,00,00,00,00
"DependOnGroup"=hex(7):00,00
"ObjectName"="LocalSystem"
"Description"="Allows administration of Web and FTP services through the Internet Information Services snap-in"
"FailureCommand"="\"C:\\WINDOWS\\System32\\iisreset.exe\" /fail=%1%"
"FailureActions"=hex:80,51,01,00,01,00,00,00,01,00,00,00,03,00,00,00,4c,00,41,\
00,03,00,00,00,01,00,00,00,03,00,00,00,01,00,00,00,03,00,00,00,01,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IISADMIN\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IISADMIN\Enum]
"0"="Root\\LEGACY_IISADMIN\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001
The Service is IISADMIN. It does work when manually installed.
Here are the registry keys you asked for from a working machine:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IISADMIN]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,\
5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,69,00,6e,00,65,\
00,74,00,73,00,72,00,76,00,5c,00,69,00,6e,00,65,00,74,00,69,00,6e,00,66,00,\
6f,00,2e,00,65,00,78,00,65,00,00,00
"DisplayName"="IIS Admin"
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,53,00,61,00,6d,00,\
53,00,53,00,00,00,00,00
"DependOnGroup"=hex(7):00,00
"ObjectName"="LocalSystem"
"Description"="Allows administration of Web and FTP services through the Internet Information Services snap-in"
"FailureCommand"="\"C:\\WINDOWS\\System32\\iisreset.exe\" /fail=%1%"
"FailureActions"=hex:80,51,01,00,01,00,00,00,01,00,00,00,03,00,00,00,4c,00,41,\
00,03,00,00,00,01,00,00,00,03,00,00,00,01,00,00,00,03,00,00,00,01,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IISADMIN\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IISADMIN\Enum]
"0"="Root\\LEGACY_IISADMIN\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001
Posted by:
WiseUser
19 years ago
Posted by:
MSI_repackager
19 years ago
Hi,
Sorry for the delayed response. I have used a comma as the delimiter for each field. ServiceInstall Table is as follows:
W3SVC,W3SVC,World Wide Web Publishing,32,2,1,blank,IISADMIN[~][~],blank,blank,blank,inetinfo.exe_service,description(to long to write here).
IISADMIN,IISADMIN,IIS Admin,32,2,1,blank,RpcSs[~]SamSs[~][~],blank,blank,blank,inetinfo.exe_service,description(to long to write here).
SMTPSVC,SMTPSVC,Simple Mail Transfer Protocol,32,2,1,blank,EventLog[~]IISADMIN[~][~],blank,blank,blank,inetinfo.exe_service,description(to long to write here).
I have tried changing the ServiceType to 16 instead of 32 which is own process instead of shared without success. Also I have the Event field in the ServiceControl table set to 161 which equals Install Start = Yes and Uninstall Stop and Uninstall Delete equal to Yes. I have also tried combinations here to but without any success.
I am now looking at the AppID's in HKCR to see whether this might be related.
Please let me know if there is anything I should be changing here...
Thanks
M
Sorry for the delayed response. I have used a comma as the delimiter for each field. ServiceInstall Table is as follows:
W3SVC,W3SVC,World Wide Web Publishing,32,2,1,blank,IISADMIN[~][~],blank,blank,blank,inetinfo.exe_service,description(to long to write here).
IISADMIN,IISADMIN,IIS Admin,32,2,1,blank,RpcSs[~]SamSs[~][~],blank,blank,blank,inetinfo.exe_service,description(to long to write here).
SMTPSVC,SMTPSVC,Simple Mail Transfer Protocol,32,2,1,blank,EventLog[~]IISADMIN[~][~],blank,blank,blank,inetinfo.exe_service,description(to long to write here).
I have tried changing the ServiceType to 16 instead of 32 which is own process instead of shared without success. Also I have the Event field in the ServiceControl table set to 161 which equals Install Start = Yes and Uninstall Stop and Uninstall Delete equal to Yes. I have also tried combinations here to but without any success.
I am now looking at the AppID's in HKCR to see whether this might be related.
Please let me know if there is anything I should be changing here...
Thanks
M
Posted by:
WiseUser
19 years ago
It all looks good to me.
I know this is a dumb question, but you do have permissions to start services?
Have you set any NTFS permissions using your package?
Any clues in the event log?
You could try this:
1) Export the service keys from the registry of a working PC into a ".reg" file - also export the "ENUM\ROOT\LEGACY_*" keys which you didn't post.
2) Export exactly the same keys from a "broken" PC (hopefully they'll exist at the time you get the 1920 error). I wonder if you could try to start the service manually from a command windows at this point too?
3) Use Windiff to compare the ".reg" files to find any differences between a "good" and a "bad" install.
You could also use the Sysinternals NTFileMon tool to look for "Access Denied" messages (laborious work).
Btw, you probably know this, but it's a bit "unusual" to repackage Microsoft services that are part of Windows.
Good luck!
I know this is a dumb question, but you do have permissions to start services?
Have you set any NTFS permissions using your package?
Any clues in the event log?
You could try this:
1) Export the service keys from the registry of a working PC into a ".reg" file - also export the "ENUM\ROOT\LEGACY_*" keys which you didn't post.
2) Export exactly the same keys from a "broken" PC (hopefully they'll exist at the time you get the 1920 error). I wonder if you could try to start the service manually from a command windows at this point too?
