Windows 7 / 8 OSD pauses on Installing Software Updates

Posted: September 26, 2013 in Configuration Manager, Solved, System Center, Windows Update, Windows8
Tags: , , , , , , , , , , , , ,

Last update: 6/2/2014 Link to Microsoft TechNet article response

When runnning a Windows 7 or Windows 8 OSD install task sequence on ConfigMgr 2012 SP1 (CU2 and CU3), I’ve noticed that it seems to get stuck and appears to hang for a while when it gets to the “Install Software Updates” step. Typically it will sit there for 5- 10 minutes or so with no apparent activity before it starts applying the updates as required. The updates do eventually apply and the build completes as normal.


Checking the WindowsUpdate.log you can see that it looks like the client is attempting to go to the internet to contact windowsupdate.com

On a computer that does NOT have internet access:
2013-09-25 17:33:23:246  956 a9c Misc WARNING: Send failed with hr = 80072ee2.
2013-09-25 17:33:23:246  956 a9c Misc WARNING: Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <None>
2013-09-25 17:33:23:246  956 a9c Misc WARNING: Send request failed, hr:0x80072ee2
2013-09-25 17:33:23:277  956 a9c Misc WARNING: WinHttp: SendRequestUsingProxy failed for <http://ds.download.windowsupdate.com/w8/2/windowsupdate/redir/wuredir.cab>. error 0x80072ee2
2013-09-25 17:33:23:293  956 a9c Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072ee2
2013-09-25 17:33:23:293  956 a9c Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072ee2
2013-09-25 17:33:23:293  956 a9c Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072ee2

It will repeat this entry block several times along with other similar extended messages
At this point the WSUS server entries are still showing as NULL

2013-09-25	17:32:38:777	 956	a40	Agent	  * WSUS server: NULL 
2013-09-25	17:32:38:777	 956	a40	Agent	  * WSUS status server: NULL
And on one with Internet access

it will actually connect to download the catalogue of applicable updates

2013-09-29 13:09:28:330  940 2d0 PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
2013-09-29 13:09:28:330  940 2d0 PT   + ServiceId = {9482F4B4-E343-43B6-B170-9A65BC822C77}, Server URL = https://update.microsoft.com/v6/ClientWebService/client.asmx
2013-09-29 13:09:32:142  940 2d0 DtaStor WARNING: Attempted to add URL http://download.windowsupdate.com/msdownload/update/software/dflt/2010/01/3569764_713d53bd37125617c050ad97b3873029e2cf3d5b.cab for file cT1TvTcSVhfAUK2Xs4cwKeLPPVs= when file has not been previously added to the datastore
2013-09-29 13:09:32:142  940 2d0 DtaStor WARNING: Attempted to add URL http://download.windowsupdate.com/msdownload/update/software/secu/2009/09/windows6.1-kb974455-x64_726dfa22997da156d13638edecdc1be7871ac4ba.msu for file cm36Ipl9oVbRNjjt7Nwb54caxLo= when file has not been previously added to the datastore
2013-09-29 13:09:32:142  940 2d0 DtaStor WARNING: Attempted to add URL http://download.windowsupdate.com/msdownload/update/software/secu/2010/01/windows6.1-kb978251-x64_57f781323835dfa7a94131ea668c59412dd029df.msu for file V/eBMjg136epQTHqZoxZQS3QKd8= when file has not been previously added to the datastore
2013-09-29 13:09:32:142  940 2d0 DtaStor WARNING: Attempted to add URL http://download.windowsupdate.com/msdownload/update/software/dflt/2009/12/3404635_c32a5f3e5bf22eaf03a1fe913b80ef033af0846d.cab for file wypfPlvyLq8Dof6RO4DvAzrwhG0= when file has not been previously added to the datastore
2013-09-29 13:09:32:142  940 2d0 DtaStor WARNING: Attempted to add URL http://download.windowsupdate.com/msdownload/update/software/dflt/2010/02/3623329_d564a83e9c7b1f4976afe080f9f78c986ffc966b.cab for file 1WSoPpx7H0l2r+CA+feMmG/8lms= when file has not been previously added to the datastore
2013-09-29 13:09:32:142  940 2d0 DtaStor WARNING: Attempted to add URL http://download.windowsupdate.com/msdownload/update/software/dflt/2010/01/3557358_0352cc6255c71fff305cc7cad063b3338237ab04.cab for file A1LMYlXHH/8wXMfK0GOzM4I3qwQ= when file has not been previously added to the datastore
...many many more, then...
2013-09-29 17:46:58:024  940 628 Agent   * Added update {9703DEC9-DEAF-4566-B966-AECA447A4BA4}.105 to search result
2013-09-29 17:46:58:024  940 628 Agent Update {09783536-1B07-4479-9050-2D73A66AE237}.102 is pruned out due to potential supersedence
2013-09-29 17:46:58:024  940 628 Agent   * Added update {CA62F9C5-96CD-4C58-B8F4-3682CF6D4392}.101 to search result
2013-09-29 17:46:58:024  940 628 Agent   * Added update {8D780338-EEC1-4D31-B1CD-6187400C02F3}.101 to search result
2013-09-29 17:46:58:024  940 628 Agent Update {3ADC9B22-961C-4EFE-B474-9AE27A254814}.105 is pruned out due to potential supersedence
2013-09-29 17:46:58:024  940 628 Agent Update {77507BF9-6899-47DF-96D0-2FFA53A90470}.101 is pruned out due to potential supersedence
2013-09-29 17:46:58:024  940 628 Agent Update {E6EBC631-1C08-426F-9594-7CE9C3019506}.103 is pruned out due to potential supersedence
2013-09-29 17:46:58:024  940 628 Agent   * Added update {5DF3EFBC-3B83-4A42-A2D5-A8B075C59181}.105 to search result
... and many more of these

