931125 endless loop

Our WSUS server got this update last night must of been a minor update
to it or something.

Other Updates
Update for Root Certificates [May 2009] (KB931125)
This item updates the list of root certificates on your computer to the
list that is accepted by Microsoft as part of the Microsoft Root
Certificate Program. Adding additional root certificates to your
computer enables you to use Extended Validation (EV) certificates in
Internet Explorer 7, a greater range of security enhanced Web browsing,
encrypted e-mail, and security enhanced code delivery. After you install
this item, you may have to restart your computer. Once you have
installed this item, it cannot be removed.


This update was already approved.

The users get a shield for this update and then after install they get
another shield for:
Update for Root Certificates
Then after this is installed they get the shield again for
Update for Root Certificates [September 2009] (KB931125)

This then is in a never ending loop.

Has anyone else experienced this?

We went in to wsus and Declined the "Update for Root Certificates" but
users still get the endless loop.

I am also experiencing this issue. Still investigating it.

jamie wrote:
>
> Our WSUS server got this update last night must of been a minor update
> to it or something.
>
> Other Updates
> Update for Root Certificates [May 2009] (KB931125)
> This item updates the list of root certificates on your computer to the
> list that is accepted by Microsoft as part of the Microsoft Root
> Certificate Program. Adding additional root certificates to your
> computer enables you to use Extended Validation (EV) certificates in
> Internet Explorer 7, a greater range of security enhanced Web browsing,
> encrypted e-mail, and security enhanced code delivery. After you install
> this item, you may have to restart your computer. Once you have
> installed this item, it cannot be removed.
>
>
> This update was already approved.
>
> The users get a shield for this update and then after install they get
> another shield for:
> Update for Root Certificates
> Then after this is installed they get the shield again for
> Update for Root Certificates [September 2009] (KB931125)
>
> This then is in a never ending loop.
>
> Has anyone else experienced this?
>
> We went in to wsus and Declined the "Update for Root Certificates" but
> users still get the endless loop.

I think I found a resolution. There was also another Update for Root
Certificates (KB931125) from February that was superseded, but still
approved on my WSUS box. Once I declined this update and restarted the
automatic update services on my client the loop quit. My best guess is
that there is something in the detection logic of the February update
that is causing it to be reinstalled when MS declined the May 2009
update on the last sync.


jamie wrote:
>
> Our WSUS server got this update last night must of been a minor update
> to it or something.
>
> Other Updates
> Update for Root Certificates [May 2009] (KB931125)
> This item updates the list of root certificates on your computer to the
> list that is accepted by Microsoft as part of the Microsoft Root
> Certificate Program. Adding additional root certificates to your
> computer enables you to use Extended Validation (EV) certificates in
> Internet Explorer 7, a greater range of security enhanced Web browsing,
> encrypted e-mail, and security enhanced code delivery. After you install
> this item, you may have to restart your computer. Once you have
> installed this item, it cannot be removed.
>
>
> This update was already approved.
>
> The users get a shield for this update and then after install they get
> another shield for:
> Update for Root Certificates
> Then after this is installed they get the shield again for
> Update for Root Certificates [September 2009] (KB931125)
>
> This then is in a never ending loop.
>
> Has anyone else experienced this?
>
> We went in to wsus and Declined the "Update for Root Certificates" but
> users still get the endless loop.

[slhtech]

Got same this morning. why i suddenly need an update released two months ago? perhaps it takes microsoft that long to almost work the bugs out?

told it not to notify me again and haven't seen it back yet.

Wade I'm currently discussing this in the microsoft.public.windowsupdate
forum. Under the subject of "Root certificate updates".

I know this is not the best place but more discussion was going on there
regarding the subject.

Basically what I did.
declined all of the cert updates but sept.
then computers stuck in loop would not fall out. So to fix this what I
had to do was-


stop the service "Automatic Updates"
ok go to C:\windows
delete the softwaredistribution folder
start the service "Automatic Updates"

So far the above has worked on two machines. There is probably a better
way but all I have for now.

In article <OeR7CUTbKHA.5348@TK2MSFTNGP06.phx.gbl>,
wade@nospam.logan.k12.ut.us says...
>
> I am also experiencing this issue. Still investigating it.
>
> jamie wrote:
> >
> > Our WSUS server got this update last night must of been a minor update
> > to it or something.
> >
> > Other Updates
> > Update for Root Certificates [May 2009] (KB931125)
> > This item updates the list of root certificates on your computer to the
> > list that is accepted by Microsoft as part of the Microsoft Root
> > Certificate Program. Adding additional root certificates to your
> > computer enables you to use Extended Validation (EV) certificates in
> > Internet Explorer 7, a greater range of security enhanced Web browsing,
> > encrypted e-mail, and security enhanced code delivery. After you install
> > this item, you may have to restart your computer. Once you have
> > installed this item, it cannot be removed.
> >
> >
> > This update was already approved.
> >
> > The users get a shield for this update and then after install they get
> > another shield for:
> > Update for Root Certificates
> > Then after this is installed they get the shield again for
> > Update for Root Certificates [September 2009] (KB931125)
> >
> > This then is in a never ending loop.
> >
> > Has anyone else experienced this?
> >
> > We went in to wsus and Declined the "Update for Root Certificates" but
> > users still get the endless loop.

restarting automatic update service did not do the trick for us.

