Repeated reinstallation for Forefront Client update after hotfix KB952265


  • I installed KB952265 when it came down from WSUS and it appeared to install successfully. However, my automatic update client now shows the FCS client update (1.0.1703) as a needed update repeatedly. It appears to apply successfully, but automatic updates continues to say it is needed. Anyone else seeing this in the last few days?
    Thursday, July 24, 2008 4:25 PM

All replies

  • Hi

    I have had the same problem before the update was released.  we have disabled the forefront client in WSUS because of this problem and only enable it when we add new machines.  I have not been able to resolve the problem either.  At other sites that I have implemented forefront client security I have not encountered this problem but I do have the problem internally at my company.  I would also appreciate a fix for this problem.


    Thursday, July 31, 2008 12:17 PM
  • Hi

    Ok, what I have found is that there is a forefront client update that was released on the 15th of May 2007 and a newer one that was released on 18 June 2008.  For some reason the old one on my WSUS was approved and the new one was declined.  There are a few ppl here that admin the WSUS so maybe one of them declined that update.

    i will monitor it and see if it resolves the problem.

    Also for more information on this problem check out the following URL:


    Kind Regards

    Thursday, July 31, 2008 12:44 PM
  •  Hi Joan

    sorry to reply so many times in such a short space of time but it appears to have fixed my problem.  So to add some more detail I approved the whole client for approval.  this is not an update to the client but an actualy whole client installation update.  the 1 required to install the FCS client.  This is the client that was released on the 18 of June 2008. 

    Please check which client version you have approved.

    Thursday, July 31, 2008 12:56 PM
  • Hi Robert,

    I'm working on this again and still have the problem. Can you help me identify the full client installation update you're referring to? I don't have any updates showing dated June 18 2008 or any that are identified as the full client. When reinstalling the client, the following updates are applied (excluding definitions): Client Update 1.0.1703.0 and then the problem update -  KB952265.

    I took a look at the Windows Catalog as well to see if I the update you reference was removed/expired and didn't see anything.

    I'd appreciate the help. At this moment, I've declined the KB952265 update until I figured out how to resolve.


    Friday, August 08, 2008 5:23 PM
  • Hi Joan

    What is the date of your client that gets deployed?  Or to be more clear, what is the date of the WSUS update that installs forefront?  Is yours the one that was released on the 15th May 2007?

    Monday, August 11, 2008 9:10 AM
  • Robert,

    The "Client Update for Microsoft Forefront Client Security" update has a release date list in WSUS as October 3, 2007.



    Monday, August 11, 2008 12:49 PM
  • Hi Joan

    I cannot attach a picture of my WSUS update on this forum but on my WSUS 3.0 server I have a "Client update for Microsoft Forefront client security (1.0.1703.0)" that was released on the 18 June 2008. After approving this update and declining the old version the reinstallation problem went away.  This includes problems with the update KB952265, for my enviroment anyway and my customers.

    Are you sure you dont have this update under your declined options?


    Wednesday, August 13, 2008 8:28 AM
  •  Robert,

    I double-checked the 'declined' updates via search and didn't see any full client updates for Forefront.

    I think you're right about not having the correct version, but I can't find any alternative in declined or anywhere else in WSUS.

    I verified by declining the full client update on my WSUS server and uninstalling an FCS client. I then installed an older version of the FCS client via an .msi. I used Microsoft Online for updates (rather than my WSUS)  it appears to be successful. Microsoft Updates doesn't see any more Forefront updates needed and the update is successfully installed. However, it leaves me without a FCS client install update in WSUS.

    If you have any thoughts, I'd appreciate it.


    Friday, August 15, 2008 6:10 PM
  • That is strange that you do not have a newer version. 

    How many WSUS servers do you have?  Is it only the one?  Try clearing the Forefront options and running a Sync.  Then add them again and run a Sync again.  I am searching for an answer to why you dont see the newer client version.  So far no luck but I will check at my other customer sites to see what their version are.  I will let you know.

    Wednesday, August 27, 2008 10:30 AM
  • I was wondering if maybe its something under your product classifications.  Maybe you do not have product updates or something similar enabled.
    Wednesday, August 27, 2008 1:00 PM
  • Hi Joan

    I am not sure if you still having this problem but I helped another guy here on the forums which gave me a bit more insite to the problem.  The latest update of the client is from the 12 August 2008 as far as I remember.  He could not see it either.  So he cleared all the Forefront options in his WSUS server and ran a synch.  He then re-added the forefront options and ran a synch again and Wola, the correct version appeard.  So he then approved it and his problems went away.

    Hope this helps.


    Friday, August 29, 2008 9:16 AM
  • Robert,

    You are absolutely right! I followed the same procedure - removed Forefront from WSUS, ran server cleanup, and added it back. Sure enough the August 2008 full client update was in the 'declined' group. I've approved it. thanks so much for your help with this!!!!

    Friday, August 29, 2008 12:49 PM
  • Hi,

    Looking through the suggestions in this thread I'm still unable to resolve the update-looping of the 18.06.2008 version of "Client Update for Microsoft Forefront Client Security (1.0.1703.0)."

