[booster]

Hi guys,

I get the same issue and fixed it with a manual download. However and to cover any further problem would it be possible to raise a warning inside BP when such occurs? Something like “not able to download the new cab file”?

My problem: the cab file is configured to be reused, on purpose for my environments. For some previous patching this issue was unnoticed, servers simply output “no applicable update”. As we use filtering etc. this is not completely weird (and happen sometimes) but here we missed some important KB. A simple warning would help.

thx!

[booster]

Some bulk idea that may help you:
Create a script to deploy on target computer. The script contains de installation command, the source share, and output the result to BP, a file or any code that can help. (logged output)

Considering an AD domain in such deployment an OU detection (executed on the target computer so) at first step and a list matching the share by OU is a nice to have.

A DFS share may help replicating the content on location too and avoid the location detection.

[booster]

Hi Doug and thank you for your answer. This is a solution indeed but I had to mention the reboot windows are determined. So for example ionly reboot during the lunchtime of between 08Pm and 10PM. If the updates were not installed to catch the 1st windows wait for the next one

In such way the solution is not applicable but it’s a start 🙂

[booster]

Hi doug,

Not side by side but well on the same server untouched between the BP update. There is definitely a link with an external check, whatever it is, as with full Internet access the issue is gone. The same version was slow with restricted Internet connectivity, opening slowness gone without the limitation. In the meanwhile it seems other issues were discovered with the firewall so I may not be the best example.

[booster]

May you first copy the script to the local computer then execute it inside the script?

This way only the BP user defined need access to the share.

[booster]

I’m in the same case as paulzbp. The load time of the BP application increased significantly with the latest release. I’m on W2016 dedicated server, estimation = 30 sec to open the application. during the 1st 5sec I see the Windows loading circle near the mouse cursor, then nothing for the rest of the time.

EDIT: My BP servers are only granted to a subset of sites. Removing this limit fixed the load time issue. Any IP/behaviour change that may explain it?

[booster]

Was just creating a topic for the same issue, will wait the fix

Thx doug

[booster]

Old thread but was helpful, so thx!

[booster]

Hi gnussbaum

In this APP/DB scenario my scenario include a script where all APP services are first stopped and disabled, then the SQL services if needed (or only this one if no issue with the apps). Then all servers are patched together (same multiple steps jobs for all). I’ve so a better control in case of trouble and the patching itself does no more need any dependencies.

chose the best scenario following your needs :).

[booster]

Available already:

– select all hosts to test

– windows updates>generate consolidated of update history. Select for example last 10 days and enable the filter including all WannaCry KB (one per line) for the OS you have. check in the footer the number of raw match the number of hosts to be sure everyone gave an answer.

you will have which KB was installed (matching the Os version), installation status, and reboot status if not yet done

Edit: a bit too late 🙂

[booster]

I simply used the KB selection and sort the by OS

– select all hosts>get information> OS (to sort by OS)

– method 2 https://batchpatch.com/remotely-install-only-a-subset-of-available-windows-updates

[booster]

Hi Doug,

thank you for the answer and consideration 🙂

[booster]

Happy to read it too, Thx Doug

[booster]

Hi guys,

I guess the result of investigations will be shared, I faced this issue on some environment, most of time it was an AV problem or somehow a precedent unfinished BP job

Removing the remote folder and follow the process on the target server (file/folder creation) was enough to get rid of it for me. Maybe the WUA agent too but I never faced it at this level.

Waiting for update

Booster

[booster]

Hi guys

Take care with the following:

Reboot (force, if required)

Wait for host to offline and come back online

The deployment may stuck if no reboot was required (no OFFLINE flag).

Regards

Booster

[booster]

Hi jwiseguy

Seems good :), additional comments below:

a) Step 9: did you get at this point automatic services no running? The server is rebooted during step 2, and maybe a second time at step5 and step7. So far, manually stopped services should already run, but maybe you faced an issue with some stopped services. If the answer is yes, can you please share the list of problematic services?

b) During last steps I often add “Get last boot time” to help troubleshooting, if necessary

C) loop2 and 3: my last runs point me to the following sequence:

Download and install updates + reboot if required

wait 1 min ##necessary for next step

Wait for host to be detected online ## to start the next “wait” after the reboot

wait 5 min ##if a 2nd reboot is initiated by a KB after the 1st one

This block is the one I use for each loop following the initial one. I’m sure yours will work too anyway

Regards

Booster

[booster]

