Rolling out the Windows 7 ESU went pretty well for the majority of the 3,000 Win7 Clients we had (ever decreasing with a Windows 10 rollout).
Suddenly in MEMCM 1910 (SCCM) I had an increase in non compliant Windows 7 devices and KB4575903 was not installing.
Windows 7 updates were applying fine but…..
The devices were not compliant with my SUG baseline
It transpires I was getting in the windowsupdate.log
2020-10-21 11:21:53:894 1140 c30 Agent WARNING: Failed to evaluate Installed rule, updateId = {A14053C6-954D-4E31-A9EC-A233360A48AE}.200, hr = 80041010
2020-10-21 11:21:53:894 1140 c30 Agent WARNING: Failed to evaluate Installable rule, updateId = {A14053C6-954D-4E31-A9EC-A233360A48AE}.200, hr = 80041010
2020-10-21 11:21:56:749 1140 c30 Agent WARNING: Failed to evaluate Installed rule, updateId = {916F3D06-6B38-4B5D-A776-88F48A7609BE}.201, hr = 80041010
2020-10-21 11:21:56:764 1140 c30 Agent WARNING: Failed to evaluate Installable rule, updateId = {916F3D06-6B38-4B5D-A776-88F48A7609BE}.201, hr = 80041010
2020-10-21 11:22:00:773 1140 c30 Agent WARNING: Failed to evaluate Installed rule, updateId = {68079C3F-2EA8-4B62-B0E8-0688D60F8EB2}.202, hr = 80041010
2020-10-21 11:22:00:773 1140 c30 Agent WARNING: Failed to evaluate Installable rule, updateId = {68079C3F-2EA8-4B62-B0E8-0688D60F8EB2}.202, hr = 80041010
2020-10-21 11:22:01:553 1140 c30 Agent WARNING: Failed to evaluate Installed rule, updateId = {940C733D-7502-4A8D-8965-979D14F073F1}.200, hr = 80041010
2020-10-21 11:22:01:553 1140 c30 Agent WARNING: Failed to evaluate Installable rule, updateId = {940C733D-7502-4A8D-8965-979D14F073F1}.200, hr = 80041010
2020-10-21 11:22:05:734 1140 c30 Agent WARNING: Failed to evaluate Installed rule, updateId = {13336AA6-0956-4F0D-A6C2-52E84CFB596A}.200, hr = 80041010
2020-10-21 11:22:05:750 1140 c30 Agent WARNING: Failed to evaluate Installable rule, updateId = {13336AA6-0956-4F0D-A6C2-52E84CFB596A}.200, hr = 80041010
2020-10-21 11:22:07:560 1140 c30 Agent WARNING: Failed to evaluate Installed rule, updateId = {40FFC1EF-FAA5-447F-A21B-B0E675114265}.200, hr = 80041010
2020-10-21 11:22:07:560 1140 c30 Agent WARNING: Failed to evaluate Installable rule, updateId = {40FFC1EF-FAA5-447F-A21B-B0E675114265}.200, hr = 80041010
2020-10-21 11:22:08:106 1140 c30 Agent WARNING: Failed to evaluate Installed rule, updateId = {49130C58-976C-48F3-A057-40FE9FF19315}.200, hr = 80041010
2020-10-21 11:22:08:106 1140 c30 Agent WARNING: Failed to evaluate Installable rule, updateId = {49130C58-976C-48F3-A057-40FE9FF19315}.200, hr = 80041010
The thing is that none of those are the KB4575903 which the Unique Id of 40B2919A-852A-49E7-90C9-18C7312CD3C4. In the logs is is showing as superseded.
In MEMCM console It does not show as superseded
For the properties of the software update it does not show a “superseded by” KB article (all 3 updates have no superseded by information)
Only thing I can see to fix it is to use my WU Slegehammer followed by my MEMCM Client SledgeHammer
Once I have done that the update (KB4575903) eventually installs and appears in the windows update log
2020-10-21 11:47:45:103 1140 1f20 DnldMgr *********** DnldMgr: Copy update to cache [UpdateId = {4C94D541-349D-4CFF-81C4-B9627CCA1004}.202] ***********
2020-10-21 11:47:45:134 1140 1f20 DnldMgr Asking handler to generate non-range requests.
