3 Replies Latest reply on Dec 18, 2014 9:22 AM by Lawrence Garvin

    How to unistall specific updates

    sz-a

      I had systems with an update which should be uninstalled because of an incompatibility.

       

      Yesterday I configured the updates on wsus to "not approved" and ran the uninstall as update management task using the patchmanager console and asked the users to restart their computers after successful uninstalls.

       

      But today, the update is installed again. windowsupdate.log said the install occured at shutdown yesterday evening (the systems where restarted before approximatly at 1:00pm yesterday (after uninstall) and shut down at 17:00pm).

       

      What did I wrong to uninstall cleanly?

        • Re: How to unistall specific updates
          Lawrence Garvin

          This is entirely possible if the update was previously approved, not yet installed, and already downloaded by the client pending installation.

           

          Most likely in this case the uninstall did not actually happen because there was nothing to uninstall.

          But, as a result of the previous approval, the client had downloaded the update and it was waiting to be installed.

           

          Another way this can happen is that an Approval still exists for the update. This is possible because, both Approve for Install and Approve for Remove are assigned to individual groups, thus it's possible that Group 'A' can be set for uninstallation but Group 'B' still has an active approval. If the client is in both groups, then the removal may have occurred earlier in the day, but a subsequent detection would discover that the update is not (now) installed, still approved, so it gets downloaded and installed.

           

          A couple of things to do in this scenario.

          First, once you've identified an update needs to be removed, set the approval to NotApproved for AllComputers, inherit the approvals to all groups, and then launch a DetectNow against the AllComputers group. This will ensure that all clients see the removal of the approval and not just preclude future installations, but also prevent any existing pending installations that have not yet occurred. Then apply the Approval for Removal and launch your uninstallation task.

           

          As to what exactly did happen, that can be traced through the WindowsUpdate.log if you're interested in a full forensic analysis.

            • Re: How to unistall specific updates
              sz-a

              I think, I recognized the answer:

               

              Uninstall Task was successful

               

              2014-12-16 13:34:58:711  380 1704 Report REPORT EVENT: {CD0FEB23-E308-4488-B2CD-987B7778869D} 2014-12-16 13:33:26:050+0100 1 222 101 {41FDCD78-C41E-4700-A0F8-D00C0EA200B4} 202 0 EminentWare Extension Pack - OH Success Content Uninstall Uninstallation Successful: Windows successfully uninstalled the following update: Kumulatives Sicherheitsupdate für Internet Explorer 11 für Windows 7 für x64-Systeme (KB3008923).

              2014-12-16 13:34:58:711  380 1704 Report REPORT EVENT: {37FB0E28-3D8E-4972-BFCD-ABC4739840D9} 2014-12-16 13:33:26:056+0100 1 202 102 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Content Install Reboot completed.

              ...

              2014-12-16 13:34:58:711  380 fd0 AU >>##  RESUMED  ## AU: Search for updates [CallId = {E654CE35-80A9-4E9A-8774-2DDD84CA1BB9}]

              2014-12-16 13:34:58:711  380 fd0 AU   # 1 updates detected

              2014-12-16 13:34:58:711  380 fd0 AU #########

              2014-12-16 13:34:58:711  380 fd0 AU ##  END  ##  AU: Search for updates [CallId = {E654CE35-80A9-4E9A-8774-2DDD84CA1BB9}]

              2014-12-16 13:34:58:711  380 fd0 AU #############

              2014-12-16 13:34:58:711  380 fd0 AU Featured notifications is disabled.

              2014-12-16 13:34:58:711  380 fd0 AU Setting AU scheduled install time to 2014-12-16 15:00:00

              2014-12-16 13:34:58:712  380 fd0 AU Successfully wrote event for AU health state:0

              2014-12-16 13:34:58:712  380 fd0 AU Auto-approving update for download, updateId = {41FDCD78-C41E-4700-A0F8-D00C0EA200B4}.202, ForUx=0, IsOwnerUx=0, HasDeadline=0, IsMinor=0

              2014-12-16 13:34:58:712  380 fd0 AU Auto-approved 1 update(s) for download (NOT for Ux)

              2014-12-16 13:34:58:712  380 fd0 AU #############

              2014-12-16 13:34:58:712  380 fd0 AU ## START ##  AU: Download updates

              2014-12-16 13:34:58:712  380 fd0 AU #########

              2014-12-16 13:34:58:712  380 fd0 AU   # Approved updates = 1

              2014-12-16 13:34:58:713  380 fd0 AU AU initiated download, updateId = {41FDCD78-C41E-4700-A0F8-D00C0EA200B4}.202, callId = {08AB9335-70AA-446A-901C-14133E46BFF9}

