'Access Denied' on XP or 2003 Terminal Server Systems upgraded from NT4 or Win2k or freshly installed

This procedure will be applicable to NT4 or Win2k machines that have been upgraded to Windows XP professional or Windows 2003 Terminal Server with SP1, and may be applicable to XP amd 2003 Terminal Server machines with SP1 that were not upgraded but are producing an "Access Denied" message.

The following instructions describe:

• Adding the LOCAL SERVICE account, giving it read access to "winreg"

• Adding a missing path to the "winreg" subkey

This will allow UpdateEXPERT to query the upgraded target.

• Run regedit and navigate to the following key (Note: HKLM = HKEY_LOCAL_MACHINE).

    HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg
   

Adding the LOCAL SERVICE account

• Right-click on winreg and click Permissions …; if LOCAL SERVICE is present, make sure the account has read permissions. If LOCAL SERVICE is not present, we want to locate and add the account, giving it read permissions.

• Click Add button above ... then Advanced button on the next screen that pops up ...

• Click Object Types button …; and check Groups (as shown below) if necessary, then hit OK. This is just to make sure we see all accounts.

• Click Find Now to display all accounts, groups etc. Scroll down and select LOCAL SERVICE (as shown below) and hit OK, then OK again.

• Allow Read Access for the LOCAL SERVICE account by checking "Read" (as shown below), then hit OK.

Adding the Missing Path

• Expand the winreg key so that AllowedPaths subkey is now selected, and double-click on the Machine data item on the right. Initially, all data will be highlighted. Click just below the highlighted area and add the System\CurrentControlSet\Control\Windows path as shown below on the last line.

Note: if you accidentally clear the window of all data, click "Cancel", and try again.

• Hit OK and exit regedit