"Server Unavailable" and removed permissions on .NET sites after Windows Update

Our company has five almost identical Windows 2003 servers with the same host, and all but one performed an automatic Windows Update last night without issue. The one that had problems, of course, was the one which hosts the majority of our sites.

What the update appeared to do was cause the NETWORK user to stop having access to the .NET Framework 2.0 files, as the event log was complaining about not being able to open System.Web. This resulted in every .NET site on the server returning "Server Unavailable" as the App Domains failed to be initialise.

I ran aspnet_regiis which didn't appear to fix the problem, so I ran FileMon which revealed that nobody but the Administrators group had access to any files in any of the website folders! After resetting the permissions, things appear to be fine.

I was wondering if anyone had an idea of what could have caused this to go wrong? As I say, the four other servers updated without a problem. Are there any known issues involved with any of the following updates? My major suspect at the moment is the 3.5 update as all of the sites on the server are running in 3.5.

• Windows Server 2003 Update Rollup for ActiveX Killbits for Windows Server 2003 (KB960715)
• Windows Server 2003 Security Update for Internet Explorer 7 for Windows Server 2003 (KB960714)
• Windows Server 2003 Microsoft .NET Framework 3.5 Family Update (KB959209) x86
• Windows Server 2003 Security Update for Windows Server 2003 (KB958687)

Thanks for any light you can shed on this.

From serverfault tags2k

• This french article is related to the ActiveX rollup. This might be related with the issue. Please check if you see that KB in your updates history

  Also, I think that the change from 2.0 to 3.5 reset the permissions (Even if it souldn't...) So both updates could have change the security settings on your server.

  tags2k : Hi r0ca, that KB has been deployed on the server but that was back on 14th November 2008. Is there a potential conflict between KB960715 and KB956844?

  r0ca : I'm not sure that it could have a conflict. Do you all of them deployed?
  From r0ca