When installing a .MSP file with either the /qb or /qn command lines the patch may not be applied successfully. e.g.

msiexec /p patch.msp /Lv* patch.log /qb

This can be seen in the installer log:

MSI (c) (E0:98) [10:36:49:254]: Client-side and UI is none or basic: Running entire install on the server.
...
MSI (s) (70:94) [10:36:52:942]: SFC: The following entry was not added, because its key is protected by Windows: Key: \CLSID\{00000000-0000-0000-0000-000000000000}\InprocServer32 Name: InprocServer32
MSI (s) (70:94) [10:36:52:942]: SFC: Cannot create the following key due to windows protection: \Software\Classes\TypeLib\{00000000-0000-0000-0000-000000000000}\2.0
...
MSI (s) (70:94) [10:36:55:442]: Product: Product - Update '{00000000-0000-0000-0000-000000000000}' installed successfully.

It may be possible to apply the patch with the /qr option:

msiexec /p patch.msp /Lv* patch.log /qr

Failing that, the Administrator can take ownership from TrustedInstaller and then assign Administrator Full Control permissions to the required resource using takeown/icacls.

Application Compatibility: Windows Resource Protection (WRP)
http://msdn.microsoft.com/en-us/library/bb756998.aspx

Using Windows Installer and Windows Resource Protection
http://msdn.microsoft.com/en-us/library/aa372868.aspx

Supported Resource Replacement Mechanisms
http://msdn.microsoft.com/en-us/library/aa382540.aspx

UILevel Property
http://msdn.microsoft.com/en-us/library/aa372096.aspx

Some Citrix commands do not work correctly in Citrix XenApp 5.0 for Windows Server 2008
http://support.microsoft.com/kb/958652