none
KB4093118 and KB4056897 Revert Issue

    问题

  • We have WSUS in organization and according to many windows update PROs and experts like Woody Leonhard and Susan Bradley we suspend updating our Windows 7 PCs till April 2018 because of lots issues in security and other Windows updates.

    And April updates was look like much better quality, and 25 of April I did resync my WSUS and approve all unapproved updates since January 2018 till now to PCs.

    And on some of them (something about 600 PCs) two KBs won't install.

    More correct - they installed successfuly, but after reboot while machine starts windows reverting changes and reboots couple times. And it is a pretty long in time, and users can't start using ther PCs for half an hour or more. And thay are so mad, and Company loose its money because of that.

    Important thing - I approved new revision of KB4093118 from 23 of April and old one from 13 of April is declined after WSUS resync:

    Errors we get in Windows System log:

    Ошибка установки: не удается установить следующее обновление из-за ошибки 0x80070057: Ежемесячный набор исправлений качества системы безопасности для систем Windows 7 на базе процессоров x64 (KB4093118), 04 2018 г.

    Ошибка установки: не удается установить следующее обновление из-за ошибки 0x80070057: Обновление качества (только система безопасности) для систем Windows 7 на базе процессоров x64 (KB4056897), 01 2018 г.

    And important thing - we have that problem not on all of our workstatons, only about 600, other are just installed all approved updates with success.

    We try to install only KB4093118 with no luck (reverting).

    sfc /scannow did not found errors.

    Deleting SoftwareDistribution folder did not resolve that issue.

    So, now we need experts help in that problem.

    1. Where we can get detailed KB4093118 installation log?

    2. What else can we do to resolve that issue?

    Thanks!

    2018年4月28日 1:17

答案

  • I found solution for my problem!

    I found it here. Michael_1995 answer helped a lot:

    We experienced this same issue.  We had almost the exact same errors in the CBS.log as MichaelHackman.  We discovered that in our enterprise environment we had carried over creating a legacy registry key from the Windows 7 days:
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Operational 
    
    We had created this key to allow us to up the MaxSize value (increase the number of print events could be stored in the event log before it rolled)
    
    When the Windows 10 September 2017-09 Monthly Rollup and the Rollups after that ( 2017-10 and 2017-11 Monthly Rollups ) came out, they attempt to migrate this event log from the old location in the Event Viewer (root of Application and Services Logs) to it's proper location of Application and Services Logs > Microsoft > Windows > PrintService > Operational.  So, for example, when we tried to apply KB4048954 to our Windows 10 1703 boxes... the KB tries to migrate the event location and errors out when it hits this strange key and rolls it back even after it get's past 100%.
    
    The resolution was to simply delete the legacy key. 
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Operational
    
    You may have additional legacy keys that need removed, such as...
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Admin
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Debug
    
    Hope this helps.

    After deleting registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Operational 

    Update was installed successfully:

    I still do not know why not all computers in organization affected and when that registry key appeared and what soft made it. But it is not so important, as solution itself.

    2018年6月1日 7:15

全部回复

  • Hi,

    You could check the windowsupdate.log (%windir%\windowsupdate.log) to see the detail about KB4093118.

    Please refer the following link and run the Windows Update troubleshooter.

    Fix Windows Update issues:

    https://support.microsoft.com/en-us/help/10164 

    Please also check if you could download and manually install the update.

    https://www.catalog.update.microsoft.com/Search.aspx?q=KB4093118

    https://www.catalog.update.microsoft.com/Search.aspx?q=KB4056897


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    2018年4月30日 3:57
  • Hi, Vera!

    Windows Update troubleshooter did not help, and as I wrote in 1 post, cleaning SoftwareDistribution folder did not help.

    System Update Readiness Tool for Windows 7 did not help.

    I try to install KB4093118 package from catalog with no luck. I even try to make installation log with WUSA, but in log everything fine. There is not information about installation revert, because it is happening after reboot, and log is finished at that time.

    In %windir%\windowsupdate.log I see only general information about all windows update process, but no current information about KB4093118 installation failure.

    Only 0x80070057 error in Windows System log.

    So, problem not resolved and I steel need help in it's diagnostics and resolve.

    2018年5月2日 4:49
  • KB4103718 (Monthly Rollup) failed to install on problem computers with same sympthoms: installing until 98% complete then revert changes.
    2018年5月11日 12:02
  • https://support.microsoft.com/mk-mk/help/4103718/windows-7-update-kb4103718 Проблемы с сетевыми драйверами обнаружены в майском обновлении. Никак не могут протестировать до конца сетевой стек. А вот почему не ставятся обновления (апрель и май!»), закономерности не увидел. Предположение есть: HASP драйвера, Kaspersky. Что из указанного установлено у Вас?
    2018年5月12日 10:33
  • А вот почему не ставятся обновления (апрель и май!»), закономерности не увидел. Предположение есть: HASP драйвера, Kaspersky. Что из указанного установлено у Вас?

