locked
.NET Framework updates say they install, but keep prompting after reboot RRS feed

  • Question

  • I'm trying to install these latest .net framework security updates that were released on June 12th.  On 3 different PCs so far, I install the updates(KB2656369, KB2686828. KB2656368, KB2686827) and according to windows, they install successfully. Upon reboot, I again get prompted to install them by automatic updates. If I go to the microsoft update site, they again appear as updates I need to install.

    I haven't tried on any other PCs, as I figured 3 was enough to determine this might be a global issue.

    How can I ensure that these updates are installed while preventing them from popping up and informing me that I need to update?

    Thanks!

    Wednesday, June 13, 2012 6:10 PM

Answers

  • I have tried many things to resolve this issue, and only one thing has:

    http://www.microsoft.com/en-us/download/details.aspx?id=30135

    When it does the repair of the .net framework, it actually download the original installs from MS, and repairs them properly.  Just going into add/remove programs and telling .Net Framework to repair did NOT fix the re-offer of updates.  But having this tool do the repair did.

    Friday, March 22, 2013 8:11 PM

All replies

  • I'm having the same problem.  Over and over.
    Thursday, June 14, 2012 4:47 AM
  • Check these links:


    .NET Framework Cleanup Tool User's Guide

    http://blogs.msdn.com/b/astebner/archive/2008/08/28/8904493.aspx

    Windows Update or Microsoft Update repeatedly offers the same update

    http://support.microsoft.com/kb/910339

    Thursday, June 14, 2012 6:06 AM
  • Check this link see might help.

    http://support.microsoft.com/kb/976982


    willockss

    Thursday, June 14, 2012 9:38 AM
  • Thanks for the help guys! I ended up completely uninstalling all versions of the .net framwork, re-installing them and then re-updating. That did the trick. I didn't get a chance to try the microsoft fixit tool for this issue.
    Thursday, June 14, 2012 5:56 PM
  • @skipdog: If the problem got fixed by a full reinstall of the framework(s) then it is likely that a simple repair would have achieved the same result (and faster). It would have also been worthwhile to look at your logs to find the root cause but I guess we have lost that opportunity. But good to know that your problem is resolved.

    @terry92104: if you are sill facing reoffer issues with any of these .NET update by connecting to MU, then .NET Framework Setup team can help investigate this further by looking into the install logs from your machine. You can get the detailed logs from your machine by running the log collection utility, from elevated command prompt, from here: http://www.microsoft.com/download/en/details.aspx?id=12493.

    The tool produces a cab (%TEMP%\vslogs.cab) which you can send to:netfxsetup_at_microsoft_dot_com(Alias: netfxsetup).

    Thanks, 


    Vivek Mishra - MSFT


    Saturday, June 16, 2012 2:57 AM
  • Hi Vivek. I am encountering the same problem on both a Windows XP SP3 installation and a Server 2003 R2 x64 Standard machine with KB2656369. Both are obtaining updates through WSUS if it's of any relevance. I can't afford to play around too much on the Server 2003 installation as it's a business machine, but on the XP machine, I ran the .NET cleanup utility for all versions of .NET and then re-obtained them through MU - the issue still persists. I had this issue with a few other updates relating to .NET but the cleanup tool sorted those out. I am running the log collection tool now as I'm typing this... Hopefully I, and the many others facing this issue can find some resolution.
    Sunday, June 17, 2012 1:29 PM
  • I have sent the vslogs.cab file on to the e-mail address you supplied. I will let you all know the outcome.

    Since my post, another XP SP3 machine is showing the same issue with the same update. Weird. Starting to think this is a lot more wide-spread than I initially thought.

    Sunday, June 17, 2012 1:58 PM
  • Didn't notice this before... For both the x86 and x64 editions of KB2656369, on WSUS it states: "The selected update has expired and cannot be approved for installation. It is recommended that you decline this update"

    Does this mean the updates have been found broken and expired accordingly? They are still showing up as needed by the computers on WSUS.

    Sunday, June 17, 2012 3:57 PM
  • Hello.  Yes, I am still having my problem with reoffer on these KB's.  I have run the install logs from my machine using the link you provided.  I have sent the file to the address you gave.  I didn't uninstall my .NET framework nor run the cleanup tool.  Both KB's appear in my add/remove listing.  The MU KB's show as 0kb in size.  Make me wonder why it would want to update my .NET with a 0kb file.
    Sunday, June 17, 2012 5:45 PM
  • I believe patch issues you may refer to some of the earlier article on how you can resolve this. :)

    use MBSA to re-download the patch and install.


