[amartin]

Unfortunately this problem has returned. I was able to successfully install security updates on a number of Windows 7 Pro machines last week using BatchPatch. Note that these machines are joined to an AD domain and I am running BatchPatch as a user who is in the local “Administrators” group on all machines (using “Option 1” as documented here). However, attempting to perform the same operation (Download and install updates + reboot if required) failed instantly on all machines. Here’s an example error log:

Tue-20:50:05> CPU Info: Error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Tue-20:50:03> CPU Info: Attempting to retrieve CPU info...

Tue-20:48:09> Executing TaskKill /F /S COMPUTER1 /IM BatchPatchRemoteAgent.exe

Tue-20:47:13> CPU Info: Error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Tue-20:47:12> CPU Info: Attempting to retrieve CPU info...

Tue-20:46:34> Executing TaskKill /F /S COMPUTER1 /IM BatchPatchRemoteAgent.exe

Tue-20:45:39> Waiting for host to go offline and come back online...

Tue-20:45:39> Job Queue: Initiating 'Wait for host to go offline and come back online'

Tue-20:45:39> Windows Update: Error 1601: Failed to retrieve WMI info. Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Tue-20:45:38> Windows Update: Initializing...

Tue-20:45:38> Job Queue: Initiating 'Download and install updates + reboot if required'

Tue-20:45:38> COMPUTER1 is now responding to WMI requests...

Tue-20:44:48> COMPUTER1 ONLINE

Tue-20:44:25> COMPUTER1 OFFLINE

Tue-20:43:31> Remote Command: Exit Code: 0 (SUCCESS)

Tue-20:43:16> Remote Command: Executing  \COMPUTER1  shutdown.exe /r /f /t 0

Tue-20:43:16> Remote Command: Establishing connection...

Tue-20:43:14> Reboot (shutdown.exe /r /f /t 0): Queued...

Tue-20:31:37> Waiting for host to go offline and come back online...

Tue-20:31:37> Job Queue: Initiating 'Wait for host to go offline and come back online'

Tue-20:31:36> Windows Update: Error 1601: Failed to retrieve WMI info. Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Tue-20:31:36> Windows Update: Initializing...

Tue-20:31:36> Job Queue: Initiating 'Download and install updates + reboot if required'

Tue-20:29:29> Windows Update: Update/Reboot Cycle: Queued...

Other tools that also use WMI like PDQ Deploy work fine on these machines still. I also tried disabling Windows Firewall on some of these machines but there was no improvement in behavior. It seems like one of the Windows Updates I installed last week is now blocking BatchPatch from being able to access these machines. I already followed the debugging steps on this page to no avail. What else can I try to get BatchPatch working again? Thanks!

[amartin]

Hi Doug,

Thanks for the suggestions. I am not using WSUS, so I could hide the updates, but I am concerned about the case you mentioned where Microsoft re-releases an update. In addition to the GWX updates, I’m also concerned about the telemetry updates backported to Windows 7, so I think I need to keep excluding them since as far as I know there’s no official Microsoft way to block them.

I’m fine just manually entering an exclusion list each time – just thought I’d check if there was a better way. Thanks!

[amartin]

Hi Doug,

Great, this looks like exactly what I am looking for!

[amartin]

Hi Doug,

Thanks for the update! An update on my testing and evaluation – clearing the remote directory via ‘Tools > Delete remote working directory’ worked and I was able to successfully scan for updates (although the remote command you posted would be more precise). I then switched to online mode as you suggested (no cached and no offline), installed the two KBs mentioned in the link you posted to fix slow checking for updates, and re-ran “Download and install updates” in online mode. It seemed to work well, finishing installing updates in 2-3 hours on all machines so I think things are working well!

One question I do have – if I use “Download and install updates + reboot if required”, will it reboot the Windows computer multiple times and keep checking for updates until it is 100% good (since it seems checking for updates after a reboot can find additional updates to install) or would I need to create a scheduled task with a series of “Download and install updates + reboot if required” chained together to achieve this effect?

I plan on purchasing a BatchPatch license soon – thanks for all of your great support!

[amartin]

Hi Doug,

Thanks for the help! I deleted C:Users<user>AppDataLocalCocobolo_Software,_LLCBatchPatchcachewsusscn2.cab from the machine where I have BatchPatch, however even after doing that and re-running I still got the “failed to add scan package service” error. I then went and deleted the copy of wsusscn2.cab that was on the clients in C:Program FilesBatchPatch (it was still the old version) and after doing that it looks like it is working! Is there a way to clear the Remote Working Dir (C:Program FilesBatchPatch) since that’s where the corrupt copy of wsusscn2.cab lives on the remote machines? It would be nice to be able to clear it out from all of them at once.

Regarding offline + cached mode, which updates are not available via this method? I am really only interested in security updates, so as long as those are all available via this method, it should be fine for my use case. The reason why I am trying offline + cached is I have found the Windows Update “check for updates” task to take many hours to complete on some clients. I think this is just due to inefficiencies in Windows Update and attempting to retrieve the list of updates calculate the difference of which updates to apply vs which are installed. I was hoping that the offline mode might be faster in this case since it’s just comparing to a local file.

[Author]

Posts