Win11 cumulative update February 2024 (KB5034765) - cant be installed

In February 2024 MS released a very important cumulative update (which is also fixing 2 major Zero-Day-exploits in the OS with the cumulative update KB5034765 as reported by various sources in the internet)

• CVE-2024-21412 Internet Shortcut Files Security Feature Bypass Vulnerability
• CVE-2024-21351 Windows SmartScreen Security Feature Bypass Vulnerability

Officially MS is only reporting on their page publicly this update "solves security issues"

While installing theses updates:

• 2024-02 Cumulative Update for Windows 11 Version 23H2 for x64-based Systems (KB5034765)

and/or 

• 2024-02 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 23H2 for x64 (KB5034467)

I failed as many others already trying to install this update.


During the offline mode installing the update I got this message:

Something didn't go as planned. No need to worry-undoing changes.

After the rollback you will see that the update is still waiting for you to be installed.

Resolution is really simple in this case:

• Check for the hidden folder: C:\$WinREAgent
• As admin rename it into something else like "C:\DONOTUSE THIS DOLLARWinREAgentFOLDER" or any other name.

And then let the update run again.

When you re-run the update after renaming the folder its very likely that it works.
So far for me and obviously many others they reported the same issue.

After this action my system reported now no new updates and the Windows version was "Build 22631.3155" as expected (winver.exe).

Image Credits: Image created with Dalle2 prompt: man with black suit and black sunglasses is leaning against a large Windows logo. He is leaning from the right side to the left. On the left side a Windows logo is rushing in to the picture and stopped by the man.

Extend and read Windows Update Log

Sometimes something went wrong during Windows Updates. So it would be helpful to know what's  going wrong. Therefore we have the Windows Update Log. But where is it, how to read and how to extend to get even more out of it.

Beware - in Windows 10 the Windows Update logfile is by default in ETL format! 

This is an internal logging format from Microsoft. To "translate" it in to human readable format you need to to convert it. This is fortunatelly very simple.

1. Open Powershell
2. Type in: Get-WindowsUpdateLog (and press Enter)
3. Last line will tell you where the WindowsUpdate.log file was written.

How to enable extended logging

Microsoft Product Support Services may ask you to turn on verbose logging. To turn on verbose logging, add the following registry key with two values:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace
Value name: Flags
Value type: REG_DWORD
Value data: 00000007

Value name: Level
Value type: REG_DWORD
Value data: 00000004

This registry key turns on an extended tracing to the %systemroot%\Windowsupdate.log file. Additionally, this registry key turns on an extended tracing to any attached debuggers.  

How to read and understand the log

You will find a comprehensive article on this here:
https://support.microsoft.com/en-us/help/902093/how-to-read-the-windowsupdate-log-file

Windows cummulative updates cause WSUS to fail

Recently Microsoft released an interesting article about failing WSUS to deliver updates to Windows Clients. Currently affected are Versions before 1703 but due to the nature of the updates and the issue this will be soon the case also for the current Version.

Short Story:
High CPU and Memory consumption on the WSUS process (w3wp.exe IIS worker threat) due to the high volume of meta data caused by later and therefore larger cummulative updates for Windows 10.
 
The symptoms include:

• High CPU on your WSUS server – 70-100% CPU in w3wp.exe hosting WsusPool
• High memory in the w3wp.exe process hosting the WsusPool – customers have reported memory usage approach 24GB
• Constant recycling of the W3wp.exe hosting the WsusPool (identifiable by the PID changing)
• Clients failing to scan with 8024401c (timeout) errors in the WindowsUpdate.log
• Mostly 500 errors for the /ClientWebService/Client.asmx requests in the IIS logs

The solution is:

• Configure IIS to stop recycling the IIS pool
• Limit the number of inbound connections to IIS
• Increase the ASP.net timeout
• Monitor the processes

Long Story with solution details:
https://blogs.technet.microsoft.com/configurationmgr/2017/08/18/high-cpuhigh-memory-in-wsus-following-update-tuesdays/

Updates needed to serve Windows 10 updates and upgrades with WSUS

I created a demo environment and thought it would be nice to use latest SCCM on latest Windows and guess what?  (SCCM Current Branch on Windows Server 2016 TP5)


You WILL FAIL!

Reason is you need to install a patch to WSUS to enable Windows 10 catalog.
But this patch is only available to Windows Server 2012 R2.
Not yet available to Windows Server 2016 TP5 (curious but that's the way it is)


So I installed another WSUS Server on Windows Server 2012 R2 latest patches stand alone. Then I enabled WSUS role.


But before you start configuring it. You must install at least these patches for 
Windows Server 2012 R2:
This Update enables the Win10 classification in the WSUS catalog
KB3095113
https://support.microsoft.com/en-us/kb/3095113
(also checkout note from WSUS team:
https://blogs.technet.microsoft.com/wsus/2015/12/03/important-update-for-wsus-4-0-kb-3095113/)

If you synced the catalog already and you missed the fix in the first place you need to read this for fixing it!https://blogs.technet.microsoft.com/wsus/2016/01/29/how-to-delete-upgrades-in-wsus/


This Update enables the ESD function. Without it you can not deploy 1607 or newer!
BE CAREFULL AND READ THE MANUAL STEPS NECESSARY!!!https://support.microsoft.com/en-us/kb/3159706

This update also replaces the problematic fix KB3148812. If it is installed you can install the KB3159706 on top of it! But don't miss the manual steps!


HINT:
You get all the updates also through (you need to know the KB article number)
http://catalog.update.microsoft.com




Microsoft promised these steps are not necessary for WSUS on Windows Server 2016 RTM.


HAPPY UPDATING!

Windows 10 Update Assistant for failing upgrades from RTM to 1511

Recently MS released an update that let you update your system to the latest public release (1511) if your system is still on RTM and may not update automatically to the recent version due to errors in Windows Update.

Please chekcout this KB article therefore https://support.microsoft.com/en-us/kb/3159635


The update to 1511 is essential to receive the new Redstone release coming in few weeks!