Windows Update: Error 1611: 5. Failure

[Chris]

Hello. I’m working off the eval copy as a proof of concept for patch management for my organization. We have WSUS set to download the updates, and I’m hoping to use BatchPatch to install the updates from a central location instead of having to log in to each machine. I’ve had some success on a few machines, but several machines are giving me the “Windows Update: Error 1611: 5. Failure” message. Here is the Windows Update Message I am receiving:

Windows Update Messages

Error 1611: 5. Failure – 11:56:23

Download/Install Filter

Include:

kb4012212

kb4012215

kb4012213

kb4012216

kb4012214

kb4012217

All Messages

Wed-11:56:23> Windows Update: Error 1611: 5. Failure

Wed-11:56:23> Windows Update: Failed to obtain result. Could not find file ‘\tpa-sftp-01bC$Program FilesBatchPatchBatchPatchTempResult.log’.

Wed-11:56:03> Windows Update: Executing BatchPatchRemoteAgent.exe…

Wed-11:56:02> Windows Update: Attempting to initiate Windows Update (Action: Install downloaded updates: ‘SoftwareOnly’) …

Wed-11:56:02> Windows Update: Establishing connection…

Wed-11:56:02> Windows Update: Initializing…

Wed-11:56:02> Windows Update: Queued… (Install downloaded updates)

Wed-11:50:22> Windows Update: Error 1611: 5. Failure

Wed-11:50:22> Windows Update: Failed to obtain result. Could not find file ‘\tpa-sftp-01bC$Program FilesBatchPatchBatchPatchTempResult.log’.

Wed-11:50:02> Windows Update: Executing BatchPatchRemoteAgent.exe…

Wed-11:50:02> Windows Update: Attempting to initiate Windows Update (Action: Install downloaded updates: ‘SoftwareOnly’) …

Wed-11:50:02> Windows Update: Establishing connection…

Wed-11:50:02> Windows Update: Initializing…

Wed-11:50:02> Windows Update: Queued… (Install downloaded updates)

Wed-11:46:32> Windows Update: Error 1611: 5. Failure

Wed-11:46:32> Windows Update: Failed to obtain result. Could not find file ‘\tpa-sftp-01bC$Program FilesBatchPatchBatchPatchTempResult.log’.

Wed-11:46:12> Windows Update: Executing BatchPatchRemoteAgent.exe…

Wed-11:46:12> Windows Update: Attempting to initiate Windows Update (Action: Install downloaded updates: ‘SoftwareOnly’) …

Wed-11:46:12> Windows Update: Establishing connection…

Wed-11:46:12> Windows Update: Initializing…

Wed-11:46:12> Windows Update: Queued… (Install downloaded updates)

there is no folder on any of these servers called “servernamec$program filesbatchpatch

I do not see any entries in the event log after attempting to perform updates.

Any advice?

[doug]

This appears to be a permissions problem. Windows System Error code 5 means ERROR_ACCESS_DENIED. What is peculiar in this particular example is that normally if there is a permissions problem BatchPatch will spit out an ‘Access Denied’ error before ‘Executing BatchPatchRemoteAgent.exe.’ However, what you are seeing indicates that the failure occurs later, at an unexpected place, which would seem to indicate that there are partial permissions but not complete permissions. If you are not seeing a C:Program FilesBatchPatch folder on the target computer, then it would indicate that BatchPatch was not able to create folder, though again that seems slightly odd only because normally BP would try to create that folder and then say ‘Access Denied’ if it couldn’t. Whereas based on what you are reporting the failure occurs later AND the folder still does not exist. Please start by going through the steps in the troubleshooting guide. This should help reveal where exactly the problem is occurring. Report back with your results.

Thanks,

Doug

[Chris]

Thanks for the speedy response. I’m following your troubleshooting guide. Step 1 is good, I can retrieve information with the Get Information actions. Step 2 seems to still be where the problem is. I confirmed that the Program Files folder has full permissions for domain admins, but received the same error and the folder was still not created. I then tried creating the BatchPatch folder manually and giving my account specifically direct access to it. I get the same Error 1611:5 message, but there are 2 files in the folder. The log file says there are no applicable updates in the filtered collection. I’m curious why the error message then? I’ve run the filtered list against other machines and had it simply state no applicable updates in the filtered collection.

[doug]

Chris – It still sounds like there is something weird happening with permmissions. From the computer that is running BatchPatch are you able to reach the target computer by going to “start > run” and then typing:

\targetComputerNameGoesHereC$Program FilesBatchPatch

What happens when you do that? Also please go through all of the steps in the troubleshooting guide to see which other steps you can or cannot complete successfully.

-Doug

[Chris]

Thanks again. I spent some more time on it after going through your steps and figured out that on some computers the psexec service would not start, and on the machines where BatchPatch was working, the service was running fine. Turns out our security team had disabled the service in some of their policies. I’m having it turned back on and will let you know how the results are.

[doug]

Excellent. I’m glad you made some progress.

-Doug

[pchamorro]

I’m getting similar error messages. I don’t know exactly what is the problem yet. All what I know is that it’s a psexec issue 🙁

[andreasL]

hi pchamorro, we had the same problem of some servers in our environment. for us, the reason was the virus-scanner (in our case sophos). some servers got different scan-policies and some policies configured a block of psexec/psexesvc. after reconfig, whitelist and unlock the application ban for psexec/psexesvc, it works well on all our servers.

maybe, thats a hint for you.

greetings from germany

[doug]

Another option that might work is to use the following setting in BatchPatch:

Tools > Settings > Remote Execution > Use PsExec -r switch to specify remote service name

This setting allows you to modify the remote service name that is used by psexec from psexesvc to BatchPatchExeSvc or any other custom name of your choice. In the case where anti-virus or other security related software is blocking the remote service from running, changing the name of the remote service with this setting can bypass the restriction for some of those applications without having to add psexesvc to a whitelist.

[andreasL]

hello doug, thank you for this hint. nice option to bypass the restriction.

out of interest, we will test this solution, soon.

[doug]

Thanks, Andreas. Let me know how it goes.

-Doug

[Author]

Posts