Updates fail to install

[Dave Davison]

Every time I close the computer down I get the prompt saying don't unplug as updates are being installed. Looking at the updates history I see that there is one that constantly fails, any suggestions as to what this update is and why the constant failure to install?

[HansV]

This appears to be a known problem.
Try installing Servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1: March 12, 2019 and SHA-2 code signing support update for Windows Server 2008 R2, Windows 7, and Windows Server 2008: September 10, 2019.
If all goes well, the failed update should then succeed.

[Dave Davison]

Many thanks Hans, will give that a go and see how things pan out. Regards Dave.

[stuck]

As Hans has already said, you almost certainly need to install the two updates he gives links too, first. I certainly had to install them before my little Win 7 would update.

Ken

[Dave Davison]

Thanks Ken, appreciate every response to my queries. Thanx

[Argus]

Looking at the updates history I see that there is one that constantly fails, any suggestions as to what this update is and why the constant failure to install?

Could have replied but was away for a second or two and then Hans had replied, not much to add in this case, it's documented. Though that documentation mentions a bit more than has already been mentioned above.

It's a monthly rollup update for August; it came with another update for Windows 7 SP1, the update to the SHA-2 code signing support, KB4474419, mentioned by Hans, which was installed on your machine 14 August according to your screenshot.

(The SHA-2 code signing support has been updated again some days ago, being part of September month's updates, but that's another story. SHA-2 code signing support is a requirement since this summer on Windows 7, what MSFT calls "legacy Windows versions"; I think it has been released and updated in stages.)

I had one machine fall over on this one (I'm not running WU on auto.). It already had the servicing stack update from this spring, KB4490628. It also had an earlier version of KB4474419, the SHA-2 code signing support, also from this spring. It would then seem MSFT wanted the more recent version (of the SHA-2 code signing support) to be installed before the big one, the monthly rollup. If that's a requisite, then they shouldn't be offered together.

However, even if the machine had those two updates (and in one case an older version), it lacked a third optional non-security update, the KB3133977 from the spring 2016. That's the one which caused boot problems for computers with Asus motherboards and a bit of a headache for users. Since that machine has an Asus motherboard the optional update KB3133977 was skipped at the time (as several optional updates are), but changes were made to UEFI to clear the way.

Since both KB4512506 (the monthly rollup) and KB4472027 (the SHA-2 Code Signing Support*) articles also mention KB3133977 as a requirement before installing a rollup (released 13 August or later), in the monthly rollup article: "Microsoft strongly recommends that you install the updates listed below", in the SHA-2 Code article: "The following updates must be installed", I didn't fancy playing peekaboo with WU by testing the other way around of the August updates, i.e. the update to SHA-2 code signing before the monthly rollup, so installed KB3133977, and then KB4474419 before the August rollup. (Should have taken care of the KB3133977 at the time, 2016, but it was optional for something not used on the machine, that's what you get if not reading KB articles ...)

So, make sure you have 'em both; the update to the servicing stack (very likely you have it, if running on auto, though servicing stack updates will only be offered if there are no other pending updates, so if it has been empty there (in the "important updates") some time the last 6 months it will probably have been offered) and the KB3133977 (since you already have what seems to be the August version of the SHA-2 code signing support KB4474419, before trying another monthly rollup (since we're now in September).

They made it all automatic so that we shouldn't have to worry about our computers not being up to date, and then as result we have to be even more vigilant, on our toes. Way to go.

*/

The following updates must be installed and the device must be restarted before installing any Rollup released August 13, 2019 or later. The required updates can be installed in any order and do not need to be reinstalled, unless there is a new version of the required update.

1. The latest servicing stack update (SSU) (KB4490628). If you are using Windows Update, the latest SSU will be offered to you automatically.
2. The latest SHA-2 update (KB4474419) released August 13, 2019. If you are using Windows Update, the latest SHA-2 update will be offered to you automatically.
3. If you are using EFI Boot on your device or virtual machine (VM), you must also install KB3133977. Currently, KB3133977 is required as a workaround for a known issue when using EFI Boot and should be applied even if you are not using BitLocker. For more information on this issue, see the FAQ below.

Important You must restart your device after installing all the required updates, before installing any Monthly Rollup, Security-only update, or Preview of Monthly Rollup.

[Dave Davison]

Managed to install the first link that Hans recommended but could find no button any button / tab on the page that opened when I clicked the second!!!

[HansV]

As Argus mentioned, the second one has actually already been installed successfully (it's the next to last one in your screenshot), so hopefully, the problem update will now go through...

[Argus]

Managed to install the first link that Hans recommended but could find no button any button / tab on the page that opened when I clicked the second!!!

Hans told you to download two updates (not links); I told you (and everyone else) that you already have one of them (that was needed for the August update), and that there are strong recommendations (expressed as "must") to install all three mentioned in Microsoft's articles related to the update that failed to install.

The article for KB4512506 mentions (as quoted above from another article):
1. KB4490628
2. KB4474419
3. KB3133977

Hans linked to articles for the first two. KB articles do not have download buttons in general, they tend to point you to using WU (Windows Update), and if that doesn't work their second suggestion is a link to Microsoft Catalog/Download Centre (the exceptions are updates that solve specific problems, updates which are not distributed via WU). I don't understand what you found to be different between the two pages that were linked to in this case.

