When installing the latest version of the Windows Update Client, you may recieve an error that references this code: 0x8007041d
0x8007041d simply refers to not being able to stop, restart or manipulate in some way, the Windows Update service.
With a recent version of the Windows Update agent installed, the C:\windows\WindowsUpdate.log file will produce and error similair to the following:
Windows Update Client standalone setup : eula file path is d:\72535cf0e694fc12f4c5a4\en\eula.rtf
2005-11-14 12:26:23 23248 68f8 Setup *************
2005-11-14 12:26:23 23248 68f8 Setup ** START ** Setup: Installing client binaries
2005-11-14 12:26:23 23248 68f8 Setup *********
2005-11-14 12:26:23 23248 68f8 Setup * Download directory: d:\72535cf0e694fc12f4c5a4\
2005-11-14 12:26:23 23248 68f8 Setup * Stop and start service: Yes
2005-11-14 12:26:53 23248 68f8 Setup FATAL: SelfUpdate: Failed to stop service wuauserv, error = 0x8007041D
2005-11-14 12:26:53 23248 68f8 Setup * WARNING: Exit code = 0x8007041D
2005-11-14 12:26:53 23248 68f8 Setup *********
2005-11-14 12:26:53 23248 68f8 Setup ** END ** Setup: Installing client binaries
2005-11-14 12:26:53 23248 68f8 Setup *************
2005-11-14 12:26:53 23248 68f8 Setup FATAL: InstallUpdatedBinaries failed with error 0x8007041d
This can occur with the Standalone Installer, as in the example above, but also when updating your Windows Update client though the Windows Update homepage.
On the web you will find references to Norton virusscanner possibly causing this, but its not the only reason this can happen. ( http://www.kbalertz.com/kbNamed_902322/902322.aspx ) In fact there are any number of reasons a Windows server can fail to unload.
The Windows Update service is launched by the system, under system account credentials, and with the following command line: C:\windows\system32\svchost.exe -k wugroup
If the service is trapped in the “stopping” state, you may wanna kill the process manually, however, you can only do this on a Windows 2000 machine! As I will show below…
But because the service is launced via cvchost, you might have a hard time recognising which instance of cvchost to kill.
Process Explorer has an option to show the command line with which all system processes have been started. This is simply a column you have to turn on in the main view.
The Windows XP / W2K3 command tasklist.exe will give you much the same data:
On a Windows 2000 Server:
tasklist /FI "IMAGENAME eq SVCHOST.EXE" /SVC
Image Name PID Services
========================= ====== =============================================
svchost.exe 636 RpcSs
svchost.exe 780 EventSystem, Netman, NtmsSvc, RasMan, SENS
svchost.exe 2512 TapiSrv
svchost.exe 26864 BITS
svchost.exe 30912 wuauserv
A Windows Server 2003 machine:
Image Name PID Services
========================= ====== ============================================
svchost.exe 1504 DcomLaunch
svchost.exe 1580 RpcSs
svchost.exe 1636 Dhcp, Dnscache
svchost.exe 1780 LmHosts, W32Time
svchost.exe 1820 AeLookupSvc, BITS, CryptSvc, dmserver,
EventSystem, helpsvc, lanmanserver,
lanmanworkstation, Netman, Nla, sacsvr,
Schedule, seclogon, SENS, SharedAccess,
ShellHWDetection, TrkWks, winmgmt, wuauserv
svchost.exe 692 ERSvc
svchost.exe 1120 RemoteRegistry
svchost.exe 2824 W3SVC
svchost.exe 2948 TermService
A Windows XP machine:
Image Name PID Services
========================= ====== ============================================
SVCHOST.EXE 940 DcomLaunch, TermService
SVCHOST.EXE 1008 RpcSs
SVCHOST.EXE 1104 AudioSrv, BITS, Browser, CryptSvc, Dhcp,
dmserver, ERSvc, EventSystem, helpsvc,
lanmanserver, lanmanworkstation, Netman,
Nla, RasMan, Schedule, seclogon, SENS,
SharedAccess, ShellHWDetection, srservice,
TapiSrv, Themes, TrkWks, w32time, winmgmt,
Wmi, wuauserv, WZCSVC
SVCHOST.EXE 1196 Dnscache
SVCHOST.EXE 1308 LmHosts, RemoteRegistry, SSDPSRV, WebClient
SVCHOST.EXE 3320 stisvc
A funny thing to note here is the difference between Windows 2000 and Windows XP / W2K3. On Windows 2000 Server, the wuauserv service is run as a completely seperate process, with its own ID.
This means you can kill it seperatly.
But on Windows XP / W2K3, it is launched as part of the Network Services group. This is reflected in the command line in which it is launched:
C:\WINDOWS\system32\svchost.exe -k netsvcs
You cant simply kill svchost.exe in this case, it will crash the system.
Recommended is to disable the service, reboot, and after reboot install the standalone Windows Update Agent.