none
Do not install 2506143 (optional WMF 3.0 patch) on your SBS 2011

All replies

  • Uninstall it if you have :p

    Issues I've seen so far include errors while creating new users from the SBS console and the Connect to the Internet wizard failing. Removing the update rolls back Powershell to version 2 and fixes those issues though.



    • Edited by CraftyBee Thursday, December 13, 2012 9:04 PM
    Thursday, December 13, 2012 8:49 PM
  • Hi,

    Thanks for the update.

    Should we decline this update and wait for the next release?


    Regards, Rajiv K Khandelwal

    Friday, December 14, 2012 7:37 AM
  • I've declined it. It breaks user account creation at the email part. Don't install it.
    Monday, December 17, 2012 11:57 PM
  • Unfortunately, uninstalling it apparently brings forth another problem - it deletes a registry key that causes problems and errors with your event logs.

    Here is the key that is deleted:  

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\ForwardedEvents

    I had to export the key from another system and install it into the registry of the affected SBS2011 box to restore the ability to view the event logs without error.

    Who knows what else it breaks. 

    This update should be pulled.  NOW!

    Tuesday, December 18, 2012 5:43 PM
  • This update also causes problems with Update Rollup 4 and 5 for Exchange Server 2010 SP2.  If these fail to install, you should be able to successfully deploy them after removing 2506143.
    Wednesday, December 19, 2012 6:51 AM
  • Around 5:40 Pacific time this update was pulled off the update servers.

    Wednesday, December 19, 2012 7:27 AM
    Moderator
  • http://marc.info/?l=patchmanagement&m=135588298213669&w=2

    Thanks to each of you who reported this issue and helped identify the affec=
    ted cases.

    As a result of these regressions and feedback from customers and experts li=
    ke you, we have expired the WMF 3.0 Update for all platforms (Windows 7, Se=
    rver 2008, and Server 2008 R2) as of 5:07 pm PDT.

    2506143 Windows Management Framework 3.0 for Windows 7 (KB2506143)
            Windows Management Framework 3.0 for Windows 7 for x64-based System=
    s (KB2506143)
            Windows Management Framework 3.0 for Windows Server 2008 R2 for x64=
    -based Systems (KB2506143)

    2506146 Windows Management Framework 3.0 for Windows Server 2008 (KB2506146=
    )
            Windows Management Framework 3.0 for Windows Server 2008 for x64-ba=
    sed Systems (KB2506146)

    We're engaged in an internal post-mortem to identify and resolve the issues=
    that led to these updates being released that resulted in the regressions.

    We work hard to ensure updates always release with an exceptionally high qu=
    ality bar.  That bar was not met for these updates and we're working to ens=
    ure we can prevent this from happening again.  Thank you for your feedback =
    through this and other channels - and please keep providing helpful feedbac=
    k so we can continue to improve.


    doug neal
    Microsoft Update (MU)

    Wednesday, December 19, 2012 7:28 AM
    Moderator
  • Unfortunately, uninstalling it apparently brings forth another problem - it deletes a registry key that causes problems and errors with your event logs.

    Here is the key that is deleted:  

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\ForwardedEvents

    I had to export the key from another system and install it into the registry of the affected SBS2011 box to restore the ability to view the event logs without error.

    Who knows what else it breaks. 

    This update should be pulled.  NOW!

    OK, all SBS 2011 VM's have the same problem now. Thanks for tracking this down and for doing Microsofts job!

    All technicans I've talked to, told me that from now on they'll definitely disable automated updates, even important and critical ones. Here we are again with the situation, that now one trusts MS updates anymore. Consequence: security holes open for months.

    Is this registry key generical? Can some upload a ZIP with the .reg file? Or is there any advise on how to restore it?

    Thanks,

    HP

    Thursday, December 20, 2012 4:14 PM
  • How can I find out if this patch has been installed? Is there some way to get a list of installed updates?

    Thanks,

    Dermot

    Friday, December 21, 2012 9:58 AM
  • 1.  Do you remember approving it?

    2. Do you remember manually installing it?  No updates on SBS are auto installed.

    3.  Go into windows update and click on view installed updates.

    Friday, December 21, 2012 3:01 PM
    Moderator
  • I think adding this should solve the problem:

    Windows Registry Editor Version 5.00
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\ForwardedEvents]
    "Enabled"=dword:00000000
    "Isolation"=dword:00000002
    "MaxSize"=dword:01400000
    "MaxSizeUpper"=dword:00000000
    "Type"=dword:00000001
    "OwningPublisher"="+++SYSTEM SPECIFIC+++"
    "ChannelAccess"="+++SYSTEM SPECIFIC+++"

    Two values are system-specific ...

