locked
update issue RRS feed

  • Question

  • Hi

    One of our server 2008 R2 SP1 having a problem with installing Windows updates.

    I did check the failed security updates and i can see that the security update kb4471318 of 12-2018 is not installed on this machine and after that almost all the securtity update also failed.

    I think the best action would be first to install the kb4471318. When I go to the .catalog.update.microsoft.com to download this update and install it manually I can see that there is 2 files to download one. should I download both the .exe file and .msu file and install them both?

    This is what I see when try to download the file:


    Shahin

    Monday, September 16, 2019 1:42 PM

Answers

  • Hi Shahin,
      

    Yes, as I suggested at the outset, the order of updates should be: KB4490628 -> KB4474419 -> KB4516655.
      

    I think KB4490628 is a critical SSU and it may determine whether subsequent updates can be successfully installed. And please note that KB4490628 is best to approve the installation separately, which means that you should not approve other updates at the same time, otherwise it will not be installed successfully.
      

    Hope the above can help you.
      

    Regards,
    Yic

    Please remember to mark as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by Shahin Thursday, October 3, 2019 8:12 AM
    Wednesday, September 25, 2019 6:15 AM

All replies

  • This tool automatically fixed system consistencies and compatibility issues thus ensuring a smooth update process.

    Refer this for more info,

    https://www.computerworld.com/article/3268942/you-won-t-believe-why-the-win7-monthly-rollup-kb-4093118-keeps-installing-itself.html

    Refer this Official doc,

    https://support.microsoft.com/en-us/help/4499164/windows-7-update-kb4499164

    Administrators should ensure that any one or more of the Monthly rollups released between April 10, 2018 (KB4093118) and March 12, 2019 (KB4489878) have been installed prior to installing April 2019 and later updates. Each of these rollup updates includes PciClearStaleCache.exe.

    Monday, September 16, 2019 1:59 PM
  • Thanks for your reply,

    I did check my server 2008 R2 and can see the KB4093118 has been installed but KB4489878 is not on my system and in your artical I cannot find anything mentioned aobut this update for server 2008R2.On this server we see 2 updates  kb4471318 from 11-2018 and kb4471318 12-2018 before to other failed updates.


    Shahin

    Also why this update has 2 parts to download the pciclearstabelcache.exe ans msu file? should we just install the msu part?
    • Edited by Shahin Monday, September 16, 2019 2:37 PM
    Monday, September 16, 2019 2:15 PM
  • You can install or ignore it.(PciClearStaleCache)

    If your server is VM or Updates have not been installed on it since March, 2018,

    below mentioned symptoms may be happened. It's depend on your update history.

    According to that MS article,

    If you want to install latest updates after April, 2019,

    you have to ensure installing updates which have been released  between April 10, 2018 and March 12, 2019.

    Refer this for update release history (https://support.microsoft.com/en-us/help/4009469)

    Read this part. 

    Starting with KB4493472 Monthly Rollup updates will no longer include PciClearStaleCache.exe. This installation utility addressees inconsistencies in the internal PCI cache. This can cause the symptoms listed below when installing monthly updates that do NOT include PciClearStaleCache:

    • Existing NIC definitions in control panel networks may be replaced with a new Ethernet Network Interface Card (NIC) but with default settings. Any custom settings on the previously NIC persist in the registry but were unused.
    • Static IP address settings were lost on network interfaces.
    • Wi-Fi profile settings were not displayed in the network flyout.
    • WIFI network adapters were disabled

    These symptoms are especially common on guest virtual machines and on machines which have not been updated since March, 2018.

    Administrators should ensure that any one or more of the Monthly rollups released between April 10, 2018 (KB4093118) and March 12, 2019 (KB4489878) have been installed prior to installing April 2019 and later updates. Each of these rollup updates includes PciClearStaleCache.exe.

    Monday, September 16, 2019 3:28 PM
  • I think the best action would be first to install the kb4471318. When I go to the .catalog.update.microsoft.com to download this update and install it manually I can see that there is 2 files to download one. should I download both the .exe file and .msu file and install them both?

    Hi Shahin,
      

    The "pciclearstalecache" program appeared in the Monthly rollups released between April 10, 2018 and March 12, 2019 to resolve the internal PCI cache issue. According to your description, if you can confirm that the Monthly rollup released from April 2018 to December 2018 has been installed through Windows Update, you do not need to download the "pciclearstalecache" program separately.
      

    But if you are not sure, I suggest you choose to install.
      

    Regards,
    Yic

    Please remember to mark as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, September 17, 2019 1:24 AM
  • Hi yic,

    I can see that all of the monhly updates from April 2018 untill December 2018 is installed, it look like problem is starting at the start of 2019 no update has been installed, I said this because I can see that at 25-07-2019 update KB3019978 has been failed but strangely enough this is en update of 12-2015 and after this update I can see one monthly update from March and one from July! that both have been failed.

    Any suggestion on how to correct this?

    Thanks


    Shahin

    Tuesday, September 17, 2019 9:11 AM
  • Hi Shahin,
      

    My advice is to install the latest Servicing Stack Updates for your server, available at: "ADV990001 | Latest Servicing Stack Updates".
       

    After the Servicing Stack Updates are deployed normally, please install the monthly cumulative update again and check for success.
       

