|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
This is a discussion from Standalone installer script for Windows 7 ESU, regardless the license.
I’m trying to catch up on the patches (have several Windows 7 systems to maintain) and am hitting a snag with the September 2020 patches. After right-clicking on the W7ESUI.com and OK’ing the UAC prompt, I’m getting the following error:
What am I doing wrong? This had not happened before.
I’m trying to catch up on the patches (have several Windows 7 systems to maintain) and am hitting a snag with the September 2020 patches. After right-clicking on the W7ESUI.com and OK’ing the UAC prompt, I’m getting the following error:
What am I doing wrong? This had not happened before.
.
.
All the updates and W7ESUI.com have to be in the same folder.
I usually make a folder (OSUpdate) in the root of C:\
You right click on W7ESUI.com and “Run as administrator.”
I think the ID has to be an Administrator (not Standard) as well.
Try to move the folder to another location
OK, but the folder is in the same location as all the previous ESU folders, and they didn’t give any trouble. Has MS changed something?
UPDATE: Tried putting the folder right into C:\, and I got the same error.
I downloaded the files via Pale Moon (on a different Win7 PC).
I don’t even get as far as @AusJohn; W7ESUI.cmd never gets started at all (at least visibly) before the “cannot access” error pops up.
The error has nothing to do with W7ESUI
your cmd.exe cannot access the script path for some reason
did you use 0patch? can you check if the script and updats are not blocked (check file properties)
The file properties look OK, I have read/write/modify permissions. Anything special I should be looking for?
I haven’t used 0patch on that particular PC, but I have to admit that 0patch is looking more and more attractive. 🙂
UPDATE: But here’s something strange. I tried to launch cmd.exe directly as Administrator from the Start menu, and the same “cannot access” error popped up!
Permissions (in Properties) for cmd.exe on that laptop are the same as for any other Windows 7 computer I have.
Do the SO patches bitness tie up with the bitness of the device? (32bit/ 64bit)
Cybertooth – you wrote, “UPDATE: But here’s something strange. I tried to launch cmd.exe directly as Administrator from the Start menu, and the same “cannot access” error popped up!”
I’m not a tech, but sounds like something is wrong at a deeper level.
Suggest first making a complete backup of your 7 machine, and then running (in order)
sfc /scannow
DISM /Online /Cleanup-Image /Scanhealth
sfc /scannow
If cmd is still not fixed, you might want to get the System Update Readiness tool from Microsoft and run that. (I ran that within the last ten days on one of the 7 machines I keep updated with the W7ESUI tool here – no problem.)
He cannot run those commands if cmd.exe is not working
maybe try ofline scan/repair from WinPE
Could he maybe try running cmd from C:\Windows directly instead of from the start menu?
Or try WIN + R?
Cybertooth, try checking if your antivirus is blocking the file ?
Could he maybe try running cmd from C:\Windows directly instead of from the start menu?
Thanks for the idea. Just tried it from C:\Windows\System32 with the same result (error).
Cybertooth – I do recommend the MS System Update Readiness tool. Here’s a link for the 64-bit version (I think):
https://www.microsoft.com/en-us/download/details.aspx?id=20858
You can read more about it on Seven Forums – especially at this link: https://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html where the SUR tool is mentioned in the Note under Option Two.
See also https://docs.microsoft.com/en-us/troubleshoot/windows-server/deployment/fix-windows-update-errors
Good luck.
Or try WIN + R?
Thanks, just tried running cmd.exe with Ctrl+Shift+Enter from Win+R and it’s opening the regular CLI without asking for Administrator rights.
I also tried another way, suggested in How-To Geek, to do Ctrl+Shift+Enter from the Start menu, and received a different error:
Hmmm. As a non-tech — I’m Watson, not Holmes — I wonder whether your cmd.exe file is corrupt. You might rename it cmd.old and copy and paste in a cmd.exe from one of your other machines.
Or just give up and have a Scotch.
Cybertooth – Two thoughts – and I just edited –
2. Go to Installed Updates and UNinstall the most recent updates. Then see if you can start cmd and run sfc /scannow, etc.
.
.
.
Well, whaddaya know, running cmd.exe as Admin from Task Manager did not cause an error! <scratching head>
Out of curiosity, I decided to try running W7ESUI.cmd from the DOS box that opened up. So far, so good. Will report on developments.
UPDATE: W7ESUI.cmd finished the installation, although at the end of the process the CLI stayed open instead of closing itself as it normally does. Rebooting showed a perfectly normal patch installation progress. However, after the reboot, cmd.exe as Admin still runs only from Task Manager.
Should I still run SFC and DISM?
Cybertooth – I vote yes. It’s certainly never hurt my three 7 machines or (with a slightly different DISM line) my 10 machine.
Watson 1 – Holmes 0.
When “cmd.exe” (the child process) is executed by the “elevated administrator task manager” (the parent process), cmd.exe (child) acquires its elevated administrator’s privileges from the elevated administrative task manager (parent) and runs as “admin” as expected.
