KB4041681/KB4041678

[ChuckRAskWoody Lounger]

Working on an issue with Windows Update issues, I was ready to try and install of the oldest patch in Windows Update. It was KB4041681. To do what I have previously had to do since then, I looked up the Security Only for that update and KB4041678 was where I was pointed to. Of course, I checked to see if that was installed and sure enough it was.

Question: I KB4041678 was installed WHY is KB4041681 still showing in Windows Update to be installed?????

[PKCanoDa Boss]

KB4041678 is a Security-only patch.
KB4041681 is a Monthly Cumulative Rollup.
A Security-only patch cannot supersede the Rollup.
If you have been installing Security-only patches each month (and not the Rollups) you will continue to be offered the Rollups through Windows Update.

[ChuckRAskWoody Lounger]

I hid KB4041681 and now KB4038777 shows up when KB4038779 has been installed.

Will this keep happening till today?  To work on a similar issue with the Sysnative folks I had to install hundreds of files in Winsxs.  Could these be triggering the Windows Rollups even though the Security only pieces were installed in many cases.

[PKCanoDa Boss]

The Security-only patches DO NOT supersede the Rollups. Therefore, you will continue to be offered the Rollups through Windows Update,

[ChuckRAskWoody Lounger]

I had to go to the Security Only installs when the Rollups quit working with little information.

What is in the Rollup that is of value that Security doesn’t have?

[PKCanoDa Boss]

The Security-only updates contain security patches. They are NOT cumulative.

If you are installing Security-only patches manually, you also need to be installing the IE11 Cumulative Updates.

The Monthly Rollups contain the Security-only patches, the IE11 CU, AND the non-security fixes (patches).

[ChuckRAskWoody Lounger]

If I try and install a Rollup which has the Security piece already installed, will it fail.  As I said, back in October 2017, I believe, the Rollups stopped working.  Sysnative had me install over 400 Winsxs files.  Would  these be the fix for the Rollup issue?

If I try and fail a Rollup install, I will have to continue Security Only and Hide the Rollups as I can’t find a way to remove them.

[EllyAskWoody MVP]

ChuckR wrote:

I hid KB4041681 and now KB4038777 shows up when KB4038779 has been installed.

Just to clarify a bit further… for those of us who install the Security Only patches, it is suggested to hide the Monthly Quality and Security Updates.

If you haven’t been doing so, when you hide the most recent one, the next most recent one will show up… hide that and the next next most recent one will show up… all the way back to when the first Monthly Quality and Security Roll-up was issued. It is Group B protocol to hide all Monthly Quality and Security Roll-ups, and any other updates you don’t intend to install, so that the Servicing Stack updates will show up in Windows Update, to be installed all by themselves. It is expected that on the next Patch Tuesday, a new Monthly Quality and Security roll-up will show up in Windows Update.

Interestingly, you are having September and October 2017 patches showing up. Does that mean you’ve been hiding all the Monthly Quality and Security roll-ups since then? I would think that if you searched for updates, it should return the June 2019 Monthly roll-up.

If you’ve been doing Security Only updating, and you want to return to Group A, updating with the Monthly Quality and Security update, you only need to install the most current update. However, June’s patches have already been issued, which have yet to be cleared by Woody. You can:

1) Hide June Monthly Roll-up, search for updates again, and the May Monthly Roll-up should show up. Install, and it will bring you up to date regarding non-security patches, and IE 11. The monthly roll-ups are designed to install anything you don’t have. Unhide the June patch.

OR

2) Wait until Woody gives the all clear for the June Monthly Roll-up and install it then.

ChuckR wrote:

Sysnative had me install over 400 Winsxs files. Would these be the fix for the Rollup issue?

I’m assuming that you followed the directions of the help you were given at Sysnative.com… and it is better to stick to following one specific helper, as there are usually multiple ways to address a problem.

