Scott Hanselman

The Mystery of the Failed Live Meeting Launch

September 19, '07 Comments [21] Posted in Bugs | Musings | Tools
Sponsored By

I've got to attend my first Microsoft Live Meeting in the morning, and since I'm remote I thought I'd just run the quick test of the Live Meeting Client before bed. You know, you visit a test page with your browser, and a Live Meeting client "jumps out" of the browser and connects. I've done it a million times before.

I open the Calendar Meeting, click, and...I get a dialog titled:

"RTC Router" - "The directory name is invalid"

Of course, I try it at least 10 times to make sure it's REALLY not working. You never know, it could work that 9th try, right?

OK. Now I'm getting tense. I need this to work, the LiveMeeting is in the morning. Um, reinstall, ok...just reinstall.

Microsoft has an internal website that you download all the corporate IT products you need for your regular job. I go back up in IE, am prompted for my Microsoft domain account and password (this machine isn't on the domain), find the right page, download the MSI and run the installation in place. OK. Whew. I go back open the Calendar Meeting, click, and...I still get a dialog titled:

"RTC Router" - "The directory name is invalid"

Crap. Ok, it's Procmon time. Who owns this dialog box? I give the dialog a good shake while Task Manager is open. That's a low-tech way of answering the Who's Process Is This question - grab a dialog with the mouse and shake it around the screen...the process that owns it will start using a little bit of CPU.

It's RunDll32.exe. That's a generic process that runs Procedures directly within DLLs. Basically a LoadLibrary()|GetProcAddress() command-line interface.

Now, I set the filters in Procmon to just watch two processes - iexplore.exe and rundll32.exe. I then reproduce the issue and watch the logs.

RunDll32

OK, looks like this is being called when I click the link in IE:

C:\Windows\system32\rundll32.exe "C:\Program Files (x86)\Common Files\Microsoft Shared\LiveMeeting Shared\RtcRouter.dll",RouteMIME %1

It's being launched because of the mime/type of the file being returned from the web server. The registry says that there's a .rtc and .rtc-ms extension of type "Microsoft.RTC.ConnectionFile."

Registry Editor

The Set Associations Dialog in Vista confirms it.

Set Associations

So, this RunDll32 RtcRouter.dll action is the "Microsoft Office Live Meeting Router." RTC is probably Real Time Communication, but at this point I don't care.

Now, I reproduce the failure again and look for the "Live Meeting" string.

MoreRegistry

This run shows three things that are important. First the very top shows the writing to a log file called pwconsole-debug30.txt...it contains just this:

[MC] 08:55:50:031 GMT [PID 9228] [THREAD 4996]  [I] RTCRouter - RouteMIME called
[MC] 08:55:50:033 GMT [PID 9228] [THREAD 4996]  [W] RTCRouter - Inserting for HKLM - {69CEBEF8-52AA-4436-A3C9-684AF57B0307}
[MC] 08:55:50:042 GMT [PID 9228] [THREAD 4996]  [W] RTCRouter - Using Target Product code : {69CEBEF8-52AA-4436-A3C9-684AF57B0307}
[MC] 08:55:50:043 GMT [PID 9228] [THREAD 4996]  [E] RTCRouter - Error launching console

Ah, but the second thing in Procmon that jives with this long is the GUID which is apparently a Microsoft Installer Product Code leading to a Component which is the LiveMeeting Console.

Notice the Access Denied in reading the PWConsole.exe. Ok, so this is a permissions issue.

I head down into C:\Program Files (x86)\Microsoft Office\Live Meeting 8 and get ACCESS DENIED! What? I can't even go into my own folder? I JUST made this folder when I ran that installer.

Hm. OK, I'm Administrator, so I'm taking over ownership. I open an Administrator cmd.exe and from within that folder, run:

takeown /f "Live Meeting 8" /r /a
SUCCESS: The file (or folder) is now owned by user QUADPOWER\scott

That'll teach you. Now, I took ownership, but I still need permissions, so I go into Properties, Security, and I'm sure to go into Advanced|Edit|Edit and select "Replace all existing permissions" as I want to make sure I'm taking control of the entire directory and all files, not just one directory and forgetting to recurse.