When a user tries to execute an elevated command/script/program (child process) from the console (a parent process without admin privileges) regardless of whether or not the user is an administrator & dependent upon the system’s User Account Control (UAC) settings, UAC calls “consent.exe” (Consent User Interface for Administrative Applications) to ask for permission and/or administrator’s password to execute the command/script/program under elevated administrative privileges.
It sounds like the “consent.exe” file in Windows System32 may be missing or corrupt.
It’s been known in the past that Avast & AVG (maybe others?) mistakenly flagged the “consent.exe” file in the Windows System32 folder a virus and deleted it from the System32 folder. If so, it may have been moved to the Anti-Virus’s protected quarantine for possible future restoration and may still be there.
Other 3rd party Anti-Virus products/updates (Symantec Endpoint Protection was one) may also have injected their DLL(s) into consent.exe which may have corrupted it.
If “consent.exe” is either missing from the Windows System32 folder or it’s corrupted, as @glnz indicated above, “SFC /scannow” should resolve this issue.
Hope this helps 🙂
@glnz … what a sneaky backdoor into administrative command prompt 👍
(edit – typo)
Win7 - PRO & Ultimate, x64 & x86
Win8.1 - PRO, x64 & x86
Groups A, B & ABS
RDRguy – many thanks for the compliment, but I’m just a lawyer. When I push buttons on my PC, I have NO IDEA what I’m doing.
Cybertooth – did sfc /scannow fix your cmd or consent?
If “consent.exe” is either missing from the Windows System32 folder or it’s corrupted, as @glnz indicated above, “SFC /scannow” should resolve this issue.
Consent.exe does show up in the right folder, although I can’t tell if it’s been corrupted. I ran SFC /scannow and DISM, and (amazingly, first time ever on any of my PCs I think) SFC came back with a completely clean result, with no “integrity violations”.
There is a log file for DISM and it says there are 7 errors. I’m not sure if it’s safe to upload this file, but it says there are two “CSI Payload Files” missing from the Component Store, both referencing certcli.dll (for x86 and amd64). The log file says that for 5 of the errors, there are “unavailable repair files”. None of those items references certcli.dll, so I speculate that DISM did find “repair files” for certcli.dll, although I’m still getting the error when trying to run cmd.exe as Administrator. Maybe I need to reboot for DISM’s fixes to take effect?
Grasping at straws here but can you create a new user account (admin preferred) then try running cmd.exe as admin after new user login? If this works, your current user profile may be corrupted which can cause all sorts of odd & unexpected problems.
You could also try running cmd.exe as admin after booting into safe mode – this would surely add additional info to this challenging but interesting troubleshooting exercise 🙂
Win7 - PRO & Ultimate, x64 & x86
Win8.1 - PRO, x64 & x86
Groups A, B & ABS
Apparently, the “right” buttons are being pushed 🙂
Win7 - PRO & Ultimate, x64 & x86
Win8.1 - PRO, x64 & x86
Groups A, B & ABS
Cybertooth – per my understanding, the DISM I recommended,
DISM /Online /Cleanup-Image /Scanhealth
doesn’t repair; Win 7 does not have the repair option the way Win 10 does.
(In Win 10, this would be Dism /Online /Cleanup-Image /RestoreHealth.)
My understanding is that Win 7 has only the System Update Readiness Tool for repairing.
See also https://docs.microsoft.com/en-us/troubleshoot/windows-server/deployment/fix-windows-update-errors
and if you scroll down in that article to the end, you’ll see some info about manual repairs that might be relevant.
Also suggest running sfc /scannow again (from your cmd-as-admin window), followed by System Update Readiness Tool, and then followed by sfc /scannow.
And don’t forget my earlier alternate suggestion, “Go to Installed Updates and UNinstall the most recent updates. Then see if you can start cmd and run sfc /scannow, etc.” If that works, then you might skip the September 2020 updates and go straight to the November updates (but don’t skip any SSUs that are recommended here).
You might also try posting your travails on Seven Forums.
.
.
.
OK, I tried running cmd.exe as Administrator while in Safe Mode… and it worked! All the methods that are giving errors in normal Windows mode, ran without issue.
As I’m starting with the simplest approaches and moving on to the more complex ones only as necessary, next I’ll try running the sequence SFC-DISM-SFC as proposed by @glnz. If that doesn’t solve the problem, I’ll have to pick between uninstalling updates or creating a new Admin account next.
Consent.exe does show up in the right folder, although I can’t tell if it’s been corrupted.
What is your level of consent? — C:\Windows\System32 –
The General tab shows a size of: 113 KB (115,936 bytes)
Here’s a screenshot of the Details tab:
Incidentally, running the SFC-DISM-SFC sequence with a reboot didn’t help. Nor was there any improvement after running the System Update Readiness tool followed by SFC /scannow.
As you mentioned running McAfee in one of your earlier posts above, look what’s addressed on the McAfee Knowledge Center website dated 6/23/2020.
Might this be the cause of the odd administrative privilege elevation issues you’re having 🤞🤞🤞
Win7 - PRO & Ultimate, x64 & x86
Win8.1 - PRO, x64 & x86
Groups A, B & ABS
Nice find, @RDRguy! How did you think to look for McAfee-related possibilities?
