locked
WSUS fails to download Windows 10 upgrade files RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    1
    Sign in to vote

    Hi,

    Im approving the Windows 10 1511 upgrades on WSUS - Server 2012R2.

    Single WSUS server synching directly with MS and storing updates locally.

    The Windows 10 upgrades keep failing to download though so i cant actually deploy them to my Windows 10 group for upgrade from Win 7.

    I approve the update  "Upgrade to Windows 10 Pro, version 1511, 10586 - en-gb, Retail for my Windows 10 computer group.

    It starts downloading then about 5 minutes later will come up with:

    The files for this update failed to download. 
    The update can be approved but will not be available to computers until the download is complete. Click retry download to start the download again.


    The following is logged in the event log:

    Content file download failed.
    Reason: File cert verification failure. 
    Source File: /d/upgr/2015/12/10586.0.151029-1700.th2_release_clientpro_ret_x64fre_en-gb_4609bbb28b8638ba63df922e68ae75a77434df64.esd 
    Destination File: S:\WSUS Content\WsusContent\64\4609BBB28B8638BA63DF922E68AE75A77434DF64.esd

    Ive tried rebooting the server and running the server clean up wizard but i cant clear the above error cycle.

    Anybody any ideas?

    Thanks


    • Edited by Fulgent Monday, January 11, 2016 11:00 AM
    Monday, January 11, 2016 10:59 AM

Answers

  • Question
    Sign in to vote
    1
    Sign in to vote
    Hi

    Windows 10 Pro Retail:

    Requested file 10586.0.151029-1700.th2_release_CLIENTPRO_RET_x64fre_en-us.esd has no decrypt information

    Windows 10 Pro Volume Licensed:

    Requested file 10586.0.151029-1700.th2_release_CLIENTEducation_VOL_x64fre_en-us.esd has no decrypt information

    This error occurs if you have applied the KB3095113 after ticking the Upgrades Classification on 2012 or 2012 r2 Server. When you tick the Upgrades Classification WSUS downloads metadata about the available Upgrades into the SUSDB WSUS Database. If the hotfix isn't applied first this data is not stored correctly in the SUSDB Database and is unusable.

    To fix this you need to delete the information about the Upgrades from the SUSDB Database.

    See http://blogs.technet.com/b/wsus/archive/2015/12/04/important-update-for-wsus-4-0-kb-3095113.aspx?pi47623=7#pi47623=7#comments (Sorry I can't make this a hyper-link as I have only just created this account).

    In the Comments Section there is a post "This Drove me Mad" 26 Jan 2016 4:28 PM which explains how to delete these unusable entries from your SUSDB Database. This information is provided without warranty and you should take all necessary precautions if following it.

    I have followed the instructions posted by "This Drove me Mad" and "FCW" from this Blog on my production WSUS 2012 Server and it fixed this problem for me.

    I have just successfully Upgraded a Windows 10 RTM 10240 PC to th2 1511 10586 via WSUS so this was the last problem I needed to solve to get it to work.
    • Proposed as answer by Kuba_L Wednesday, January 27, 2016 3:14 PM
    • Marked as answer by Fulgent Friday, February 5, 2016 1:07 PM
    Wednesday, January 27, 2016 7:07 AM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Same issue here.

    Content file download failed.
Reason: File cert verification failure. 
Source File: /d/upgr/2015/12/10586.0.151029-1700.th2_release_clienteducation_vol_x64fre_en-us_d323df11892182823610ecc72a6871b836b7a833.esd 
Destination File: E:\WSUS\WsusContent\33\D323DF11892182823610ECC72A6871B836B7A833.esd


    Update: Installing Hotfix 3095113 and adding a mimetype for .esd to IIS on the WSUS server fixed this issue. Clients are able to download the update but cannot install it. They return an error: Requested file 10586.0.151029-1700.th2_release_CLIENTEducation_VOL_x64fre_en-us.esd has no decrypt information


