none
How do I remove a KB that shows installed but doesn not show a removal? RRS feed

  • Question

  • Hi All,

    W10 Home 1903 x64

    I have a customer with a specialty software that flagged a bad Microsoft Update, which they wan tme to remove:

    Affected Microsoft Windows Updates:

    Now these do show in installed updates:


    Problem: when I go to "uninstall Updates" they don't exist:

    How do I uninstall these two turkeys??????

    Many thanks,

    -T


    Friday, October 11, 2019 11:02 PM

All replies

  • In run type: appwiz.cpl in Add/Remove locate the box Show updates

    If still a problem,in my computer/search type in the update,once shown,R.click on it,delete...

    Saturday, October 12, 2019 12:13 AM
  • Hi Andrew,

    Please read my post a little more carefully.  I was in the applications wizard.  The two in question do not show.

    -T

    Saturday, October 12, 2019 12:42 AM
  • Windows may incorrectly display the successful installation of an update when no update was installed.

    Open administrative powershell and type or copy and paste:

    wmic qfe list

    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.
    .
    .
    .
    .
    .



    Saturday, October 12, 2019 1:39 AM
  • 1) it shows it they were installed.  I made a red box around both of them.

    2) the KB's thoroughly messed up the customer's program and their tech support flagged the two KB's, so the two were indeed installed because they caused the symptom.

    3) the two KB's do not show in the list of removals.

    I need to know how to remove KB's that do not show.


    Saturday, October 12, 2019 1:51 AM
  • These are some options if they were installed.

    First, this is an illustration of Windows reporting successful installation of an update that was never installed:

    The update history displayed several updates that were successfully installed many times that were never installed.

    .

    .

    .

    If the update was installed then you can try to uninstall the latest updates using command line.

    .

    .

    Find a flash drive that you can format ( > or = 8 GB)

    .

    .

    Create a bootable windows 10 iso:

    https://www.microsoft.com/en-us/software-download/windows10
    https://www.tenforums.com/tutorials/9230-download-windows-10-iso-file.html
    https://www.tenforums.com/tutorials/2376-create-bootable-usb-flash-drive-install-windows-10-a.html

    .

    .

    Boot to the iso:

    http://www.disk-image.com/faq-bootmenu.htm

    .

    .

    Open the Windows advanced troubleshooting menu > command prompt > the black box should display title bar:  Administrator:X:Windows\System32\cmd.exe and prompt:  X:\Sources>

    .

    .

    Confirm the drive letter for the Windows image.

    Usually D: –> dir d:

    .

    .

    Run the following to view the installed packages which will also show a date of install.

    Dism /Image:D:\ /Get-Packages

    .

    .

    Find the package(s) that were just installed by date. Run the following command on the last installed package:

    example:

    dism.exe /image:d:\ /remove-package /packagename:Package_for_KB4014329~31bf3856ad364e35~amd64~~10.0.1.0

    .

    .

    Reboot.

    .

    .

    Repeat as necessary to uninstall the latest windows update

    .

    .

    Note:  some updates cannot be uninstalled.

    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.
    .
    .
    .
    .
    .






    Saturday, October 12, 2019 2:32 AM
  • Please remember to vote and to mark the replies as answers if they help.
    Is there a place to put a raspberry for blow off answers?
    Saturday, October 12, 2019 5:52 AM
  • Follow up:

    I am not at the customer site, but this is what I do believe I need to do:

    1)  open an elevated CMD prompt

    2)  find the list of installed KB's:    
            wmic qfe list brief /format:table

    3)  remove the offender(s):
            wusa /uninstall /KB:4517389
            wusa /uninstall /KB:4524147





    Saturday, October 12, 2019 6:53 AM
  • It is unlikely that the updates were installed.

    If you find that they were installed then please update the thread so that viewers can learn from your findings.

    Other options to consider:

    a) open a thread for the computer problems

    b) perform a system restore to a date that predates the possible installation date

    c) restore a backup image if available

    d) create a VM with windows version/build that works with the specialty software

    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.
    .
    .
    .
    .
    .


    Saturday, October 12, 2019 7:10 AM
  • KB4524147 is a required security update, fixing an actively exploted bug in internet explorer.
    (so no theoretical problem)
    Before uninstalling this you should make sure your customers are no longer using IE,
    or use the workarounds described in:
    CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability
    Saturday, October 12, 2019 10:33 AM
  • It is unlikely that the updates were installed.


    Maybe if I repeat myself 100 more times?  The symptoms are that they were.  The two machines are in terrible condition when they attempt to print and the tech support of the specialty software has sent out a general warning to all its users explaining the situations. 
    Saturday, October 12, 2019 8:39 PM
  • KB4524147 is a required security update, fixing an actively exploted bug in internet explorer.
    (so no theoretical problem)
    Before uninstalling this you should make sure your customers are no longer using IE,
    or use the workarounds described in:
    CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability
    The customer is using both Firefox and Chrome on all their maciens.  I have removed the IE icons.  I will shortly try to get them off Chrome and on to Brave.
    Saturday, October 12, 2019 8:42 PM
  • KB4524147 is a required security update
    By chance is there some mechanism with a "required security update" that keeps you from uninstalling it?  If so, is there a work around?
    Saturday, October 12, 2019 8:44 PM
  • The sister website for Technet is Microsoftanswers.

    This website typically troubleshoots failure to update.

    Long ago it was taught that to test whether a windows update was or was not installed was to attempt to uninstall the update.  If it was displayed in the search results it confirmed installation.  If it was not displayed in the search results it had failed to install.

    The above remains true for Windows 1607 as per the earlier post in this thread.

    Things can change.  So I'm interested if seeing whether you can find it installed using command line or any other method. 

