You are here: FAQs > Access Denied While Upgrading to SP 3

Wizcrafts Computer Services

Specializing in Computer Networking, Security and Troubleshooting

Access Denied error while trying to upgrade Windows XP to Service Pack 3

The problem

You are trying to perform an online upgrade of your Windows XP computer to Service Pack 3 (or SP2). You may be doing this through Windows Updates, or by downloading the complete SP3 upgrade file from this Microsoft XP Service Pack 3 Download page. At some point during the upgrade process it halts and a message box appears - telling you the following bad news.

"Access is denied," which after you click 'OK' is followed by another message box that says, "Service Pack 3 installation did not complete. Select 'OK' to undo the changes that have been made."

Why this may happen

The first thing you should do before upgrading to XP SP3 is to make sure all of your hardware drivers are up to date and that you have installed all applicable Windows Updates. If your computer has an AMD processor, read this first!

Access Denied errors during a service pack upgrade are mainly caused by insufficient user privileges, either for overwriting system files, or the Windows Registry, or both. What may have happened is that operating system files and folders, and/or branches of the Windows Registry have been assigned to "System" as the "Owner," rather than the "Computer Administrator" account you are using. Shit happens, bits get scrambled, permissions go awry! Don't worry, if that's the case we can fix it.

When you upgrade the operating system to a new service pack level, new versions of system files overwrite older files of the same name. Also, new data about the upgraded files must be written to the machine-wide portions of the Windows Registry. For reasons unknown, or due to file corruption, your logged in Administrative identity does not possess full control over all branches of the Registry, thus, you got an Access Denied message. An Administrator account should have complete control over all portions of the Registry, in order to upgrade the OS and major components. Something happened that removed that level of permission from a branch of the Registry required to be writable in order to upgrade the service pack level.

Another cause of this access denied failure is if the account you are logged onto is anything less than an administrator level account. While operating as a Limited or Power User will protect you from most malware, it will not allow you to properly upgrade your operating system (not even using "Run as"). Upgrading to SP3 must be done from within a full Administrator level account, not a Limited User, or Power User, or Backup Operator account. In fact, you may have to logon to the actual "Administrator" account to successfully perform this upgrade (more info below).

Finally, a possible cause could be from corrupted operating system files due to a Virus, Trojan, Rootkit, Spyware, or other Malware infection. You should scan your computer with all of the security applications you have installed on the computer, after updating them to the current definitions. If you don't have any anti-virus or anti-spyware programs you can use an online scanner from Trend Micro. You can keep all of your devices protected from malicious programs and online exploits by purchasing and installing Trend Micro security programs and apps.

I thought I was the Administrator!

You may think you are the Administrator, but in reality you probably aren't. If your logged-in account identity is labeled "Computer Administrator" (under Users and Passwords - Account Type) it is in fact a member of what is known as the "Administrators Group." That group account has Administrator level privileges, but may actually not have "Full Control" or "Ownership" of all operating system files and the all branches of the "Windows Registry." The actual true "Administrator" account may possess these required permissions, or at least allow you to override insufficient permissions as needed (See "Taking Ownership" in my extended comments).

There is no account named "Administrator" on the Welcome screen! How do I access it?

There are two ways to gain access to the actual "Administrator" account in both XP Home and Professional. One way is to reboot the computer into "Safe Mode," where the actual "Administrator" account will be listed on the Welcome Screen. However, some programs won't install from Safe Mode and your networking may not be fully functional (Safe Mode With Networking). Therefore, I recommend using the second method of accessing the true Administrator account - the Classic Windows Logon Screen, which will allow normal access to the Internet, with full Administrator privilges and the ability to install SP3 (and run followup Windows Updates). See my extended comments for directions for displaying the Classic Windows Logon and getting into the true Administrator account.

---

Displaying the hidden Windows Classic Logon Screen

Windows XP normally hides the true Administrator account from the Welcome Screen in normal mode, but displays it in Safe Mode. While you can easily access it by rebooting into Safe Mode (tap F8 during boot cycle), you can also access it via the Classic Windows Logon (box, or screen). Here's how.

To temporarily use the classic logon screen, press CTRL+ALT+DEL two times on the Welcome logon screen. This will hide the Welcome Screen and reveal the Classic Windows Logon box. When the logon box appears type the user name: Administrator and then type in any password you have assigned to that account. If you have not created a password for Administrator, leave the password field blank and press Enter, to logon.

