Some Notes on the Machines

From the indefatigable Matt Quick:

Sometimes, trying to install .NET 3.5 either via Add/Remove Programs or via the standalone offline installer produces an error code. This is due to WSUS not having the files for .NET 3.5. Use the following workaround to avoid taking the machine off the domain, installing .NET 3.5, then putting it back on the domain:

This worked for me. Windows has to download the 3.5 installation files, but the server is configured not to use Windows Update (common for managed servers), but WSUS. The above article describes how to fix this. In a nutshell:

1. Start the Local Group Policy Editor or Group Policy Management Console.
2. Expand Computer Configuration, expand Administrative Templates, and then select System.
3. Open the Specify settings for optional component installation and component repairGroup Policy setting, and then select Enabled.
4. Select the Contact Windows Update directly to download repair content instead of Windows Server Update Services (WSUS) check box.

Make sure Windows Updates Service is set to Manual or Automatic to apply this fix.

Right from the source:

https://www.catalog.update.microsoft.com/Search.aspx?q=KB4012216

Here it is:

http://www.portableupdate.com/

When going to version 1607 of 10, it is reportedly supposed to be automatic:

https://blogs.windows.com/windowsexperience/2016/08/02/how-to-get-the-windows-10-anniversary-update/

but can be done by ISO:

https://answers.microsoft.com/en-us/windows/wiki/windows_10-windows_install/how-to-upgrade-to-windows-10-anniversary-update/fab99802-4358-49d9-8278-e9664cd56311

A 539-megabyte monster! Appears to be designed to solve lots of problems.

https://www.microsoft.com/en-us/download/details.aspx?id=20858

A very nice downloader provided by Microsoft:

https://www.microsoft.com/en-us/software-download/windows8

This has been happening on long-installed machines for quite a while. But in the last week, four different sets of Windows 7 64-bit install media, over seven different reloads, have had Windows Update get stuck, or freeze, while searching for Windows updates, eating 100% of one CPU core. Several changes in reload pattern were attempted, some of which included WSUSoffline, without success. Profoundly expert help provided the following. Before deliberately attempting Windows Update, we are to install these, in this order:

1. Servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1: September 20, 2016:
   https://support.microsoft.com/en-us/kb/3177467

2. July 2016 update rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1:
   https://support.microsoft.com/en-us/kb/3172605

3. September 2016 update rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1:
   https://support.microsoft.com/en-us/kb/3185278

Windows Update may get stuck again, searching for new updates, the first time any of the above is attempted. If this occurs, each time, we do this:

1. In TASKMGR, terminate process wusa.exe
2. Restart service wuauserv
3. Try the install again.

The second time we do each install (after the termination and service restart), the popup for searching for Windows updates comes up for 3-10 seconds, and then we are asked whether we want to install. We then say yes, and it installs. Then we move to the next one of the three!

Some Windows Update issues are permissions problems, which can be fixed using a method involving SUBINACL:

https://support.microsoft.com/en-us/kb/968003#/en-us/kb/968003

Yet something newer than the below, the Windows Update Automated Troubleshooter:

https://support.microsoft.com/en-us/gp/windows-update-issues/en-us

Microsoft is now providing an interesting toolset for Windows Update issues on current operating systems:

http://support.microsoft.com/common/survey.aspx?scid=sw;en;3779&showpage=1

And another Fix-It:

http://support.microsoft.com/kb/968002

And something to install, the SDK, which contains Windows Installer 4.5 and possibly 5.0 too:

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=c17ba869-9671-4330-a63e-1fd44e0e2505&displaylang=en

The below are our previous methods, from the indefatigable Mike Hunsinger. It is best to try level 1, see if that fixes, go to level 2. Both of these are done in administrative command prompts.

Level 1.

1. Stop services:
   net stop bits
net stop wuauserv
net stop appidsvc
net stop cryptsvc
2. Rename folders:
   ren %systemroot%\SoftwareDistribution SoftwareDistribution.bak
ren %systemroot%\system32\catroot2 catroot2.bak
3. Start services:
   net start bits
net start wuauserv
net start appidsvc
net start cryptsvc
4. If in Windows Vista or Server 2008 R1: bitsadmin /reset /allusers

Level 2.

1. Stop services:
   net stop bits
net stop wuauserv
net stop appidsvc
net stop cryptsvc
2. Deletions:
   Del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"
3. Registrations:
   cd /d %windir%\system32
regsvr32.exe atl.dll
regsvr32.exe urlmon.dll
regsvr32.exe mshtml.dll
regsvr32.exe shdocvw.dll
regsvr32.exe browseui.dll
regsvr32.exe jscript.dll
regsvr32.exe vbscript.dll
regsvr32.exe scrrun.dll
regsvr32.exe msxml.dll
regsvr32.exe msxml3.dll
regsvr32.exe msxml6.dll
regsvr32.exe actxprxy.dll
regsvr32.exe softpub.dll
regsvr32.exe wintrust.dll
regsvr32.exe dssenh.dll
regsvr32.exe rsaenh.dll
regsvr32.exe gpkcsp.dll
regsvr32.exe sccbase.dll
regsvr32.exe slbcsp.dll
regsvr32.exe cryptdlg.dll
regsvr32.exe oleaut32.dll
regsvr32.exe ole32.dll
regsvr32.exe shell32.dll
regsvr32.exe initpki.dll
regsvr32.exe wuapi.dll
regsvr32.exe wuaueng.dll
regsvr32.exe wuaueng1.dll
regsvr32.exe wucltui.dll
regsvr32.exe wups.dll
regsvr32.exe wups2.dll
regsvr32.exe wuweb.dll
regsvr32.exe qmgr.dll
regsvr32.exe qmgrprxy.dll
regsvr32.exe wucltux.dll
regsvr32.exe muweb.dll
regsvr32.exe wuwebv.dll
4. Reset networking:
   netsh winsock reset
5. Reconfigure proxy settings:
• If on XP: proxycfg.exe -d
• If not on XP: netsh winhttp reset proxy

6. Start services:
   net start bits
net start wuauserv
net start appidsvc
net start cryptsvc
7. If in Windows Vista: bitsadmin /reset /allusers
8. Install the latest Windows Update Agent.
9. Reboot.

We have the System Update Readiness tool for workstations and DISM for servers:

http://support.microsoft.com/kb/947821

For Vista/2008 SP1 and up through 8.1/2012R2 so far. One heads-up: according to this article by a Microsoft developer, it will take about 10 minutes to run, it takes the form of “checksur.exe”.