While installing a .Net Framework patch, it may fail with the following error message: DDSet_Error: Failed to install assembly 'c:\WINNT\Microsoft.NET\Framework\v2.0.50727\System.Web.dll' because of system error: Access is denied.

From the failure MSI log file, I found the following information:

08/16/11 13:55:41 DDSet_Status: Loading mscoree.dll
08/16/11 13:55:41 DDSet_Status: Loading fusion.dll using LoadLibraryShim()
08/16/11 13:55:43 DDSet_Error: Failed to install assembly c:\WINNT\Microsoft.NET\Framework\v2.0.50727\System.Web.dll. IAssemblyCache->InstallAssembly() returned -2147024891.
08/16/11 13:55:43 DDSet_Error: Failed to install assembly 'c:\WINNT\Microsoft.NET\Framework\v2.0.50727\System.Web.dll' because of system error: Access is denied.

I found the following failure in the ProcMon trace:

1:18:56.1723410 PM        MsiExec.exe      2608       1392       0.0009179            CreateFile          C:\WINNT\assembly\GACLock.dat                ACCESS DENIED                Desired Access: Generic Write, Read Attributes, Delete, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Delete On Close, Attributes: T, ShareMode: None, AllocationSize: 0

GACLock.dat is an empty file that is used to mutex access to the GAC.  It is created on the fly and should be deleted when the process using it is done GAC’ing a file. Patch install fails because fusion cannot acquire a handle to this file.

 1.            The file is ACL’ed in a way that prevents the executing process from opening it.

a.            Check icacls to ensure SYSTEM has access.

b.            To fix either change the ACL or just rename the file then delete it.

2.            The file is pending delete and open in some other process.

a.            Check open handles with procexp or handle.exe. (Process Explorer tool can be used http://technet.microsoft.com/en-us/sysinternals/bb896653)

b.            To fix this either closing the running app, or just rename the file and delete it. 

In order to delete the file, try running the following command:  del /a:s   %windir%\assembly\gaclock.dat

The option /a:s  was used because the file attribute was marked as System.