To configure Windows XP to use the classic logon and shutdown screens for every logon session, follow these steps:

1. Click Start, and then click Control Panel.
2. Double-click User Accounts.
3. Click Change the way users log on or off.
4. Clear the Use the Welcome screen check box.

Note If you turn off the Welcome logon screen, you also turn off the Fast User Switching option.

The true Administrator account is usually able to achieve results sometimes denied to members of the "Administrator's Group." This is especially true when you need to reclaim full control that is assigned to "System."

Once you have logged onto the true Administrator account try upgrading to SP3 again, either via Windows Updates, or by running the downloaded Service Pack 3 setup file.

The next paragraphs have further information about what you can do if you are still getting Access denied errors from the true Administrator account. One of these solutions will probably solve your problem.

Taking Ownership of the Registry and system folders

Even if you have complete and full Computer Administrator privileges and are logged onto the actual "Administrator" account, you may still have to "take ownership" of the four main branches of your Windows Registry, and/or the Windows Directory and it's files and folders, to successfully install XP SP3.

To do this go to Start > Run and type in Regedit and press Enter. When the Registry Editor opens there should be five items with + signs listed in the left pane, each beginning with "HKEY," each representing a different branch of the Registry. Right click, one at a time, on each of the five master HKEY names, then choose "Permissions." Find your administrator-level user name in the list of users and make sure that when highlighted it shows "Full control" under Allow, in the "Permissions for {user name}" options field. If it shows less than full control - try checking the box labeled "Full control" (under Allow) and click Apply.

If it accepts this first change of permissions you are good to proceed to the next step. Otherwise, log out of the Computer Administrator account and log onto the actual "Administrator" account, then try the procedure again. If you are already in the actual Administrator account and are refused permission to take full control, you must use the script shown below to install the correct system-wide permissions.

The access denied message can occur on a file level, a folder level, or a Registry level. In my experience, the Windows Registry is an overlooked location where a lot of access denied issues arise. The reason can be that the owner of an important branch of the Registry has been assigned to System, when it needs to go to Administrators Group, or Administrator. That's why I mentioned taking ownership of the system-wide branches of the Registry.

The next step is to actually "take ownership" of each of the keys in the Registry, in case any of them are assigned to another user account, or to System. Here's what to do:

With the Registry Editor open, right click on each main HKEY branch of the Registry, one at a time, selecting "Permissions" from the options menu. Then proceed as follows:

1. look at the lower section of the Permissions boxes and find a button labeled "Advanced";
2. click on Advanced for each of the 5 main branches of the Registry, one at a time;
3. the Advanced Security Settings for HKEY_(whatever) will open;
4. find and click on the tab labeled "Owner" and see who is listed as "owner";
5. If it shows "Administrators" or "Computer Administrator" it is ok.
6. Otherwise, find that name in the "Permission entries" field underneath and double-click on it, placing it into the "Owner" field.
7. Click on Apply, then OK, then OK again, for each of the 5 branches of the Registry.

You should now have complete control over the Registry for the Administrators group, or Administrator account itself. Reboot to make the changes take, then try installing XP SP3 again.

Also, the options to take ownership will not be present in XP if your boot drive is not formatted as NTFS. Almost nobody is using FAT32 anymore, on XP computers, so this shouldn't be a problem for you.

---

If all else fails download SubInACL from Microsoft and create a script to install the missing Administrator privileges.

1. Download and install the subinacl.msi command line permissions tool from Microsoft.
2. Open Notepad (Start > Run > type: Notepad and press Enter) and copy/paste in following codes:
   1. cd /d "%ProgramFiles%\Windows Resource Kits\Tools"
   2. subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f
   3. subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f
   4. subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f
   5. subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f
   6. subinacl /subdirectories %windir%\*.* /grant=administrators=f /grant=system=f
   7. secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose
3. Save the file (File > Save As) with name “SP3.bat“. Accept the changed file type if challenged.
4. Now right-click on the file and select “Run as" > "administrator.“ It might take some time to complete.
5. After completion, restart your system and now you should be able to install SP3.

I hope this helps you to upgrade your finicky computer to XP Service Pack 3. To your success!

Back to our main FAQs page

(back to top)