Error 1620: 2250. Failure

[pepinjo]

Recently we have been unable to patch our Domain controllers with batchpatch. We removed anti-virus, collect network trace. Nothing is being filtered (ports). We are able to retrieve anything else from batchpatch (OS version, disk space). Only the patching deployment is not working.

Thu-12:18:58> Windows Update: Error 1620: 2250. Failure
Thu-12:18:58> Windows Update: Failed to obtain result. Could not find file ‘\\AZCC1GDCP01\C$\Program Files\BatchPatch\BatchPatchTempResult.log’.
Thu-12:18:53> Windows Update: Executing BatchPatchRemoteAgent.exe…
Thu-12:18:52> Windows Update: Attempting to initiate Windows Update (Action: Search for updates: ‘SoftwareOnly’ | Server selection: Default / Managed) …

Any feedback would be appreciated.
Thank you

[doug]

So you’re saying that up until recently this problem didn’t occur? Did you update Windows version or similar upgrade on the DCs? Did you change accounts that you’re using to do the patching? Did you change the server where BatchPatch is running? Did you switch from integrated security to alternate credentials? Different version of PsExec? Different version of BatchPatch?

What version of BP are you running? What version of PsExec are you running? What version/build of Windows is BatchPatch running on? (you can use ‘Actions > Get info > Get OS version’ to get the full details). What version/build of Windows are the DCs?

2250 is an error that we very rarely hear about. It translates to:

ERROR_NOT_CONNECTED
2250 (0x8CA)
This network connection does not exist.

Try enabling ‘Tools > Settings > Remote Execution > Use PsExec -r switch’ if it’s disabled, or disable it if it’s enabled. In general we recommend that this switch be enabled, but as a test, try the opposite of your current setting to see if anything changes. If no difference, then put it back to enabled (enabled is generally better than disabled). You can use a name like ‘BatchPatchExeSvc’ or whatever custom name you prefer.

It’s worth also trying FQDN or IP address instead of NetBIOS name.

Additionally, try integrated security instead of alternate credentials… this means that you would launch BatchPatch using run-as, so that it’s running as the user that has administrator privileges, instead of adding “alternate credentials” for the host/row inside of the software.

Have a look at the following link for more info:
https://batchpatch.com/troubleshooting-errors-1611-64-1620-64-1611-2250-1620-2250

Additionally, consider going through the steps in this guide to see if you can pinpoint where things are failing: https://batchpatch.com/batchpatch-troubleshooting-guide

You could also try PAExec (free open source clone of PsExec) and see if any difference. In ‘Tools > Settings > Remote Execution’ you would change the ‘Use psexec custom filepath’ to point to the PAExec. Please note that when using ‘alternate credentials’ (not when using ‘integrated security’) PAExec sends them over the network obfuscated but not encrypted) PsExec (v2.x) encrypts them.

[pepinjo]

Thank you Doug for this quick update.

[pepinjo]

Hi Doug

Just giving you an update, I was able to have a work around, I still don’t know why the current way is not working anymore. I ran the application using the “run AS” with the admin account using to connect into all the domain controllers and the check update works.

Jon

[doug]

Very intersting! Thanks for the update. I’m glad you got it working. I don’t have any good ideas for why the original method would have stopped working. It’s particularly strange that it would stop working with a 2250 exit code and yet the run-as method works properly. Doesn’t make a lot of sense, but glad you have a solution/workaround.

[Author]

Posts