    2016/01/11 11:45:57.6754161 9116  6232  Handler         * START *   Windows Setup Install
    2016/01/11 11:45:57.6754165 9116  6232  Handler         Updates to install = 1
    2016/01/11 11:45:57.6773597 9116  6232  Handler         Starting Windows Setup with command line = C:\Windows\SoftwareDistribution\Download\a27eddd1fab9eb9faba5b83b39121205\WindowsUpdateBox.exe" /ClassId 4a075626-3ec1-4185-b02f-40c8460997d4 /ReportId {E5522A92-1491-4B11-871A-8B425043C3B3}.200 "
    2016/01/11 11:45:57.6773605 9116  6232  Handler         HandlerSecsInADay = 86400.
    2016/01/11 11:45:57.6773613 9116  6232  Handler         Registering WinSetup COM server as CLSID {4A075626-3EC1-4185-B02F-40C8460997D4} and APPID {8028FA73-9E1D-45ED-B5F4-1775C8BA301F}
    2016/01/11 11:45:57.6788787 9116  6232  Handler         Successfully registered WinSetup COM server as CLSID {4A075626-3EC1-4185-B02F-40C8460997D4}
    2016/01/11 11:45:59.1116953 9116  5004  Handler         Requested file 10586.0.151029-1700.th2_release_CLIENTEducation_VOL_x64fre_en-us.esd has no decrypt information
    2016/01/11 11:45:59.2386324 9116  6232  Handler         Installer completed. Process return code = 0x8007007E, result = 0x8007007E, callback pending = False
    2016/01/11 11:45:59.2388578 9116  6232  Handler         Exit code = 0x8007007E
    2016/01/11 11:45:59.2388594 9116  6232  Handler         * END *   Windows Setup Install



    • Edited by wirt's leg Monday, January 11, 2016 5:16 PM
    Monday, January 11, 2016 3:58 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    details from SoftwareDistribution log on the wsus server

    2016-01-11 11:36:02.895 UTC	Info	WsusService.26	ContentSyncAgent.ProcessBITSNotificationQueue	ContentSyncAgent recieved Transferred Event for Item: 09fc48d7-13d2-42d4-937f-86890caebd2e
2016-01-11 11:36:02.897 UTC	Info	WsusService.26	ContentSyncAgent.ContentSyncSPFireStateMachineEvent	ContentSyncAgent firing Event: FileDownloaded for Item: 09fc48d7-13d2-42d4-937f-86890caebd2e
2016-01-11 11:36:02.933 UTC	Info	WsusService.26	ContentSyncAgent.VerifyCRC	filelocalpath is S:\WSUS Content\WsusContent\95\C37C73A38AD4167153008CAAC82D9375983E7695.esd, additionalHash is 3205B7761EAAEDC6F7F14787AC047FB3F5F9CCC33279A3B46DD97F31CF1908DD
2016-01-11 11:36:07.655 UTC	Info	WsusService.26	ContentSyncAgent.VerifyCRC	calculated sha1 hash is C37C73A38AD4167153008CAAC82D9375983E7695
2016-01-11 11:36:07.656 UTC	Info	WsusService.26	ContentSyncAgent.VerifyCRC	matched sha1 hash
2016-01-11 11:36:18.551 UTC	Info	WsusService.26	ContentSyncAgent.VerifyCRC	calculated sha2 sha256 hash is 3205B7761EAAEDC6F7F14787AC047FB3F5F9CCC33279A3B46DD97F31CF1908DD
2016-01-11 11:36:18.552 UTC	Info	WsusService.26	WsusTestKeys.PerformCheck	autest.cab signature is invalid
2016-01-11 11:36:18.552 UTC	Info	WsusService.26	WsusTestKeys.AreTestKeysAllowed	Server test key check: test keys are NOT allowed
2016-01-11 11:36:18.562 UTC	Info	WsusService.26	CabUtilities.CheckCertificateSignature	File cert verification failed for S:\WSUS Content\WsusContent\95\C37C73A38AD4167153008CAAC82D9375983E7695.esd with 2148204547
2016-01-11 11:36:18.658 UTC	Warning	WsusService.26	ContentSyncAgent.ProcessBITSNotificationQueue	Invalid file deleted: S:\WSUS Content\WsusContent\95\C37C73A38AD4167153008CAAC82D9375983E7695.esd
2016-01-11 11:36:18.658 UTC	Info	WsusService.26	ContentSyncAgent.ContentSyncSPFireStateMachineEvent	ContentSyncAgent firing Event: FileVerificationFailed for Item: 09fc48d7-13d2-42d4-937f-86890caebd2e
2016-01-11 11:36:18.666 UTC	Info	WsusService.26	EventLogEventReporter.ReportEvent	EventId=364,Type=Error,Category=Synchronization,Message=Content file download failed.
Reason: File cert verification failure. 
Source File: /d/upgr/2015/12/10586.0.151029-1700.th2_release_clientpro_ret_x86fre_en-gb_c37c73a38ad4167153008caac82d9375983e7695.esd 
Destination File: S:\WSUS Content\WsusContent\95\C37C73A38AD4167153008CAAC82D9375983E7695.esd
2016-01-11 11:36:18.669 UTC	Info	WsusService.26	EventLogEventReporter.ReportEvent	EventId=364,Type=Error,Category=Synchronization,Message=Content file download failed.
Reason: File cert verification failure. 
Source File: /d/upgr/2015/12/10586.0.151029-1700.th2_release_clientpro_ret_x86fre_en-gb_c37c73a38ad4167153008caac82d9375983e7695.esd 
Destination File: S:\WSUS Content\WsusContent\95\C37C73A38AD4167153008CAAC82D9375983E7695.esd
2016-01-11 11:36:18.674 UTC	Info	WsusService.26	ContentSyncAgent.WakeUpWorkerThreadProc	ContentSyncAgent found no more Jobs, going to Sleep for BITS Notifications

