This article is also available as a PDF download.

It was going to be a straightforward chore: installing
Windows XP Service Pack 2 on about 50 PCs in two computer labs. SP2 has been
around long enough and most of us know its quirks well enough to be prepared.

In this instance, the two network technicians assigned to do
the job also did all preflight checks, such as ensuring that the BIOS and all
drivers were up to date. All the machines were of the same make and specs and
didn’t have any “strange” or legacy software installed.

The installation itself seemingly went smoothly. There were
no error messages or apparent hitches during the process. After the
installation all the applications still worked correctly.

However, soon afterward, the following problems were
discovered:

  • None of the PCs could print. (Printing was via different
    print servers to different models of printers in the two labs.)
  • The Windows installer service stopped working,
    so one couldn’t install software.
  • The networking properties couldn’t be accessed,
    as the Network Connections icons had disappeared. Accessing network properties
    via the command line resulted in errors.

When the technicians reported this to me, I checked with
them that the preparatory steps had indeed been performed and that the Windows
firewall had been disabled, as we had planned to do. Their reply to the latter
question–that they “didn’t enable” it–only struck me later; SP2 enables
the firewall by default.

As printing was my most pressing problem (from a user
perspective), I devised a quick-and-dirty workaround. However, it was no
solution, and I discovered that if I removed (uninstalled) a printer, I
couldn’t add it again.

I tried reinstalling SP2 on one PC, but the problems
persisted.

As I started troubleshooting the printing problem, I first
checked that there was really no driver issue (despite assurances by the
technicians). I found both the printers and print servers had the latest
drivers. The Print Spooler service was also running.

Knowing that the Windows firewall is often the culprit when
things start breaking after applying SP2, I next turned my attention to that. I
wanted to check the firewall settings but was met by a message that the
firewall service had to be started (fair enough) and I was prompted to do so (Figure A). I opted to have it started,
but after trying for quite awhile, I received an error message.

Figure A

Trying to access the Windows firewall settings resulted in an error
message.

I went into services and tried to stop and restart the
Windows Firewall/Internet Connection Sharing (ICS) service. It failed with an
error message (Figure B).

Figure B

Trying to manually restart the Windows firewall service also failed.

I now started seriously suspecting that the failed firewall
service might be at the root of the other problems I was experiencing. I turned
to the Microsoft Knowledge Base for help, and sure enough, there was an article
describing my problem with the firewall and offering a solution. (See “You cannot start the Windows
Firewall service in Windows XP SP2.”
). I tried that solution, but to
my dismay, it also failed (Figure C).

Figure C

The netsh command to restart the firewall after
applying a Microsoft recommended registry fix was also unsuccessful.

I searched wider on the Net but found no other solution.

I began to wonder about the other services. Services have
dependencies, and if one of the dependent services fails, it can have a
snowball effect. So I turned my attention back to the services.

The first thing I noticed, now that I had a closer look at
all the relevant services, was that the Network Connections service was in a
hung state (Figure D). It showed it
was starting, but no amount of staring and waiting resulted in a changed
status. Hmmm, that would explain why I had no Network Connections icons (Figure E) or access to network
properties. But I still didn’t know what caused it to fail in the first place.

Figure D

The Network Connections service showed a status of “starting” but in fact never
did.

Figure E

The Network and Internet Connections icons were missing after installing
SP2.

I went back to the MS Knowledgebase and found an article
titled “‘Network
and Dial-up Connections’ folder icons missing,”
which offered a
solution that looked promising. But you guessed it. It failed.

Now I was really beginning to feel alone. I seemed to have
ended up between a rock and a hard place. I searched the Net again–in vain. I
read whatever I could lay my hands (eyes) on about SP2 for known issues, tips
and tricks and in-depth descriptions and discussions. Not a glimmer of hope.

I went back to the services because I still felt convinced
my problem was somewhere there. I checked the status and startup type of every
service, even those that had little likelihood of causing my present problems.
I also compared it to the services on a working Windows XP Pro machine (without
SP2) at another location on the same network. It didn’t turn up any surprises.

I went back to my documentation to see what SP2 did with
what services. Still no Eureka!
moment, but it got me thinking. I remembered that Microsoft had done a lot of
work on the Remote Procedure Call (RPC) service trying to fix some serious
security vulnerabilities associated with this service.

Now let me hasten to add that I know very little about this
service. Apart from knowing it’s a communications protocol, I’ve found it to be
a rather obscure service responsible for all kinds of things, but it’s not quite
clear what. All I know from experience and from what I’ve read through the
years is that it’s an important service that you are generally unaware of until
it breaks–and then it can create havoc.

I had another look at this service and compared the
configuration of an SP2 PC with the one without SP2. It seemed the same. Same
startup type and same status. But then I looked at the logon type and I noticed
the difference. (Figure F).

Figure F

The logon account of the RPC service was set to NT Authority\Network
Service after SP2 had been applied.

I changed this service’s logon on the SP2 machine to Local
System Account. I couldn’t stop and restart the service manually after the
change, so I restarted Windows. After restarting, all the problems–printing,
network connections, Windows installer service, firewall service–had
disappeared like mist before the sun.


Tips

  • Note that I had to change only the logon type of
    the Remote Procedure Call (RPC) service and not that of the Remote Procedure
    Call (RPC) Locator service.
  • Make a note of services, including logon type,
    before making big changes to your system, like applying a service pack. Also,
    be careful of changing logon types. You could end up with a service that fails
    to start and no (easy) way of reverting to the previous setting.

In an ironic twist to the tale, I was busy with research for
this article (specifically looking for more info on the RPC service’s logon
type) when I stumbled upon a newsgroup discussion referring to a TechRepublic task
sheet: “Resolve
Windows RPC errors caused by XP SP2 and security updates.”
And there
was the solution I had been searching for so long! Of course, as I did not know
the RPC service was the cause of my woes, I wasn’t searching for that.