Microsoft KB Archive/830846

= Windows Product Updates may stop responding or may use most or all the CPU resources =

Article ID: 830846

Article Last Modified on 9/5/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, 64-Bit Datacenter Edition
 * Microsoft Windows Server 2003, 64-Bit Enterprise Edition
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Web Edition
 * Microsoft Windows XP Professional for Itanium-based systems
 * Microsoft Windows XP Professional for Itanium-based systems
 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Media Center Edition 2002
 * Microsoft Windows XP Professional
 * Microsoft Windows XP Tablet PC Edition
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Datacenter Server
 * Microsoft Windows 2000 Professional Edition
 * Microsoft Windows 2000 Server

-



SYMPTOMS
When you try to install a product update (for example, a security patch, a critical update, an update rollup, or a hotfix) for any of the products that are listed in the &quot;Applies to&quot; section of this article, the installation may stop responding (hang).

When this problem occurs, the Processes tab in Windows Task Manager may indicate that Update.exe is using most or all the CPU resources. To start Windows Task Manager, right-click an empty area on the taskbar, and then click Task Manager.



CAUSE
This problem occurs if both the following conditions exist:  The Debug Programs user right (SeDebugPrivilege) was revoked from all users and groups, including administrators. By default, the Debug Programs user right is assigned only to administrators and to Local System. A user who has this user right can attach a debugger to any process. The product update that you are trying to install contains version 5.3.23.4 of Update.exe. This version requires the Debug Programs user right.

To determine the version of Update.exe that is included with a Windows product update, follow these steps:  Use the -x command-line switch to extract the product update package to a temporary folder. For example, to extract the English 826232 security patch for Microsoft Windows 2000 to the C:\826232 folder, run the following command:

windows2000-kb826232-x86-enu -x:c:\826232

 Right-click the Update.exe file in the temporary folder that you created in step 1, and then click Properties. Typically, Update.exe is located in a folder that is named Update (for example, C:\826232\Update). The file version appears on the Version tab. 



RESOLUTION
On October 29, 2003, Microsoft released several revised security patches that contain version 5.4.1.0 of Update.exe. Version 5.4.1.0 or later versions of Update.exe no longer require the Debug Programs user right. The following table lists the revised security patches that are available.



WORKAROUND
To work around this problem, grant the Debug Programs user right to the Administrators group. In Group Policy, the Debug Programs user right is located under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment.

<div class="moreinformation_section">

MORE INFORMATION
Microsoft does not recommend that you revoke the Debug Programs user right from the Administrators group. If you revoke the Debug Programs user right from the Administrators group, Microsoft recommends that you use the updated security patches where available.

<div class="references_section">