Hi jwiseguy

In my personal environment maintenance windows are exceptions and I’m facing the same question. What I can add:

a) try to manage your AV software to reduce the time of KB install

b) The step “wuauclt.exe /resetauthorization /detectnow” was only necessary for server not able to end a “check for available updates” (done prior the maintenance windows), otherwise I use it only for debugging (check my post on this forum for my particular case)

c) The point 4, “1 min”, is “5 min” in my setup. the 1 min is not enough when:

-host is patched

-reboot initiated by BP

-the update process continue after the reboot and initiate itself a second reboot

When this sequence occurs, the “Wait for host to go offline and come back online” is passed sometimes before the second reboot and the sequence failed. The 5 min solved the problem

d) My sequence plans 3 loops of KB detection, but I’m not forcing the reboot during loop 2 and 3 (may be unnecessary if all done during the first loop). I means for your:

Starting point 5:

Download and install updates + reboot if required

wait 1 min ##necessary otherwise next step is sometimes detected during the reboot process

Wait for host to be detected online

wait 5 min ## see point c), same explanation

++ again the the process for the 3rd loop if necessary

Obviously these comments are not general and applies to the environments I manage, I hope something will be useful for you

Regards

booster

[booster]

Follow up:

The previous mentioned actions did not solved the problem, here below the steps needed in my case:

1/ open admin cmd.exe and type

DISM.exe /Online /Cleanup-image /Restorehealth

(https://support.microsoft.com/en-us/kb/947821?wa=wsignin1.0)

2/ wuauclt.exe /resetauthorization /detectnow

These steps were necessary after the following ones, successful but not solving the issue

– reboot

– sfc /scannow

– rename softwaredistribution folder

– WU agent update to last version (manual KB install)

– Windows update reset (https://support.microsoft.com/en-us/kb/971058)

– wuauclt.exe /resetauthorization /detectnow (without dism first)

Regards

Booster

[booster]

Hi Doug,

I let it run for more than 2 hours, not really endless but close ;). I’ve requested the maintenance, hope it will help.

thanks for your answer

Regards

Booster

[booster]

Hi Doug,

I agree, It occurs once on multiple BP server installed. Thanks for your consideration

Regards

Olivier

[booster]

Solved with the last release as announced

thx!

[booster]

Hi Doug,

I confirm the bug is gone, thx!!

[booster]

Hi folks,

McAfee has a default policy named “access protection”, it may be your problem. By default this AV block outgoing SMTP, starting script from temp folder, and protect system files.

If something was blocked, it should be displayed in the respective logs file of the application on the server itself, right click the policy give you the possibility to display the file.

Regards

Booster

[booster]

thx for the update doug

Regards

Booster

[booster]

Hi robbzz,

I just tested the report on multiple 2003 servers (Microsoft(R) Windows(R) Server 2003, Standard Edition 5.2.3790 (SP2) [X86-based PC]) and it works fine for me.

Regards

Booster

[booster]

My 2 cents about this: I get the same error message for this KB on systems not using BP but the regular windows update directly on Internet. Some others .NET updates follow, but I didn’t check the exact reason. Maybe a depreciated or specific one depending on installed KB

[booster]

+1 to have the possibility to export/import the job queue, and all remote/local saved commands.

BTW I exported concerned registry value, no problem for

SavedUserDefinedCommands_RemoteProcess

SavedUserDefinedRegularCommands_RemoteProcess

But when importing SavedUserDefinedJobQueues, the data value is blank. I guess it’s linked to the fact it’s a multiline REG_SZ?

I tried with the GUI and CLI, same result even when trying to export the whole key to a test profile

Regards

Booster

[booster]

hi Doug,

I confirm it’s solved.

thank you!

booster

[booster]

Hi Doug,

I restarted the BP server for this purpose: the setting seems to be ignored, the full reboot was not a problem so I proceeded. When starting the checks, I don’t see 1 copy+ all the other with “queued” status but well at least 10 copies (hard to catch during the process). However it will no more hurt my setup when the new update will come.

Thanks for the support/update

Regards

Booster

[booster]

Hi Doug,

A small update about this topic: “Settings > General > Concurrent File-Copy Operations Maximum.’ Setting this value to 1” does not make any change on the 100% CPU problem. I change it, rebooted the server (and BP so), and the copies start on multiple servers at a time what ever the set value.

Following my tests changing this value does not affect the behaviour, 100% only for this steps then all fine

Regards

Booster

[Author]

Posts