The other steveb - Steve Banks' Blog on SBS, EBS, and other Small Business Technology Topics : Microsoft Updates

Have a Calyptix and Microsoft Updates are failing?

steveb — Mon, 23 Feb 2009 06:09:00 GMT

Setting up a new Windows 2008 x64 Server and loading updates on a customer's Vista notebook. Having updates fail on the server with an 802002b error stating "Windows Update encountered an unknown error" on the 2008 box. I have also been having an IE 7 update failing consistently on our SBS 2003 box. Decided to try turning off the Web monitoring/filtering our office's Calyptix AE1000. All updates completed without any trouble. I like the Calyptix, but if you are running into similar errors, either on Calyptix, or other firewalls for that matter, try turning off the monitoring / outbound filtering.

Run update from console session! - MS07-049: Vulnerability in Virtual PC and Virtual Server that could allow privilege elevation

steveb — Mon, 20 Aug 2007 18:06:00 GMT

If you prefer to run Microsoft Updates from a TS session, then make sure you run MS07-049 from a console session per the KB 937986 (http://support.microsoft.com/kb/937986).

Taken from the KB:

When the update 937986 is applied on a remote machine by using Terminal Services, the update does not replace the vulnerable files if the /console option is not used. To avoid this issue, you must use the /console option as shown in this example:

mstsc /console /v:<machine name>
-Steve

Lost TS/RDP after running updates?

steveb — Mon, 30 Jul 2007 08:40:00 GMT

After experiencing Terminal Services intermittently hanging after applying Microsoft Updates I've come across one way that gets the server back up and responsive most of the time and a backup plan for when it still doesn't.

First, to cover yourself, it is a good idea to run a system state backup at minimum of the server before applying updates in case you need to get yourself out of a challenge resulting from the update. Then what I've started doing (wasn't an original idea, got it from others in the community) is creating a restart.bat file that consists of shutdown -r -f and a hard return to bounce the server. I then create a one time scheduled task and set it for about 30 minutes out from when I figure the updates should have been applied and the server restarted and back online. Most of the time a restart will "jump start" the Terminal Services and get them running if they hang. If I don't have to use it, I go into Scheduled Tasks and set the time back a day to disable it until next time. The other trick I ran across was the result of a desperate attempt to get a box back online one night as I was applying updates from my Vista Tablet PC. I've since tried this from XP Pro and it does not work, so seems to be a Vista only trick.

If TS/RDP hangs on the server, as Microsoft is beginning to admit is a problem finally, attempt to VPN from your Vista computer to the remote network using the remote domain's administrator account (I've only tried this with Windows PPTP so no idea about IPSec or edge VPN devices such as SonicWALLs but I'm guessing it would fail since the reason this is working has to be because Vista is authenticating as the remote administrative account). Once you have established the Windows PPTP VPN from your Vista box, open a command prompt by selecting off of your start menu, "right clicking" and running as administrator. Once inside the command window, type shutdown -i and drop in the name or IP address of the remote server you are wanting to get back your Terminal Services from and do a restart in the graphical interface. I have had this work all but once or twice (hence the new addition of the scheduled task restart batch file). When the server comes back online TS is normally responsive and you can head off to bed versus getting in the car and taking off to a client site in the middle of the night!

Steve