KB3139398 March 2016 Update Failing Issue [Solution]

In the setup event log you see KB3139398 and probably a bunch more KBs failing to install

The fact all the others are failing is because KB3139398 is failing.

This is typically someone has applied a group policy to deny file system access to the files.

See https://community.spiceworks.com/topic/1506101-kb3139398-fails-if-you-re-already-blocking-usb-mass-storage-devices

So first step is to remove the GPO setting. There are two possiblilties:

  1. There is an existing GPO applied to the device
  2. There was a GPO applied to the device and the file access has remained

There is an existing GPO applied to the device

Run the Group policy results wizard against the computer. You will then be able to see if a GPO applied or not and identify the GPO to change.

So then edit the GPO to remove the settings

Wait 15 minutes to allow GPO to replicate to all Domain controllers you have. 

Do a GPupdate on the device, so that  the GPO is applied.

Re-run the Group policy results wizard against the computer, to see the GPO has been updated

Go to %SystemRoot%\inf and for the two files USBStor.inf and usbstor.pnf , right click on them and see if you have access to the security tab and see the security in place.

If you can see the security, then the KB should now be able to be installed correctly.

If you see this

you  do not have access, then follow the next section to get the KB3139398 installed and then reapply the settings to the GPO , if you still want the USB policy applied

There was a GPO applied to the device and the file access has remained

If you do not have access, then take ownership of the two files.

Once you take ownership, go to the security tab. You should then see the default access

Unfortunately that does not show all the security applied, so press the advanced button

It will then show you the full security that is applied

Unfortunately my picture is missing the deny permission, that you should see listed (this is normally deny BUILTIN\USERS )

A Deny is processed before an Allow so if SYSTEM is part of the BUILTIN\Users . Then it will always be denied access, event if there is an allow for it to have full control

So remove the deny(s) that you see. for BOTH files

Then reinstall the KB’s and reboot and KB3139398 should now be installed .

Leave a comment

Your email address will not be published. Required fields are marked *