If you had done something to your Winsxs folder, Microsoft warns:

Deleting files from the WinSxS folder or deleting the entire WinSxS folder may severely damage your system so that your PC might not boot and make it impossible to update.

Which could have been the problem that Sysnative was helping you with.

For step by step updating instructions go to MS-DEFCON 4: It’s time to get the May 2019 Windows and Office patches installed, click on the linked ComputerWorld article, and follow Windows 7 Group A instructions. Group A uses the Monthly Quality and Security updates. Remember to hide the June Monthly update, as these instructions were given before the June roll-up was issued. If the problem with updating has been corrected, the May 2019 update should install and bring you up to date…

When Woody suggests that you back up, don’t skip that step. Whether the roll-up issue is fixed or not, back up your data. When you get everything working nicely, do a disc image so you could easily restore if something goes wrong again. It is easiest to go back to the most recent good image, rather than tracking down a problem… Malware can cause problems with updating, and a clean install will wipe it out.

Win 7 Home, 64 bit, Group B

[ChuckRAskWoody Lounger]

I plan on matching the Group B Security-Only information for Windows 7 Professional 64bit with what is installed.

Will there be a problem if I find I missed a month and install it?

1 user thanked author for this post.

Elly

[PKCanoDa Boss]

The Security-only updates are not cumulative, so each stands on it’s own. If it’s not installed, you missed it, you can install it.

The IE11 Cumulative Updates, that are also needed if you are in Group B, ARE cumulative, so you only need the latest one.

[ChuckRAskWoody Lounger]

I only run Chrome and sometimes Firefox.  Is it still important to install the last IE11?

[PKCanoDa Boss]

Yes. IE is an integral part of the OS and is used by other services, even if you are not using it as your browser. If you do not update it, you leave your system vulnerable.

[GoneToPlaidAskWoody Plus]

So very, very true. I hope that others pay attention to your reply. IE is so deeply embedded in Windows that it is and remains a magnet for hackers.

On a side note…

Much older laptops usually have older versions of LoJack (a laptop theft recovery service) embedded in BIOS. It it was ever activated, then the older versions of LoJack actually run hidden instances of IE so that LoJack on the computer can communicate with LoJack’s servers. These older versions of LoJack are rightly classified as malware, not only because these older versions of LoJack launch multiple hidden instances of IE, but also because these older versions of LoJack perform zero validation of any received data which supposedly should only come from LoJack’s servers. LoJack is now called Absolute Software.

If you uninstalled LoJack AND killed your LoJack account with Absolute Software, it apparently is impossible for them to turn off LoJack in your laptop computer’s BIOS. I made this very serious mistake on one of my older laptops. Just a “heads up” for everyone with a circa 2011 laptop who might have enabled LoJack in the laptop’s BIOS.

[MicrofixDa Boss]

Yes it is very important to install the last IE update.
IE is a core component of Windows 7 and needs updating irrespective of third party browsers used.

Win7 Pro x64 | Win8.1 Pro x64 | Linux Hybrids x64 | W10 x86 1909

[ChuckRAskWoody Lounger]

I don’t want to UnHide all the updates.  Can you please tell me what the latest IE I should install is?

Thanks for all this help.

[PKCanoDa Boss]

You can download it from AKB2000003 – all the Group B patches (Security-only and IE11 CUs) are listed there since the beginning. Those are direct download links from the MS Catalog.

The font is pale gray, but THE LINKS STILL WORK. Be sure you get the right bitedness.

2 users thanked author for this post.

Elly, Microfix

[ChuckRAskWoody Lounger]

Thanks   What is bitedness????

[PKCanoDa Boss]

Windows 32-bit or 64-bit operating system, whichever you have.

• This reply was modified 7 months ago by  PKCano.

1 user thanked author for this post.

Elly

[ChuckRAskWoody Lounger]

I don’t seem to have IE11 installed.  I went to Program Files/Internet Explorer and tried to run  ieinstal.exe as Admin. The screen flashed no IE  Installed. I even tried the 32bit version.