Console

NOTE:  I'm just reporting my experience here, be careful when you do crazy stuff as Administrator and don't come to me when it all blows up for you. YMMV. Seriously.

I immediately notice something I didn't see before...the PWConsole NOW has an icon. I had a generic one before. AH. I've got permissions. And by I, I mean, explorer.exe.

Console (4)

Cool, now I go back into Outlook, click on the Live Meeting Test Link, and I'm in:

Microsoft Office Live Meeting - livemeeting.com - Live Meeting 2007 Console Test

Conclusion

How did I get myself into this situation? Here's my working theory.

  1. When I’m remoted into Corporate authenticated as, say, MICROSOFT\mrscott on my home computer that
    1. doesn’t have a machine account
    2. and where MICROSOFT\mrscott is a temporary identity (it’s not admin, and it’s just hanging out launching some processes, and not others) and
    3. I run installations with that domain authenticated identity via direct launching from Internet Explorer
  2. THEN:
    1. those installations run as MICROSOFT\mrscott the whole time and regular LOCALMACHINE\scott can’t access them, resulting in chaos and confusion, directories and files created and owned by an account that isn't on this machine. Oh, and it results in blog posts like this.

Is this something others might be having trouble with and who should be told?  Or, is this totally obvious and easily discoverable?

Of course! Just don’t run MSI installers launched directly from a Intranet website when you're domain authenticated against that site as someone who doesn't have administrator privileges on the local machine. <sarcasm>It's so obvious!</sarcasm> Well, actually, stated like that, it does make sense. I can't add my domain account as an Administrator on this machine without joining the box to the domain, which I don't want to do. So, I'll download my installers from the internal sites and then run them from now on.

Good night!

About Scott

Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. He is a failed stand-up comic, a cornrower, and a book author.

facebook twitter subscribe
About   Newsletter
Sponsored By
Hosting By
Dedicated Windows Server Hosting by ORCS Web
Wednesday, September 19, 2007 11:56:04 AM UTC
You didn't run IE as your corporate account, though, right? If you were just prompted for your credentials in IE, that doesn't mean IE or any process/installer that is launched is running as that account, just that it's going to use those credentials to talk to a remote web server.
Wednesday, September 19, 2007 12:25:50 PM UTC
Scott: I love the way you study and solve computers problems, I hate when some colleagues tell "try rebooting the PC". That's not the way, even when sometimes it really solves the problem!
edddy
Wednesday, September 19, 2007 12:38:00 PM UTC
I've hit problems like this before on Vista too. Generally I never have the time to dig into the cause; usually taking ownership (using the batch file described by Tim Sneath here: http://blogs.msdn.com/tims/archive/2006/11/10/windows-vista-secret-11-deleting-the-undeletable.aspx) is about as far as I go. I bet there are plenty of people hitting this in Vista without realizing the cause (when they click stuff, it's not unreasonable to expect it to just work :] ).
Wednesday, September 19, 2007 12:44:24 PM UTC
Good luck not joining your machine to the domain: even as a contractor it was a pain working around the MSFT assumption that all machines have joined the Borg. I'd give you six months at the outside. :)
Wednesday, September 19, 2007 1:12:53 PM UTC
Nice debugging work. Your example of procman has given me yet another tool in my debugging toolbox!
Tom
Wednesday, September 19, 2007 2:36:59 PM UTC
Scott, nicely done. I love your analysis and that you took the time to do all this to solve the problem. I can tell you I will use this method in the future. On the other hand, I just wanted to tell you that I see lot's of problems like this on vista. Many times when I create a folder on the desktop, or on folders like program files, when I try to get in there later I cannot, or if I want to create a sub folder, i'm not allowed. I end up giving EVERYONE full control (cause I know that works) and that's how I solve the problem, but I can't believe the a folder I MYSELF created doesn't have permissions for me to do stuff to it.

Then it happens with apps as well. I have an IconLib folder that the application itself made, and when it tries to read from it, waits for a long time before telling me it can't access it. I change it to everyone full control and solve it but sometimes it just switches back.