    Guowen Su
    Cisco Certified Network Associate
    Cisco Certified Internetwork professional - MPLS
    Certified Information Systems Security Professional
    Microsoft Partner Network 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator:Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator
    Certified Ethical Hacker
    Computer Hacking Forensics Investigator
    Certified Sonicwall Security Administrator
    Microsoft Geeks

    • Proposed as answer by Soh.M Monday, June 18, 2012 10:11 AM
    Monday, June 18, 2012 10:11 AM
  • Thanks. I'll give it a bash, but I really don't see why MBSA should be necessary for this... IMHO the updates should install happily without it. The fact that the update is listed in add/remove programs is the bit that really throws me.
    Monday, June 18, 2012 10:57 AM
  • @Grim.Fandango: The update KB2656369 was originally released in Apr (v1) and then it was fixed for a known issue and re-released in Jun (v2). The v1 update has been expired by MU, as it is no longer required and only the v2 update is relevant going forward.

    Users connected to MU directly will now only see the v2 update. But for WSUS, system admins should ensure that the v1 update (and all other v1 updates from MS12-025) is also unapproved, if they have not set the automatically decline option in WSUS. If they do not do this then the v1 update will continue to exist in their Enterprise and reoffer on all boxes which have installed the v2 update.


    Vivek Mishra - MSFT

    Tuesday, June 19, 2012 12:30 AM
  • @Guowen Su: I ran MBSA and surprise surprise, everything is perfect except for that dang .NET update.

    As far as I'm aware though, isn't MBSA only what the name describes - an analyzer? I've always thought you couldn't solve any problems with MBSA, just get reports of common vulnerabilities and suggestions if you do have these vulnerabilities open. If all MBSA is going to do is tell me that I'm missing that update, then that doesn't really accomplish anything.

    @Vivek Mishra: I remember reading that... However, the two updates labelled as needed are both release dated 4 June, so I assume those are v2 of the update.

    The only other updates with the same KB in WSUS are two seemingly identical unapproved and unneeded updates for Itanium based computers. The only difference being the one is dated 4 June and expired, and the other is dated the 12 June and would allow for an install (if I needed it).

    On the two updates that are marked as needed, they do not specifically state that they are v2, but I can't find any other expired updates that could be v1 of it. The WSUS server was only put into place this month, so I'm thinking v1 may not even have been synchronized from the MU catalog. Thoughts?

    Tuesday, June 19, 2012 3:00 PM
  • @Grim.Fandango: Can you share the title of the 2 updates you seeing in WSUS that are marked as needed?

    Just for 2656369 the following are the v1 GUIDs, which you can also use to identify the right updates in WSUS console. You need to ensure that the v1 GUIDs are declined (either by syncing from MU OR manually unapproved):

    - Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 and Windows XP x86 (KB2656369)                    bd7d83ad-dc89-4543-a14b-9af14a9d6e53
    - Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 and Windows XP for x64-based Systems (KB2656369)  38a64c04-a886-471c-b8e1-9d99c510b1f6
    - Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 for Itanium-based Systems (KB2656369)             aeca660a-0acd-4b2b-a829-54d21b21b3e0

    Question: Does your Automatic Approvals settings been set to also decline updates automatically as only then v1 GUIDs will expire when syncing from MU?

    Lastly, if you are still facing reoffering issues with the update 2656369 after ensuring your WSUS box has the right approved updates, then we can dive deeper by looking into the logs. You can get the detailed logs from your machine by running the log collection utility, from elevated command prompt, from here:http://www.microsoft.com/download/en/details.aspx?id=12493.

    The tool produces a cab (%TEMP%\vslogs.cab) which you can send to: netfxsetup_at_microsoft_dot_com(Alias:netfxsetup).

    We fixed a reoffering problem, due to inconsistent MSI registration, for terry92104 (in this thread) and if you have a similar issue then we can offer the same solution.

    Thanks,


    Vivek Mishra - MSFT


    Tuesday, June 19, 2012 5:51 PM
  • @Grim.Fandango: Can you share the title of the 2 updates you seeing in WSUS that are marked as needed?

    Just for 2656369 the following are the v1 GUIDs, which you can also use to identify the right updates in WSUS console. You need to ensure that the v1 GUIDs are declined (either by syncing from MU OR manually unapproved):

    - Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 and Windows XP x86 (KB2656369)                    bd7d83ad-dc89-4543-a14b-9af14a9d6e53
    - Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 and Windows XP for x64-based Systems (KB2656369)  38a64c04-a886-471c-b8e1-9d99c510b1f6
    - Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 for Itanium-based Systems (KB2656369)             aeca660a-0acd-4b2b-a829-54d21b21b3e0

    • Spot on! The first two GUIDs (not the itanium) are the ones that are marked as needed on all the 2003/XP computers. I will work on a way to decline these updates, although it will be a tad tricky - I'll explain why now.


    Question: Does your Automatic Approvals settings been set to also decline updates automatically as only then v1 GUIDs will expire when syncing from MU?

