.Net Framework 3.5 WIC install error and ‘SeSecurityPrivilege’ with WSS and MOSS

.Net 3.5 Error

WIC x64 Installer: [2] Setup Failed on component WIC x64 Installer
WapUI: [2] DepCheck indicates WIC x64 Installer is not installed.

WSS Content DB setup error

System.Security.AccessControl.PrivilegeNotHeldException: The process does not
possess the ‘SeSecurityPrivilege’ privilege which is required for this
operation.
at System.Security.AccessControl.Win32.GetSecurityInfo(ResourceType
resourceType, String name, SafeHandle handle, AccessControlSections
accessControlSections, RawSecurityDescriptor& resultSd)

After several hours we found out that the cause of the issue was because the domain policy was overriding the the local policy of the server.

To resolve this issue Open Local Security Policy (under adminstration tools) ->Local Policy->User Assignments -> “Manage Auditing and Security Log” under this policy add the service account. (by default administrators should exsist here).

To help diagnose this issue download whoami.exe from microsoft.com

run whoami with the /PRIV switch i.e. whoami /PRIV

a normal output should look like this (items marked as disabled are still ok) must make sure sesecurityprivilege is listed

PRIVILEGES INFORMATION
———————-

Privilege Name                  Description                               State

=============================== ========================================= ======
==
SeIncreaseQuotaPrivilege        Adjust memory quotas for a process        Disabled
SeTcbPrivilege                  Act as part of the operating system       Disabled
SeSecurityPrivilege             Manage auditing and security log          Disabled
SeTakeOwnershipPrivilege        Take ownership of files or other objects  Disabled
SeLoadDriverPrivilege           Load and unload device drivers            Disabled
SeSystemProfilePrivilege        Profile system performance                Disabled
SeSystemtimePrivilege           Change the system time                    Disabled
SeProfileSingleProcessPrivilege Profile single process                    Disabled
SeIncreaseBasePriorityPrivilege Increase scheduling priority              Disabled
SeCreatePagefilePrivilege       Create a pagefile                         Disabled
SeBackupPrivilege               Back up files and directories             Disabled
SeRestorePrivilege              Restore files and directories             Disabled
SeShutdownPrivilege             Shut down the system                      Disabled
SeDebugPrivilege                Debug programs                            Disabled
SeSystemEnvironmentPrivilege    Modify firmware environment values        Disabled
SeChangeNotifyPrivilege         Bypass traverse checking                  Enabled
SeRemoteShutdownPrivilege       Force shutdown from a remote system       Disabled
SeUndockPrivilege               Remove computer from docking station      Disabled
SeManageVolumePrivilege         Perform volume maintenance tasks          Disabled
SeImpersonatePrivilege          Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege         Create global objects                     Enabled
SeIncreaseWorkingSetPrivilege   Increase a process working set            Disabled
SeTimeZonePrivilege             Change the time zone                      Disabled
SeCreateSymbolicLinkPrivilege   Create symbolic links                     Disabled

Thanks to Lewis and whoami.exe