RE: Performing Cleanup failes when installing patches
From: Jonas Back (jonasback_at_noway.com)
Date: 09/29/04
- Next message: Todd J Heron: "Re: Reboot problem Windows Server 2003"
- Previous message: Todd J Heron: "Re: Server is not operational!"
- In reply to: Bob Qin [MSFT]: "RE: Performing Cleanup failes when installing patches"
- Next in thread: Jonas Back: "RE: Performing Cleanup failes when installing patches"
- Reply: Jonas Back: "RE: Performing Cleanup failes when installing patches"
- Messages sorted by: [ date ] [ thread ]
Date: Wed, 29 Sep 2004 10:24:20 -0700
I realized that the Data Transaction Coordinator is NOT
the problem. A few hours later I got the installation to
fail even though the service was running.
>From now on, we always use UNATTENDED installations with
a Unattend-file that doesn't install the HP Support Pack
that installs a couple of HP Management Agents etc. This
to ensure that Altiris imageing nor HP Agents doesn't
have anything to do with the problem. Policy template
applied is the same as before. I don't know if this could
be related to hardware but it happends on all our HP
ProLiant. The hardware is a HP ProLiant BL20p with iLo
Firmware 1.50 and System ROM I01 (08/15/2002).
Unfoutrunately, we only have ProLiant servers so cannot
try on any other at the moment.
I did a lot of scenarios here during a couple of days
since unattend-installation takes quite some time, I
couldn't do that many a day. I managed to pinpoint the
problem to: Applying your policy template AND changing
the size of the paging file. From my experience - strange
but that's my conclusion. Sorry for all misleads earlier
but I was simply to fast porsting you with my probkem
since I didn't realize that I actaully used images that
from the beginning had pagefile set to 2048 MB.
I might also want to mention I don't use Windows Update
to update the patches, but install the manually.
By default, the pagefile is (min-max) 768-1536 MB. I
always reboot between each action to make sure all
settings are there.
Scenario: Installed server, applied policy - patch works
Scenario: Installed server, applied policy, Changed
pagefile to 2048-2048 MB - patch hangs, changed pagefile
to 768-1548 - patch hangs.
Scenario: Installed server, applied policy, Changed
pagefile to 2000-2000 MB - patch hangs, changed pagefile
to 1500-1600 - patch hangs
...here I got really confused and REALLY wanted to make
sure I was right - could it really be? So I decided to
just do the working scenario twice! :)
Scenario: Installed server, applied policy - patch works
Scenario: Installed server, applied policy - patch works
Scenario: Installed server, applied policy, Changed
pagefile to 768-1537 MB - patch works
Scenario: Installed server, applied policy, Changed
pagefile to 768-2000 MB - patch hangs
Scenario: Installed server, Changed pagefile to 2048 -
2048 - patch works. Applied policy - patch works
Scenario: Installed server, applied policy, Changed
pagefile to 2048-2048 MB - patch hangs
...then I got the tip to allow the user who installs the
patch to have the "Debug Programs" user right.
Scenario: Installed server, applied policy, allowed
Administrators to "Debug programs" - patch works. Changed
pagefile to 768-1999 MB - patch works. Changed pagefile
to 768-2000 MB - patch works. Changed pagefile to 2000-
2000 MB - patch works. Changed pagefile to 2101-2101 MB -
patch works. Install ProLiant Support Pack - patch works.
Scenario: Installed server, applied policy, allowed
Administrators to "Debug programs", Changed pagefile to
1024-1024 MB - patch works. Changed pagefile to 1600-1600
MB - patch works. Changed pagefile to 1999-1999 MB -
patch works. Changed pagefile to 2048-2048 MB - patch
works. Install ProLiant Support Pack - patch works.
Changed pagefile to 2101-2101 MB - patch works.
...By now, it feels like "Debug programs" GPO is the
problem so I reinstalled two new servers and did the
following scenario. The servers are names XSYSFRA1 and 2.
Scenario: Installed server, applied policy, Changed
pagefile to 2048-2048 MB - patch hangs
Scenario: Installed server, applied policy, allowed
Administrators to "Debug programs", Changed pagefile to
2048-2048 MB - patch hangs
...so apparently it can't be "Debug Programs". Can you
understand my frustration? :).
What I will do now is to try to see if there's a specific
SIZE of the pagefile that cause the installation to fail
since I got the installations to work at lower level of
the pagefile (or if I don't change it at all). But still,
I can't understand and sounds very strange that the
pagefile-size can cause securitypatches to fail during
installation. But this is the information I have so far.
Thanks for helping out! I've emailed you the files you
asked for from both servers.