I have Windows 7 Professional 64bit.

[PKCanoDa Boss]

IE is an integral part of every Win7 OS. It is definitely installed on your system. The executable is iexplore.exe and the shortcut is a blue lower case “e.”

[ChuckRAskWoody Lounger]

All I have is iexplore.exe.mui in both 32 and 64bit.

[ChuckRAskWoody Lounger]

I fixed the IE11 problem.  I turned it off in the Control Center in the past.  Checking it allowed iexplore.exe to run and KB4503259 ran OKAY.

I will start to TRY and run any missing Security Updates this weekend.

[ChuckRAskWoody Lounger]

I was able to cleanup KB2952664/KB3150513 KB3021917.

KB3022345 KB3068708 KB3080149 generated the message “An Error occurred. Not all of the updates were successfully uninstalled”

Any familiarity with those that failed Uninstalling??

I am looking into the CBS.LOG which is 267,564kb.

[ChuckRAskWoody Lounger]

I hit the wall again.  I installed every Security Only Update until I tried KB4499175.  I ran it after I ran pciclearstatecache.  I also tried KB4508772 which also reverted the install.

I seem to be missing some Parent Packages these want.

I will continue working with Sysnative to see what they can suggest.  They have been good about supplying missing parents.

[PKCanoDa Boss]

Have you installed the latest Servicing Stack KB4490628 (has to be installed exclusively = by itself) and the SHA-2 update KB4474419?

1 user thanked author for this post.

Elly

[ChuckRAskWoody Lounger]

I installed KB4490628 okay.   KB4474419 is what started all this investigation.

I have not tried it lately, but will now with fingers crossed.

[ChuckRAskWoody Lounger]

Thinking they may need the kb4474419 update which is the SH2 portion. It failed. It is indicated on write-ups that this maybe needed before new updates. This was also sent to Sysnative support.

CBS.log (49.69MB) – SendSpace.com

[ChuckRAskWoody Lounger]

I just ran a program to check the Register and it had a lot of hits.  Sysnative is helping as usual.

[ChuckRAskWoody Lounger]

Things just got worse.  Windows automatically tried to install 3 updates. When I logged in today 1 failed and Windows kept re-trying.  I finally managed to get into Safe with Network.

I sent information to Sysnative and hope these issues can finally be resolved.  We have been working on KB4474419 before the other failures.

Keeping you aware JUST INCASE any ideas arise.

Does the Patch Lady work with Sysnative support??

[ChuckRAskWoody Lounger]

Found out how to look at INSTALLED UPDATES in this environment and found kb3207752 installed today. It is a Rollup from December 2016.
I had previously installed KB3205394 which is the Security only for December 2016.

[ChuckRAskWoody Lounger]

I have 3 Pending Updates.

KB4474419 This one started all the issues found by Sysnative and we are still working on.

KB3207752 Dec 2016 Rollup

KB4343900 Aug 2018 Rollup

Is there any way clear these? I don’t trust Rollups and the 1st KB constantly goes to 96% installed before Reverting the changes.

Thanks

[PKCanoDa Boss]

You can do without the Rollups if you are manually installing the Security-only Updates and the IE11CUs.
But if you have not prepared for SHA-2 (KB4474419) by next month (July 2019) you will not be able to use Windows Update. It also requires Servicing Stack KB4490628.

See 2019 SHA-2 Code Signing Support requirement for Windows and WSUS

To protect your security, Windows operating system updates are dual-signed using both the SHA-1 and SHA-2 hash algorithms to authenticate that updates come directly from Microsoft and were not tampered with during delivery. Due to weaknesses in the SHA-1 algorithm and to align to industry standards Microsoft will only sign Windows updates using the more secure SHA-2 algorithm exclusively.