    Get OwningPublisher from:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventCollector/Debug

    Get ChannelAccess from:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Analytic

    Hope this helps

    Michael

    Wednesday, January 02, 2013 11:20 PM
  • I'm stuck with this update on an 2k8SBS box.  So far it will not uninstall; I go through the uninstall and it prompts for a reboot.  Reboot of the server and it shows that updates failed and is rolling back changes.  The server reboots again and KB2506143 is back.  I'm not sure how it got on the server and I'm hoping to have some time with the server tonight to wipe the log's so I can hopefully see what is failing on the removal process and do as many reboots as I need.  Has anyone ran into any uninstall problems with this update?  I see plenty of stuff it breaks and some fixes for those issues, but nothing on removal issues.  Any help would be greatly appreciated.  I'll update this post w/log entries and anything else I find later tonight.

    Thx :)

    Here's the activity from tonight; still no joy.

    Windows SBS 2011 Standard SP1

    Here's what I've done...

    uninstalled kb2506143 via control panel and deleted contents of C:\windows\softwaredistribution\download

    rebooted and received

    Configuring Windows Updates

    then received

    Failure configuring Windows updates Reverting changes

    server reboot automatically

    Received Failure configuring Windows updates Reverting changes but get to login prompt and desktop.

    event viewer shows
    Package KB2506143 failed to be changed to the Absent state. Status: 0xd0000065.

    Next I uninstalled kb2506143 via admin command prompt WUSA.exe /Uninstall /KB:2506143  

    Event Viewer
    Windows update "Microsoft Windows Management Framework 3.0 (KB2506143)" requires a computer restart to finish uninstalling. (Command line: "WUSA.exe  /Uninstall /KB:2506143")
    This computer will restart to finish uninstalling Windows update "Microsoft Windows Management Framework 3.0 (KB2506143)" (Command line: "WUSA.exe  /Uninstall /KB:2506143")

    rebooted and received

    Configuring Windows Updates

    then received

    Failure configuring Windows updates Reverting changes

    server reboot automatically

    Received Failure configuring Windows updates Reverting changes but get to login prompt and desktop.

    event viewer shows the following after this step

    Windows update "Microsoft Windows Management Framework 3.0 (KB2506143)" was successfully uninstalled. (Command line: "WUSA.exe  /Uninstall /KB:2506143")
    (Based on the time stamp I suspect this was logged on the 1st reboot after uninstall.)

    I feel this is from the last reboot.
    Package KB2506143 failed to be changed to the Absent state. Status: 0xd0000065.

    SBS console is still broke when adding a new user when it comes to creation/configuration of e-mail account.
    Powershell get-host still shows 3.0

    attempted SBS Console repair = no joy, received error configuring e-mail.

    Is M$ looking into this KB and a fix for affected SBS and Exchange systems?

    ______________________________________________________________________________________________________________

    Thanks Susan; just for reference for anyone else here is what I've done tonight.

    Downloaded Windows6.1-KB2506143-x64.msu and ran the following under admin command prompt.

    wusa /uninstall C:\KB2506143\Windows6.1-KB2506143-x64.msu

    rebooted and received Configuring Windows Updates then received Failure configuring Windows updates Reverting changes.  The server reboot automatically, Received Failure configuring Windows updates Reverting changes but get to login prompt and desktop.

    Ran the following on the MSU to extract the files

    expand -f:* C:\KB2506143\Windows6.1-KB2506143-x64.msu C:\KB2506143

    Created the C:\Sandbox folder and ran the following command under admin command prompt.

    start /w pkgmgr /m:C:\KB2506143\Windows6.1-KB2506143-x64.cab /up /s:C:\Sandbox

    rebooted and received Configuring Windows Updates then received Failure configuring Windows updates Reverting changes.  The server reboot automatically, Received Failure configuring Windows updates Reverting changes but get to login prompt and desktop.

    I'll be calling M$ tomorrow afternoon as I'm out of idea's.  I'll update my post w/the results from the call, hopefully we can figure this out.

    ____________________________________________________________________________________________________________

    The resolution in this case w/KB2506143 not de-installing properly was to remove the WinRMRemoteWMIUsers__ from Active Directory.  This allowed the KB to be removed successfully.  Confirmed powershell @ ver 2 and corrected the Forward Events event log.