2020-10-21 11:47:45:134 1140 1f20 Handler Generating request for CBS update 4C94D541-349D-4CFF-81C4-B9627CCA1004 in sandbox C:\WINDOWS\SoftwareDistribution\Download\e537aaa9dd2df8b3f3634bf4cfe42680_ctc
2020-10-21 11:47:45:134 1140 1f20 Handler Selecting self-contained because update has express payload but server doesn't support it.
2020-10-21 11:47:45:134 1140 1f20 Handler Selected payload type is ptSelfContained
2020-10-21 11:47:45:134 1140 1f20 Handler Detected download state is dsStart
2020-10-21 11:47:45:134 1140 1f20 Handler Adding Windows6.1-KB4575903-x64.cab (entire file) to request list.
2020-10-21 11:47:45:134 1140 1f20 Handler Request generation for CBS update complete with hr=0x0 and pfResetSandbox=0
2020-10-21 11:47:45:150 1140 1f20 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\Download\e537aaa9dd2df8b3f3634bf4cfe42680_ctc\Windows6.1-KB4575903-x64.cab with dwProvFlags 0x00000080:
2020-10-21 11:47:45:244 1140 1f20 Misc Microsoft signed: Yes
2020-10-21 11:47:45:244 1140 1f20 DnldMgr Asking handler to generate non-range requests.
2020-10-21 11:47:45:244 1140 1f20 Handler Generating request for CBS update 4C94D541-349D-4CFF-81C4-B9627CCA1004 in sandbox C:\WINDOWS\SoftwareDistribution\Download\e537aaa9dd2df8b3f3634bf4cfe42680_ctc
2020-10-21 11:47:45:244 1140 1f20 Handler Selecting self-contained because update has express payload but server doesn't support it.
2020-10-21 11:47:45:244 1140 1f20 Handler Selected payload type is ptSelfContained
2020-10-21 11:47:45:244 1140 1f20 Handler Detected download state is dsHavePackage
2020-10-21 11:47:45:244 1140 1f20 Handler Request generation for CBS update complete with hr=0x0 and pfResetSandbox=0
2020-10-21 11:47:45:259 8564 1f18 COMAPI -------------
2020-10-21 11:47:45:259 8564 1f18 COMAPI -- START -- COMAPI: Install [ClientId = CcmExec]
2020-10-21 11:47:45:259 8564 1f18 COMAPI ---------
2020-10-21 11:47:45:259 8564 1f18 COMAPI - Allow source prompts: No; Forced: No; Force quiet: Yes
2020-10-21 11:47:45:259 8564 1f18 COMAPI - Updates in request: 1
2020-10-21 11:47:45:259 8564 1f18 COMAPI - ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
2020-10-21 11:47:45:259 8564 1f18 COMAPI - Updates to install = 1
2020-10-21 11:47:45:259 8564 1f18 COMAPI <<-- SUBMITTED -- COMAPI: Install [ClientId = CcmExec]
2020-10-21 11:47:45:259 1140 2080 Agent *************
2020-10-21 11:47:45:259 1140 2080 Agent ** START ** Agent: Installing updates [CallerId = CcmExec]
2020-10-21 11:47:45:259 1140 2080 Agent *********
2020-10-21 11:47:45:259 1140 2080 Agent * Updates to install = 1
2020-10-21 11:47:45:259 1140 2080 Agent * Title = 2020-07 Extended Security Updates (ESU) Licensing Preparation Package for Windows 7 for x64-based Systems (KB4575903)
2020-10-21 11:47:45:259 1140 2080 Agent * UpdateId = {40B2919A-852A-49E7-90C9-18C7312CD3C4}.202
2020-10-21 11:47:45:259 1140 2080 Agent * Bundles 1 updates:
2020-10-21 11:47:45:259 1140 2080 Agent * {4C94D541-349D-4CFF-81C4-B9627CCA1004}.202
2020-10-21 11:47:45:290 1140 2080 Agent WARNING: failed to calculate prior restore point time with error 0x80070002; setting restore point
2020-10-21 11:47:45:446 1140 2080 DnldMgr Preparing update for install, updateId = {4C94D541-349D-4CFF-81C4-B9627CCA1004}.202.