    What is the kb number/url of this 12 August update? I can't find it anywhere. These are the only updates in August according to Update Catalog: kb951951 (SP1) and kb956280 (critical update) - both released 25.08.2008, and bot are installed on clients.

    Is my problem due to the installed SP1 and critical updates of 25.08.2008?

    Morten Ross
    Monday, September 01, 2008 11:28 AM
  • Hi,

    It seems my variation of the problem was due to the "Updates" classification being unchecked/unselected. This being a requirement for FCS, the problem was resolved once checked.

    Morten Ross
    Monday, September 01, 2008 4:29 PM

    For me there were two versions of the problem file (1.0.1703). Declining the older and approving the newer fixed the problem.


    Wednesday, September 03, 2008 10:28 PM
  • I'm having this same problem.  It seems to have started after KB971026.  Are we seeing history repeat itself?  Does anyone have a fix?
    Friday, June 19, 2009 12:38 AM
  • I am getting reports from users that they are being asked repeatedly to install Client Update for Forefront Clent Security (1.0.1703.0) which has also started since KB971026.  Please help
    Friday, June 19, 2009 1:49 AM
  • i also encounter the same problem. it keeps on reinstalling Update 1.0.1702.0, seems to appear only after approving KB971026.

    Need help please.
    Friday, June 19, 2009 5:12 AM
  • We have the same problem after installing KB971026...

    Friday, June 19, 2009 5:39 AM
  • We have this issue too since 2 days back...

    Friday, June 19, 2009 7:56 AM
  • Same problem here after installing KB971026: forefront client install loop on client computers. Has anyone a fix?

    Friday, June 19, 2009 8:10 AM
  • Same here :(. Tried to deny all outdated Updates but didn't help.
    Friday, June 19, 2009 8:17 AM
  • Same problem here aswell!!

    If anyone finds out whats happening please let me know.

    Friday, June 19, 2009 9:01 AM
  • Hello all,
    Started getting same loop this morning.  Anyone manged to fix, any ideas as to cause?

    Friday, June 19, 2009 9:11 AM
  • Same here
    I've checked WSUS but can only find one instance of this package.
    • Edited by HAL07 Friday, June 19, 2009 11:46 AM
    Friday, June 19, 2009 11:14 AM
  • Bump.  Same here.  Just loops back to scanning and offering the initial Forefront installation, as if Forefront CS has been uninstalled.  With KB971026 installed, Windows Update seems to no longer detect the existance of Forefront on your machine.
    "Keep a cool head and always carry a lightbulb."
    Friday, June 19, 2009 11:36 AM

  • Well that's a perfect example why you shouln't auto-approove WSUS updates without testing them. Luckily I managed to cancel the aprooval of KB971026, after I saw what it does, before my users got ahold of it.

    I extracted the offered "Client Update for Microsoft Forefront Client Security (1.0.1703.0)" thingy from C:\windows\system\software distribution download" and it contains the plain old RTM installer - when I run it manually, it says Installation completed successfully.

    It does look like an detection issue, however it only happens when checking with WSUS, and works fine with Microsoft Update.

    Friday, June 19, 2009 12:05 PM
  • I hope you don't mind, but I thought it would help to create a new post about this, as the posts in the last 12hrs relate to a different KB update (KB971026) than referenced in the title of this one:

    Although this article hasn't exactly gone stale, M$ tend to ignore old articles even when they're highly active, so starting a new one might help.

    "Keep a cool head and always carry a lightbulb."
    Friday, June 19, 2009 12:24 PM
  • Please do not spawn new threads on this issue.
    Friday, June 19, 2009 12:43 PM
  • Hi everyone...

    Sorry about this.. They identified this yesterday evening and have been working most of the night trying to get it fixed.  There was an issue with the detection logic for the new update that was released that is causing this reoffer.  From what I understand it has been fixed and is going through testing however I don't have any eta on when it's going to get pushed out through MU->WSUS

    Here are the workarounds that I currently have for this issue:

    1.  Unapprove KB971026 on the WSUS server.  This will not stop systems from being offered the Client Update for Microsoft Forefront Client Security (1.0.1703.0) Package, but will keep systems that do not already have it from running into the issue.


    2.  Unapprove the Client Update for Microsoft Forefront Client Security (1.0.1703.0) Package on the WSUS server.  This will workaround the re-offer issue, however, any new systems that are brought online will not get the FCS Client package so will obviously not be protected.


    3.  Just leave it as is.  Besides getting the install failures and reports on the install failure, there should be no effect on getting Definition Updates or the AM engine.  Note that this workaround has not been tested, it is possible it could have some other negative effect.

    CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response) Check out my blog http://blogs.technet.com/kfalde
    Friday, June 19, 2009 2:10 PM
  • Thanks for the update Kurt.  I'm sure we will see the results of their work very soon.
    Friday, June 19, 2009 3:05 PM
  • I am not computer litterate.  I have a new dell 537 and I keep getting updates for forfront client security pack that I do not have installed.  Every night the updates come and I hit install and they fail.  I get error code 643 and 80070645.  The numbers on the pack is kb951951 and the update is kb973846.  How can I get this stopped????  Thanks. Please e-mail me at fphilli1@live.com
    Tuesday, November 17, 2009 10:05 PM