    Microsoft provides free support for failure to update.  Consider checking to see whether they provide free support for problems related to updates that display successfully installed.

    https://support.microsoft.com/en-us/contactus/

    https://support.microsoft.com/en-us/help/4051701/global-customer-service-phone-numbers

    In addition, report the problem via the Microsoft feedback hub:

    https://support.microsoft.com/en-us/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app


    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.
    .
    .
    .
    .
    .

    Saturday, October 12, 2019 11:46 PM
  • The sister website for Technet is Microsoftanswers.

    This website typically troubleshoots failure to update.

    Long ago it was taught that to test whether a windows update was or was not installed was to attempt to uninstall the update.  If it was displayed in the search results it confirmed installation.  If it was not displayed in the search results it had failed to install.

    The above remains true for Windows 1607 as per the earlier post in this thread.

    Things can change.  So I'm interested if seeing whether you can find it installed using command line or any other method. 

    Microsoft provides free support for failure to update.  Consider checking to see whether they provide free support for problems related to updates that display successfully installed.

    https://support.microsoft.com/en-us/contactus/

    https://support.microsoft.com/en-us/help/4051701/global-customer-service-phone-numbers

    In addition, report the problem via the Microsoft feedback hub:

    https://support.microsoft.com/en-us/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app

    Thank you for the Microsoftanswers link.  Do you know of one that is not hosted by M$?

    I think the issue here is that the system is acting like those two KB's were installed and folks mistake me for saying they were actually not.

    I stay away from M$'s support.  1) I can't understand them and 2) when I do understand them, they are, well, "terrible" would be an understatement.  M$ support is something you do once and never repeat.

    If I can't get rid of these guys from the command line, the customer is going to have to wait till M$ patches the patch and that may be months or never.

    I have approached the customer with the idea of once this gets working to get a decent anti virus and then lock him down. M$'s updates are a disaster.

    Thank you for all the help and tips

    -T

    Sunday, October 13, 2019 3:13 AM
  • so did you try "wusa /uninstall /KB:4524147"? (from elevated command prompt)

    Sunday, October 13, 2019 5:22 AM
  • so did you try "wusa /uninstall /KB:4524147"? (from elevated command prompt)

    I won't have access to the customer's machines  until Monday
    Sunday, October 13, 2019 5:55 AM
  • Hi,

    We can boot into WinRe mode and uninstall them: 

    1. Go to Window Recovery Environment (WinRE) by keeping pressing Shift key and click restart in start menu.

    2. Run the below command, which will list all the packages on the OS 
    DISM /Image:C:\ /Get-Packages

    Note: please replace C with the machine’s OS drive  

    4. We can uninstall the sepcific updates by running the following commands:
    Dism /Image:C:\ /Remove-Package /PackageName:<Package Identity>

    Note: The package identity can be found in update Packages.

    Best regards,

    Yilia 

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Monday, October 14, 2019 3:27 AM
    Moderator
  • Thank you!   I will try the command line stuff first, then this.  And I will write your recommendations down for the future.  :-)

    Monday, October 14, 2019 3:39 AM


  • 1. Go to Window Recovery Environment (WinRE) by keeping pressing Shift key and click restart in start menu.

    2. Run the below command, which will list all the packages on the OS 
    DISM /Image:C:\ /Get-Packages

    From my Windows 10 virtual machine:

    DISM /Image:C:\ /Get-Packages
    from the resulting log file:
    ...DISM.EXE Failed to access the image folder or image's windows folder.


    Monday, October 14, 2019 7:40 AM
  • Hi, 

    Please make sure C: drive is your OS drive, use the following commands by order to find which is your OS drive: 

    Diskpart

    list vol

    Best regards,

    Yilia 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, October 14, 2019 7:55 AM
    Moderator
  • Hi, 

    Please make sure C: drive is your OS drive, use the following commands by order to find which is your OS drive: 

    Diskpart

    list vol

    Best regards,

    Yilia 


    I forgot about C: getting moved to D:.  Thank you!
    Monday, October 14, 2019 7:56 AM
  • Please see the post Saturday, October 12, 2019 2:32 AM

    It had the steps for Windows RE.

    One method is dir to determine the windows partition.

    boot to the iso:

    http://www.disk-image.com/faq-bootmenu.htm

    .

    .

    Open the Windows advanced troubleshooting menu > command prompt > the black box should display title bar:  Administrator:X:Windows\System32\cmd.exe and prompt:  X:\Sources>

    .

    .

    Confirm the drive letter for the Windows image.

    Usually D: –> dir d:

    .

    .

    Run the following to view the installed packages which will also show a date of install.

    Dism /Image:D:\ /Get-Packages

    .

    .

    Find the package(s) that were just installed by date. Run the following command on the last installed package:

    example:

    dism.exe /image:d:\ /remove-package /packagename:Package_for_KB4014329~31bf3856ad364e35~amd64~~10.0.1.0

    .

    .

    Reboot.

    .

    .

    Repeat as necessary to uninstall the latest windows update

    .

    .

    Note:  some updates cannot be uninstalled.

    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.
    .
    .
    .
    .
    .






    Monday, October 14, 2019 8:32 AM
  • Everyone is coming to work today and their printing issues are resolved.  Well except that I had to put the drive drives back to the right model printer on one customer and reinstall a PDF driver on another. The original customer on this ticket is not printing without any issues.

    M$ must have rolled out the patch of the patch.  Also, I don' see KB:4524147 installed anywhere any more.

    Monday, October 14, 2019 11:29 PM
  • Hi,

    Glad to know the issues have been solved. 

    If there is anything else we can do for you, please feel free to post in the forum.

    Best Regards,

    Yilia


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, October 15, 2019 6:37 AM
    Moderator