    So it appears it tripping up here:

    2016-01-11 11:36:18.552 UTC	Info	WsusService.26	WsusTestKeys.PerformCheck	autest.cab signature is invalid
2016-01-11 11:36:18.552 UTC	Info	WsusService.26	WsusTestKeys.AreTestKeysAllowed	Server test key check: test keys are NOT allowed

    Still none the wiser after googling for an hour though of how to sort.

    Tuesday, January 12, 2016 11:17 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Currently with Microsoft PSS - they got no clue either! :(
    Tuesday, January 19, 2016 3:49 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    same issue here. I have the hotfix applied on WSUS (2012 R2 server) and MIME added for esd type, windows 10 updates are downloaded and approved, but clients cannot install them, windowsupdate.log says "Requested file 10586.0.151029-1700.th2_release_CLIENTEducation_VOL_x64fre_en-us.esd has no decrypt information"

    Any idea how to fix it?

    Thursday, January 21, 2016 7:32 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    Could you directly download the patch from MS site & try to install on the system manually. so that problem can be determined either system or wsus.

    Regards, Krselva. Please remember to mark the replies as answers if its helps you, and unmark the answers if it is not help you.

    Friday, January 22, 2016 12:10 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    Could you directly download the patch from MS site & try to install on the system manually. so that problem can be determined either system or wsus.

    Regards, Krselva. Please remember to mark the replies as answers if its helps you, and unmark the answers if it is not help you.

    Hi Krselva, that is a good point. I'd like to download that very same patch from MS server and see if that goes through manually. Any idea where can I get the one matching this name below?

    10586.0.151029-1700.th2_release_CLIENTEducation_VOL_x64fre_en-us

    I actually have 10 more clients that run Professional retail editions of Win 10 already and they fail the same way when trying to install 1511 upgrade from WSUS, same kind error:

    "Requested file 10586.0.151029-1700.th2_release_CLIENTPRO_RET_x64fre_en-us.esd has no decrypt information"

    We do not approve the upgrade of the rest of workstations we have (around 40) from Windows 7 to 10 until the upgrade process over WSUS is reliable and confirmed working.


    • Edited by Kuba_L Friday, January 22, 2016 3:59 PM
    Friday, January 22, 2016 3:17 PM
  • Question
    Sign in to vote
    1
    Sign in to vote
    Hi

    Windows 10 Pro Retail:

    Requested file 10586.0.151029-1700.th2_release_CLIENTPRO_RET_x64fre_en-us.esd has no decrypt information

    Windows 10 Pro Volume Licensed:

    Requested file 10586.0.151029-1700.th2_release_CLIENTEducation_VOL_x64fre_en-us.esd has no decrypt information

    This error occurs if you have applied the KB3095113 after ticking the Upgrades Classification on 2012 or 2012 r2 Server. When you tick the Upgrades Classification WSUS downloads metadata about the available Upgrades into the SUSDB WSUS Database. If the hotfix isn't applied first this data is not stored correctly in the SUSDB Database and is unusable.

    To fix this you need to delete the information about the Upgrades from the SUSDB Database.

    See http://blogs.technet.com/b/wsus/archive/2015/12/04/important-update-for-wsus-4-0-kb-3095113.aspx?pi47623=7#pi47623=7#comments (Sorry I can't make this a hyper-link as I have only just created this account).

    In the Comments Section there is a post "This Drove me Mad" 26 Jan 2016 4:28 PM which explains how to delete these unusable entries from your SUSDB Database. This information is provided without warranty and you should take all necessary precautions if following it.

    I have followed the instructions posted by "This Drove me Mad" and "FCW" from this Blog on my production WSUS 2012 Server and it fixed this problem for me.