In article <e#pAXcTbKHA.2680@TK2MSFTNGP04.phx.gbl>,
wade@nospam.logan.k12.ut.us says...
>
> I think I found a resolution. There was also another Update for Root
> Certificates (KB931125) from February that was superseded, but still
> approved on my WSUS box. Once I declined this update and restarted the
> automatic update services on my client the loop quit. My best guess is
> that there is something in the detection logic of the February update
> that is causing it to be reinstalled when MS declined the May 2009
> update on the last sync.
>
>
> jamie wrote:
> >
> > Our WSUS server got this update last night must of been a minor update
> > to it or something.
> >
> > Other Updates
> > Update for Root Certificates [May 2009] (KB931125)
> > This item updates the list of root certificates on your computer to the
> > list that is accepted by Microsoft as part of the Microsoft Root
> > Certificate Program. Adding additional root certificates to your
> > computer enables you to use Extended Validation (EV) certificates in
> > Internet Explorer 7, a greater range of security enhanced Web browsing,
> > encrypted e-mail, and security enhanced code delivery. After you install
> > this item, you may have to restart your computer. Once you have
> > installed this item, it cannot be removed.
> >
> >
> > This update was already approved.
> >
> > The users get a shield for this update and then after install they get
> > another shield for:
> > Update for Root Certificates
> > Then after this is installed they get the shield again for
> > Update for Root Certificates [September 2009] (KB931125)
> >
> > This then is in a never ending loop.
> >
> > Has anyone else experienced this?
> >
> > We went in to wsus and Declined the "Update for Root Certificates" but
> > users still get the endless loop.

"Wade Godfrey" <wade@nospam.logan.k12.ut.us> wrote in message
news:e%23pAXcTbKHA.2680@TK2MSFTNGP04.phx.gbl...
>I think I found a resolution. There was also another Update for Root
>Certificates (KB931125) from February that was superseded, but still
>approved on my WSUS box. Once I declined this update and restarted the
>automatic update services on my client the loop quit. My best guess is that
>there is something in the detection logic of the February update that is
>causing it to be reinstalled when MS declined the May 2009 update on the
>last sync.

Couple of notes here

Microsoft does not decline updates, only expires them. Even though an update
is expired by Microsoft, it's still necessary for the local WSUS
Administrator to actually decline the update in order to hide it from client
systems.

The added complication comes here in that the May 2009 update has defective
supercession data -- which is *why* it was expired! (and should have been
declined by WSUS Administrators the moment it was expired).

When the May 2009 update is not declined, and because it does not have
correct supercession data, it triggers a detection as isInstallable, and the
WUAgent attempts to install it. Whether the installation fails or succeeds,
I don't really know. If it fails, then it's just looping because isInstalled
continues to be false; if it succeeds, then it triggers a (re) detection of
the Sep 2009 update which then becomes isInstallable and not isInstalled
again.

The correct remediation of this issue is, in fact, to decline the May 2009
update (because it is expired), to decline the Feb 2009 update (because it
is superceded by the Sep 2009 update), and when they fix a similar issue
produced in last week's Nov 2009 update (which is now also expired due to
defective supercession metadata), it will then be appropriate to decline the
Sep 2009 update.

On my systems where all former (unneeded/irrelevant) updates were already
declined, I did not experience this looping reinstallation issue, and
successfully installed the Sep 2009 KB931125 update to my lone XP SP3 system
the first time.

--
Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

My Blog: http://onsitechsolutions.spaces.live.com
Microsoft WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

Sorry Lawrence, I knew that Microsoft only expires them, not declines,
my bad choice of words.

Another correction for Jamie, I actually stopped the update service and
restarted it on my client, not just restarted it.

