How the Windows Update Agent (WUAgent) determines the status of an update
This article describes the basic logic of how an update distributed via WSUS (or AU, WU, and MU) is evaluated by the Windows Update Agent to determine the update's status on a given computer. This knowledge can be helpful for two reasons:
- First, it can help diagnose why updates are misbehaving -- in the next post in this series we will describe exactly how to do this.
- Second, understanding this logic process is critical to properly developing your own package content -- which we will also discuss in the third post.
For now, let's focus on the basics.
Two State Values; Three Valid Value Combinations
At the root of the entire logic stream are two state values named isInstallable and isInstalled. It is the logical combination of these two state values that determines how an update is reported to the WSUS server.
- if isInstalled is TRUE, then the update is reported as Installed. (The value of isInstallable is not relevant in this case, but it should evaluate to FALSE.)
- if isInstalled is FALSE and isInstallable is TRUE, then the update is reported as Not Installed. The state Not Installed actually consists of three sub-states, known as InstalledPendingReboot, Downloaded, and NotInstalled. In the WSUS native console, these states are all labelled as "Needed".
- if isInstalled iS FALSE and isInstallable is FALSE, then the update is reported as Not Applicable.
The state of isInstalled=TRUE and isInstallable=TRUE is a logically inconsistent state, and should not occur in a properly constructed update definition.
There are three sets of logic rules that are evaluated by the Windows Update Agent in the process of executing a detection event. They are the Prerequisite Ruleset, Applicability Ruleset, and the Installed Ruleset. There are some very complex discussions in the WSUS SDK concerning the differences between the PreRequisite Ruleset and Applicability Ruleset, but both are used to evaluate the value isInstallable. The Installed Ruleset is used to evaluate isInstalled.
Primarily this ruleset is used to identify criteria that is absolute. For example, Adobe Reader X requires Internet Explorer 7 to be installed. If IE7 is not installed, then Reader X isn't an option and nothing else matters. Generally the Prerequisite Ruleset is used to identify those things that are absolute: Processor Architecture, Windows Version, Windows Language. It allows those sort of obvious things to be filtered out at the start. Updates for Windows 7 are ignored by Windows XP systems; updates for non-English systems are ignored by English-language systems; updates for 32-bit systems are ignored by 64-bit systems. If the logical aggregation of all of the rules fails, isInstallable is FALSE. Logically speaking in this condition, isInstalled could never be TRUE, so it is also presumed to be FALSE. The update is thus reported as "Not Applicable".
This ruleset is used to identify criteria that might or might not actually exist, which determines whether an update can be installed. For example, a product update for v1.1 requires that an earlier version of the product is installed; if it is not installed then the update is not relevant. More specifically, these rules are typically built to test individual file versions, so an update that replaces a file with version 18.104.22.168 requires that something prior to v22.214.171.124 is currently installed. If the earlier file is present, then it can be updated; if the product is not installed, and the file is not present, then the product cannot be updated. An update package may have only one rule (checking a single file version, for example), or it may have several rules. If the logical aggregation of all of the rules fails, isInstallable is FALSE; if the logical aggregation of all of the rules pass, then isInstallable is TRUE.
This ruleset is used to determine if the update package is actually installed. It's not relevant to the Windows Update Agent how the update was installed, merely whether the identified criteria is true or not. It's important to understand that the WUAgent reports an update as installed, not because of an event that may, or may not, have actually occurred, but because of the state of the machine regarding that update. Typically a rule in the Installed Ruleset tests for the presence of a file with a specific version (e.g. is the file version EQUAL TO v126.96.36.199), but might also test for a registry key or value that uniquely identifies that particular update. For complex updates, there may be multiple tests for different files and/or registry objects. If the logical aggregation of all of the rules fails, isInstalled is FALSE; if the logical aggregation of all of the rules pass, then isInstalled is TRUE.
Evaluation of Rulesets
Returning back to our two state values, then:
- If the PreRequisite Ruleset returns FALSE, then the update is NotApplicable.
- If the Installed Ruleset returns TRUE, then the update is Installed.
- If the PreRequisite Ruleset return TRUE, and the Installed Ruleset returns FALSE, then the Applicability Ruleset determines the status:
- Applicability Ruleset is FALSE, the update is NotApplicable
- Applicability Ruleset is TRUE, the update is NotInstalled
In the next post we'll look at how we can use this knowledge to troubleshoot an update package that is not behaving as desired or expected.