AngryTechnician Posted February 23, 2011 Posted February 23, 2011 (edited) OK, so I haven't had time yet to fully diagnose this but wanted to get some info up now in case anyone else spots something similar. After updating my System Center Essentials 2010 server to Windows Server 2008 R2 SP1, and then adding the Windows 7 SP1 ISO to my WDS server, I decided to test a full rebuild over PXE. Everything worked apart from one thing: my package for Microsoft Office Professional Plus 2010 will not install - Windows Update reports error 0x80070570 every time. This error corresponds to "The file or directory is corrupted and unreadable". So far I've tried resetting the SoftwareDistribution folder, running the OS rebuild again, publishing a new package of the same Office setup files on SCE, and publishing a slightly modified version. This package has been working since I deployed it back in August. Every other package on SCE I've tried so far (more than 40 of them) works fine, it's just this one that is a problem. I haven't yet tried the deployment on another machine, since they currently all have Office already. That will be my next test, but probably won't happen until Friday as I'll be at Microsoft tomorrow. Any other suggestions or wisdom in the meantime gratefully received! Edited February 23, 2011 by AngryTechnician
AngryTechnician Posted February 24, 2011 Author Posted February 24, 2011 OK, just confirmed that the package still works fine on Windows 7 RTM machines, so it's definitely something to do with the client. Next step: a Windows 7 RTM machine that has been updated with SP1 using the standalone installer.
AngryTechnician Posted February 24, 2011 Author Posted February 24, 2011 OK, a Windows 7 RTM machine that installed the package fine fails to install the same package after being upgraded to SP1. This is not good.
sted Posted February 24, 2011 Posted February 24, 2011 is there a sp for office? or does say x64 work and x86 not
AngryTechnician Posted February 24, 2011 Author Posted February 24, 2011 (edited) This is the x86 version onto an x86 client. There is no service pack for Office 2010 yet. Also, a manual install of the same files works fine on SP1; it's only when it is pulled from my SCE server the problem occurs. I've narrowed it down to an alleged file signature problem on one of the .cab files in the package - this is from the %windir%\WindowsUpdate.log file: 2011-02-23 18:47:27:378 956 370 Misc Validating signature for C:\Windows\SoftwareDistribution\Download\6289c9a097282d35d784377ec24ef813\eda2be140a7d24d5885df8d87c0cc68cc6d704a2: 2011-02-23 18:47:27:378 956 370 Misc WARNING: Digital Signatures on file C:\Windows\SoftwareDistribution\Download\6289c9a097282d35d784377ec24ef813\eda2be140a7d24d5885df8d87c0cc68cc6d704a2 are not trusted: Error 0x80070570 2011-02-23 18:47:27:674 956 370 DnldMgr WARNING: File failed postprocessing, error = 80070570 This seems spurious for three reasons. First, the package works fine pre-SP1. Second, I've downloaded that .cab file manually and the signature reports "This digital signature is OK" when I check it in file properties. Third, every package on the server is signed with the same certificate, and they all work fine apart from this one. Edited February 24, 2011 by AngryTechnician
pomroy24 Posted March 11, 2011 Posted March 11, 2011 For what it's worth I've had the exact same problem with Adobe Acrobat Pro. We deploy it using Local Update Publisher to WSUS and consume it with Windows Update on the clients. In all cases it works flawlessly until you introduce Windows 7 SP1.
pomroy24 Posted March 11, 2011 Posted March 11, 2011 Thread on the LUP forum here: SourceForge.net: Local Update Publisher: Topic: Windows 7 SP1 seems to break Acrobat X LUP 1
AngryTechnician Posted March 11, 2011 Author Posted March 11, 2011 (edited) Just had a read through of your above linked thread: my SCE server is running Server 2008 R2 SP1, and the problem still occurs, so I wouldn't get your hopes up on having both on SP1 being the fix. Edited March 11, 2011 by AngryTechnician
pomroy24 Posted March 11, 2011 Posted March 11, 2011 Yup, already tried it and I can verify same. Upgrading WSUS server to Windows 2008 R2 + SP1 does *not* fix the issue.
pomroy24 Posted March 11, 2011 Posted March 11, 2011 Today's test: Apply the two patches from this vulnerability (which seem not to be present on my WSUS server or clients) on a pre-SP1 machine: CVE-2010-0486 : The WinVerifyTrust function in Authenticode Signature Verification 5.1, 6.0, and 6.1 in Microsoft Windows 2000 SP4, Wind Microsoft Security Bulletin MS10-019 - Critical: Vulnerabilities in Windows Could Allow Remote Code Execution (981210) They are rolled into SP1 according to the documentation but have never appeared as Critical Updates in my WSUS for some reason.