Lawrence Garvin [MVP] wrote:
> "Wade Godfrey" <wade@nospam.logan.k12.ut.us> wrote in message
> news:e%23pAXcTbKHA.2680@TK2MSFTNGP04.phx.gbl...
>> I think I found a resolution. There was also another Update for Root
>> Certificates (KB931125) from February that was superseded, but still
>> approved on my WSUS box. Once I declined this update and restarted the
>> automatic update services on my client the loop quit. My best guess is
>> that there is something in the detection logic of the February update
>> that is causing it to be reinstalled when MS declined the May 2009
>> update on the last sync.
>
> Couple of notes here
>
> Microsoft does not decline updates, only expires them. Even though an
> update is expired by Microsoft, it's still necessary for the local WSUS
> Administrator to actually decline the update in order to hide it from
> client systems.
>
> The added complication comes here in that the May 2009 update has
> defective supercession data -- which is *why* it was expired! (and
> should have been declined by WSUS Administrators the moment it was
> expired).
>
> When the May 2009 update is not declined, and because it does not have
> correct supercession data, it triggers a detection as isInstallable, and
> the WUAgent attempts to install it. Whether the installation fails or
> succeeds, I don't really know. If it fails, then it's just looping
> because isInstalled continues to be false; if it succeeds, then it
> triggers a (re) detection of the Sep 2009 update which then becomes
> isInstallable and not isInstalled again.
>
> The correct remediation of this issue is, in fact, to decline the May
> 2009 update (because it is expired), to decline the Feb 2009 update
> (because it is superceded by the Sep 2009 update), and when they fix a
> similar issue produced in last week's Nov 2009 update (which is now also
> expired due to defective supercession metadata), it will then be
> appropriate to decline the Sep 2009 update.
>
> On my systems where all former (unneeded/irrelevant) updates were
> already declined, I did not experience this looping reinstallation
> issue, and successfully installed the Sep 2009 KB931125 update to my
> lone XP SP3 system the first time.
>

>> The correct remediation of this issue is, in fact, to decline the May
>> 2009 update (because it is expired), to decline the Feb 2009 update
>> (because it is superceded by the Sep 2009 update), and when they fix a
>> similar issue produced in last week's Nov 2009 update (which is now also
>> expired due to defective supercession metadata), it will then be
>> appropriate to decline the Sep 2009 update.

To close up this thread -- I just synchronized a properly configured
November 2009 KB931125 that was published earlier today.

To summarize the various instances of KB931125 for 2009:

November 2009 "Update for Root Certificates [November 2009]"
Original Release Date: 11/24/2009 (current package)
This update supercedes the September 2009 update.

November 2009 "Update for Root Certificates [November 2009]"
Original Release Date: 11/19/2009; deleted from the catalog
This update had defective supercession metadata.

September 2009 "Update for Root Certificates [September 2009]"
Original Release Date: 9/22/2009; still active and unrevised
This update superceded the May 2009 update and is superceded by the November
2009 update.
It should now be declined, and the November 2009 update should be approved.

September 2009 "Update for Root Certificates"
Original Release Date: 9/21/2009; deleted from the catalog
This update had defective supercession data -- specifically the same error
introduced in the 5/22/09 update was replicated in this package. "Update for
Root Certificates [May 2009]" was recorded as a *superceding* update, rather
than a superceded update. This package was corrected 24 hours later by the
current September 2009 package.

May 2009 "Update for Root Certificates [May 2009]"
Original Release Date: 5/26/2009; Last Modification Date: 11/19/2009
This update was expired by Microsoft on 11/19/2009 in response to the first
attempt at the Nov 2009 release (which also had defective metadata). This
release of the May 2009 package contained the correct supercession data.
This update also should have expired the 5/22/2009 package, but did not do
so. This update should have been declined on WSUS servers in September,
2009, when the Sept 2009 update was released, but certainly should be
declined now, as the update has been expired.

May 2009 "Root Certificates Update"
Original Release Date: 5/22/2009; Last Modification Date: 5/22/2009
This update superceded the February 2009 "Update for Root Certificates", and
was actually the original release with defective metadata, showing the Feb
2009 "Update for Root Certificates" as a *superceding* update, rather than a
superceded update. The metadata currently shows this update as expired, but
as of an image of a server I have based on a last sync date of 11/17, this
update was still *active* on that date -- which suggests this update was
only recently expired, and the revision date of that expiration was not
properly recorded in the update metadata. This update should have been
expired when the corrected package was published on 5/26/2009, and is the
culprit for the recent spate of problems with installation of KB931125.

February 2009 "Update for Root Certificates"
Original Release Date 2/24/2009; Last Modification Date: 9/21/2009
This update was expired by Microsoft on 9/21/2009 as a result of the 9/21/09
release of the September 2009 package, which had defective supercession
metadata, and was subsequently republished 24 hours later on 9/22/09. It
should have been declined in September 2009 for either of two reasons: the
supercession of the Sep 2009 update, as well as the fact that it was an
expired update.







--
Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

My Blog: http://onsitechsolutions.spaces.live.com
Microsoft WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin