Installing Windows Update client error 0x8007041d

When installing the latest version of the Windows Update Client, you may recieve an error that references this code: 0x8007041d

0x8007041d simply refers to not being able to stop, restart or manipulate in some way, the Windows Update service.

With a recent version of the Windows Update agent installed, the C:windowsWindowsUpdate.log file will produce and error similair to the following:

Windows Update Client standalone setup : eula file path is d:72535cf0e694fc12f4c5a4eneula.rtf
2005-11-14 12:26:23 23248 68f8 Setup *************
2005-11-14 12:26:23 23248 68f8 Setup ** START **  Setup: Installing client binaries
2005-11-14 12:26:23 23248 68f8 Setup *********
2005-11-14 12:26:23 23248 68f8 Setup   * Download directory: d:72535cf0e694fc12f4c5a4
2005-11-14 12:26:23 23248 68f8 Setup   * Stop and start service: Yes
2005-11-14 12:26:53 23248 68f8 Setup FATAL: SelfUpdate: Failed to stop service wuauserv, error = 0x8007041D
2005-11-14 12:26:53 23248 68f8 Setup   * WARNING: Exit code = 0x8007041D
2005-11-14 12:26:53 23248 68f8 Setup *********
2005-11-14 12:26:53 23248 68f8 Setup **  END  **  Setup: Installing client binaries
2005-11-14 12:26:53 23248 68f8 Setup *************
2005-11-14 12:26:53 23248 68f8 Setup FATAL: InstallUpdatedBinaries failed with error 0x8007041d

This can occur with the Standalone Installer, as in the example above, but also when updating your Windows Update client though the Windows Update homepage.

On the web you will find references to Norton virusscanner possibly causing this, but its not the only reason this can happen. ( http://www.kbalertz.com/kbNamed_902322/902322.aspx ) In fact there are any number of reasons a Windows server can fail to unload.

The Windows Update service is launched by the system, under system account credentials, and with the following command line: C:windowssystem32svchost.exe -k wugroup

If the service is trapped in the “stopping” state, you may wanna kill the process manually, however, you can only do this on a Windows 2000 machine! As I will show below…

But because the service is launced via cvchost, you might have a hard time recognising which instance of cvchost to kill.

Process Explorer has an option to show the command line with which all system processes have been started. This is simply a column you have to turn on in the main view.

The Windows XP / W2K3 command tasklist.exe will give you much the same data:

On a Windows 2000 Server:

tasklist /FI "IMAGENAME eq SVCHOST.EXE" /SVC

Image Name                   PID Services
========================= ====== =============================================
svchost.exe                  636 RpcSs
svchost.exe                  780 EventSystem, Netman, NtmsSvc, RasMan, SENS
svchost.exe                 2512 TapiSrv
svchost.exe                26864 BITS
svchost.exe                30912 wuauserv

A Windows Server 2003 machine:

Image Name                   PID Services
========================= ====== ============================================
svchost.exe                 1504 DcomLaunch
svchost.exe                 1580 RpcSs
svchost.exe                 1636 Dhcp, Dnscache
svchost.exe                 1780 LmHosts, W32Time
svchost.exe                 1820 AeLookupSvc, BITS, CryptSvc, dmserver,
EventSystem, helpsvc, lanmanserver,
lanmanworkstation, Netman, Nla, sacsvr,
Schedule, seclogon, SENS, SharedAccess,
ShellHWDetection, TrkWks, winmgmt, wuauserv
svchost.exe                  692 ERSvc
svchost.exe                 1120 RemoteRegistry
svchost.exe                 2824 W3SVC
svchost.exe                 2948 TermService

A Windows XP machine:

Image Name                   PID Services
========================= ====== ============================================
SVCHOST.EXE                  940 DcomLaunch, TermService
SVCHOST.EXE                 1008 RpcSs
SVCHOST.EXE                 1104 AudioSrv, BITS, Browser, CryptSvc, Dhcp,
dmserver, ERSvc, EventSystem, helpsvc,
lanmanserver, lanmanworkstation, Netman,
Nla, RasMan, Schedule, seclogon, SENS,
SharedAccess, ShellHWDetection, srservice,
TapiSrv, Themes, TrkWks, w32time, winmgmt,
Wmi, wuauserv, WZCSVC
SVCHOST.EXE                 1196 Dnscache
SVCHOST.EXE                 1308 LmHosts, RemoteRegistry, SSDPSRV, WebClient
SVCHOST.EXE                 3320 stisvc

A funny thing to note here is the difference between Windows 2000 and Windows XP / W2K3. On Windows 2000 Server, the wuauserv service is run as a completely seperate process, with its own ID.
This means you can kill it seperatly.

But on Windows XP / W2K3, it is launched as part of the Network Services group. This is reflected in the command line in which it is launched:
C:WINDOWSsystem32svchost.exe -k netsvcs

You cant simply kill svchost.exe in this case, it will crash the system.
Recommended is to disable the service, reboot, and after reboot install the standalone Windows Update Agent.