MS Hotfix msu patch wants to install after it has been installed

When an update repeatedly detects and installs, that almost always an indication that the Installed Ruleset is not returning  TRUE value when it should.

Installed Rules:                 MSI Product Installed: Product ID={7789ba8a-663f-7e63-7e25-bbdc0c7a68d3}

Since your only test is for the Product ID, this suggests that you've identified an incorrect Product ID for this rule.

However....Historically, a TRUE result from the Installed Ruleset overruled any other ruleset results; however, recent observations have indicated that the WUA team may have changed (read: BROKEN) the functionality in the Windows Update Agent, and now a TRUE result from the Applicability Rules returns an isInstallable condition, even if the Installed Ruleset returns an isInstalled result.

Applicability Rules:                 NOT File Exists: Path=SoftwareDistribution\Download\7789ba8a663f7e637e25bbdc0c7a68d3\Windows6.1-KB2532445-v2-x64.cab Common Path=WINDOWS Version= Size=N/A Modified Date=10/4/2011 11:55:00 PM Creation Date=N/A Language=Language Neutral

In addition, this Applicability Rule is problematic, for two reasons:

First, I suggest for Applicability Rules that you use the File Version rule, and specify the test for LESS THAN the file version of the file being installed by the package.

Second, you CANNOT test for the presence/absence of files in the ~\SoftwareDistribution\Download folder -- they do not exist there at the time of detection rule evaluation; you should be testing at the actual installation location of the installed product. Ergo, this rule will always return TRUE (the file will never exist at the time of detection), and thus the update package will always be evaluated as isInstallable.

I covered these basic ruleset creation principles, including the logic evaluation process of the WUA, in these webcasts:

Package Creation Fundamentals

Creating Packages with Patch Manager

Thanks Lawrence,

Just a question then, can I test for the existence of registry entries in the installable and applicable rules? There is no version number for this hotfix. Also if I do a WMI request, is it a remote request from Patch Manager/WSUS Server to the workstation, or is the WMI request done locally on the workstation itself to determine the existence of an installed product? I only ask because I have WMI firewalled off so remote machines cannot query anything. Also are there any other things I can try in regards specifically to MSU hotfixes which don't seem to have an installation path or version number of files? This KB in particular has tons of files in the Microsoft listing, and none of them match any on a machine where I have this manually installed because more recent updates have overwritten these file versions. Thank you for your reply.

I also don't quite understand why the applicability rule wouldn't work because that particular file is not there prior to installation of the hotfix, and it IS there afterwards, just confused as to why this wouldn't fall under that? I will rewatch the webcasts again. I really appreciate your help.

what's interesting is, i changed to the following rules and it is still having the same issue, however, another machine that i manually installed this hotfix on but didn't approve the update for was in another WSUS group and it shows as installed on the Patch Manager Console, so this leads me to believe that the problem is in my Applicability ruleset.

Here is what I have:

Applicability Rule:
NOT WMI Query: Namespace=root\cimv2 WAL Querty=select * from Win32_QuickFixEngineering where HotFixID="KB2532445"

Installed Rules:
WMI Query: Namespace=root\cimv2 WAL Querty=select * from Win32_QuickFixEngineering where HotFixID="KB2532445"

So i'm not sure where the problem lies here then. As you suggested, if the update repeatedly detects and installs, it is an indication that the installed ruleset is not returing "TRUE". However, within the Patch Manger Console, i am seeing another workstation that uses this logic that shows it IS installed and it is. Also as per your previous post, i don't believe the Applicability rule will ring always true, because after it installs, the WMI query should then show that the hotfix is indeed installed and thus not applicable? I really appreciate your help with this! It's so frustrating because these hotfixes do not have valid versions in their dlls since newer updates supercede them. I have also tried registry rules and it yields the same results.