2020-10-21 11:47:45:446 3592 eb8 Misc =========== Logging initialized (build: 7.6.7601.24560, tz: +1300) ===========
2020-10-21 11:47:45:446 3592 eb8 Misc = Process: C:\WINDOWS\system32\wuauclt.exe
2020-10-21 11:47:45:446 3592 eb8 Misc = Module: C:\WINDOWS\system32\wuaueng.dll
2020-10-21 11:47:45:446 3592 eb8 Handler :::::::::::::
2020-10-21 11:47:45:446 3592 eb8 Handler :: START :: Handler: CBS Install
2020-10-21 11:47:45:446 3592 eb8 Handler :::::::::
2020-10-21 11:47:45:446 3592 eb8 Handler Starting install of CBS update 4C94D541-349D-4CFF-81C4-B9627CCA1004
2020-10-21 11:47:45:462 3592 eb8 Handler CBS package identity: Package_for_KB4575903~31bf3856ad364e35~amd64~~6.1.1.0
2020-10-21 11:47:45:462 3592 eb8 Handler Installing self-contained with source=C:\WINDOWS\SoftwareDistribution\Download\e537aaa9dd2df8b3f3634bf4cfe42680\Windows6.1-KB4575903-x64.cab, workingdir=C:\WINDOWS\SoftwareDistribution\Download\e537aaa9dd2df8b3f3634bf4cfe42680\inst
2020-10-21 11:47:49:159 1140 c30 Report REPORT EVENT: {43590691-7FC4-4921-800A-00B2B39115A6} 2020-10-21 11:47:45:290+1300 1 181 101 {40B2919A-852A-49E7-90C9-18C7312CD3C4} 202 0 CcmExec Success Content Install Installation Started: Windows successfully started the following update: 2020-07 Extended Security Updates (ESU) Licensing Preparation Package for Windows 7 for x64-based Systems (KB4575903)
2020-10-21 11:47:52:482 3592 eb8 Handler Completed install of CBS update with type=1, requiresReboot=0, installerError=0, hr=0x0
2020-10-21 11:47:52:482 3592 eb8 Handler :::::::::
2020-10-21 11:47:52:482 3592 eb8 Handler :: END :: Handler: CBS Install
2020-10-21 11:47:52:482 3592 eb8 Handler :::::::::::::
2020-10-21 11:47:52:482 1140 2080 Agent LogHistory called. idUpdate={40B2919A-852A-49E7-90C9-18C7312CD3C4}.202, resultMapped=0, resultUnMapped=0
2020-10-21 11:47:52:482 1140 2080 Agent *********
2020-10-21 11:47:52:482 1140 177c AU Can not perform non-interactive scan if AU is interactive-only
2020-10-21 11:47:52:482 8564 7ac COMAPI >>-- RESUMED -- COMAPI: Install [ClientId = CcmExec]
2020-10-21 11:47:52:482 1140 2080 Agent ** END ** Agent: Installing updates [CallerId = CcmExec]
2020-10-21 11:47:52:482 8564 7ac COMAPI - Install call complete (succeeded = 1, succeeded with errors = 0, failed = 0, unaccounted = 0)
2020-10-21 11:47:52:482 1140 2080 Agent *************
2020-10-21 11:47:52:482 8564 7ac COMAPI - Reboot required = No
2020-10-21 11:47:52:482 8564 7ac COMAPI ---------
2020-10-21 11:47:52:482 8564 7ac COMAPI -- END -- COMAPI: Install [ClientId = CcmExec]
2020-10-21 11:47:52:482 8564 7ac COMAPI -------------
2020-10-21 11:47:57:490 1140 c30 Report REPORT EVENT: {C4232DD4-C0AC-42AC-BF4D-E57CC7A9153D} 2020-10-21 11:47:52:482+1300 1 183 101 {40B2919A-852A-49E7-90C9-18C7312CD3C4} 202 0 CcmExec Success Content Install Installation Successful: Windows successfully installed the following update: 2020-07 Extended Security Updates (ESU) Licensing Preparation Package for Windows 7 for x64-based Systems (KB4575903)
2020-10-21 11:48:44:477 1140 24ec AU Can not perform non-interactive scan if AU is interactive-only
But after that, the hr = 80041010 errors come back , but you could say that is expected as it is not related to KB4575903
OK, got to the bottom of it KB4575903 is sort of partially superseded.
It needs to be active (Green Icon) in SCCM, so that it will be available for someone who has not signed up to ESU yet.
This is because the CUs that supersede it can’t be installed because as a prerequisite KB4575903 needs to be installed and Win 7 ESU activated.
But once it is installed, The CU will supersede it.
Confused yet?
So for me, I will just move KB4575903 to a separate SUG so that if I have any Win7 ESU rogues out there, they will get it. and I will remove it from my compliance baseline SUG, which achieves my goal
This was incredibly helpful, thank you for your research