3) Use Windiff to compare the ".reg" files to find any differences between a "good" and a "bad" install.
You could also use the Sysinternals NTFileMon tool to look for "Access Denied" messages (laborious work).
Btw, you probably know this, but it's a bit "unusual" to repackage Microsoft services that are part of Windows.
Good luck!
Posted by:
MSI_repackager
19 years ago
Hi,
I know this is wandering from best practice, but my manager seems adamant that this will be packaged and thus I continue...
At the moment when the 1920 error occurs I go into Services and try starting the IIS Admin Service, I get the following error dialog
'Windows could not start the IIS Admin on Local Computer. Fore more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code -2147221164.' This is coupled with the following Event Log in the System Event Log: Event ID 7024
'The IIS Admin service terminated with a service-specific error 2147746132 (0x80040154)'
Can you tell me how to check whether I have set the right permissions in my package (NTFS particularly)? I have done a compare of keys (including Enum\Root\Legacy) on working and non-working machine and everything looks the same as far as I can see.
Thanks for your help with this btw, much appreciated :-)
M
I know this is wandering from best practice, but my manager seems adamant that this will be packaged and thus I continue...
At the moment when the 1920 error occurs I go into Services and try starting the IIS Admin Service, I get the following error dialog
'Windows could not start the IIS Admin on Local Computer. Fore more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code -2147221164.' This is coupled with the following Event Log in the System Event Log: Event ID 7024
'The IIS Admin service terminated with a service-specific error 2147746132 (0x80040154)'
Can you tell me how to check whether I have set the right permissions in my package (NTFS particularly)? I have done a compare of keys (including Enum\Root\Legacy) on working and non-working machine and everything looks the same as far as I can see.
Thanks for your help with this btw, much appreciated :-)
M
Posted by:
oofemioo
19 years ago
Posted by:
WiseUser
19 years ago
I must admit that the event log entry doesn't tell me very much.
I take it you're installing the "SMTP" and "W3" services at the same time within the same package?
Have you tried removing all entries from the "ServiceControl" table?
Are you knowingly changing any permissions on anything - either through LockPermissions or Custom Action?
I take it you're installing the "SMTP" and "W3" services at the same time within the same package?
Have you tried removing all entries from the "ServiceControl" table?
Are you knowingly changing any permissions on anything - either through LockPermissions or Custom Action?
Posted by:
MSI_repackager
19 years ago
Hi WiseUser,
I am installing all three services in the one package. Unfortunately they are all interlinked as I tried doing a snapshot of IIS without SMTP and W3 which failed.
One of the tests I did was taking everything out of the Service Control table. The MSI will install without the 1920 error, however the services are still unable to be started manually or automatically, showing the same event log errors and dialog errors upon restarting the machine.
I haven't set any custom actions (actually I don't know how to create custom actions yet) and I haven't set any file permissions or registry permissions in the MSI.
The alternative solution that I can see at this stage is placing the i386 directory from the CD-ROM onto a share which users can point to when accessing Add/Remove Windows Components.
M
I am installing all three services in the one package. Unfortunately they are all interlinked as I tried doing a snapshot of IIS without SMTP and W3 which failed.
One of the tests I did was taking everything out of the Service Control table. The MSI will install without the 1920 error, however the services are still unable to be started manually or automatically, showing the same event log errors and dialog errors upon restarting the machine.
I haven't set any custom actions (actually I don't know how to create custom actions yet) and I haven't set any file permissions or registry permissions in the MSI.
The alternative solution that I can see at this stage is placing the i386 directory from the CD-ROM onto a share which users can point to when accessing Add/Remove Windows Components.
M
Posted by:
WiseUser
19 years ago
Posted by:
MSI_repackager
19 years ago
Posted by:
MSI_repackager
19 years ago
Hi WiseUser,
I know it's been a while, but I thought I'd report back and let you know I ended up ditching the MSI and followed the instructions I found on:
http://support.microsoft.com/?kbid=222444 (Using the Sysocmgr.exe tool)
I searched Google and found an IIS 6.0 answer file for this and just changed it to suit our requirements... works great, and problem solved!
M
I know it's been a while, but I thought I'd report back and let you know I ended up ditching the MSI and followed the instructions I found on:
http://support.microsoft.com/?kbid=222444 (Using the Sysocmgr.exe tool)
I searched Google and found an IIS 6.0 answer file for this and just changed it to suit our requirements... works great, and problem solved!
M
Posted by:
Jack_Mcall
18 years ago
Hi All
Also worth noting when you get this error 1920 is that ISS is not installed on most desktops as standard
It can be installed by an admin by going to add remove programs "Add/Remove Windows Components"
You can then set IIS to be installed by the OS
This will install the IISADMIN service as well as the W3SVC service so that your msi will now be able to start these services using the service control table
Also worth noting when you get this error 1920 is that ISS is not installed on most desktops as standard
It can be installed by an admin by going to add remove programs "Add/Remove Windows Components"
You can then set IIS to be installed by the OS
This will install the IISADMIN service as well as the W3SVC service so that your msi will now be able to start these services using the service control table
Rating comments in this legacy AppDeploy message board thread won't reorder them,
so that the conversation will remain readable.
so that the conversation will remain readable.