6 Replies Latest reply on Feb 23, 2018 1:06 PM by ddenning

    Problems with Windows 1709 and Agent patching

    MashK Rookie

      Hi All,

       

      I've been experiencing the a problem with the recent February rollup patches for Windows 1709 (KB4074588). Namely, they fail to install. That's more of a Windows issue than an Ivanti  issue as it doesn't matter what method I install them with.

       

      My problem is I'm installing via agent, patches install, machine reboots and does a post patch scan so I can see what patches have been applied. On the post install scan it picks up the failed patch as missing and then attempts to install it again, where the same thing happens. I know in the agent policy I can disable the reboot, but I don't want to do that as I want the patch applied. On the other hand it's going to be a pain for the user concerned with this perpetual patch cycle.

       

      Any ideas?

       

      Thanks,

       

      Mashood

        • 1. Re: Problems with Windows 1709 and Agent patching
          MashK Rookie

          Also, I can't see where to cancel the postpatch scan in the agent configuration.

          • 2. Re: Problems with Windows 1709 and Agent patching
            ddenning SupportEmployee

            Hi,

             

            Thank you for posting your question. This issue appears to be caused by a problem with the January delta patch so we pulled the January delta from our xml to prevent further corrupt states. If you have the delta installed (which is most likely the case) then you will need to repair/uninstall the January delta and install the full January or February cumulative update. You might need to use the DISM tool repair on the system to completely restore the good state https://www.windowscentral.com/how-use-dism-command-line-utility-repair-windows-10-image

             

            Regarding your agent question. Once you start a task the only thing you can do is stop the task.

             

            Thanks!

             

            David

            • 3. Re: Problems with Windows 1709 and Agent patching
              bhelm1 Rookie

              I have several machines that will not accept the patch (KB4074588) when pushed from Shavlik, but if I navigate to the Patches directory on those machines and run the patch it installs successfully, no repairs or uninstall needed.  Looking for a way to resolve this, would like to avoid touching every workstation manually!

               

              Edit: Mileage may vary with this.  After posting this reply I tried on 2 other machines and was unsuccessful in installing the updated directly from the machine.  On these machines I uninstalled the January patch, ran a DISM Restore Health and the update still errors out.

               

              Thanks,

              Brad

              • 4. Re: Problems with Windows 1709 and Agent patching
                ddenning SupportEmployee

                Hi,

                 

                Thank you for your reply to this post.

                 

                You are saying that after uninstalling the delta and running the DISM tool, you are not able to install KB4074588? If so, please submit a support case for this at support.ivanti.com and feel free to request David. With the case, please submit a DPDTrace DPDTrace GUI Tool: Used to troubleshoot patch detection issues from a target machine that you uninstalled the delta from and ran the DISM tool on but cannot install KB407588.

                 

                Thanks

                 

                David

                • 5. Re: Problems with Windows 1709 and Agent patching
                  ddenning SupportEmployee

                  Hi Brad,

                   

                  As is mentioned in this post error 0x80092004  trying to deploy kb4074588 windows 10 x64 :

                   

                  We can reproduce the issue by installing 4056892 and verifying it shows installed 2 times.  Our conclusion is the issue is caused by a defective Microsoft delta patch. Currently there are no fixes that we are aware of as uninstalling the patch is unsuccessful, all tooling like DISM, SGC and fixit tools are ineffective. We have yet to find a method to fix the issue 4056892 is causing and have also filed a defect with Microsoft.We are actively monitoring Microsoft's patch feed for a patch that repairs machines in this state and will release it into the XML feed the day it is released.

                   

                  We are prompting all customers with this issue to contact Microsoft, we will post an update if we get updates through their cases.

                   

                  Please let us know what Microsoft replies with and I will update this post with any new information.

                   

                  Thanks!

                   

                  David

                  • 6. Re: Problems with Windows 1709 and Agent patching
                    ddenning SupportEmployee

                    Official Statement:

                     

                    We have had multiple customers reporting a problem with deploying the delta version of MS18-02-W10 (KB4074588), the Cumulative Update for Windows 10 and Windows Server 2016: February 13, 2018. We are aware of the issue and have concluded that it is caused by a defective Microsoft delta patch. Currently there are no fixes that we are aware of as uninstalling the patch is unsuccessful. We have submitted this as a bug to Microsoft through some of our back channels. We are also actively monitoring Microsoft's patch feed for a patch that repairs machines in this state and will release it into the XML feed the day it is released.

                     

                    We have seen this problem fixed by the following steps, but would suggest caution performing as we are not aware if it will cause any other problems:

                     

                    1. Uninstall all instances of 4056892. This will bring the build back to 16299.15 (rtm)

                    2. Perform an in-place upgrade using the RTM ISO 16299.15 (rtm), choose keep all settings.

                    3. Install the February update 4074588.