Printable View
We're updating our XP SP3 desktops using WSUS 3.0. Today during the first
round of patch testing we found that the patch for KB956572 wouldn't install.
In checking the install log for the patch, it seems to be failing because
NTDLL.DLL is in use. Running the update manually produces the same result.
Any ideas where to look in order to fix this? TiA
Hello
see the "How to obtain help..." section of
http://support.microsoft.com/kb/956572
I would have thought the part where I mentioned "updating our XP SP3 desktops
using WSUS 3.0." would have indicated that we were using WSUS.
Thanks for taking the time to reply though. ;-)
I am also unable to instal this update but there is no mention of NTDLL.
Instead there is the error message:' KB956572 Setup encountered an error:
The update.ver file is not correct.'
Can anyone help with this
OK, the fact that a manual install doesn't work either eliminates WSUS from the
picture. I gather the update does work in Safe Mode, in which case the problem
smells of a third-party security product issue. What software do you have
installed?
The odd thing is that NTDLL.DLL is *always* in use. It's one of the core DLLs
used by pretty much every user-mode process, so the update should be expecting
to need to do a replace-on-reboot operation. Could you post the install log
here? There might be other clues in it.
I assume you've tried the install on a machine that has recently been rebooted?
Not just security software. See also "KB956572 fails to install on SBS 2003 server"
Oops. Previous post sent too soon.
(<bleeping> Ctrl-Enter in OE while Working Online.)
Not just security software. See also "KB956572 fails to install on SBS 2003 server"
There the symptom looks like it could be caused by a driver or driver
support software. (I have a vague recollection of an HP Printer driver
or its software doing something like this before.) Safe mode could
inhibit stuff like that too.
Personally, I don't see any reason to suspect a driver or driver-related
software in either thread; my first guess in both cases would be security
software. YMMV.
You're probably thinking of one of the MSXML files being locked by HP printer
software? Different situation, as ntdll.dll is actually supposed to be locked.
I suspect the problem is actually either a lock on some other resource
associated with the attempted update of ntdll.dll, or third-party kernel-mode
software intercepting and rejecting the attempt to look at it. Or perhaps a
mangled ACL; unless we can figure out how to reproduce the problem all I can do
is speculate.
I'm going to backpedal on this. On further investigation, ntdll.dll is usually
locked with the SHARE_READ flag. If any process has locked it for exclusive
access, you get the symptoms the OP describes.
This means it could be any piece of software on the system causing the problem.
Just the log entry which precedes the error message.
Yes. Thanks.
Still fighting with this.
Security related, we are using RSA for secure logins and Mcafee for
antivirus. Other than that, nothing else out of the ordinary that I can think
of. This is the first time we've had problems patching though.
After reading some other posts and getting some ideas, I've found that the
issue in my case was with Norton Ghost. Once I uninstalled Ghost from a test
PC the WSUS install ran just fine on it. Hope this helps some other people.
That gave me the cue I needed. In the case of a client of mine, Drive Image
7 (precursor of recent editions of Norton Ghost) was removed, and the update
installed successfully after that.