              2014-12-16 13:34:58:713  380 fd0 AU Setting AU scheduled install time to 2014-12-16 15:00:00

              2014-12-16 13:34:58:713  380 fd0 AU Successfully wrote event for AU health state:0

              2014-12-16 13:34:58:713  380 fd0 AU AU setting pending client directive to 'Download Progress'

              2014-12-16 13:34:58:715  380 fd0 AU Successfully wrote event for AU health state:0

              2014-12-16 13:34:58:715  380 fd0 AU   # Pending download calls = 1

              2014-12-16 13:34:58:715  380 fd0 AU <<## SUBMITTED ## AU: Download updates

              2014-12-16 13:34:58:716  380 fd0 AU Successfully wrote event for AU health state:0

              2014-12-16 13:34:58:739  380 1704 Report CWERReporter finishing event handling. (00000000)

              2014-12-16 13:34:58:784  380 1704 DnldMgr *************

              2014-12-16 13:34:58:784  380 1704 DnldMgr ** START **  DnldMgr: Downloading updates [CallerId = AutomaticUpdates]

              2014-12-16 13:34:58:784  380 1704 DnldMgr *********

              2014-12-16 13:34:58:784  380 1704 DnldMgr   * Call ID = {08AB9335-70AA-446A-901C-14133E46BFF9}

              2014-12-16 13:34:58:784  380 1704 DnldMgr   * Priority = 2, Interactive = 0, Owner is system = 1, Explicit proxy = 0, Proxy session id = -1, ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}

              2014-12-16 13:34:58:784  380 1704 DnldMgr   * Updates to download = 1

              2014-12-16 13:34:58:784  380 1704 Agent   *   Title = Kumulatives Sicherheitsupdate für Internet Explorer 11 für Windows 7 für x64-Systeme (KB3008923)

              2014-12-16 13:34:58:784  380 1704 Agent   *   UpdateId = {41FDCD78-C41E-4700-A0F8-D00C0EA200B4}.202

              2014-12-16 13:34:58:784  380 1704 Agent   *     Bundles 1 updates:

              2014-12-16 13:34:58:784  380 1704 Agent   *       {5E4FC344-044E-4D43-8937-6E6641913340}.200

              2014-12-16 13:34:58:796  380 1704 PT +++++++++++  PT: Synchronizing file locations  +++++++++++

              2014-12-16 13:34:58:796  380 1704 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://vsrvc1020/ClientWebService/client.asmx

              2014-12-16 13:35:01:204  380 1704 DnldMgr ***********  DnldMgr: New download job [UpdateId = {5E4FC344-044E-4D43-8937-6E6641913340}.200]  ***********

              2014-12-16 13:35:01:256  380 1704 DnldMgr   * Queueing update for download handler request generation.

              2014-12-16 13:35:01:256  380 1704 DnldMgr Generating download request for update {5E4FC344-044E-4D43-8937-6E6641913340}.200

              2014-12-16 13:35:03:046  380 1704 Handler Generating request for CBS update 5E4FC344-044E-4D43-8937-6E6641913340 in sandbox C:\Windows\SoftwareDistribution\Download\91b274cba7f4e7dc32066a0e72ef7b99

              2014-12-16 13:35:03:091  380 1704 Handler Selecting self-contained because update has express payload but server doesn't support it.

              2014-12-16 13:35:03:091  380 1704 Handler Selected payload type is ptSelfContained

              2014-12-16 13:35:03:091  380 1704 Handler Detected download state is dsHavePackage

              2014-12-16 13:35:03:092  380 1704 Handler Request generation for CBS update complete with hr=0x0 and pfResetSandbox=0

              2014-12-16 13:35:03:092  380 1704 DnldMgr ***********  DnldMgr: New download job [UpdateId = {5E4FC344-044E-4D43-8937-6E6641913340}.200]  ***********

              2014-12-16 13:35:03:097  380 1704 DnldMgr   * All files for update were already downloaded and are valid.

              2014-12-16 13:35:03:101  380 1704 Agent *********

              2014-12-16 13:35:03:101  380 1704 Agent **  END  **  Agent: Downloading updates [CallerId = AutomaticUpdates]

              2014-12-16 13:35:03:101  380 fd0 AU >>##  RESUMED  ## AU: Download update [UpdateId = {41FDCD78-C41E-4700-A0F8-D00C0EA200B4}, succeeded]

              2014-12-16 13:35:03:101  380 1704 Agent *************

              2014-12-16 13:35:03:101  380 fd0 AU #########

              2014-12-16 13:35:03:101  380 fd0 AU ##  END  ##  AU: Download updates

              2014-12-16 13:35:03:101  380 fd0 AU #############

              2014-12-16 13:35:03:101  380 fd0 AU Setting AU scheduled install time to 2014-12-16 15:00:00

