- This topic has 3 replies, 2 voices, and was last updated 7 years, 9 months ago by .
-
Posts
-
Alright, so I read the previous post about how it is most likely the cab file that is the problem. Here is the situation. I am attempting to patch machines over the network on a switch that is not connected to the internet, I’ve created my own network to push these updates.
My cache and batchpatch are all on an external drive that I am plugging into one computer on the switch. This computer is able to read the updates, connect and push out, however shortly after copying over the cab file it doesn’t carry over the digital signature which is partially why I think the install is failing.
Is there anything we can do to get these to carry over short of downloading a new cab file (which we cannot do on this particular computer).
Any help is greatly appreciated.
Error -198 comes with an HRESULT value. The HRESULT is the value that tells us what the actual reason for the failure is. So, without knowing for sure what the reason is, the fix is harder to determine. However, generally speaking the -198 error usually means that there is a problem with the WsusScn2.cab file. One of the possible problems with this file could be that it is missing a valid signature. You can look at the WsusScn2.cab file in your BatchPatch cache folder to see if has a valid signature. Simply right click on the file and view the properties. In the properties there will be a tab titled “Digital Signatures.” If this tab does not exist, then there is no digital signature on the file. If the tab exists but the signature is bad, then it will tell you that. Either of those situations will cause the -198 error to occur. The signature is not being lost during the file copy on your network. It’s just not on the file in the first place. This is why you need to re-download the file and make sure it has a signature.
If you want a way to auto-redownload and verify signature, BatchPatch can do that. However, in the current version it only does it in one part of the app, which is not the part of the app that you previously used to download it. If you use ‘Tools > Download offline updates repository’ and then check one box from each section in the window that it presents, it will download the WsusScn2.cab file and verify the signature before continuing. Once it downloads successfully you can just quit the window so that it doesn’t do anything else. If it cannot validate the signature it will redo the download until it gets a good file. This way you can just let it keep looping on its own until it gets a good download. Alternatively you can manually download the file from Microsoft using this link: http://go.microsoft.com/fwlink/?LinkId=76054 and then manually check the file properties to make sure there is a valid signature.
In the next version of BatchPatch the other areas of the software that download the WsusScn2.cab file will also validate the signature, but in the current version they don’t do that. They just verify that the download completes successfully, which is unfortunately not enough because it seems that Microsoft is sometimes posting WsusScn2.cab files that do not contain valid signatures. We have been seeing this occur occasionally for the past 6 months. Prior to that it never happened before, which is why the other areas of the app were never written to validate the signature. It was never necessary in the past because simply validating that the download was successful was enough. However, starting about 6 months ago we started seeing Microsoft sometimes have unsigned files on their servers, and so we now need to also verify the signature to make sure it’s good. In our experience, when you repeatedly download the file you will eventually connect to a server that has a signed file.
-Doug
This is related to the user account and permissions. I have never seen this particular HRESULT before… is it really 2147022987 or is it actually -2147022987 ? Makes a huge difference when you leave out the negative. I suspect it’s the latter with the negative, which translates to 80070775 for Windows and according to some googling would appear to mean that the user account is locked out or something else related to the user account not being active or permissioned properly.
-Doug
- You must be logged in to reply to this topic.