    I have just successfully Upgraded a Windows 10 RTM 10240 PC to th2 1511 10586 via WSUS so this was the last problem I needed to solve to get it to work.
    • Proposed as answer by Kuba_L Wednesday, January 27, 2016 3:14 PM
    • Marked as answer by Fulgent Friday, February 5, 2016 1:07 PM
    Wednesday, January 27, 2016 7:07 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Hi

    Windows 10 Pro Retail:

    Requested file 10586.0.151029-1700.th2_release_CLIENTPRO_RET_x64fre_en-us.esd has no decrypt information

    Windows 10 Pro Volume Licensed:

    Requested file 10586.0.151029-1700.th2_release_CLIENTEducation_VOL_x64fre_en-us.esd has no decrypt information

    This error occurs if you have applied the KB3095113 after ticking the Upgrades Classification on 2012 or 2012 r2 Server. When you tick the Upgrades Classification WSUS downloads metadata about the available Upgrades into the SUSDB WSUS Database. If the hotfix isn't applied first this data is not stored correctly in the SUSDB Database and is unusable.

    To fix this you need to delete the information about the Upgrades from the SUSDB Database.

    See http://blogs.technet.com/b/wsus/archive/2015/12/04/important-update-for-wsus-4-0-kb-3095113.aspx?pi47623=7#pi47623=7#comments (Sorry I can't make this a hyper-link as I have only just created this account).

    In the Comments Section there is a post "This Drove me Mad" 26 Jan 2016 4:28 PM which explains how to delete these unusable entries from your SUSDB Database. This information is provided without warranty and you should take all necessary precautions if following it.

    I have followed the instructions posted by "This Drove me Mad" and "FCW" from this Blog on my production WSUS 2012 Server and it fixed this problem for me.

    I have just successfully Upgraded a Windows 10 RTM 10240 PC to th2 1511 10586 via WSUS so this was the last problem I needed to solve to get it to work.

    Awesome guidelines!!! Thanks for that blog link, Without Prejudice!

    Posting clickable link for easy access: http://blogs.technet.com/b/wsus/archive/2015/12/04/important-update-for-wsus-4-0-kb-3095113.aspx?pi47623=7#pi47623=7#comments

    Tried that, all worked well for me with Management Studio SP4 x64, waiting until win10 upgrade files get re-downloaded and will post back with the outcome :)

    So, based on what I did and what I read, looks like enabling the Upgrades category and syncing the db before applying the hotfix to WSUS corrupts the win10 patches... then above steps outlined in linked blog comments are necessary to fix it... interesting ...
    • Edited by Kuba_L Wednesday, January 27, 2016 8:51 PM
    • Proposed as answer by Lordick Wednesday, April 5, 2017 1:58 AM
    • Unproposed as answer by Lordick Wednesday, April 5, 2017 1:58 AM
    Wednesday, January 27, 2016 6:56 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Posting back, problem is SOLVED after following linked steps above. Got first workstation upgraded successfully to 1511 over WSUS.

    Worth noting however, in my case, I actually had to reset the catroot2 and SoftwareDistribution folders on client PC, otherwise it was trying to re-use the old files which I think were corrupted too, because installation was throwing an error related to Custom software/patch category (we don't have such) on WSUS.

    Another issue, Windows 10 upgrade problem though, is that we have to uninstall the McAfee SaaS anti-virus before upgrading, otherwise installation can't proceed and installer complains about it.

    Thursday, January 28, 2016 6:53 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    same issue here. I have the hotfix applied on WSUS (2012 R2 server) and MIME added for esd type, windows 10 updates are downloaded and approved, but clients cannot install them, windowsupdate.log says "Requested file 10586.0.151029-1700.th2_release_CLIENTEducation_VOL_x64fre_en-us.esd has no decrypt information"

    Any idea how to fix it?

    I was having the same problem except the upgrade was only working with about 20% of my Windows 10 clients. Naturally, my first few test PCs worked great. Once I applied the the upgrade to production PCs, they started failing left and right with that decrypt error.

    The only reliable fix that I have found is to reset the Windows Update components on the client using this method, deleting the C:\$Windows.~BT folder, then restarting the client. Once it comes back up, it is able to install the upgrade via WSUS.

    It may be worth mentioning that I did not check the Upgrades classification before installing the hotfix. I remade my WSUS server just so I could run the Windows 10 upgrades (my WSUS was on Server 2008 R2 previously). Luckily I don't have too many clients on build 10240 so I don't have to fix very many PCs. However, I will more thoroughly test the next build before applying it to production PCs.

    • Proposed as answer by kentpo Thursday, October 31, 2019 3:10 PM
    Thursday, January 28, 2016 9:32 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Deleting the C:\$Windows.~BT folder working fine

    Thursday, October 31, 2019 3:10 PM