Now, you say the first one was downloaded via the link and installed, but you didn't, or could not, download the second. In the first case we don't know if you already had it (since it was a link to an older update from March, it has now been replaced, more below), since you didn't look for it. In the second case we already know you have it (or one version of it since MSFT is keen to keep it updated, but let's not go there, or maybe we have to), so there shouldn't be any need for it in the short term.

Do you have the updates, 1, 2, and 3 mentioned above? (Check via Control Panel's Uninstall programs - Installed updates.)

Or you just forget about it, and move on, since we are now in September.

As it is, since this thread was started a couple of days after September's Patch Tuesday (10/9), but the topic is August month's updates, it becomes a bit hypothetical, if you are going to use Windows Update to install the failed update, since it won't be offered anymore. September's monthly rollup for Windows 7 SP1 is KB4516065.

And they've moved the goalposts.

Microsoft again strongly recommends the latest versions of a couple of updates before installing the latest monthly Rollup (KB4516065). That is, again, the latest servicing stack update, this time called KB4516655, 10 September (not KB4490628 from this spring) and the latest SHA-2 update KB4474419 (same number, but also updated 10 September, i.e. not the one installed 14 August).

If you see an update that's not been successfully installed you can search for information about it, preferably by using its designation by article numbers from MSFT's Knowledge Base, such as "KB4510526", for the August update, or "KB4516065" for the September update. In the articles you can find information about known "issues" with the update, if any, and requirements, i.e. "Before installing this update". In an ideal world Microsoft would make sure computers are not offered updates they can't install since they are missing one or two updates, but we are not there. Using only the numbers in searches, such as 4510526, may also work but there is a risk that you end up with a search result full of links to science articles, plumbing in Syldavia etc.

[Dave Davison]

I must emphasize I appreciate every response to my questions especially lengthy ones like that of Argos but can't profess to understand all the technical information and having past the octogenarian milestone I doubt if I ever will but press on regardless. I got a prompt last night that there were five updates available so clicked the accept tab and retired for the night. Just now I looked at my update History and see the one that persistently fails. If the answer to this glitch lies among all the technical details explained by Argos simply point me to it and I will try to grasp it.

[Argus]

I got a prompt last night that there were five updates available so clicked the accept tab and retired for the night. Just now I looked at my update History and see the one that persistently fails.

Not everything can be a "one-liner" post. In for example the Office sub forums we see loungers work on files or code, uploading and downloading every day, sometimes there is quite a bit of work put into those files, but the posts are often short. If I think it is needed, or to put something in context, I'll post it.

Background, general comments
You mention 5 updates, and that's fine, but I'm afraid we can all see a different number of updates for the OS and other software.
(At the moment I also see 5 updates on one Windows 7 machine: the monthly rollup; the September update to the SHA-2 code support; and three Office updates, but there is no sign of the updated servicing stack for September, KB4516655, it should be there since it was empty (no pending updates) before Patch Tuesday (10/9). This is a problem discussed at different places on the net, but I won't dwell on that in your thread unless someone else has comments about it.)

I'll try to put it as short as I can: if you are going to install September patches (some prefer to wait a couple of days), this would be the safe way:
First: KB4474419 (that's the latest SHA-2 code support, it's "good" to have when installing the other updates, read: requirement),
Second: KB4516655 (the Servicing Stack update, if offered),
And finally: September's monthly rollup, KB4516065.

If you have tried to install updates and find a failed update, I would bet it's because you are missing the SHA-2 code update, since the updates are signed using SHA-2, but could also be because of missing the Servicing Stack update (that has at least happened earlier).

Now, looking at your attached image; that is in some cases some quite old updates dropping down the tube. I'll concentrate on the 16/9, but I notice that you successfully installed the Servicing Stack Update, KB4516655, yesterday 15/9.

It starts with the failed monthly update, KB4516065. The first successful today was KB2984976 from 2014, gosh.
(Just a small comment, no need to know/understand; it's an update about Remote Desktop Protocol (RDP), I think there have been some recent vulnerabilities related to RDP, and it is possible that recent updates need this one to be installed, so if missed earlier it will pop-up, but I have not looked closer at it.)

After that follows three other old updates that also failed to install, KB3020388, KB2923545, and KB3075226, two important and one recommended, all three from 2014 and 2015 and related to Remote Desktop Protocol as the successful one mentioned above. That's 5 altogether.

Question
I cannot tell from your screenshots (both of them) if you have the latest version of KB4474419 SHA-2 code support (some call it v3). It would explain the failed monthly rollup, but not the other three (since, if I understand things correct, they would not rely on SHA-2, but what do I know).

To start with the most recent of the failed updates, the monthly rollup KB4516065, you will need to install the latest version of KB4474419 if it is not already installed. Either it is offered in your Windows Update or you will have to download it manually, install it and let the PC reboot. I could point you to the KB article KB4474419, but the download link will point you to MSFT Update Catalog for KB4474419, and there you will find plenty of different versions of the same update. It is easy to pick if one knows what to look for, but I appreciate that it can be a problem. I gather you are running Windows 7 64-bit, is that right?