I don’t have the precise version of McAfee that’s discussed on that page, but my version does have a vtpinfo.exe file in the analogous location, as well as a vtp_catcache file. I would have to create a new user to carry out the recommended procedure; wonder what exactly I should be entering on the command line where they give “resetvtpcache”.
I visited the McAfee forums to see if there are other complaints about this, and it looks like I won the lottery.
In safe mode, McAfee shouldn’t have been running & your admin CMD.exe worked so I still suspect your Anti-Virus is somehow erroneously interfering with the normal operation of Windows UAC which consists mainly of the Windows Application Information Service (Appinfo) & the Consent.exe program.
All of these 3rd party Anti-Virus products DO hook into UAC (as designed by MS) to primarily ID themselves/processes as “trusted processes” so that the user isn’t constantly bombarded by UAC permission prompts whenever they’re performing their anti-virus & malware protection tasks.
A good primer on UAC can be found here. Figure 4 shows a good overview of how UAC works.
As your McAfee version is not exactly what’s specifically address in McAfee’s Knowledge Center article, I’d be a little leery trying their proposed workaround – it may work but then again it may also screw things up more.
I’d first poke around your McAfee product’s settings to see if something can be turned either OFF or ON that fixes the problem.
If this doesn’t work, I’d consider uninstalling McAfee, reboot & another SFC /scannow to verify McAfee uninstall didn’t break anything, verify that administrator’s CMD.exe now works, then (as desired) a fresh reinstall of your McAfee S/W (up to date version if possible). Re-verify all is well – if not, you now know exactly what the problem is.
Good luck 🙂
Win7 - PRO & Ultimate, x64 & x86
Win8.1 - PRO, x64 & x86
Groups A, B & ABS
I went through every single McAfee setting and didn’t find anything that looked promising. Nor does the quarantine have any items related to this issue (just some cookies).
Guess the next step will be to un/reinstall McAfee and see what happens. Other previously suggested measures to take would be to create a new administrator account, and to uninstall recent Windows patches.
I uninstalled McAfee, rebooted, and ran SFC /scannow, then tried to run cmd.exe with admin rights. Still no dice. 🙁
Well, I’m now completely stumped … this IS a very interesting & challenging problem.
SFC should have found/fixed any Windows OS file issues which I would expect to include the cmd.exe, consent.exe & appinfo.dll files.
Safe mode ran fine so cmd.exe file is probably OK.
UAC nor McAfee runs in safe mode so if SFC did check consent.exe & appinfo.dll and found no errors, I would suspect some other 3rd party program that interfaces with UAC the culprit with McAfee being the most likely.
By the way, both consent.exe & appinfo.dll files are periodically updated by MS and if you search for either of these, you’ll find several versions of them in your Windows Winsxs folder under several subfolders with names starting with:
“amd64_microsoft-windows-lua_31bf3856ad364e35_{version# & ID here}”
My consent.exe version is 6.1.7601.24561 which I got when I installed the Oct 2020 updates on 10/24/2020.
It could still be a user profile problem which may be worth a try but assuming you logged into safe mode with same user profile, I wouldn’t give this much hope.
I guess it could also be some “other” non-Windows program but this is only a guess.
As you’ve installed ESU updates using @abbodi86’s script, I’m not sure you can easily “uninstall” them like you would normally – something about first having to somehow re-install the last pre-ESU Rollup then backing out the latest ESU Rollup. You’ll need to scroll through the ESU script topic for more info.
Win7 - PRO & Ultimate, x64 & x86
Win8.1 - PRO, x64 & x86
Groups A, B & ABS
Besides the original (anti-malware) version of Windows Defender, the only other security software on that laptop is Malwarebytes Anti-Exploit. I can try uninstalling it if there’s a chance that it might be the culprit.
UPDATE: I found the cause. It’s MBAE. When I opened the GUI, there was a button to “Stop Protection.” Rather than uninstalling the program, I decided to try that first, then went to open cmd.exe as Admin from the Start menu. Hitting the same button to restart its protection and then trying to launch cmd.exe with elevated rights, resulted in the same problem we’ve been seeing all along.
The puzzling thing is, MBAE has been on this machine for years, since 2014 or so, and it had never given any grief. FWIW, it’s version 1.13.1.304.
FURTHER UPDATE: This was reported as a bug in version 288 on the Malwarebytes forum here. Evidently, though, the bug wasn’t fixed in the next version.
@Cybertooth … that’s AWESOME & what a GREAT find ‼️ 👍👍👍
Those darn 3rd party Anti-Virus/Malware products – now I know why Woody always recommended not using them. 😂
Win7 - PRO & Ultimate, x64 & x86
Win8.1 - PRO, x64 & x86
Groups A, B & ABS
Why not just copy and paste cmd, consent and other relevant files from one of your working 7 machines into this one?
In addition to cmd.exe and consent.exe, which files should I copy over?
UPDATE: We may not need to compile a list of files to copy over after all–see this post.
Just a quick note to give my sincere thanks to everyone who gave of their time to investigating this weird and frustrating problem. Hopefully it helped us all to get just a little better acquainted with the workings of the machines that we are relying so much on these days.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