After about 5 minutes, the WSUS Server settings change to show the local SUP, however the update clients still keeps trying to go to the internet.

Client without Internet Access will continue to fail
2013-09-25	17:35:29:783	 956	a9c	EP	FATAL: SLS: Failed to download and verify redir., error = 0x80004004
2013-09-25	17:35:29:783	 956	a9c	EP	FATAL: Failed to obtain 9482F4B4-E343-43B6-B170-9A65BC822C77 redir Client/Server URL, error = 0x80004004
2013-09-25	17:35:29:799	 956	a9c	PT	WARNING: PTError: 0x80004004
2013-09-25	17:35:29:799	 956	a9c	PT	WARNING: Initialization failed for Protocol Talker Context: 0x80004004
2013-09-25	17:35:29:830	 956	a9c	Agent	  * WARNING: Exit code = 0x80004004
2013-09-25	17:35:29:830	 956	a9c	Agent	*********
2013-09-25	17:35:29:830	 956	a9c	Agent	**  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
2013-09-25	17:35:29:830	 956	a9c	Agent	*************
2013-09-25	17:35:29:830	 956	a9c	Agent	WARNING: WU client failed Searching for update with error 0x80004004
2013-09-25	17:35:30:064	 956	a40	Service	*********
2013-09-25	17:35:30:064	 956	a40	Service	**  END  **  Service: Service exit [Exit code = 0x240001]

AFter failing multiple times, a new web site is attempted which also fails

2013-09-25	17:38:41:046	 956	7ec	Misc	WARNING: WinHttp: SendRequestUsingProxy failed for <http://fe1.update.microsoft.com/w8/2/windowsupdate/redir/wuredir.cab>. error 0x80072ee2
However a client with Internet Access

…has assessed what updates to apply from the internet catalogue downloaded earlier, but will now try to download them from the local SUP. If the required updates don’t exist on the DP, then more errors and messages