>-----Original Message-----
>Hi Jonas,
>
>I cannot reproduce the problem on my side.
>
>Is it possible for you to send me some files to
troubleshoot this issue?
>
>Files:
>C:\Program Files\WindowsUpdate\iuhist.xml
>C:\Windows\Windows Update.log
>C:\Windows\SETUPAPI.log
>
>In addition, please run the MPS Reporting tool on both
the client and the
>server to collect the system information for further
research.
>
>1. Visit the following web page:
>
>http://microsoft.com/downloads/details.aspx?
FamilyId=CEBF3C7C-7CA5-408F-88B7
>-F9C79B7306C0&displaylang=en
>
>2. Download the file MPSRPT_SETUPPerf.EXE
>
>3. Double-click MPSRPT_SETUPPerf.EXE to run the tool.
>
>4. On your system a CAB file will be generated for your
convenience in the
>%systemroot%\MPSReports\Setup\<Report Type>\Cab
directory called
>%COMPUTERNAME%_MPSReports.CAB. The CAB file will contain
the reports
>generated by the MPS Reporting Tool. Please send the cab
file to me by
>email. (where %systemroot% is the Windows system folder,
such as C:\Windows
>or C:\Winnt)
>
>Please send the result of MPS Reporting tool to me
directly at
>bobqin@microsoft.com and I will do further research.
>
>Thank you,
>
>Bob Qin
>Microsoft Online Partner Support
>
>Get Secure! - www.microsoft.com/security
>
>====================================================
>When responding to posts, please "Reply to Group" via
your newsreader so
>that others may learn and benefit from your issue.
>====================================================
>This posting is provided "AS IS" with no warranties, and
confers no rights.
>
>--------------------
> From: "Jonas Back" <jonasback@noway.com>
> Subject: Performing Cleanup failes when installing
patches
> Date: Thu, 23 Sep 2004 11:34:39 -0700
> Newsgroups: microsoft.public.windows.server.general
>
> I have a problem installing ANY securitypatch on
our
> Windows 2003 servers. A default installed Windows
2003
> works just fine, but it's when we tighten security
on
> them, installation fails. When we install the
patch it
> seems to work, but it hangs on "Performing
cleanup" which
> usually just takes a few seconds. I've circled out
what
> option that actually fails the installation and
that's
> when we put the service "Distributed Transaction
> Coordinator" into Disabled and reboot and then try
to
> install the patch.
>
> What we do is a simple Unattend installation of
Windows
> 2003 Server Standard English. The first thing we
do is to
> put the "Distributed Transaction Coordinator"
service in
> DISABLED and reboot. Right after the reboot we try
to
> install a security patch for the OS. Then it hangs
> on "Performing Cleanup". We reboot and then the
patch is
> actually installed according to Add/Remove
Programs. But
> the fact that the installation fails creates a lot
of
> problems for us on our security tightened servers.
>
> Then I simply put the service to Automatic and
reboot,
> then the installations works fine. Put it to
Disabled and
> reboot - same problem occurs.
>
> This goes for ANY security patch available for
Windows
> 2003:
> MS03-023
> MS03-034
> MS03-041
> MS03-043
> MS03-044
> MS03-045
> MS04-006
> MS04-011
> MS04-012
> MS04-014
> MS04-015
> MS04-023
> MS04-024
> MS04-028
>
> This is my conclusion after many hours of testing
trying
> to figure out which setting that causes the
problem. What
> I would like is to see if someone else can
reproduce this
> problem or if it's just us? Might it be our
hardware?
> These are standard bladeservers HP ProLiant BL20p.
We
> have DL-models aswell but haven't had the
oppurtunity to
> try them aswell. I know this sounds really strange
since
> I can't see why this service has to do with
security
> patching but it's driving me crazy!
>
> I found this problem when applying the Microsoft
Windows
> Server 2003 Security Guide V1.3 Group Policies.
> Apparently someone else has the same problem:
>
http://search.communities.microsoft.com/newsgroups/preview
> Frame.asp?
>
ICP=tnmanaged&sLCID=US&sgroupURL=microsoft.public.windows.
> server.general&sMessageID=%
> 253CuMoxTZrjEHA.3604@TK2MSFTNGP10.phx.gbl%253E
>
>
>.
>
- Next message: Todd J Heron: "Re: Reboot problem Windows Server 2003"
- Previous message: Todd J Heron: "Re: Server is not operational!"
- In reply to: Bob Qin [MSFT]: "RE: Performing Cleanup failes when installing patches"
- Next in thread: Jonas Back: "RE: Performing Cleanup failes when installing patches"
- Reply: Jonas Back: "RE: Performing Cleanup failes when installing patches"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