    • Actually... Automatic approvals are disabled entirely. I've got automatic synchronizations running every 3 hours, and have WSUS Smart Approve running from the scheduled tasks with no run-set every hour to automate the approval of needed updates only, while I'm in the process of moving the servers over onto WSUS one-by-one. Unfortunately, this is how I want updates to occur, but there was no way to do this purely with WSUS - it was either manually approve all needed updates and ignore the rest -or- set automatic approvals which would pull down absolutely everything. Unfortunately, where I live our bandwidth is not even close to international standards, so this is not plausible and especially seeing as we only have +-10-15 computers (about 5 servers and 5 non-business house computers) pulling updates from WSUS. Unfortunately, the problem this leaves me with now is that any updates I decline/unapprove, will be approved as soon as WSUS Smart Approve runs. I'm pretty sure there is a way to exclude certain updates with a xml config file, but I'll have to take a look through the manuals for WSUS Smart Approve, as this is my first time using it.


    Lastly, if you are still facing reoffering issues with the update 2656369 after ensuring your WSUS box has the right approved updates, then we can dive deeper by looking into the logs. You can get the detailed logs from your machine by running the log collection utility, from elevated command prompt, from here:http://www.microsoft.com/download/en/details.aspx?id=12493.

    • I can do, but I'm sure that declining the update would fix the problem. If I decline the updates, they'll still show up as needed on WSUS, right? Doesn't really matter, just would be nice to have the status of the computers on WSUS as 100% installed so I know when there actually are updates needing installation and not just that computers "need" that one update.

    • One last question... I just found 2 updates on WSUS that look like they may be v2, would you mind confirming for me? The two have a status of installed/not applicable and from the status reports it looks like they are indeed installed on all computers in question:

      Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 and Windows XP for x64 based Systems (KB2656369)
      GUID: e207bd31-3ada-48cc-8cbc-109864bd4ec7

      And

      Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 and Windows XP x86 (KB2656369)
      GUID: 95fc6ed1-ef3e-4e5a-b6c8-184ddf95dafa

    Thanks, seem to be starting to make progress in isolating the issue!




    Tuesday, June 19, 2012 8:18 PM
  • One last question... I just found 2 updates on WSUS that look like they may be v2, would you mind confirming for me? The two have a status of installed/not applicable and from the status reports it looks like they are indeed installed on all computers in question:

    Those are the v2 GUIDs which were released in Jun 2012 and they should remain approved for deployment.

    Thanks,


    Vivek Mishra - MSFT

    Wednesday, June 20, 2012 10:39 PM
  • Vivek,

    I have declined the v1 updates in WSUS and it unmarks it as needed by all the computers - beautiful!

    Thank you!

    This kills two birds with one stone, as WSUS Smart Approve will not approve it if it's marked as not needed. Great! I just wish there was a way to decline an update for only a certain group - there is a PC here that we DO NOT want IE 9 on, but it's either decline update for all computers, or none of them. Sure, I can leave it as not approved for a group, but then WSUS Smart Approve approves it on its next run, and besides, it will still be marked as needed. Bit of a pain in the butt, but I can live with it - I'll just have to remember that 1 computer will always need 1 update. That is irrelevant to this topic though, as the issue is resolved. Thanks again to you and all the others that contributed!

    Note, I have also marked the option that automatically approves new revisions of previously approved updates, as well as automatically declines expired updates - hopefully this will prevent it from ever happening again!

    Wednesday, June 20, 2012 11:10 PM
  • @Grim.Fandango: Good to hear that your problem is resolved!

    As far as WSUS Smart Approve is concerned, it might be worthwhile to post your questions on WSUS forum. They might be able to help you further on this. http://social.technet.microsoft.com/Forums/en-us/winserverwsus/

    Thanks,


    Vivek Mishra - MSFT

    Friday, June 22, 2012 11:22 PM
  • This is a joke! Tons of people are having these problems and spending hours on end trying to fix it.  You would think Microsoft could release a update/patch that would fix all of the problems.  If it needs to remove items then re-install them so be it, but for everyone with this issue running around trying to fix it is a big joke! It seems as though everyone's problems are a bit different which doesn't make sense.  Then Microsoft releases a patch that's no good.

    Next computer is a Macintosh as I'm tired of always having to work on windows based PC's which last around 3-5 years then they run like crap.  And yes that's doing virus scans, de-fragmenting spyware/malware scans.  When you use the add/remove with Microsoft it doesn't remove everything.  Installing software, de-installing software, viruses, malware all damage Microsoft's operating system.

    Tuesday, September 11, 2012 1:40 AM
  • I have tried many things to resolve this issue, and only one thing has:

    http://www.microsoft.com/en-us/download/details.aspx?id=30135

    When it does the repair of the .net framework, it actually download the original installs from MS, and repairs them properly.  Just going into add/remove programs and telling .Net Framework to repair did NOT fix the re-offer of updates.  But having this tool do the repair did.

    Friday, March 22, 2013 8:11 PM