AngryTechnician Posted March 11, 2011 Author Posted March 11, 2011 (edited) I think I can save you some time there: both of those updates (KB979309 and KB978601) are deployed to my pre-SP1 workstations, and they still work fine. They show up as "Security Updates" rather than "Critical Updates" in WSUS, if that helps explain why you didn't see them before. Edited March 11, 2011 by AngryTechnician 1
pomroy24 Posted March 11, 2011 Posted March 11, 2011 Thanks for that. I've since re-searched WSUS which now magically found the updates. Last time it found no results for either KB number.
AngryTechnician Posted March 11, 2011 Author Posted March 11, 2011 On a side note: Local Update Publisher is a tool I'd never heard of before today, and I think a lot of members here would be interested in hearing more about it. There was a thread started last month that didn't really get any traction, but if you've time, I for one would love to hear more about your presumably positive experiences with it (this one aside!)
sukh Posted March 11, 2011 Posted March 11, 2011 Hi @Angrytechnician - Just to clarify, manually deploying Office 2010 on Win 7 SP1 machine work fine? Regards Sukh
pomroy24 Posted March 11, 2011 Posted March 11, 2011 (edited) In brief, Local Update Publisher is an open source project that allows you to publish 3rd party updates (MSI, MSP, EXE) to a WSUS server for consumption with the built-in Windows Update client. A few changes need to be made to make it possible (like allowing 3rd party signed updates to be consumed and publishing a certificate to sign them) but it can all be accomplished in one quiet afternoon. It provides an interface very similar to WSUS (though stripped down) for monitoring the success of your deployments and can be installed on the same server as WSUS without causing problems. It solves the Acrobat/Flash/Java/Firefox updating issue effectively for admins without the time and/or resources to implement SCCM deployment. Local Update Publisher | Download Local Update Publisher software for free at SourceForge.net http://sourceforge.net/apps/mediawiki/localupdatepubl/index.php?title=Main_Page The wiki page is temporarily down - it should work soon. Edited March 11, 2011 by pomroy24 1
sukh Posted March 11, 2011 Posted March 11, 2011 Might want to try You cannot install some updates or programs
sukh Posted March 11, 2011 Posted March 11, 2011 Also, "Error 0x80092026: The cryptographic operation failed due to a local security option setting." Check for the Key, don't worry about if it's for W2K3
sukh Posted March 11, 2011 Posted March 11, 2011 And How do I reset Windows Update components? Sorry for the multiple links, I haven't got a lab set-up for SCE 2010. If I do this, I'll have to blow away my exisiting labs and am working on other issues. Let me know how you get along. Thanks Sukh
sukh Posted March 11, 2011 Posted March 11, 2011 Also, Have you tried to deploy Office without AU by setting a deadline via SCE on the package?
pomroy24 Posted March 11, 2011 Posted March 11, 2011 Went through all the possible fixes here: You cannot install some updates or programs No luck finding anything wrong so I ran the "Fix it" tool and that didn't work either (it tries methods #1 through 5). The others don't seem to apply, most are attempts to fix corruption that occurs over time; this issue is plainly demonstrated with a very fresh installation of Windows 7 + SP1. This registry key doesn't appear to exist in Windows 7: "Error 0x80092026: The cryptographic operation failed due to a local security option setting." Thank you for the links all the same, have a nice weekend.
sukh Posted March 11, 2011 Posted March 11, 2011 Have you tried to deploy via SCE 2010 using a deadline? Cheers S
pomroy24 Posted March 12, 2011 Posted March 12, 2011 I can't speak for AngryTechnician. I'm troubleshooting Adobe Acrobat deployed by Local Update Publisher (no SCE or SCCM involved). It just so happens it's the same error message in Windows Update, seemingly from the same root cause. Both are large .cab files that appear to fail the digital signature test after download. I suspect there's something wrong with the way Windows 7 SP1 verifies the signatures.
sukh Posted March 12, 2011 Posted March 12, 2011 can either of you deploy a seperate package other than the one is failing? Just trying to rule if it's WSUS or Win 7 SP1. So far from the logs and symptons, it appears Win7 SP1 AU. If you can deploy other packages then it most likely point to the size as you suggested. Out of interest what size is Adobe? one .cab or multiple?
pomroy24 Posted March 12, 2011 Posted March 12, 2011 All other LUP deployments work fine (Firefox, Java, Adobe Flash). Acrobat has two .cab files, 394 mb and 83 mb. It's much larger than the others and works fine in all cases except Windows 7 SP1. It looks like Microsoft is on the case per the last message in this thread: One particular software package no longer installs on Windows 7 after upgrade to SP1 - error 80070570 (file corrupt) 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now