Customers running legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) will be required to have SHA-2 code signing support installed on their devices by July 2019. Any devices without SHA-2 support will not be offered Windows updates after July 2019. To help prepare you for this change, we will release support for SHA-2 signing in 2019. Windows Server Update Services (WSUS) 3.0 SP2 will receive SHA-2 support to properly deliver SHA-2 signed updates. Refer to the Product Updates section for the migration timeline

[ChuckRAskWoody Lounger]

KB4490628 is installed

KB4474419 is the one that WON’T install. It goes as far as 96% and then Reverts.

[EllyAskWoody MVP]

@ChuckR-

Please clarify when you are cross posting in another forum. The Sysnative forum assigns a Windows Update Analyst who is part of or has graduated from the Sysnative Windows Update Academy, who will take you through diagnosing your problem and providing fixes, step by step. Your thread there, relating to the questions you are asking here, in this forum, appears to be Install sequence for KB4490628, KB4474419. I wouldn’t expect me, or other Loungers to track down this information for you. Do not assume that because you posted an actual link or information in another thread, that you don’t need to post or refer to it here. There are far too many people posting to expect anyone to remember from one thread to another.

Your initial question here:

ChuckR wrote:

Question: I KB4041678 was installed WHY is KB4041681 still showing in Windows Update to be installed?????

was answered by PKCano in Post# 1846683

But your responses seem to indicate that you do not understand the answer, when you remain puzzled that a Monthly Rollup is showing up in Windows Update after the Security Only update is installed.

Monthly Rollups, unless hidden or installed, should show up in WU, whether or not Security Only updates are installed.

In reading through your thread on Sysnative, there are times that you are not responsive to the next step or question being asked, and are sometimes making other changes independent of what is being suggested.

An example would be:

Sysnative-

Check Windows Update again and report the result.

Your response-

What would I expect to see in Windows Update? Should I just try to install KB4499178 again?

You never did check WU and report the result, even when your analyst tried to get you back on track by having you install the oldest available update, check WU again, and report the result. You seem to think that the Security Only update is equivalent, which it is not. Instead of checking for updates with WU and installing the oldest one (your directed, immediate step at that point) you decide to return to one of the problematic updates and try it. If you are unwilling or unable to follow a particular step, you should report that to your analyst and follow the next step you are given. Instead, you tell the analyst that you are:

installing KB4503259… and then checking out what Security Updates I missed. If all that works okay, I will then try KB4474419.

You were told:

Best to install KB4503259 only and report back if it fails.

because your analyst wants you to go step by step, so that any changes are agreed upon, and reports of what you see will be accurately interpreted.

Your Sysnative analyst is extremely patient and tries to work with you, over and over again… but you fail to follow the specific step given. If you unhide the latest rollup (which you were asked to do)… not install, simply unhide it, and report what shows in WU when you check for updates, you would have answered the analyst’s question… but there is no indication that you unhide any Monthly Rollup, as you report none are showing up when you check for updates. Either you have installed the June Monthly Rollup, or you have failed to unhide it, but you are only reporting no change, which is not giving your analyst the information needed.

It is likely that the Sysnative analyst does not know about or understand Group B updating. You need to either follow help here, or there. Since you have been unable to comply with the needed one step and report format there, you are not really assisting the analyst to find the solution to your problem. Jumping back and forth between this forum and there is confusing the issue further. It could be that the fixlist.txt installed one or more updates that you were missing… maybe even updates that you were trying to avoid as a Group B updater, which is why you may have noticed an old rollup update as having been installed.

The extremely patient Sysnative analyst continued to try and work with you. When asked,

What exactly did you turned off ?
A screenshot of that would be helpful.

you respond

Control Panel\Programs & Features\Turn Windows Features On or Off.

Please note that on my system there are 20+ Windows Features that could have been adjusted. Your analyst needed to know which one you changed (but you shouldn’t be doing other stuff to your computer while he’s trying to help you, because it makes his job more difficult and much more likely to fail- which is what you are complaining about.

