{"id":5511,"date":"2022-01-06T22:35:29","date_gmt":"2022-01-06T22:35:29","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=5511"},"modified":"2022-03-06T22:38:54","modified_gmt":"2022-03-06T22:38:54","slug":"windows-update-issues","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/windows-update-issues","title":{"rendered":"Windows Update issues"},"content":{"rendered":"

\u00a0<\/p>

The preference is to install patches prior to our automated patching. If this isn\u2019t possible, remove the above servers from the current automated patching schedule, and re-add the next day.<\/p>

\u00a0<\/p>

The Update\u00a0<\/b>Process<\/p>

OS<\/p><\/td>

Bad KBs<\/p><\/td>

Fixed KB<\/p><\/td><\/tr>

2022<\/p><\/td>

KB5009555<\/span><\/b><\/p><\/td>

KB5010796<\/a><\/p><\/td><\/tr>

2019<\/p><\/td>

KB5009557<\/span><\/b><\/p><\/td>

KB5010791<\/a><\/p><\/td><\/tr>

2016<\/p><\/td>

KB5009546<\/span><\/b><\/p><\/td>

KB5010790<\/a><\/p><\/td><\/tr>

2012 R2<\/p><\/td>

KB5009624\u00a0(CU)<\/span><\/p><\/td>

KB5010794<\/a><\/p><\/td><\/tr>

2012<\/p><\/td>

KB5009586 (CU)<\/span><\/p><\/td>

KB5010797<\/a><\/p><\/td><\/tr>

2008 R2<\/p><\/td>

KB5009610 (CU)<\/span><\/p><\/td>

KB5010798<\/a><\/p><\/td><\/tr>

2008<\/p><\/td>

KB5009627 (CU)<\/span><\/p><\/td>

KB5010799<\/a><\/p><\/td><\/tr><\/tbody><\/table>

\u00a0<\/b><\/p>

Do not use the windows update GUI. This will install the bad patch and force a reboot, likely leaving you with a boot loop. If you forget and get stuck in a boot loop, there is a recovery process below. The other reason to not use the windows update UI is the fixed KBs are only downloaded if you have the \u2018download updates for other Microsoft products\u2019 ticked.<\/p>

\u00a0<\/p>

I highly recommend downloading these prior to the outage window as they\u2019re circa 1.5GB and will take up to 3 hours to install.<\/p>

  1. If the server you are patching is 2016 or newer \u00a0\u2013 skip the dodgy KB and jump straight to downloading and installing the fixed KB. These patches are cumulative and will save you a patching cycle.<\/li>
  2. If the server you are patching is 2012 R2 or below \u2013 download both the dodgy KB and the fixed KB. Install the dodgy KB and then the fixed KB. Do not reboot when the dodgy KB prompts to, ignore it and install the second update.<\/li>
  3. Confirm in the windows update history that the server reports the fixed patch installed.<\/li>
  4. Perform a normal scan\/install for updates to capture anything outside of this patch such as PowerShell updates etc.<\/li><\/ol>

    \u00a0<\/p>

    So I used the GUI to install the update or rebooted between patches and the server is in a boot loop – what now?<\/p>

    1. Try to log in straight after the server reboots and stop the netlogon service. This will sometimes prevent the lsass service from crashing and give you time to install the fixed KB.<\/li>
    2. Boot a windows ISO and load the recovery prompt under advanced and enter the following commands.<\/li><\/ol>

      Diskpart<\/span><\/p>

      List volume\u00a0# use the ltr column to determine the drive letter for the below command<\/span><\/span><\/p>

      exit<\/span><\/p>

      dism \/image:D:\\ \/Remove-Package \/PackageName:XXXXXXX\u00a0<\/span>#where XXXX is the KB from above.<\/span><\/p>

      1. If the above fails or you are uncomfortable running the dism commands, call the TSO<\/li><\/ol>

        \u00a0<\/p>

        Lastly if N-Able has been on the server at some point it\u2019ll have disabled the windows update GUI. Check patch management isn\u2019t enabled in n-able, if it\u2019s not use the PowerShell script below to clean up the relevant registry keys. If there is a GPO in place and we rip something out we shouldn\u2019t, it will reapply in <15 minutes.<\/p>

        \u00a0<\/p>

        $ErrorActionPreference = ‘Continue’<\/span><\/p>

        Remove-ItemProperty ‘HKLM:\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate’ -Force -Name WUServer<\/span><\/p>

        Remove-ItemProperty ‘HKLM:\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate’ -Force -Name TargetGroup<\/span><\/p>

        Remove-ItemProperty ‘HKLM:\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate’ -Force -Name WUStatusServer<\/span><\/p>

        Remove-ItemProperty ‘HKLM:\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate’ -Force -Name TargetGroupEnable<\/span><\/p>

        Set-ItemProperty ‘HKLM:\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU’ -Value 0 -Force -Name UseWUServer<\/span><\/p>

        Set-ItemProperty ‘HKLM:\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU’ -Value 0 -Force -Name NoAutoUpdate<\/span><\/p>

        Set-ItemProperty ‘HKLM:\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate’\u00a0\u00a0\u00a0 -Value 0 -force -Name DisableWindowsUpdateAccess<\/span><\/p>

        Restart-Service -Name wuauserv<\/span><\/p>","protected":false},"excerpt":{"rendered":"

        \u00a0The preference is to install patches prior to our automated patching. If this isn\u2019t possible, remove the above servers from the current automated patching schedule, and re-add […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3768,3766,3767,3770,3771,3769,3772,3773,3765,3774,3764,3775,3776,3777],"class_list":["post-5511","post","type-post","status-publish","format-standard","hentry","category-research","tag-kb5009546","tag-kb5009555","tag-kb5009557","tag-kb5009586","tag-kb5009610","tag-kb5009624","tag-kb5009627","tag-kb5010790","tag-kb5010791","tag-kb5010794","tag-kb5010796","tag-kb5010797","tag-kb5010798","tag-kb5010799"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/5511","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/comments?post=5511"}],"version-history":[{"count":2,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/5511\/revisions"}],"predecessor-version":[{"id":5603,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/5511\/revisions\/5603"}],"wp:attachment":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/media?parent=5511"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/categories?post=5511"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/tags?post=5511"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}