lots of..
2013-09-29 17:51:07:313  940 7a4 Agent WARNING: Failed to get deployment data from data store, error 80248007
2013-09-29 17:51:07:313  940 7a4 Agent WARNING: Failed to get deployment data from data store, error 80248007
2013-09-29 17:51:07:313  940 7a4 Agent WARNING: Failed to get deployment data from data store, error 80248007
2013-09-29 17:51:07:313  940 7a4 Agent WARNING: Failed to get deployment data from data store, error 80248007
followed by lots of...
2013-09-29 17:51:07:313  940 7a4 AU Auto-approving update for download, updateId = {726B7201-862A-4FDE-9B12-F36B38323A6F}.104, ForUx=0, IsOwnerUx=0, HasDeadline=0, IsMinor=0
2013-09-29 17:51:07:313  940 7a4 AU Auto-approving update for download, updateId = {E7E7C106-BBF5-4B87-89D6-2A5960C9BA0A}.100, ForUx=0, IsOwnerUx=0, HasDeadline=0, IsMinor=0
2013-09-29 17:51:07:313  940 7a4 AU Auto-approving update for download, updateId = {DD1F3E07-252B-4478-9C93-B0C53907F9E2}.200, ForUx=0, IsOwnerUx=0, HasDeadline=0, IsMinor=0
2013-09-29 17:51:07:313  940 7a4 AU Auto-approving update for download, updateId = {40336E0A-7B9B-45A0-89E9-9BD3CE0C3137}.101, ForUx=0, IsOwnerUx=0, HasDeadline=0, IsMinor=0
2013-09-29 17:51:07:313  940 7a4 AU Auto-approving update for download, updateId = {083F5713-854C-4CB9-88BC-9D944F89947F}.201, ForUx=0, IsOwnerUx=0, HasDeadline=0, IsMinor=0
followed by LOTS of errors trying to download and install all the updates it now can't get content for

Up to 10 minutes later, it suddenly seems to pick up the correct configuration and starts applying the updates

2013-09-25	17:43:50:470	 956	7ec	EP	Got WSUS Client/Server URL: "HTTP://SUPSERVER.DOMAIN.COM:8530/ClientWebService/client.asmx"
2013-09-25	17:44:03:331	 956	7ec	Setup	Checking for agent SelfUpdate
2013-09-25	17:44:13:692	 956	7ec	Setup	Client version: Core: 7.8.9200.16384  Aux: 7.8.9200.16384
2013-09-25	17:44:13:692	 956	7ec	EP	Got WSUS SelfUpdate URL: "HTTP://SUPSERVER.DOMAIN.COM:8530/selfupdate"
2013-09-25	17:44:41:335	 956	7ec	Misc	Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\wuident.cab:

26/9/13 – At this stage I have reproduced this on three completely seperate ConfigMgr2012 environments. Investigations continue.

29/9/13 – On a computer that has internet access during the build phase, due to the detection of required updates, but failure to download, the Windows Update history actually show all the “failed” updates as well.failed_updates

The reference on Technet for the TS actions though indicates that updates should NOT be applying until the “Install Software Updates” action runs, so there is something either not working as expected, or some document changes to be made

http://technet.microsoft.com/en-us/library/hh846237.aspx#BKMK_InstallSoftwareUpdates

SOLUTION (sort of)

10/10/13 – A call was placed with Microsoft who has been able to also produce the same results. The current suggestion is to use an UNATTEND.XML file (or add to existing) to disable the Automatic Updates settings after Windows installs. Testing has indicated this works, however further investigation is happening to determine if this is expected behaviour or not.

    <settings pass="oobeSystem">
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <OOBE>
                <ProtectYourPC>3</ProtectYourPC>
            </OOBE>
        </component>
        <component name="Microsoft-Windows-Shell-Setup" processorArchitecture="x86" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <OOBE>
                <ProtectYourPC>3</ProtectYourPC>
            </OOBE>
        </component>
    </settings>

unattendxml

6/2/2014 – The official Microsoft response is here: http://blogs.technet.com/b/configurationmgr/archive/2014/02/19/support-tip-computers-connect-to-windows-update-to-download-updates-during-configmgr-task-sequence-execution.aspx

Comments
  1. Ibrahim says:

    I added the suggested Unattend.xml file but the installation fails in SCCM 2012 OSD. it complains about the answer file.

    • Scott says:

      Can you provide more details? What errors are you getting? Does your build work normally without the unattend file? Have you tried editing/opening the file in the system image manager?

      • Ibrahim says:

        I got it to work now. I opened the answer file in system image manager and it complained about the root node. so i added the root node and it worked.

        Thanks

  2. Scott says:

    I’ve just received confirmation from Microsoft that the behaviour experienced above is “by design” and won’t be changed. They are going to update the ConfigMgr documentation library with a small additional note and a KB article for this issue will also be published with the unattend.xml change as the solution to prevent it.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s