    Tuesday, January 15, 2013 9:39 PM
  • Nuke out the software distribution folder.  SBS 2008 is set to 'download but do not install" so it's stuck in your software distribution folder.
    Tuesday, January 15, 2013 9:42 PM
    Moderator
  • Got the same problems with WMF 3.0: Exchange update didn''t work and forwarded events log was inaccessible.

    Uninstall of WMF did sort out the exchange problem and recovering the registry entry gave me access to the forwarded events log, but the event collector did stop working the day I uninstalled the WMF update.

    Two values are system-specific .
    Get OwningPublisher from:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventCollector/Debug

    This entry doesn't exist in my 2008R2.

    Instead I tried the OwnlingPublisher from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Forwarding/Debug

    I noticed that the winrm service was no longer properly configured, so I reapplied "winrm qc -q" and "wecutil qc /q".

    My subscriptions are still there but marked as "inactive". If I try to enable them I get "File not found". Even if I create new subcriptions the same problem occurs.

    Any ideas how to get event collection up and running again?

    Wednesday, January 16, 2013 10:48 AM
  • I would call support.  This is not something we know how and can't be fixed in a forum. 

    1-800-microsoft, since it was their screw up they will comp the call back.

    Wednesday, January 16, 2013 9:12 PM
    Moderator
  • I would call support.  This is not something we know how and can't be fixed in a forum. 

    1-800-microsoft, since it was their screw up they will comp the call back.

    Not an option for me, cause imho it takes to long to get a qualified response...

    Therefore I did a litte bit more research and compared the whole WINEVT registry branch with an export of a a reference system where WMF 3.0 wasn't applied to.

    I noticed that some other hives related to the EventCollector have been deleted too:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\ForwardedEvents

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventCollector/Debug

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EventCollector/Operational

    Just restore them from an "untouched" referece system to get them listed in the EventLog MMC.

    There is another important entry: The OwningPublisher referenced by above channels has been deleted too. I simply restored

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{b977cf02-76f6-df84-cc1a-6a4b232322b6}

    (owner may be system related!), restarted the EventLog related services and finally I was able to enabled event subscriptions :)

    Shame on microsoft for this ugly WMF update...

    Thursday, January 17, 2013 2:30 PM
  • The point of calling is ensuring that Microsoft sees the impact to the system.  Calling and specifically asking for the SBS team will ensure you get to the right spot.  No one else has reported this many changes to the system and thus it would be beneficial for all impacted customers (not just you) to get official Microsoft eyeballs on your box.
    Thursday, January 17, 2013 3:37 PM
    Moderator
  • I currently have a support case open with Microsoft regarding this.  I escalated it to second level, and when it became clear the Engineer didn't understand the extent of the damage caused by WMF 3.0, I took matters into my own hands.  Coincidentally, I used the exact same procedure outlined by Daniel-Hoegele to repair the ForwardedEvents log/channel and related Event Subscription.  While it has been suggested that the "Owning Publisher" for ForwardedEvents may be system-specific, my GUID was {b977cf02-76f6-df84-cc1a-6a4b232322b6}, the same as Daniel's.  Using an untouched reference server, I found numberous instances where the GUID {b977cf02-76f6-df84-cc1a-6a4b232322b6} was missing on the Event Collector:

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Microsoft-Windows-EventCollector]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\System\Microsoft-Windows-EventCollector]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{b977cf02-76f6-df84-cc1a-6a4b232322b6}]

    Like Daniel, I was able to get everything working again after I exported these keys from the healthy system and merged them with the Reg on the broken server.

    I have articulated all of this very clearly to Microsoft Support; they are currently working with Software Devel to create a hotfix.  So, more to come...

    Wednesday, January 30, 2013 7:48 PM
  • Have these issues been sorted out with SP3 for Exchange?

    Saturday, March 09, 2013 12:10 AM
  • Failure while trying to uninstall KB2506143 from SBS 2011:
    http://support.microsoft.com/kb/2796821/en-us?sd=rss&spid=1163
    Friday, March 15, 2013 4:30 PM
    Moderator
  • Two short updates regarding the WMF 3.0 uninstall issue:

    - MS has released an update regarding the event collector problem: http://support.microsoft.com/kb/2809215

    - If you uninstall WMF 3.0 on a HP Proliant Server, WBEM provider updates will fail and leaving you with a non working System Management Homepage due to a "CompileBaseMOFS" problem. Compiling MOFS seems to be part of the WMF and the only way to get WBEM back working is to install WMF 3.0, install WBEM, remove WMF 3.0 and never again install any WBEM updates...

    Sunday, July 14, 2013 8:55 PM