    У нас не ставится секьюрити онли за январь и кумулятивный за апрель (и май тоже). Видимо именно с января что-то идет не совместимое с нашими проблемными компьютерами.

    Из продуктов Kaspersky используем KES10. При диагностике проблемы проверяли его влияние - полностью штатно его удалили и пробовали ставить проблемные обновления - безуспешно. Притом эти же версии KES10 стоят на компьютерах, где обновления установились успешно (коих большинство).

    По поводу HASP драйверов уточню, так как точно не знаю, но, с большой вероятностью на проблемных компьютерах они не установлены.

    =====================================================

    English:

    We have problems with January security-only and April (and May too) cumulative rollup. Apparently since January something is not compatible with our problem computers.

    From Kaspersky products we use KES10. When the problem was diagnosed, its effect was checked - it was completely removed from it and tried to put problem updates - unsuccessfully.

    Moreover, these current versions of KES10 are on computers where updates have been installed successfully (we have most of them).

    Concerning HASP drivers, I will clarify, because I do not know for sure, but, with a high probability, they are not installed on problem computers.

    2018年5月14日 5:16
  • В майском накопительном обновлении снова обнаружены проблемы с сетевыми драйверами. Может быть это как-то связано с вышеуказанным. У меня на работе две рабочие машины с такими же симптомами. Вижу быстрое решение только переставлять ОС. https://support.microsoft.com/en-us/help/4103718/windows-7-update-kb4103718 P.S. Уточните про HASP драйверы или Sentinel License Manager (service).
    2018年5月14日 20:21
  • Сетевые драйверы на компах обновляли? Пробовали ставить обновления через Clean Boot?
    2018年5月14日 20:24
  • Hi,

    Did this the updates affect your environment?

    If yes, please disable the update from WSUS temporarily.

    And keep troubleshooting on one machine and collect logs.

    For troubleshooting this issue, please take the following steps to collect the logs.

    1. Stop the Windows Update service by running “net stop wuauserv” as administrator.

    2. Backup the cbs.log (C:\Windows\Logs\CBS) and clear everything in it.

    3. Install the latest update KB4103723 manually and restart the machine to reproduce the issue.

    4. Export Event Viewer\Windows Logs\Applications, System, Setup

    5. Upload the logs to OneDrive and paste the link here.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    2018年5月16日 9:34
  • Hi,

    Did this the updates affect your environment?

    If yes, please disable the update from WSUS temporarily.

    And keep troubleshooting on one machine and collect logs.

    For troubleshooting this issue, please take the following steps to collect the logs.

    1. Stop the Windows Update service by running “net stop wuauserv” as administrator.

    2. Backup the cbs.log (C:\Windows\Logs\CBS) and clear everything in it.

    3. Install the latest update KB4103723 manually and restart the machine to reproduce the issue.

    4. Export Event Viewer\Windows Logs\Applications, System, Setup

    5. Upload the logs to OneDrive and paste the link here.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Hi, Vera!

    Could you be so kind to read carefuly first post, that describing my problem?

    I have that problem only on about 700 PC with Windows 7 SP1, but you want me to install Windows 10 1607 Cumulative Rollup KB4103723 from 8 of may.

    Did you CTRL+C, CTRL+V that advice to all Windows Update issues on that Windows 7 IT Pro forum?

    2018年5月16日 10:28
  • My apology, the latest update KB should be KB4103713.


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    2018年5月24日 5:28
  • I think, that I found root cause of revert problem.

    Here is piece of CBS.log - https://pastebin.com/1MX3Pebu

    2018-05-31 15:52:07, Info                  CSI    00000084 Begin executing advanced installer phase 38 (0x00000026) index 79 (0x000000000000004f) (sequence 118)
        Old component: [ml:328{164},l:326{163}]"Microsoft-Windows-Printing-Spooler-Core, Culture=neutral, Version=6.1.7601.17777, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS"
        New component: [ml:328{164},l:326{163}]"Microsoft-Windows-Printing-Spooler-Core, Culture=neutral, Version=6.1.7601.24000, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS"
        Install mode: install
        Installer ID: {3bb9fd2b-351e-4b9c-b1fc-ed0758805998}
        Installer name: [6]"Events"
    2018-05-31 15:52:07, Error                 CSI    00000001 (F) Logged @2018/5/31:12:52:07.296 : [ml:292{146},l:290{145}]"events installer: online=1, install=1, component=amd64_Microsoft-Windows-Printing-Spooler-Core_31bf3856ad364e35_6.1.7601.24000_neutral_release__."
    [gle=0x80004005]
    2018-05-31 15:52:07, Error                 CSI    00000002 (F) Logged @2018/5/31:12:52:07.390 : [ml:144{72},l:142{71}]"WmiCmiPlugin (-1): InstrumentationManifestAssert failed. HR=0x80070057."
    [gle=0x80004005]
    2018-05-31 15:52:07, Error                 CSI    00000003 (F) Logged @2018/5/31:12:52:07.390 : [ml:166{83},l:164{82}]"WmiCmiPlugin eventloghandler.cpp(192): ProcessEventsInstall failed. HR=0x80070057."
    [gle=0x80004005]
    2018-05-31 15:52:07, Error                 CSI    00000004 (F) Logged @2018/5/31:12:52:07.390 : [ml:170{85},l:168{84}]"WmiCmiPlugin eventloghandler.cpp(212): EventLogHandlerInstall failed. HR=0x80070057."
    [gle=0x80004005]
    2018-05-31 15:52:07, Error                 CSI    00000005@2018/5/31:12:52:07.390 (F) CMIADAPTER: Inner Error Message from AI HRESULT = E_INVALIDARG
     [
    [25]"\u041f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0437\u0430\u0434\u0430\u043d \u043d\u0435\u0432\u0435\u0440\u043d\u043e.
    