Your analyst clearly states,

Please stop posting multiple replies. Post only one reply and then wait.

At this point you posted that you cannot find a Send button… (which is great, as you are waiting for your analysts reply)… but did you follow the private message link and copy the link to the file sharing website you have uploaded your Software.zip file to into a private message… and click send (which is probably below your message reply box, so scroll down). If it isn’t addressed to your analyst (PeterJ), and given a title, it may fail to send.

Do not expect your analyst to try and figure out how to fix things without using a Monthly rollup.

Group B was designed for Enterprise, where an IT specialist configures what is deployed in that environment. Most people cannot adequately follow Group B updating, and Woody suggests Group A updating for them. Your questions indicate that you do not have enough of a tech background to really make Group B updating viable for you (understanding bitness, or supersedence, etc.). I came to AskWoody with a non-techy background, and it took me a long time to understand some of the terms regularly tossed around related to updating, let alone apply them to my own machine. Woody and the folks here absolutely have the heart for working through problems, but you cannot expect to jump back and forth between Sysnative and here without confusing things for you, us, and the Sysnative analyst. Pick one site until your problem (installing KB4474419) is resolved, and only attempt to fix one thing at a time, rather than jumping all over the place and doing things you were not instructed to do. Since you’ve been working with the Sysnative analyst since May, I’d suggest continuing with him until the problem is resolved.

Hopefully, all the questions you’ve asked here (not related to fixing the problem) have helped you understand better how Windows Updates works, both for Group A and Group B. You’ve indicated that you moved to Security Only updating when regular WU Monthly Rollups stopped working, which might be a logical work-around, but since you were already using Monthly Rollups, getting them and WU to work properly is most important at this point.

As I understand it, your Sysnative analyst had you uninstall the problem update (KB4474419), and then give them the information requested. Continue with him, step by step, without worrying about how updating might be accomplished here.

That isn’t to say that you shouldn’t ask questions here… just don’t mix up the diagnosis and fix of a particular problem with other questions and actions. At this point, after reading your Sysnative posts, I’m impressed with how patient @peterj is, sticking with you through noncompliance with steps, reports, and doing other things while he helps you with the particular issue you started with. Be grateful for his time and energy. Same for PKCano… whose patience in answering the same questions (not just from you, but from other newbies here) is remarkable. You are very capable and willing to try things, but need to slow down so that what you are trying is actually what is needed for a particular issue.

Meantime, there is nothing stopping you from reading through Group A and B updating, and telemetry issues on this site. Just don’t make changes in settings on your computer, unless directed, until you are done working through the current issue.

Win 7 Home, 64 bit, Group B

1 user thanked author for this post.

Bluetrix

[ChuckRAskWoody Lounger]

I have tried to follow everything Sysnative has requested.  Without my taking any activity, WU went ahead and tried to run the three updates mentioned earlier. These are the ones that now are Pending and won’t go away.

I will now STOP posting information here.  I thought Patch Lady or someone on the forum may have run into these issues as issues are posted.

[EllyAskWoody MVP]

@ChuckR-

ChuckR wrote:

Without my taking any activity, WU went ahead and tried to run the three updates mentioned earlier. These are the ones that now are Pending and won’t go away.

It may be easiest to allow the ‘pending’ updates to finish installing, check what they are, and uninstall if not needed, rather than to try to prevent their installation from completing.

Sometimes it can be difficult to pinpoint what was done that caused updating to be initiated. The fixlist.txt file, meant to fix your updating problem may have initiated some needed updates. Or you may have checked for updates and not cleared the check marks for installation and ‘applied’ that change, so that Windows went ahead and installed them when your machine was shut down. You have a lot more control over updates in Windows 7 than in W10, so recheck your WU settings.

Definitely not wanting you to go away, especially mad. Pinpointed some areas of miscommunication and how they could be clarified… but that is, apparently, not helpful, and I apologize for that.

Win 7 Home, 64 bit, Group B

[Author]

Posts