              2014-12-16 13:35:03:101  380 fd0 AU Successfully wrote event for AU health state:0

              2014-12-16 13:35:03:101  380 1704 Report CWERReporter finishing event handling. (00000000)

              2014-12-16 13:35:03:102  380 fd0 AU AU setting pending client directive to 'Install Approval'

              2014-12-16 13:35:03:103  380 fd0 AU Successfully wrote event for AU health state:0

              2014-12-16 13:35:08:120  380 1704 Report REPORT EVENT: {C288D78E-0DE5-49E7-A418-FA26C0DC0127} 2014-12-16 13:35:03:101+0100 1 188 102 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Content Install Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on Dienstag, 16. Dezember 2014 at 16:00:  - Kumulatives Sicherheitsupdate für Internet Explorer 11 für Windows 7 für x64-Systeme (KB3008923)

              2014-12-16 13:35:08:120  380 1704 Report CWERReporter finishing event handling. (00000000)

              2014-12-16 13:35:13:734  380 132c AU WARNING: AU found no suitable session to launch client in

              2014-12-16 13:48:22:683  380 1704 Report Uploading 2 events using cached cookie, reporting URL = http://vsrvc1020/ReportingWebService/ReportingWebService.asmx

              2014-12-16 13:48:22:688  380 1704 Report Reporter successfully uploaded 2 events.

              2014-12-16 15:56:07:066  380 132c Shutdwn user approved update at shutdown

              2014-12-16 15:56:07:066  380 132c AU AU found 1 updates to install at shutdown.

              2014-12-16 15:56:07:066  380 132c AU #############

              2014-12-16 15:56:07:066  380 132c AU ## START ##  AU: Install updates

              2014-12-16 15:56:07:066  380 132c AU #########

              2014-12-16 15:56:07:066  380 132c AU   # Initiating install at shutdown

              2014-12-16 15:56:07:066  380 132c AU   # Approved updates = 1

              2014-12-16 15:56:07:167  380 132c AU <<## SUBMITTED ## AU: Install updates / installing updates [CallId = {6B2F4AE9-8011-4CFE-A8FD-F10283F769A1}]

              2014-12-16 15:56:07:168  380 132c Shutdwn InstallAtShutdown starts.

              2014-12-16 15:56:07:168  380 1318 Agent *************

              2014-12-16 15:56:07:168  380 1318 Agent ** START **  Agent: Installing updates [CallerId = AutomaticUpdates]

              2014-12-16 15:56:07:168  380 1318 Agent *********

              2014-12-16 15:56:07:168  380 1318 Agent   * Updates to install = 1

              2014-12-16 15:56:07:391  380 1318 Agent   *   Title = Kumulatives Sicherheitsupdate für Internet Explorer 11 für Windows 7 für x64-Systeme (KB3008923)

              2014-12-16 15:56:07:391  380 1318 Agent   *   UpdateId = {41FDCD78-C41E-4700-A0F8-D00C0EA200B4}.202

              2014-12-16 15:56:07:391  380 1318 Agent   *     Bundles 1 updates:

              2014-12-16 15:56:07:391  380 1318 Agent   *       {5E4FC344-044E-4D43-8937-6E6641913340}.200

              2014-12-16 15:56:10:627  380 1338 Shutdwn InstallAtShutdown got install progress.

              2014-12-16 15:56:33:036  380 1338 Shutdwn InstallAtShutdown got install progress.

              2014-12-16 15:56:34:208  380 1338 Shutdwn InstallAtShutdown got install progress.

              2014-12-16 15:56:34:208  380 1318 DnldMgr Preparing update for install, updateId = {5E4FC344-044E-4D43-8937-6E6641913340}.200.

              2014-12-16 15:56:34:210 4800 1408 Misc ===========  Logging initialized (build: 7.6.7600.320, tz: +0100)  ===========

              2014-12-16 15:56:34:210 4800 1408 Misc   = Process: C:\Windows\system32\wuauclt.exe

              2014-12-16 15:56:34:210 4800 1408 Misc   = Module: C:\Windows\system32\wuaueng.dll

              2014-12-16 15:56:34:209 4800 1408 Handler :::::::::::::

              2014-12-16 15:56:34:210 4800 1408 Handler :: START ::  Handler: CBS Install

              2014-12-16 15:56:34:210 4800 1408 Handler :::::::::

              2014-12-16 15:56:34:212 4800 1408 Handler Starting install of CBS update 5E4FC344-044E-4D43-8937-6E6641913340

              2014-12-16 15:56:34:231 4800 1408 Handler CBS package identity: Package_for_KB3008923~31bf3856ad364e35~amd64~~11.2.1.0

              2014-12-16 15:56:34:232 4800 1408 Handler Installing self-contained with source=C:\Windows\SoftwareDistribution\Download\4bf0600eb955c7ceac33fad952ada554\ie11-windows6.1-kb3008923-x64.cab, workingdir=C:\Windows\SoftwareDistribution\Download\4bf0600eb955c7ceac33fad952ada554\inst

              2014-12-16 15:57:43:339 4800 1408 Handler Requesting post-reboot reporting for package Package_for_KB3008923~31bf3856ad364e35~amd64~~11.2.1.0.