    "
    ]
    [gle=0x80004005]
    2018-05-31 15:52:07, Error                 CSI    00000006@2018/5/31:12:52:07.390 (F) CMIADAPTER: AI failed. HRESULT = E_INVALIDARG
    	Element:
    	[134129]"<events xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events" xmlns:xs="http://www.w3.org/2001/XMLSchema">
    
      <provider guid="{747EF6FD-E535-4d16-B510-42C90F6873A1}" message="$(string.eventProviderPrintSpooler)" messageFileName="%SystemRoot%\system32\ntprint.dll" name="Microsoft-Windows-PrintService" resourceFileName="%SystemRoot%\system32\ntprint.dll" symbol="SPOOLER_ETW_CONTROL_GUID">
    
        <channels>
    
          <channel chid="Admin" enabled="true" isolation="Application" message="$(string.AdminChannel)" name="Microsoft-Windows-PrintService/Admin" symbol="SPOOLER_CHANNEL_ADMIN" type="Admin" />
    
          <channel chid="Operational" enabled="false" isolation="Application" message="$(string.OperationalChannel)" name="Microsoft-Windows-PrintService/Operational" symbol="SPOOLER_CHANNEL_OPERATIONAL" type="Operational" />
    
          <channel chid="Debug" enabled="false" isolation="Application" message="$(string.DebugChannel)" name="Microsoft-Windows-PrintService/Debug" symbol="SPOOLER_CHANNEL_DEBUG" type="Debug" />
    
        </channels>
    

    Something with print spooler...

    But what to do now?

    2018年6月1日 4:51
  • I found solution for my problem!

    I found it here. Michael_1995 answer helped a lot:

    We experienced this same issue.  We had almost the exact same errors in the CBS.log as MichaelHackman.  We discovered that in our enterprise environment we had carried over creating a legacy registry key from the Windows 7 days:
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Operational 
    
    We had created this key to allow us to up the MaxSize value (increase the number of print events could be stored in the event log before it rolled)
    
    When the Windows 10 September 2017-09 Monthly Rollup and the Rollups after that ( 2017-10 and 2017-11 Monthly Rollups ) came out, they attempt to migrate this event log from the old location in the Event Viewer (root of Application and Services Logs) to it's proper location of Application and Services Logs > Microsoft > Windows > PrintService > Operational.  So, for example, when we tried to apply KB4048954 to our Windows 10 1703 boxes... the KB tries to migrate the event location and errors out when it hits this strange key and rolls it back even after it get's past 100%.
    
    The resolution was to simply delete the legacy key. 
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Operational
    
    You may have additional legacy keys that need removed, such as...
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Admin
    
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Debug
    
    Hope this helps.

    After deleting registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Operational 

    Update was installed successfully:

    I still do not know why not all computers in organization affected and when that registry key appeared and what soft made it. But it is not so important, as solution itself.

    2018年6月1日 7:15
  • Я проверил наличие вышеуказанной записи в реестре на проблемных компьютерах и ничего не нашёл. А обновление все равно не ставится и происходит откат назад. Какие ещё будут предположения?
    2018年6月1日 15:11
  • Я проверил наличие вышеуказанной записи в реестре на проблемных компьютерах и ничего не нашёл. А обновление все равно не ставится и происходит откат назад. Какие ещё будут предположения?


    Разумеется у откатов установки обновлений может быть куда больше причин, чем ранее сконфигурированное включение подробного журнала печати на компьютере.

    При диагностике проблемы я руководствовался вот этой статьей.

    А вообще начать стоит с анализа журнала cbs.log (C:\Windows\Logs\CBS) на наличие слов Error и Failed. Именно так я нашел конкретные ошибки из-за которых происходил откат изменений. Вот по строчкам с ошибками из этого лога я и нашел решение. Думаю, это поможем и вам.

    2018年6月5日 3:30