Infinite patch loop

[patrickt]

I have several machines which have been saying “1 update found” for the last two patch cycles, but when I go to the machine itself and check updates, no updates are found. All of these machines performed this months patches and rebooted successfully, but still insist there is an unapplied update. Most of these machines are Windows 7, but one is Windows server 2012 R2. I checked updates and I’m running the latest build of BatchPatch as of today.

I did not see a similar issue in my forum searches.

[doug]

What is the update that is available? Sometimes you might seen this with a Windows Defender definition update since there is a new one every day.

Also you can/should look at the ‘Remote Agent Log’ column or the BatchPatch.log file from the target computer to see what actually is taking place during the update process. Is there an update that is failing to apply? The failure will be visible in the log.

-Doug

[patrickt]

Well, that’s the problem, there is no update to be applied.

You’re right, it is a Windows defender update, but this is not each day, this is me going to the tool in a continous loop of:

Check for updates

1 update available

Download and install updates

Check for updates

1 update available

ad infinitum.

When I go to the physical machine and check updates, it says there are none, but batchpatch insists that there are. I’ve pasted the remote log below.

::Begin online search – Server Selection: Default

The search query “SoftwareOnly” returned 1 update(s):

1> Definition Update for Microsoft Security Essentials – KB2310138 (Definition 1.249.211.0) (343 MB) (2017-07-25) – Definition Updates

(Type-SoftwareUpdate | Downloaded-TRUE | RebootRequired-FALSE)

http://support.microsoft.com/kb/2310138

::End search

[doug]

Ok so we see that there is a definition update. And so now we need to see what the ‘Remote Agent log’ or the target computer C:Program FilesBatchPatchbatchpatch.log file says about the installation attempt, not just the search. If you do a “download and install updates” then there will be an entry for that in the log. It will show if the update was installed by BatchPatch or if it failed to install. If it failed to install, there will be a reason code.

I understand that you are saying that there is no update to be applied, but it seems that BatchPatch is finding an update. Just because you don’t see it in the Windows Update control panel on the target computer does not mean that it does not exist.

Also you can look at the history report in BatchPatch (‘Actions > Windows Updates > Generate consolidated report of update history’) which will show the application that has been applying this update in the past.

[patrickt]

So, I did a full cycle on one machine. The output from batchpatch logs is pasted at the bottom. It essentially shows that it succesfully downloaded and installed KB2310138 and then “found” it again when I did another search. Notice that the date this KB was issued is stamped as 7/25/17.

When I pull the consolidation report, however, attempts to install this KB go back to at least 2017-01-01 01:43:05.

Are all definition updates released under that KB number with just different signature definitions? Spot checking the machines, it appears that KB2310138 (Definition 1.249.211.0) is the one that is stuck across all of them. That definition goes back several iterations in the logs.

TOOLBOX 10/11/2017 08:47:02

****************************************************************

****************************************************************

TOOLBOX 10/12/2017 10:28:49

::Begin online search – Server Selection: Default

The search query “SoftwareOnly” returned 1 update(s):

1> Definition Update for Microsoft Security Essentials – KB2310138 (Definition 1.253.667.0) (230 MB) (2017-10-12) – Definition Updates

(Type-SoftwareUpdate | Downloaded-FALSE | RebootRequired-FALSE)

http://support.microsoft.com/kb/2310138

::End search

::Begin filtering collection

adding> Definition Update for Microsoft Security Essentials – KB2310138 (Definition 1.253.667.0)

::End filtering collection

::Begin download

1> Definition Update for Microsoft Security Essentials – KB2310138 (Definition 1.253.667.0) – Download Result: Succeeded

::End download

::Begin adding downloaded items to installer collection

adding> Definition Update for Microsoft Security Essentials – KB2310138 (Definition 1.253.667.0)

::End adding downloaded items to installer collection

::Begin installation

1> Definition Update for Microsoft Security Essentials – KB2310138 (Definition 1.253.667.0) – Installation Result: Succeeded. Reboot Required: FALSE

::End installation

Overall Installation Result: Succeeded

Reboot Required: FALSE

TOOLBOX 10/12/2017 10:30:03

****************************************************************

****************************************************************

TOOLBOX 10/12/2017 10:30:36

::Begin online search – Server Selection: Default

The search query “SoftwareOnly” returned 1 update(s):

1> Definition Update for Microsoft Security Essentials – KB2310138 (Definition 1.249.211.0) (343 MB) (2017-07-25) – Definition Updates

(Type-SoftwareUpdate | Downloaded-TRUE | RebootRequired-FALSE)

http://support.microsoft.com/kb/2310138

::End search

TOOLBOX 10/12/2017 10:31:03

[doug]

Yes, definition updates are the same KB number every time with a different definition number. Based on what you have shown me here and what you have said it appears that the issue is specific to Definition 1.249.211.0, because we see that Definition 1.253.667.0 installed successfully and then was not offered again. And it seems that the 1.249.211.0 is only offered/shown when no other definition update is offered/shown. The problematic update is, in fact, being offered by the Windows Update agent. BatchPatch is not “inventing” the update or pulling it from some cache. There are a couple of things I would suggest as a start.

0. Are you using WSUS? You should see if you can decline this particular definition update on your WSUS. If you are not using WSUS then skip to the next suggestion.

1. Note that you are currently searching for “all software updates” in BatchPatch. I suspect that the reason you do not see this update in the Windows Update control panel is because of the search scope. If you were to change your search preferences in BatchPatch (under ‘Tools > Settings > Windows Update’) to ‘Important’ and ‘Recommended’ instead of ‘all software updates’ I wouldn’t be surprised if you stopped seeing the update appear. In general, when not using WSUS we recommend using ‘Important’ and ‘Recommended’ to best mimic what Microsoft wants you to download/install on the computer.

2. You might simply be able to hide the update from appearing in BatchPatch search results. Following these instructions to hide the update in question might be sufficient.

Hiding Windows Updates Remotely In a Non-WSUS Environment

3. As a last resort I would think that you could uninstall/reinstall MSE on the target computers.

[patrickt]

I am using WSUS and I’ve declined that update. 3 of the servers have accepted their fate. I’ll try the rest again tomorrow.

[patrickt]

All workstations are happy now, thanks for the help.

[doug]

Excellent. Thanks for letting me know. You’re welcome.

-Doug

[Author]

Posts