Outlook 2013 crashing - AFTER the fixed KB3097877 update installed

[burgemaster]

Hi,

 

We had issues with the KB3097877 update as did many others. This was resolved by deploying the fixed update released on the 12th Nov.

 

We have double checked that the latest fixed update is installed by checking WSUS and also the date created for file "C:\Windows\System32\win32k.sys". This should be 3rd Nov for the new KB3097877 update (17th Oct for the bad update).

 

Has anyone else seen outlook crashing repeatedly recently? Maybe 6 times a day for a staff member?

 

Problem signature:

Problem Event Name: APPCRASH

Application Name: OUTLOOK.EXE

Application Version: 15.0.4771.1000

Application Timestamp: 561cc988

Fault Module Name: ntdll.dll

Fault Module Version: 6.3.9600.16502

Fault Module Timestamp: 52c35a76

Exception Code: c0000005

Exception Offset: 0001e12c

OS Version: 6.3.9600.2.0.0.16.7

Locale ID: 2057

[elsiegee40]

What OS is this on?

[burgemaster]

Windows 7 64bit

Server 2012 terminal server

 

EDIT.... Just found this. Looks like there is another botched office update, KB3101488

 

https://support.microsoft.com/en-us/kb/3118497

 

Looks like it was fixed with KB2975838 on the 19th..

 

https://support.microsoft.com/en-us/kb/2975838

[burgemaster]

And its not in available in WSUS or able to be imported.... great. Thanks MS

 

It comes as an 86meg EXE, so you can extract it with the switch "outlook2013-kb2975838-fullfile-x86-glb.exe /extract:C:\ExtractedFiles"

 

Theres probably an easier way to roll it out, but you can then install the MSP file with a logon script, the script below makes sure that it only gets installed once by checking for the presence of the KB2975868.txt file..

 

set objFSO = CreateObject("Scripting.FileSystemObject")
set objShell = CreateObject("WScript.Shell")
if NOT objFSO.FileExists("C:\Windows\KB2975838.log") Then 
objFSO.CreateTextFile("C:\Windows\KB2975838.log")
iReturn = objShell.Run("\\SERVER\SHARE\Patches\KB2975838\outlook-x-none.msp /quiet /norestart", 1, TRUE)
End If

 

You can double check it has installed by checking appwiz.cpl

Edited November 23, 2015 by burgemaster

[gshaw]

Is this affecting Word for anyone on here? We had Outlook crashing last week but this week's issue seems to be Word freezing up randomly on users' machines

[LeMarchand]

Is this affecting Word for anyone on here? We had Outlook crashing last week but this week's issue seems to be Word freezing up randomly on users' machines

 

We've started to have crashes in all Office 2013 applications on our spanking new Win 8.1 x64 machines. Tried turning off hardware acceleration which seemed to fix it on the couple I tried. Will report back if not.

[burgemaster]

Outlook no longer crashing.... But now Word is...

[Michael]

Can't help but think Microsoft are doing this on purpose, or possibly porting Office 2016 code to fix older code in Office 2010 or 2013.

[burgemaster]

Problem signature:

Problem Event Name: APPCRASH

Application Name: MSPUB.EXE

Application Version: 15.0.4763.1000

Application Timestamp: 55f7f1f9

Fault Module Name: mso.dll

Fault Module Version: 15.0.4771.1001

Fault Module Timestamp: 56261d17

Exception Code: c0000005

Exception Offset: 0029cf91

OS Version: 6.1.7601.2.1.0.256.4

Locale ID: 2057

 

Additional information about the problem:

LCID: 1033

skulcid: 1033

[LeMarchand]

Turning off hardware acceleration seems (so far) to have solved this for us.

[MrJDH]

Office 2013 still seeing random crashes, even after installing the re-issued KB3097877, and after KB2975838 being installed. Hardware acceleration was already disabled prior to the issue.

[burgemaster]

Does anyone else see "Office Software Protection service" (Event 1003) logged directly before the application hangs?

I'm wondering if this might be linked to our KMS

[gshaw]

OK so we're still getting crashes in Outlook and other Office products. Reading up suggests this list of failed update:

 

Original failed update was KB3097877, original busted but re-released

 

Microsoft surreptitiously reissues botched patch KB 3097877 for Windows 7 | InfoWorld

 

There's another update listed as causing crashes KB3101488 and supposedly fixed by KB2975838

 

https://support.microsoft.com/EN-US/kb/2975838

https://support.microsoft.com/en-us/kb/3101488

 

I'm going to check an affected machine to see which ones of this sorry bunch are installed and see if there's an overall fix state with them all applied. Anyone else had any joy as this is really impacting users now...

[burgemaster]

OK so we're still getting crashes in Outlook and other Office products. Reading up suggests this list of failed update:

 

Original failed update was KB3097877, original busted but re-released

 

Microsoft surreptitiously reissues botched patch KB 3097877 for Windows 7 | InfoWorld

 

There's another update listed as causing crashes KB3101488 and supposedly fixed by KB2975838

 

https://support.microsoft.com/EN-US/kb/2975838

https://support.microsoft.com/en-us/kb/3101488

 

I'm going to check an affected machine to see which ones of this sorry bunch are installed and see if there's an overall fix state with them all applied. Anyone else had any joy as this is really impacting users now...

