Some Notes on the Machines

The “Update” button on this page delivers a method faster than most:

https://www.microsoft.com/en-in/software-download/windows10

This is something new to Windows 10/2016, a C runtime library different than the redistributables. It is a required additional install for some things to run on OS before 10/2016.

www.microsoft.com/en-us/download/details.aspx?id=50410

Here is the only complete method known to this writer to automatically download and install all current Microsoft redists. It uses this:

https://www.powershellgallery.com/packages/VcRedist

Steps:

1. You’ll need the PowerShell Gallery. Windows 10 and WMF 5.1 come with it.

2. If you have 10, or once you have WMF installed, you can just run GETREDISTS.CMD (part of windows-tools ) as administrator. Alternatively, you can continue :-)

3. VcRedist is the core, we’ll install that automatically as part of the procedure. In administrative PowerShell (the -Force takes in any new updates):

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force
Install-PackageProvider -Name NuGet -Force
Install-Module -Name NuGet -SkipPublisherCheck -Force
Import-Module -Name NuGet
Install-Module -Name VcRedist -SkipPublisherCheck -Force
Import-Module -Name VcRedist
New-Item C:\VcRedist -ItemType Directory
Get-VcList | Get-VcRedist -Path C:\VcRedist
Get-VcList | Install-VcRedist -Path C:\VcRedist

The above installs all of the redistributables which Microsoft currently supports. Reportedly, some older ones (going back to 2005 at this writing) can be had using this:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force
Install-PackageProvider -Name NuGet -Force
Install-Module -Name NuGet -SkipPublisherCheck -Force
Import-Module -Name NuGet
Install-Module -Name VcRedist -SkipPublisherCheck -Force
Import-Module -Name VcRedist
New-Item C:\VcRedist -ItemType Directory
Get-VcList -Export All | Get-VcRedist -Path C:\VcRedist
Get-VcList -Export All | Install-VcRedist -Path C:\VcRedist

You may wish to delete the downloadables after the procedure:

Remove-Item C:\VcRedist -Recurse -Force

If Windows Updates says it’s controlled by system administration and not you, check all three of these:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate 

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer

You’ll probably see a DWORD preventing access. Delete it and try again.

No keys of course, but ISO media indeed, and very helpful for DISM and other fixes:

https://support.microsoft.com/en-us/help/15088/windows-create-installation-media

If the Windows Installer method doesn’t work, ESET has a tool. It does have to be run with the OS in safe mode:

https://support.eset.com/kb2289/?locale=en_US&viewlocale=en_US

Another from Matt the Quick:

By default, WSUS does not have .NET 3.5 available to install. This creates issues when .NET 3.5 is needed after a machine has joined the domain. Below is the workaround steps to install .NET 3.5 using the operating system ISO and not Windows Update or WSUS.

• Mount the ISO of the operating system. The Server 2016 ISO is known to work for this.
• Open an Administrative Command Prompt and run the following command:
  
  dism /online /enable-feature /featurename:netfx3 /all /source:D:\sources\sxs /limitaccess
  
  NOTE: The Source flag will have to be changed to reflect the Sources\sxs folder on your installation media. This is likely going to be the D drive (as in the example above), but it’s possible your results may differ slightly.
• Reboot machine.

From the indefatigable Matt Quick:

Sometimes, trying to install .NET 3.5 either via Add/Remove Programs or via the standalone offline installer produces an error code. This is due to WSUS not having the files for .NET 3.5. Use the following workaround to avoid taking the machine off the domain, installing .NET 3.5, then putting it back on the domain:

This worked for me. Windows has to download the 3.5 installation files, but the server is configured not to use Windows Update (common for managed servers), but WSUS. The above article describes how to fix this. In a nutshell:

1. Start the Local Group Policy Editor or Group Policy Management Console.
2. Expand Computer Configuration, expand Administrative Templates, and then select System.
3. Open the Specify settings for optional component installation and component repairGroup Policy setting, and then select Enabled.
4. Select the Contact Windows Update directly to download repair content instead of Windows Server Update Services (WSUS) check box.

Make sure Windows Updates Service is set to Manual or Automatic to apply this fix.

Right from the source:

https://www.catalog.update.microsoft.com/Search.aspx?q=KB4012216

Here it is:

http://www.portableupdate.com/