We fix the error of installing updates Windows 7

Windows 7 is still a popular operating system in a corporate environment, despite the fact that two new versions of the client OS have already been released. Expanded support for the G-7 will end only on January 14, 2020, which means that for the next 4 years, updates will be released for it to fix the detected vulnerabilities.

There is a rule - if there are updates, then there are problems with installing them. Let's look at what the main problems arise when updating Windows 7 through Windows Server Update Services (WSUS) and how to fix them at the lowest cost.


')

Error # 1 . Failed to find updates with error code 80244010

You will almost certainly observe this error on any system that first accessed the WSUS server. The WindowsUpdate.log will also encounter a warning:
WARNING: Exceeded max server round trips

The reason for the problem is that the list of updates has become too large, and the client cannot accept it in one go. Details - blogs.technet.microsoft.com/sus/2008/09/18/wsus-clients-fail-with-warning-syncserverupdatesinternal-failed-0x80244010
What solution does Microsoft offer? If, after an error, a repeated search for updates is started, the process of downloading metadata will continue from the moment the error occurred. Patience gentlemen, patience. Three, five attempts wuauclt /detectnow - and everything will be wuauclt /detectnow . Do not forget to wait for the end of the previous search cycle when re-searching, otherwise the magic will not work!

Error # 2. Windows updates are not installed with error 0x80070308

Occurs sporadically, and in one case out of 100 she has the only and very specific solution - delete the key
HKLM\Components\PendingRequired=1

Reboot. Here it is important not to overdo it, you should not delete any other keys in this section, even if you really do not like them, because after this update they will stop being placed forever.

Error # 3. All other errors

Almost 100% of other errors can be solved by System Update Readiness Tool (SURT) from the article support.microsoft.com/en-us/kb/947821
Download the package for your system, install, read the %windir%\Logs\CBS\CheckSUR.log log and if it ends like this:

Summary:
Seconds executed: 1164
Found 16 errors
Fixed 4 errors

then you are our client.

The problem is that during the installation of updates in the system may appear broken files. What is the cause — a faulty network, a disk, RAM, Windows Update itself — cannot be figured out, and errors will have to be corrected to install future updates.

As a rule, * .cat, * .mum, * .manifest files are damaged. Someone has * .dll damage, but I haven’t encountered it in practice. And it seems that the SURT tool should correct errors itself, since inside it there is a huge catalog of reference files. Only the last time SURT was updated in October 2014, and there have been countless patches to the operating system since then, and there are not enough files in the directory.



Below, I will describe the sequence of actions required to correct the errors of installing updates on Windows 7 x64 using SURT. For x86 edition, you just need another SURT package from KB947821.

The sequence of actions will be as follows.

1. Start the first pass of Windows6.1-KB947821-v34-x64.msu

It is not necessary to distract the user from work, we will do everything remotely. Create the following batch file and run it:

 set machine=BUHWKS02 xcopy Windows6.1-KB947821-v34-x64.msu \\%machine%\admin$\temp psexec -s \\%machine% wusa "c:\windows\temp\Windows6.1-KB947821-v34-x64.msu" /quiet /norestart pause 

where BUHWKS02 is the target machine.
When the script runs and pauses, we check %windir%\Logs\CBS\CheckSUR.log
If no errors were found, it’s not a broken update.
If it ends

Summary:
Seconds executed: 1164
Found 16 errors
Fixed 4 errors
CSI Manifest All Zeros Total count: 6
CSI Catalog Corrupt Total count: 3
Fixed: CSI Catalog Corrupt. Total count: 3
CBS MUM Corrupt Total count: 3
CBS Catalog Corrupt Total count: 3
CSI Catalog Thumbprint Invalid Total count: 1
Fixed: CSI Catalog Thumbprint Invalid. Total count: 1
Unavailable repair files:
winsxs \ manifests \ wow64_microsoft-windows-gdi32_31bf3856ad364e35_6.1.7601.19091_none_c19fa2719495aca9.manifest
winsxs \ manifests \ amd64_microsoft-windows-capi2-weakcrypto_31bf3856ad364e35_6.1.7601.23290_none_5e936c9c5ce2e8e6.manifest
winsxs \ manifests \ wow64_microsoft-windows-gdi32_31bf3856ad364e35_6.1.7601.23290_none_c22840d8adb43043.manifest
winsxs \ manifests \ amd64_microsoft-windows-gdi32_31bf3856ad364e35_6.1.7601.19091_none_b74af81f6034eaae.manifest
winsxs \ manifests \ amd64_microsoft-windows-capi2-weakcrypto_31bf3856ad364e35_6.1.7601.19091_none_5e0ace3543c4654c.manifest
winsxs \ manifests \ amd64_microsoft-windows-gdi32_31bf3856ad364e35_6.1.7601.23290_none_b7d3968679536e48.manifest
servicing \ packages \ Package_2_for_KB3123479 ~ 31bf3856ad364e35 ~ amd64 ~~ 6.1.1.0.mum
servicing \ packages \ Package_2_for_KB3123479 ~ 31bf3856ad364e35 ~ amd64 ~~ 6.1.1.0.mum
servicing \ packages \ Package_for_KB3123479_SP1 ~ 31bf3856ad364e35 ~ amd64 ~~ 6.1.1.0.mum

then we will fix it.