 

See post #3

 

I don't suppose you have a huge amount of "Office Software Protection service" events logged just before the crash?

[gshaw]

Good point haha, couldn't see the wood for the trees there. Have found a machine near our office crashing regularly so will check it out

[gshaw]

Does anyone else see "Office Software Protection service" (Event 1003) logged directly before the application hangs?

I'm wondering if this might be linked to our KMS

@burgemaster just checked logs on an affected machine; indeed 1003 is there before the crash (and seemingly at regular intervals throughout the day)

 

The machine had KB3097877 and KB3101488, as per the post on the first page KB2975838 still isn't available in my WSUS list

 

Installed KB2975838 manually and will see results tomorrow when the user returns. If that is the fix why it isn't available for automated deployment is just bizarre.

[burgemaster]

We're going to activate a few with a MAK key to rule out KMS, remove 3097877 and 2975838 on some others and test. We have office 2016 installed and testing, no crashing but 2016 is showing its own issues with shared calendars!! I keep checking Windows Update for the hope of a new patch/fix.

We might also call Microsoft Support for the first time too. I believe if it is related to patch management there is no charge but I might be wrong.

Edited December 1, 2015 by burgemaster

[gshaw]

Is no one else experiencing this? Thread seems to have gone quiet on what I'd imagine would affect a pretty broad user base on here at least?

[LeMarchand]

Is no one else experiencing this? Thread seems to have gone quiet on what I'd imagine would affect a pretty broad user base on here at least?

 

Turns out my fix doesn't work reliably. My problem is that the crashes are inconsistent, thus making it hard to troubleshoot.

 

Has anyone tried 2016 instead?

[gshaw]

Turns out my fix doesn't work reliably. My problem is that the crashes are inconsistent, thus making it hard to troubleshoot.

 

Has anyone tried 2016 instead?

@LeMarchand do your machines have KB2975838 installed? One test machine has had it installed thus far and seems to have helped. Still no sign of it on WSUS though.

[LeMarchand]

@LeMarchand do your machines have KB2975838 installed? One test machine has had it installed thus far and seems to have helped. Still no sign of it on WSUS though.

 

Not if it's not on WSUS! Have taken one of the affected machines into my office and going to try today. Was a bit leery of it as most of the people with the problem are talking about Outlook (which no-one here uses apart from me - and then only at home) but it's getting desperate!

[burgemaster]

We have moved all of our Admin staff to Office 2016, A little more rushed than planned, but they are all happy and only very few have even noticed, also only positive comments.

Deployed with computer account filtered group policy calling a logon script, we created a transform msp from the office customisation wizard which included the removal of Office 2013, KMS, supress of EULA etc. (Placed into the office update folder)

 

setlocal

REM *********************************************************************
REM Environment customization begins here. Modify variables below.
REM *********************************************************************

REM Get ProductName from the Office product's core Setup.xml file, and then add "office16." as a prefix. 
set ProductName=Office16.PROPLUS

REM Set DeployServer to a network-accessible location containing the Office source files.
set DeployServer="\\server\shares\Microsoft Office Professional Plus 2016\setup.exe"

REM Set LogLocation to a central directory to collect log files.
set LogLocation="\\server\share\Microsoft Office Professional Plus 2016\logfiles"

REM *********************************************************************
REM Deployment code begins here. Do not modify anything below this line.
REM *********************************************************************

IF NOT "%ProgramFiles(x86)%"=="" (goto ARP64) else (goto ARP86)

REM Operating system is X64. Check for 32 bit Office in emulated Wow6432 uninstall key
:ARP64
reg query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\Microsoft\Windows\CurrentVersion\Uninstall\%ProductName%
if NOT %errorlevel%==1 (goto End)

REM Check for 32 and 64 bit versions of Office 2013 in regular uninstall key.(Office 64bit would also appear here on a 64bit OS) 
:ARP86
reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%ProductName%
if %errorlevel%==1 (goto Office) else (goto End)

REM If 1 returned, the product was not found. Run setup here.
:Office
echo %date% %time% Deployment triggered on %computername%.>> %LogLocation%\%computername%.txt
%DeployServer%
echo %date% %time% Setup executed and ended with error code %errorlevel%. >> %LogLocation%\%computername%.txt

REM If 0 or other was returned, the product was found or another error occurred. Do nothing.
:End

Endlocal

Edited December 3, 2015 by burgemaster

[LeMarchand]

@gshaw Have just installed the KB, and it's still crashing.

 

Going to keep trying with 2013 this week, but may have to go to 2016. Never installed Office "remotely" (always baked it into the image), so could be fun. If I had longer I'd just update and roll out a new image, but there are some other problems with the image that need addressing. (@:*&^%!!! Start Menu).

[gshaw]

@gshaw Have just installed the KB, and it's still crashing.

 

Going to keep trying with 2013 this week, but may have to go to 2016. Never installed Office "remotely" (always baked it into the image), so could be fun. If I had longer I'd just update and roll out a new image, but there are some other problems with the image that need addressing. (@:*&^%!!! Start Menu).

@LeMarchand not the outcome we were hoping for. How about uninstalling KB3101488?

[LeMarchand]

@LeMarchand not the outcome we were hoping for. How about uninstalling KB3101488?

 

At an (unaffected) site this morning - will try later.