When Microsoft unveiled the new Windows Update Web site for all Windows
XP computers in August 2004, I discovered that none of the XP Service
Pack 1 (SP1) or SP2 computers in our domain worked with the new site.
When I clicked the Install Now button, Windows Update downloaded the
software. However, when Windows Update tried to register the software,
it displayed error 0x80070005, which stated Windows Update has
encountered an error and cannot display the requested page.

I restarted the browser and returned to the Windows Update Web site,
but Windows Update immediately displayed error 0x8DDD0007, which stated
Windows Update cannot be displayed because your computer requires you
to restart it in order to finish another process. When I rebooted the
computer and went back to the Web site, Windows Update started all over
again with the Install Now button and repeated the same errors as

After investigating the situation, I discovered why Windows Update
wouldn't work. Our company uses Microsoft Software Update Services
(SUS) and has a Group Policy Object (GPO) that configures automatic
updates on our XP and Windows 2000 computers. That GPO sets the
Automatic Updates service's Startup type setting to Automatic. You can
find the Startup type setting at \Computer Configuration\
Windows Settings\Security Settings\System Services\Automatic Updates.
When Startup type is set to Automatic, the GPO automatically sets the
security for the service to

Administrators: Full Control
SYSTEM: Full Control

These settings don't match Windows' default security settings for that
service, which essentially are

Administrators: Full Control
Authenticated Users: Read
Power Users: Full Control
SYSTEM: Full Control

To solve the problem, I edited the GPO. I deleted the INTERACTIVE: Read
setting and added the Authenticated Users: Read setting. (I left the
Power Users: Full Control setting off the security list.) Now that our
XP computers have applied this policy update, we can use the Windows
Update Web site without any problems.