Have been playing with deploying Forefront via SMS 2003 and stripping out Symantec Antivirus. Ran in to a couple of odd errors of either the BITS or Automatic Update service not running and failing with a  Error 0×80004015  “The class is configured to run as a security id different from the caller.”

This stops the service from running the service security descriptor is stuff up and needs re-setting.

fixed it using this script added in to the SMS deployment:

__________________________________________________________________________________________________

REM resets the BITS service
REM
sc sdset bits “D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)”>>C:\SetServiceObjectSecurity.log
REM
REM resets the Automatic Updates service
REM
sc sdset wuauserv “D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)”>>C:\SetServiceObjectSecurity.log
REM
REM Sets Automatic Updates & BITS services to Automatic
REM
sc config bits start= auto
sc config wuauserv start= auto
REM
REM Starts the Automatic Updates & BITS services
REM
sc start bits
sc start wuauserv

__________________________________________________________________________________________________

Not pretty, but it works