2. Copy the reference files to the target machine

Microsoft offers us a long, confused procedure with extracting good files from updates and placing them in certain directories of the SURT tool. In this case, the way in the articles wrong. Somewhere it is recommended to enclose the original msu files.

The simplest and correct option is to copy the reference files from the working system:

* .mum and * .cat from C: \ Windows \ servicing \ Packages add up to% windir% \ Temp \ CheckSUR \ servicing \ packages
* .manifest from C: \ Windows \ winsxs \ Manifests stack in% windir% \ Temp \ CheckSUR \ winsxs \ manifests \

The problem is that there are usually dozens of broken files, and it is very difficult to select and copy them. Then the following PowerShell script comes to the rescue (the reference machine is the machine from which you run the script)

 cls $flag = $false $destPC = "\\BUHWKS02" $log=get-content $($destPC + "\admin$\Logs\CBS\CheckSUR.log") $MUMCATSource = "C:\Windows\servicing\Packages\" $MUMCATDest = $destpc + "\admin$\Temp\CheckSUR\servicing\Packages\" $MANIFESTSource = "C:\Windows\winsxs\Manifests\" $MANIFESTDest = $destpc + "\admin$\Temp\CheckSUR\winsxs\Manifests\" If ((Test-Path -Path $MUMCATDest -PathType Container) -eq $false) {New-Item -Path $MUMCATDest -ItemType directory } If ((Test-Path -Path $MANIFESTDest -PathType Container) -eq $false) {New-Item -Path $MANIFESTDest -ItemType directory} foreach ($line in $log) { if ($flag -eq $True){ if ($line.trim().Length -ne 0) { $fileArray=$($line.Split("\")) $file = $FileArray[$FileArray.Length-1] $extArray = $file.split(".") $ext = $extArray[$extArray.length-1] if ($ext -eq "manifest") { Write-Warning $("Copying " + $($MANIFESTSource+$file)+" to " + $MANIFESTDest) Copy-Item $($MANIFESTSource+$file) $($MANIFESTDest+$file) } if (($ext -eq "mum") -or ($ext -eq "cat") ) { Write-Warning $("Copying " + $($MUMCATSource+$file)+" to " + $MUMCATDest) Copy-Item $($MUMCATSource+$file) $($MUMCATDest+$file) } } } if ($line -eq "Unavailable repair files:") {$flag = $true} } 

As you can see, the script is simple and can be easily sharpened by a file for your infrastructure.

3. Run the second pass Windows6.1-KB947821-v34-x64.msu

After copying the files, we re-launch the SURT using the batch file from the first step. When restarting, the tool will be able to pick up the reference files copied by us from% windir% \ Temp \ CheckSUR and replace the damaged ones with them.
If we did everything correctly, the% windir% \ Logs \ CBS \ CheckSUR.log would look like this:

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2016-03-03 09:15
Checking Windows Servicing Packages
Checking Package Manifests and Catalogs
Checking Package Watchlist
Checking Component Watchlist
Checking packages
Checking Component Store
Summary:
Seconds executed: 1435
No errors detected

Now you can continue installing updates on the target machine, for example, with the following batch files:
set machine= BUHWKS02
psexec -i -s \\%machine% wuauclt /detectnow
pause

set machine= BUHWKS02
psexec -i -s \\%machine% wuauclt /updatenow
pause


Error # 4. If SURT worked fine, but updates are still not installed

Try to resort to the old method - reset the Windows Update service to its original state. To do this, delete the% windir% \ SoftwareDistribution directory.

Create a file WU-cleanupCMD.cmd:
net stop wuauserv
rmdir /s /q %windir%\SoftwareDistribution
net start wuauserv
wuauclt /detectnow

Run:
set machine= BUHWKS02
psexec -c -s \\%machine% WU-cleanupCMD.cmd
pause

After this, Error # 1 will occur, but we already know how to deal with it.

Error # 5

The client disappears from the WSUS console. A curious error related to improper cloning of machines and duplication (build-up, etc.) of customer identifiers. It is solved like this:

 net stop wuauserv REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientIdValidation /f net start wuauserv wuauclt /resetauthorization /detectnow /reportnow 

Error # 6

GetCookie failure, error = 0x8024400D, soap client error = 7, soap error code = 300, HTTP status code = 200
SyncUpdates failure, error = 0x80072EE2, soap client error = 5, soap error code = 0, HTTP status code = 200
Windows Update Client failed to detect with error 0x80072ee2

The error is due to a lack of resources in the AppPool WSUS. The solution is to remove the limit on consumed memory. How to do it - article .
In short: Open IIS, Application Pools, WsusPool, Advanced Settings.
The parameter Private Memory Limit is set to 0.

Continuing the WSUS configuration topic is in my next article: https://habrahabr.ru/post/329440/

PS:
Many bugs are resolved in the new WSUS client:
1. KB3125574 "Windows 7 post SP1 Convenience Rollup Update" . Carefully read the Known issues section!

You must first install KB3020369 "April 2015 servicing stack update for Windows 7 and Windows Server 2008 R2".

Successful administration!