I believe in security, but I think sometimes Vista goes too far. And it is not consistent.
Wednesday, September 19, 2007 2:58:46 PM UTC
So it's "The Mystery of...", and not "The Case of...". A bit of an homage to Mark Russinovich, I presume. I suppose it would have been more fitting if you would've used WinDbg, but a nice article nonetheless!
Mick
Wednesday, September 19, 2007 3:40:22 PM UTC
As I read your description I was wondering if you'd actually downloaded it locally and run it or not. When you said "download the MSI and run the installation in place" I thought you meant you actually ran it locally. It makes sense, they way you did it, that the permissions got gakked. Well, technically speaking it makes some sense. From a usability standpoint it kinda sucks.

Great troubleshooting. I learned something today. :)
Wednesday, September 19, 2007 4:00:19 PM UTC
Now if you can just figure out why LiveMeeting client on a 32-bit Vista system totally freezes up both itself *and* the computer :(
Scott
Wednesday, September 19, 2007 4:21:27 PM UTC
I've run into this (not with livemeeting but..) and I've fixed it basically the same way. BUT, I never knew about the takeown cmd. I've been doing it through the dialog, when I find it. Thanks for that.

Given you can take ownership from a cmd line, can you also change permissions, recursively from there I wonder? That set of steps is always a convoluted series of check boxes and ok buttons!

nice post though - I love that you've documented the 'shake the window' process test, classic. How many machine revs though until we have enough CPU/GPU power that moving a window just isn't going to register in taskman?
Ian
Wednesday, September 19, 2007 4:38:00 PM UTC
Nice detective work, Scott! As Mick mentioned above, I love these types of Russonivich-style technical troubleshooting writeups.
Wednesday, September 19, 2007 4:41:11 PM UTC
I think Chris Bilson is right though. I wrote this at 3am so I was a little wonky. Why did running it in-place make a difference then?
Wednesday, September 19, 2007 5:34:34 PM UTC
Hm. OK, I'm Administrator, so I'm taking over ownership.


You mean your machine account (quadpower/scott) is an administrator account? Who owned the program before you took ownership with quadpower/scott? If you try to runas a non-admin account do you get the same error?

I'm interested because we do a lot of live remote demoing here, but we use Webex.
Wednesday, September 19, 2007 5:47:10 PM UTC
Hey Scott, I think you'll find out around here that you're not going to have a fun time trying to get by on a machine that is not joined to the domain. I don't join my personal machines to the domain, and I generally don't do work on them that requires me to be bound to the domain. That's what company machines are for.

Installing an msi is one thing, but a lot of things on \\products are ... bigger (have you seen visual studio?), and heaven forbid you really try any internal dev work with this setup..
c
Wednesday, September 19, 2007 5:50:51 PM UTC
Scott - Before it was owned by "trustedinstaller" and "msiuser." Yes, as the local Adminsitrator I did not have access, hence, TakeOwn.exe.
Wednesday, September 19, 2007 5:51:34 PM UTC
c - I agree, and that's why I do have a number of Domain Machines. It was just the Live Meeting client and Office Communicator I needed.
Thursday, September 20, 2007 4:00:29 AM UTC
This is the thing that i both LOVE and HATE about computers.. One i hate these problems when it takes you away from what you are really wanting to focus on, the more important problems to solve, and can turn a 5 minute task into a 2 hour, or 2 week task sometimes..

On the other hand, I love the gratification of solving such problems, and the process of it. But that gratification really depends on when excitment turns into stress because its taking too long. (or distracting you)

-Karl Prosser
Thursday, September 20, 2007 12:13:38 PM UTC
Well what I liked the most is that the machine is called "QuadPower" :)

Reminds me of the time I called my computer "Tsunami" back when I was in College. I had the most kickass computer on campus.

Also, nice bit of detective work...
Thursday, September 20, 2007 4:23:18 PM UTC
I love the "low tech" way of finding out the owner process of the message box. Now you are making me wonder if there is a "high tech" way of finding it out.
Thursday, September 20, 2007 4:39:15 PM UTC
vbNullString -- I use procexp. There's a little target on the main toolbar. you can drag it to any window and let go, and procexp will come back with focus on the process that owned the window.
c
Sunday, September 23, 2007 5:27:35 AM UTC
Low tech find proc...

Yep, the best way I know is using process monitor from SysIntern... er Microsoft. Use the window finder tool. Download here:
http://www.microsoft.com/technet/sysinternals
Lou
Comments are closed.

Disclaimer: The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.