    Regards,
    Yic


    Please remember to mark as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, September 18, 2019 2:18 AM
  • Does this Serviceing update will help with other not installed updates as well? I can see that installing serviceing update 4516655 has failed with automatic updates. I also can see that monthly update KB4512506 and KB4516065 is also failed.

    Shahin

    update,

    installing the servicing update KB4516655 manually failed!

    I did hide all of the updates and then check for updates and this time saw the KB4516655 and tried to install it but get error code 80092004

    We did disable the AV on the server and the same error




    • Edited by Shahin Wednesday, September 18, 2019 12:55 PM
    Wednesday, September 18, 2019 11:45 AM
  • Does this Serviceing update will help with other not installed updates as well?

    I think the newer SSU is a must, so this should be related to the inability to install recent updates.
         

    installing the servicing update KB4516655 manually failed!

    I did hide all of the updates and then check for updates and this time saw the KB4516655 and tried to install it but get error code 80092004

    We did disable the AV on the server and the same error

    This seems to be related to the change of the signature of the update package from SHA-1 to SHA-2.
    I recommend, please install the following updates to add support for SHA-2:
      

    • KB4490628 - Servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1: March 12, 2019
    • KB4474419 - SHA-2 code signing support update for Windows Server 2008 R2, Windows 7, and Windows Server 2008: August 13, 2019
        

    If one of these is not installed, SHA-2 signed updates won't be accepted and the error is thrown instead.
    Reply back with the results would be happy to help.
       

    Regards,
    Yic

    Please remember to mark as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, September 19, 2019 2:18 AM
  • Before installing the last 2 updates you mentioned, I would like to know if installing the updates that would change SHA-2 code signing will have effect the server itself? I ask this becuase this is a webserver. Or this code signing has something to do with MS pakages of updates?

    Thanks


    Shahin

    Also it looks like that update KB4516655 has already replace the KB4490628, should we anyway try to install it? or just install the KB4474419 and after install the KB4516655


    • Edited by Shahin Thursday, September 19, 2019 8:20 AM
    Thursday, September 19, 2019 8:16 AM
  • Hi Shahin,
      

    Before installing the last 2 updates you mentioned, I would like to know if installing the updates that would change SHA-2 code signing will have effect the server itself? I ask this becuase this is a webserver. Or this code signing has something to do with MS pakages of updates?

    As for the SHA-1 to SHA-2 changes, I think this is for Windows updates. But in order not to cause unnecessary accidents, a backup is the best solution.
       

    Running legacy operating system versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) requires SHA-2 code signing support by July 2019, and any device without SHA-2 support will not be available in 2019. Windows updates are available after July. For a detailed explanation of this policy change, please refer to: "2019 SHA-2 Code Signing Support requirement for Windows and WSUS".
       

    Also it looks like that update KB4516655 has already replace the KB4490628, should we anyway try to install it? or just install the KB4474419 and after install the KB4516655

    Since you mentioned that the KB4516655 installation was not successful, and I noticed that the KB4516655 is a single SHA-2 signed SSU, and the KB4490628 uses SHA-1 and SHA-2 dual signature, I recommend to complete the installation of KB4490628 first. Then proceed to the installation of KB4474419.
    If there is no problem with KB4490628 & KB4474419 installation, you can consider (I recommend) and then install KB4516655.
       

    Hope the above can help you.
       

    Regards,
    Yic

    Please remember to mark as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, September 19, 2019 9:56 AM
  • Hi Yic,

    Thaks again for your reply,

    My server is a VM and I will first backup this machine.

    Regarding the KB4474419, when try to download it from, see multiple server 2008 R2 files one is from 12-08 and one is from 09-09 which one should instal?

    https://www.catalog.update.microsoft.com/Search.aspx?q=KB4474419


    Shahin


    • Edited by Shahin Thursday, September 19, 2019 1:00 PM
    Thursday, September 19, 2019 10:55 AM
  • Hi Shahin,
      

    According to this updated KB article, the 09-09 update fixes some known issues, so I recommend choosing an update that is later in the release date.
      

    • This security update was updated September 10, 2019 to include boot manager files to avoid startup failures on x64-based versions of Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2. (KB article)
         
    Regards,
    Yic

    Please remember to mark as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, September 20, 2019 12:55 AM
  • Hi Yic,

    I did install the KB4474419 successfully on the server and I will reboot the server and will run the failed updates again and keep you posted.


    Shahin

    Monday, September 23, 2019 2:10 PM
  • Hi Yic,

    We did reboot the server and I can see that update has been installed, and I also see that the servicing update  KB4516655 was also tried to install automatically ( even it should not do that ) but it failed.

    Should I go ahed with install servicing update KB4490628 before installing the KB4516655?

    Thanks


    Shahin

    Tuesday, September 24, 2019 7:45 AM
  • Hi Shahin,
      

    Yes, as I suggested at the outset, the order of updates should be: KB4490628 -> KB4474419 -> KB4516655.
      

    I think KB4490628 is a critical SSU and it may determine whether subsequent updates can be successfully installed. And please note that KB4490628 is best to approve the installation separately, which means that you should not approve other updates at the same time, otherwise it will not be installed successfully.
      

    Hope the above can help you.
      

    Regards,
    Yic

    Please remember to mark as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by Shahin Thursday, October 3, 2019 8:12 AM
    Wednesday, September 25, 2019 6:15 AM
  • Thank you Yic for all your help.

    Shahin

    Thursday, October 3, 2019 8:12 AM