I ran into an issue today while attempting to install Threat Management Gateway 2010 on a Windows 2008 R2 server for one of my clients.  The issue that was occurring when deploying TMG I would receive the error “Microsoft SQL Express 2008 (logging instance) could not be installed.  As a result, Forefront TMG installation cannot be completed.”  Frustrating!  Looking at the logs revealed that there was a failure in the deployment with an error of “Wrapper: Install failed, hr = 0x84b30001”.  Eh?

The next step I tried was to deploy SQL 2008 Express on the Windows 2008 R2 server.  While in the process of deploying the SQL 2008 Express edition I received an error “Access Denied” and the installation failed.  After removing the failed SQL deployment from the server I started to do some research.  As it turns out Microsoft will leave their debug info in the SQL Express editions.  In order to install SQL Express the user much have permissions to “Debug Program”.   This setting is only related to SQL Express editions and not full blown (to my knowledge) SQL programs.

In order to find the security setting Debug Program I went to the “Local Security Policy” on the Windows 2008 R2 server.  I then went to “Local Policies”, “User Rights Assignment” and located “Debug Programs”.  Looking at the configuration this policy was being configured by Group Policy and was only allowing two users in the organization access to this perform Debug Program.  I asked my client to adjust their group policy to include my security account in this policy.  Did a GPUpdate /Force and rebooted the server.  Next attempt to install the server was a success!

Questions or Comments?  Please share!