Security for a day

Had a Forefront client that displayed the annoying* orange alert icon. The system was refusing to get the current Forefront definitions update with a 0×80080005.

A quick search of the web got me no-where.  Back to proper troubleshooting.

Check services (Automatic Updates & Background Intelligent Transfer Service) and WindowsUpdate.log details are the best starting points for these types of errors, so:

%systemroot%\WindowsUpdate.log

2009-07-21                         07:31:23:852           13400           3490            COMAPI      FATAL: Unable to initiate asynchronous search, hr=80080005

2009-07-21                         08:30:53:161           1924              2984            Misc                Logging initialized (build: 7.0.6000.374, tz: +0700)

2009-07-21                         08:30:53:161           1924              2984            Misc                = Process: C:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware\MpCmdRun.exe

2009-07-21                         08:30:53:161           1924              2984            Misc                = Module: C:\WINNT\system32\wuapi.dll

2009-07-21                         08:30:53:161           1924              2984            COMAPI      ————-

2009-07-21                         08:30:53:161           1924              2984            COMAPI      — START –  COMAPI: Search [ClientId = Microsoft Forefront Client Security]

2009-07-21                         08:30:53:161           1924              2984            COMAPI      ———

2009-07-21                         08:31:23:162           1924              2984            COMAPI      FATAL: Unable to connect to the service (hr=80080005)

2009-07-21                         08:31:23:162           1924              2984            COMAPI      WARNING: Unable to establish connection to the service. (hr=80080005)

2009-07-21                         08:31:23:162           1924              2984            COMAPI        – WARNING: Exit code = 0×80080005

2009-07-21                         08:31:23:162           1924              2984            COMAPI      ———

2009-07-21                         08:31:23:162           1924              2984            COMAPI      –  END  –  COMAPI: Search [ClientId = <NULL>]

2009-07-21                         08:31:23:162           1924              2984            COMAPI      ————-

2009-07-21                         08:31:23:162           1924              2984            COMAPI      FATAL: Unable to initiate asynchronous search, hr=80080005

Not much help, either.

SC Query BITS

SC Query Wuauserv

SERVICE_NAME: wuauserv

DISPLAY_NAME: Automatic Updates

TYPE                                                        : 20  WIN32_SHARE_PROCESS

STATE                                                     : 3  STOP_PENDING

(NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN))

WIN32_EXIT_CODE                      : 0 (0×0)

SERVICE_EXIT_CODE                    : 0 (0×0)

CHECKPOINT                                     : 0×2

WAIT_HINT                                        : 0×7530

Well that would be the problem, the service has hung; Reboot time.

After the reboot completed, Forefront gets the latest update and the world is a happier place.

*It’s annoying as it means I have to look at the problem