DrCheese (10th February 2011)
Hope somebody can help me.... today are systems received a load of new updates from our WUS server, a good number of our machines (about 100 of them) which were all Dells decided that they didn't like KB2393802
The machines do an automatic install of updates at 10:00AM, once these machines had installed this update, and restarted, that's all they kept doing, get to the logon screen and keep restarting.
I jumped onto the WUS server and Declined any updates from today (which included the KB2393802, went around every machine with the problem and uninstalled the Security Patch from them, this fixed the problem!
However, I'm a little concered, looking at the event logs on some of these machines that they show that KB2393802 has been downloaded to the machines and is scheduled to install at 10AM tomorrow.... WHY?!?!?
I don't want another repeat of today!!!! Help!!!!!
What can I do?!?!?
DrCheese (10th February 2011)
Glad I'm not alone!!! Posed earlier about BSOD's from updates. Did the same as you and declined all updates from 8/2/11. As I didnt have chance to identify the culrit from about 8 updates etc I just did a system restore from an earlier point. These were Fujitsu PC's and did the same/similar, booted up got almost to logging on screen then blue screened and rebooted. Came to the school at lunch and was faced with three down in the suite and a couple of more by the end of the afternoon. Bet I'm faced with a couple tomorrow as I noticed some were saying they would update at shut down (took option to not install and just shut down).
Googling around shows 'we are not alone!"
Last edited by TechSupp; 9th February 2011 at 09:24 PM.
I did see your earlier post... We are not seeing any sign of a blue screen on our machines, it just sits on the logon screen (or you can start to login) then it will just restart, within about 20-30 seconds and go around in a circle. I manually went around each machine today and uninstalled all the updates that were installed today (since found out that it's KB2393802 which is causing our problem)
What's worrying me is that I have declined the updates on the WUS server (all updates with todays date, which included KB2393802), but when I looked in Event Viewer after I'd uninstalled them from the machines, it's now showing that they are sitting there waiting to be installed again tomorrow!
So I fear I'm going to hit the same problem tomorrow after 10AM (When it's due to install)
Is this because the patches are still sitting in a folder on the computer... if so where? And can I remove these files before they get installed, so it will never pick them upagain?!?!?
This is only on our Dell machines, we have Fujitsus, Acers, HP's and unbranded which don't seem to be affected.
We are using Windows XP on all the machines, KB2393802 has many variations, Vista/Server 2003/XP, but I've declined the ot for now.
I've checked the C:\WINDOWS\SoftwareDistribution\Download\ folder on the local machines, and deleted all the contents in the hope it was picking it up from the local folder to install... but thats made no difference, the machines still pop up saying it's got Windows Updates ready to install!!
Where is it getting this file from?!?!
Have you tried declining the update and then manually syncing the machine with WSUS by running wuauclt /detectnow? That should get WSUS to tell the machine that there is no new updates. I have done this in the past and it worked fine for me.
A quick trip round google suggests that update (KB2393802) is causing all sorts of problems
This update KB2393802 updates the Windows kernel, so it could be many things causing the computer to BSOD.
Does the computer start in Safe Mode OK?
And if you are suffering from this problem, state the machine name and model number if possible.
Can someone let me know if this mainly on XP builds ? I'm about to logon to our WSUS server......
- choose Security Updates and change the filter to "Approved"
- right click on the offending update (KB2393802) and select "Approve"
- right-click the group for which you've already approved/installed the update - you can choose an extra option "Approved for removal" if the update has been downloaded or installed by one or more members of the group
- Now run wuauclt /detectnow on the affected machine it will mark the update to be uninstalled & uninstall it (either automatically or manually, depending on how you do your Windows Updates)
Thanks Guys for the replys,
The machines are Dell Optiplex 755 USFF, and 760 USFF, they are Windows XP SP3 (And all Patches)
The machines are not showing any sign of a BSOD, they boot up, sit on the logon screen for about 10 seconds max, then just restart.
I don't think doing what you suggested "timzin" is going to work in this case, as the machines are not staying on log enought for this setting to reach the clients as they just restart again....
I've just been around the rooms and some of the machines have started doing it again, the GPO hadn't kicked in where I changed the scheduled install time from 10AM... I also setup a script to delete all the contents from C:\WINDOWS\SoftwareDistribution\Download\ folder.
The machines that I have restarted and gone back into down appear to be showing KB2393802 as an update at the moment, but it didn't yesterday until later on in the day.
As a precaution I've not approved this one - got too much to be getting on with anyhoo.
This reminds me of the reported Windows Update which caused BSODs not long ago and it was malware related.
Other possibilities are driver conflicts or anti-virus conflicts too as most people seem successful uninstalling this update in Safe Mode.
Interesting... I'd approved this yesterday.
Just waiting to see what happens!
Deployed to Dell Optiplex 620/745/755/760/780's with XP Pro / SP3.
Just checked for you, all the Optiplex 755 have installed the update(s) fine.
There are currently 1 users browsing this thread. (0 members and 1 guests)