I am having a permissions issue trying to patch a 3rd party program on an Azure server

Question

I am having a permissions issue trying to patch a 3rd party program on an Azure server

Tony Bligh 0

I am trying to apply a patch to a 3rd party program installed on my Azure server. No matter what elevated account I use, I still get an error that I do not have permission to update the service.

Venkatesan S 6,435 Reputation points Microsoft External Staff Moderator

2025-11-13T18:53:58.06+00:00

Hi Tony Bligh,

Could you add more information about which type of Azure resource is hosting the program? For example, is it a Virtual Machine (VM), App Service, Azure Kubernetes Service (AKS) node, or another resource?
Tony Bligh 0 Reputation points

2025-11-13T18:56:41.9233333+00:00

This is a virtual machine running Windows 2022 Data Center.
Jilakara Hemalatha 11,600 Reputation points Microsoft External Staff Moderator

2025-11-13T19:30:25.7166667+00:00
Hi Tony Bligh,

To understand more about on this issue. Could you please provide the below details:

What is the exact error message or error code you encounter when attempting to apply the patch, and does the installer produce any log files with relevant details?

Are you running the patch as a local Administrator or a domain account, and does that account have Full Control over the program’s installation folder and related registry keys?

Which Windows Service(s) does the program use, under which account do they run, and have you tried stopping the service before applying the patch?

How are you running the patch installer (locally, remote, network share), and could antivirus, endpoint protection, or Azure policies be blocking file or service updates?

Is this VM managed via Azure Update Manager, Intune, or any other Azure patch management tool, and are there any domain or group policies that might restrict service updates?

Have you checked Windows Event logs (Application/System) or application logs for permission or access errors related to the patch?
Tony Bligh 0 Reputation points

2025-11-13T19:38:51.01+00:00
Product: ImageRight Application Server -- Error 1923. Service 'ImageRight Application Server Service' (IRAppServer) could not be installed. Verify that you have sufficient privileges to install system services.

Tried running as local administrator, domain admin, changed ownership to account I'm logged in as (domain admin), verified full control throughout full file structure.

ImageRight Application Server Service. Runs under a Domain Admin account. Service is stopped before patching.

locally using msiexec in an elevated command prompt.

There are no group policies, etc that would prevent this patching.

Yes, Windows Application logs record the same error - 1923. Service could not be installed. Verify that you have sufficient privileges to install system services.
Tony Bligh 0 Reputation points

2025-11-13T19:59:29.0133333+00:00
Product: ImageRight Application Server -- Error 1923. Service 'ImageRight Application Server Service' (IRAppServer) could not be installed. Verify that you have sufficient privileges to install system services.

Tried running as local administrator, domain admin, changed ownership to account I'm logged in as (domain admin), verified full control throughout full file structure.

ImageRight Application Server Service. Runs under a Domain Admin account. Service is stopped before patching.

locally using msiexec in an elevated command prompt.

There are no group policies, etc that would prevent this patching.

Yes, Windows Application logs record the same error - 1923. Service could not be installed. Verify that you have sufficient privileges to install system services.
Jilakara Hemalatha 11,600 Reputation points Microsoft External Staff Moderator

2025-11-13T22:34:18.6533333+00:00
Thank you for providing the details regarding the Error 1923 encountered during patching. This error indicates that the installer does not have sufficient privileges to register the service. Based on the information provided, we recommend the following steps:

You mentioned that the service is stopped before patching, which is good. Ensure that you can manually start and stop the service without any errors. Lingering issues with the service can sometimes prevent the patch from applying successfully.

Ensure that the account used to patch the application has Full Control over the installation folder. You can verify and grant permissions using the following command in an elevated command prompt:

icacls "C:\Path\To\Your\Application" /grant yourdomain\youradminaccount:(OI)(CI)F /T

Replace C:\Path\To\Your\Application with the actual application folder path.

Replace yourdomain\youradminaccount with the account used to run the patch

2.Check Registry Service Entries: The installer may be unable to write to the registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IRAppServer

This can occur due to corruption, residual entries, or system locks, even with administrative privileges. Occasionally, the Windows Installer service itself may also encounter limitations when registering a system service.

4.Remove Residual Service Entries: To resolve potential registry conflicts, open the Registry Editor (regedit) and navigate to the above key. If the key exists and the service is not running, back it up and safely delete it.

5.Repair Windows Installer Service: From an elevated command prompt, run the following commands to ensure that the installer can register services correctly:

msiexec /unregister

msiexec /regserver

Azure Update Manager Considerations: If your VM is managed by Azure Update Manager, please note that it currently cannot handle third-party patching without WSUS integration. To manage third-party application patches completely, a WSUS instance is required.

Reference: https://dotnet.territoriali.olinfo.it/en-us/azure/update-manager/guidance-migration-azure

Hope this helps! Please let me know if you have any queries.

Additionally, please check the private message for further details.
Tony Bligh 0 Reputation points

2025-11-14T12:14:28.9+00:00
All of the accounts I have attempted to use to install the patch have full control in the entire directory structure where the ImageRight software is installed.

I checked the registry, and I was able to make changes in the registry key manually.

I will attempt steps 4-6 later today and post the results.