DDSet_Error: Failed to install assembly 'c:WINNTMicrosoft.NETFrameworkv2.0.50727System.Web.dll' because of system error: Access is denied

While installing a .Net Framework patch, it may fail with the following error message: DDSet_Error: Failed to install assembly 'c:\WINNT\Microsoft.NET\Framework\v2.0.50727\System.Web.dll' because of system error: Access is denied.

From the failure MSI log file, I found the following information:

08/16/11 13:55:41 DDSet_Status: Loading mscoree.dll
08/16/11 13:55:41 DDSet_Status: Loading fusion.dll using LoadLibraryShim()
08/16/11 13:55:43 DDSet_Error: Failed to install assembly c:\WINNT\Microsoft.NET\Framework\v2.0.50727\System.Web.dll. IAssemblyCache->InstallAssembly() returned -2147024891.
08/16/11 13:55:43 DDSet_Error: Failed to install assembly 'c:\WINNT\Microsoft.NET\Framework\v2.0.50727\System.Web.dll' because of system error: Access is denied.

I found the following failure in the ProcMon trace:

1:18:56.1723410 PM MsiExec.exe 2608 1392 0.0009179 CreateFile C:\WINNT\assembly\GACLock.dat ACCESS DENIED Desired Access: Generic Write, Read Attributes, Delete, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Delete On Close, Attributes: T, ShareMode: None, AllocationSize: 0

GACLock.dat is an empty file that is used to mutex access to the GAC. It is created on the fly and should be deleted when the process using it is done GAC’ing a file. Patch install fails because fusion cannot acquire a handle to this file.

1. The file is ACL’ed in a way that prevents the executing process from opening it.

a. Check icacls to ensure SYSTEM has access.

b. To fix either change the ACL or just rename the file then delete it.

2. The file is pending delete and open in some other process.

a. Check open handles with procexp or handle.exe. (Process Explorer tool can be used https://technet.microsoft.com/en-us/sysinternals/bb896653)

b. To fix this either closing the running app, or just rename the file and delete it.

In order to delete the file, try running the following command:del /a:s %windir%\assembly\gaclock.dat

The option /a:s was used because the file attribute was marked as System.