Background:
We have a base Windows XP image that is deployed to different regions. Some
regions make minor modifications to that image before it is deployed
(software added, department specific software....). Our region was able to
successfully deploy SP2 over a year ago to our machines with no major issues.
We had less than 1% with issues and they were all worked out. We just found
out another region has not fully upgraded to SP2 yet and was asking
assistance.

Issue:
We tried applying it to a few machines via a software push and manually and
in all tests after the SP2 install, the Network Connections and Com+ services
show "Starting" and never start. I have also set up several machines using
their image and received the exact result on all of them. I have tried the
fix in Q329441(applying the patch and deleting the reg keys) as well as
changing the RPC service to Logon via LocalSystem account from
NT_Authority\NetworkServices. While it works I am trying to find the deeper
issue. I believe it is some kind of access rights/permission issue but cannot
pinpoint it. Prior to changing the RPC service to the Local System account I
receive multiple "Object Access" errors in the Security log similar to this:

Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: winmgmt
Handle ID: -
Operation ID: {0,252727}
Process ID: 588
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: CSBLX81I2QZ$
Primary Domain: Workgroup
Primary Logon ID: (0x0,0x3E7)
Client User Name: NETWORK SERVICE
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E4)
Accesses: READ_CONTROL
Query information from service

Privileges: -
Restricted Sid Count: 0

The Object name varies as does the Accesses but the rest pretty much stays
the same. Once I adjust the RPC these errors do not reappear. On our machines
that were successfully upgraded last year the RPC is set to
NT_Authority\NetworkServices and it works fine.

Based on those findings I suspect it some access right/permission that was
modified pre-deployment from the other region. I have not received much help
from them on their processes as there has been a re-organization of duties in
the other region and the prior techs are no longer there. I would like to
find a pre-upgrade solution so once the upgrade completes we won't
potentially have 1500+ machines with no network access if things went wrong
(I can make a script to apply the fixes above post-installation but if I can
fix the problem before hand it would be much more reassuring).

Any ideas which objects, reg keys and/or files may have been modified to
remove the proper access rights for these services?

Thanks,

Pete.