Can’t install TFS, or the .Net Framework, or almost anything? Check your security policies!

On a newly-rebuild Windows 2003 server, I set out to install TFS 2008. After installing SQL 2005, and SQL Reporting Services, and SQL Analysis Services, and SQL 2005 Service Pack 3, I fired up the TFS installer, only to ultimately get the dreaded “Send Report/Don’t Send Report” dialog box.

Team Foundation Server encountered a problem during setup

Nice! Looking at the install log was so much more revealing.

[09/14/09,13:33:33] Microsoft .NET Framework 3.5: ***ERRORLOG EVENT*** : Error code 1603 for this component means "Fatal error during installation."
[09/14/09,13:33:33] Setup.exe: AddGlobalCustomProperty
[09/14/09,13:33:33] Microsoft .NET Framework 3.5: ***ERRORLOG EVENT*** : Setup Failed on component Microsoft .NET Framework 3.5

Odd, why won’t the .Net Framework 3.5 install? Shouldn’t be hard to fix by downloading the .Net 3.5 installer and installing it manually. Or should it? That didn’t work, either. Again from the install log.

[09/14/09,13:42:31] WIC Installer: [2] Error code 1603 for this component means "Fatal error during installation."
[09/14/09,13:42:31] WIC Installer: [2] Setup Failed on component WIC Installer
[09/14/09,13:42:33] WapUI: [2] DepCheck indicates WIC Installer is not installed.

What does Windows Imaging Component have to do with anything? Probably nothing, but Windows Installer does, so let’s take that route. I download the latest Windows Installer installer (!) and attempt to install (!!) manually. Too bad that didn’t help, either — but at least this time I got an error message seemed to point me in the right direction.

Setup Error: You do not have permissions to update Windows Server 2003.

Now we’re getting somewhere. Googling that exact error message brought me to a Microsoft knowledge base article (KB888791) which told me:

Update.exe version and later versions require that the user who installs the software update is an administrator with certain user rights.

A quick look at the policy settings on the server showed me that the Administrators group didn’t have the “Back up files and directories” right, as shown below.

A quick request to IT to grant the Administrators group the missing right, and viola! TFS, and other software, is finally installing.

Apparently, this may have been the root cause issue for software not installing or uninstalling properly a week or so ago, when I put in the original request to have the server rebuilt, which leads me to wonder. If Update.exe knows what rights it requires, why doesn’t it check for them, why doesn’t it provide a clear error message indicating what is missing, and why doesn’t this information bubble up appropriately to MSI installers that use Update.exe?

The world may never know.