[Argus]

I notice that you successfully installed the Servicing Stack Update, KB4516655, yesterday 15/9.

Just another comment, it is indeed a bit odd that your SSU (Servicing Stack Update), KB4516655, was successful yesterday, since there are threads on the net that mentions failed installs if not having KB4474419v3, the latest SHA-2 code support. And if you have it, that's my question above, then the monthly rollup shouldn't fail.

Still, to go forward you will need to check for KB4474419 among installed/failed, or what's offered in Windows Update, if it's nowhere (apart from the old version installed 14/8) you'll have to download it from the update catalog. You can get a link when we know your version of Windows 7.

(Some say you'll still need KB4490628, the old servicing stack, and it to be installed before the September version KB4516655, good then that we solved that; your first download from Hans' link above, and KB4516655 installed 15/9. Still, there's also the old KB3133977.)

[Dave Davison]

Thank Argos. To the question [ I gather you are running Windows 7 64-bit, is that right?] the answer is yes; To use an analogy that sums up my grasp of all things I T I would liken it to the shallow or medium end of a swimming pool which is where I feel most comfortable seeing my swimming ability is mediocre to say the least. I did a bit of rummaging on line and found a MS form where as far back as May 9th this year a poster concluded BK4474410 had a bug, so maybe it is prudent for me to leave well alone as nothing seems amiss with the computer. Many thanks anyway for the detailed replies and the time you took to type them. Cheers Dave.

[Dave Davison]

SORRY, forgot to add the screenshot.....

[Argus]

I did a bit of rummaging on line and found a MS form where as far back as May 9th this year a poster concluded BK4474410 had a bug, so maybe it is prudent for me to leave well alone as nothing seems amiss with the computer. Many thanks anyway for the detailed replies and the time you took to type them. Cheers Dave.

Well, it is your computer, Dave. Yes, there have been threads around the net about some problems with different updates (as always, though sometimes it's a bit quieter).

The thread you mentioned is from, I think March to June. They released version 1 of KB4474419 in March, version 2 in August, and version 3, as mentioned earlier, now in September. I've also seen discussions about problems installing version 2, and as I think I mentioned above it's not necessarily a problem with a certain update, but that they sometimes need to be installed in a certain sequence (still one KB for August said it didn't matter, as quoted above). As I mentioned above, in August a computer here was offered 2 updates, it "choked" on the August Rollup, and somehow needed the other update, which happened to be version 2 of KB4474419 to be installed first (I also installed a third optional from 2016 that was mentioned).

I think it is this that some have been referring to as a bug. This makes it a bit complicated, more so when I don't know what's installed on your computer.

The point with updates, this late in the life cycle of Windows 7, is, and has been for quite some time, to keep it as safe as possible, to close "security holes", this is not something one can see or feel. And an update (security or other) won't fix a computer that's not running well.

[Dave Davison]

I've expressed this before but must say again, I truly appreciate the wealth of knowledge and help from the members of this forum for more years than I can remember, as 2019 gently fades away into oblivion taking with it MS support for window 7 I suppose I might have to upgrade to W10 but as long as W7 keeps remains function able I'll stay with it. Cheers Dave.

[Argus]

It's a bit easier to help if people don't give up, Dave.
Then there are some limits to what can be done via a forum.
(We are not there yet, by far.)

Even if MSFT has cut down on the amount of updates, by creating cumulative updates, i.e. one month includes what was fixed an earlier month, there are, as we have seen, also some other patches released. So one can't just say that if it didn't work this month, maybe it'll work next month and I won't miss anything since they are cumulative. That might just end with another failed install of a monthly rollup.

Not everything is a one-download-click-on-this and then all is fine. Windows 7 will stay "secure" for a longer time if it has the security updates that are needed. That said there are people who haven't installed an update for years, and of course in many aspects the OS works as it did when they stopped installing updates, unless they've managed to break it by messing with settings, but changes in other software which people tend to keep updated, such as browsers, may rely on things in the OS.

[ChrisGreaves]

This appears to be a known problem....

Recursive fixes to fixes? How brilliant is this Microsoft outfit?


Thanks Dave. I too had witnessed a recurrent failed update, and will now pursue those links
Chris

[Dave Davison]

Now that windows 7 is consigned to the bin -for most- I will still use it till something prevents me, I have an ancient update that refuses to install but - despite this - it must not have been critical as I have experienced no problems without it installed. The computer, as programmed to do - insists on installing the said update before closing down but fails to install so I thought that maybe it can be located and deleted so would appreciate it if someone can tell me where it is lurking.

[Argus]

Now that windows 7 is consigned to the bin -for most- I will still use it till something prevents me, I have an ancient update that refuses to install but - despite this - it must not have been critical as I have experienced no problems without it installed.

Well, from what you say it seems you have identified it yourself and well aware, that would be easier than for us looking at a small snapshot of update history for the last weeks.

Must be a bit critical, Dave, if the result is that monthly rollups fail ... at the bottom we see that December didn't install.