              2014-12-16 15:57:43:339 4800 1408 Handler Completed install of CBS update with type=3, requiresReboot=1, installerError=0, hr=0x0

              2014-12-16 15:57:43:339  380 1338 Shutdwn InstallAtShutdown got install progress.

              2014-12-16 15:57:43:339 4800 1408 Handler :::::::::

              2014-12-16 15:57:43:339 4800 1408 Handler ::  END  ::  Handler: CBS Install

              2014-12-16 15:57:43:339 4800 1408 Handler :::::::::::::

              2014-12-16 15:57:43:346  380 1338 AU >>##  RESUMED  ## AU: Installing update [UpdateId = {41FDCD78-C41E-4700-A0F8-D00C0EA200B4}, succeeded]

              2014-12-16 15:57:43:346  380 1338 Shutdwn InstallAtShutdown got install progress.

              2014-12-16 15:57:43:468  380 1318 Agent *********

              2014-12-16 15:57:43:468  380 1318 Agent **  END  **  Agent: Installing updates [CallerId = AutomaticUpdates]

              2014-12-16 15:57:43:468  380 1338 AU Install call completed.

              2014-12-16 15:57:43:468  380 1318 Agent *************

              2014-12-16 15:57:43:468  380 1338 AU   # WARNING: Install call completed, reboot required = Yes, error = 0x00000000

              2014-12-16 15:57:43:468  380 1338 AU #########

              2014-12-16 15:57:43:468  380 1338 AU ##  END  ##  AU: Installing updates [CallId = {6B2F4AE9-8011-4CFE-A8FD-F10283F769A1}]

              2014-12-16 15:57:43:468  380 1338 AU #############

              2014-12-16 15:57:43:468  380 1338 Shutdwn InstallAtShutdown got install progress.

              2014-12-16 15:57:43:468  380 1338 AU Install complete for all calls, reboot  needed

              2014-12-16 15:57:43:470  380 1338 AU Setting AU scheduled install time to 2014-12-16 15:00:00

              2014-12-16 15:57:43:470  380 1338 AU Successfully wrote event for AU health state:0

              2014-12-16 15:57:43:470  380 1338 AU AU setting pending client directive to 'Reboot Pending'

              2014-12-16 15:57:43:470  380 1338 AU AU initiates service shutdown

              2014-12-16 15:57:43:470  380 1338 AU InstallAtShutdown completed.

              2014-12-16 15:57:43:483  380 1338 AU Successfully wrote event for AU health state:0

              2014-12-16 15:57:43:483  380 1338 AU Successfully wrote event for AU health state:0

              2014-12-16 15:57:43:484  380 132c AU ###########  AU: Uninitializing Automatic Updates  ###########

              2014-12-16 15:57:43:486  380 132c Report REPORT EVENT: {854BB7F6-BE81-4EB3-A192-199C8DAA9800} 2014-12-16 15:57:43:470+0100 1 193 102 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Content Install Restart Required: To complete the installation of the following updates, the computer must be restarted. Until this computer has been restarted, Windows cannot search for or download new updates:  - Kumulatives Sicherheitsupdate für Internet Explorer 11 für Windows 7 für x64-Systeme (KB3008923)

               

              It seems like the Update where reinstalled after reboot because of the forgotten "/detectnow" between uninstall and reboot.

                • Re: How to unistall specific updates
                  Lawrence Garvin

                  2014-12-16 13:34:58:711  380 fd0 AU   # 1 updates detected

                   

                  2014-12-16 13:34:58:712  380 fd0 AU   # Approved updates = 1


                  You're close.... except that the WUA no longer does a full detection after a reboot, so these lines actually happen because the WUA does NOT do that fullscan. It was unaware that the approval had been removed, last it knew (what was cached) was that the update was approved.. and now the update is Not Installed, so it gets installed again.


                  To my previous point, it's absolutely critical that you remove the approvals AND the clients are aware that the approvals have been removed before you launch an uninstallation.... else what you see here is what will happen.