Jaa


Known Issues with KB3148812

UPDATE: A newer post regarding KB3148812 is published at https://blogs.technet.com/b/wsus/archive/2016/04/22/what-you-need-to-know-about-kb3148812-part-two.aspx.

Hi WSUS admins, just a quick post to let you know that we've received word of some issues happening (e.g., WSUS admin console is inaccessible, clients can't contact WSUS) in the wild after installing KB3148812.  It is critical functionality; however, you don't lose anything by skipping installation until we publish media that leverages this scenario, which will not be happening this month.  For now, feel free to remove the patch if it's causing you problems, and we'll get to the bottom of the issues that have been reported.  If you'd like to assist in resolving this, then please Email Blog Author and we'll follow up with you. 

We appreciate your patience while we get this sorted.

Comments

  • Anonymous
    April 19, 2016
    Thanks, uninstalling this fixed my borked 2012 R2 update server.
  • Anonymous
    April 19, 2016
    Update: We've identified the root cause, and the good news is that this is not an issue of code quality. The package is good as is, but it requires some additional manual steps to be taken afterward in order to realign the moving parts of the system. More information on that will be available via the KB article and this blog later this week.
  • Anonymous
    April 20, 2016
    Thank you, i was struggling with this issue for two hours.
  • Anonymous
    April 20, 2016
    Is there an issue with
    Cumulative Update for Windows 10 Insider Preview (Build 14295): April 18, 2016 / KB3154879 ?
    My WSUS won't download this update:

    Content file download failed.
    Reason: File cert verification failure.
    Source File: /d/msdownload/update/software/crup/2016/04/windows10.0-kb3154879-x86_f2c8538631162c1c3c168a9b88a95813bb3f8bfc.psf

    This is the only update that won't download, all older and newer work fine.
    And the x64 Version also downloaded fine.
  • Anonymous
    April 20, 2016
    Having the same issue below, file came down on the 14/04/2016 - seems signed with the wrong cert (developer).

    Content file download failed.
    Reason: File cert verification failure.
    Source File: /d/msdownload/update/software/crup/2016/04/windows10.0-kb3154879-x86_f2c8538631162c1c3c168a9b88a95813bb3f8bfc.psf
  • Anonymous
    April 20, 2016
    also this one.. same KB3154879

    Content file download failed.
    Reason: File cert verification failure.
    Source File: /d/msdownload/update/software/crup/2016/04/windows10.0-kb3154879-x86_c7b4d1ac4829121785ae79b2df7550004eca089f.cab
    Destination File: w:wsusWsusContent9FC7B4D1AC4829121785AE79B2DF7550004ECA089F.cab
  • Anonymous
    April 20, 2016
    Uninstall of this update fixed my WSUS that was not starting.
  • Anonymous
    April 20, 2016
    The issue is that patch does not create required columns in SUSDB:
    dbo.tbFile.IsSecure.sys.bit(1)
    dbo.tbFile.DecryptionKey.sys.varbinary(-1)
    dbo.tbFile.IsEncrypted.sys.bit(1)
    however the schema validation DLL (SUSDBVerify.dll) is checking for them thus at times of DB startup it stays in Recovery Pending state...
  • Anonymous
    April 20, 2016
    best thing in the world... install linux, microsoft has never be trustworth or reliable. so much time wasted fixing problems they caused, they should get a bill from every business that wastes time fixing problems like this that they cause
  • Anonymous
    April 20, 2016
    L’équipe WSUS a publié un billet pour alerter d’un problème pouvant survenir sur un Serveur WSUS après l’application de la KB3148812 . Dans ce cas, la console d’administration WSUS devient inaccessi
  • Anonymous
    April 20, 2016
    First of all it wouldn't be a true comment section without some Linux fanboy touting how amazing his OS is...amazing..

    Second of all, I am getting the same error on a Windows 2008 R2 server for the same windows 10 download so there may also be something wrong with that patch..

    Content file download failed. Reason: File cert verification failure. Source File: /d/msdownload/update/software/crup/2016/04/windows10.0-kb3154879-x86_c7b4d1ac4829121785ae79b2df7550004eca089f.cab
  • Anonymous
    April 20, 2016
    What can you do when uninstalling it doesn't work?
  • Anonymous
    April 20, 2016
    Uninstalled the update. WSUS still won't connect. Server 2012R2. Looks like I'll be restoring from backups.
  • Anonymous
    April 20, 2016
    Uninstalling the update worked for me too
  • Anonymous
    April 20, 2016
    How can you possibly say this was good code that needed a manual update. Failing to upgrade the databases is bad code!
  • Anonymous
    April 20, 2016
    Our 2012 R2 server needed to be rebooted twice after installing the update to get things working properly again.
  • Anonymous
    April 20, 2016
    Uninstalling I mean!
  • Anonymous
    April 20, 2016
    Where to I send a bill to recoup for my lost day spent on this?
  • Anonymous
    April 20, 2016
    I don't see this patch for Windows Server 2012 in our WSUS list, only for Win 8.1. Did it get pulled?
  • Anonymous
    April 20, 2016
    Russel, Yeah, looks like it got pulled. Can't see it anymore when I sync/update my servers at work. Have to do another sync on my wsus-server at home to be sure though as it is the only system I got that downloaded the patch in the first place..

    Unistalling the offending patch and rebooting my (home)wsus-server got it working again.
  • Anonymous
    April 20, 2016
    Hi Steve - I have this problem and restored my WSUS server yester day only to find it inoperable again this morning.
    Removing KB3148812 restored service.
    Should I block this update and then not be able to receive updates for W10 after 1.May?
    What is the best action going forward?

    Feel free to email me if you need debug information.
  • Anonymous
    April 20, 2016
    I don't understand why you say "that this is not an issue of code quality".
    IF there are needed additional steps after installing, why we don't see these needed steps at 1st start of WSUS console?
    To me it's caused by not perfect code quality.
    Nevertheless, uninstalling makes WSUS work again (Svr2012R2)
  • Anonymous
    April 20, 2016
    Sorry, my comment was related to the 2nd post of Steve Henry. I forget to mention that in the beginning
  • Anonymous
    April 21, 2016
    The update completely broke my WSUS and SCCM SUP...
    :|
  • Anonymous
    April 21, 2016
    @Steve Henry - can you confirm if it's ONLY WSUS that this is breaking?
    It broke our 3 servers - what else can/will it break?
  • Anonymous
    April 21, 2016
    What about kb3154879? Like the posters on the first page I'm also getting:

    Content file download failed. Reason: File cert verification failure. Source File: /d/msdownload/update/software/crup/2016/04/windows10.0-kb3154879-x86_c7b4d1ac4829121785ae79b2df7550004eca089f.cab Destination File: e:WSUSWsusContent9FC7B4D1AC4829121785AE79B2DF7550004ECA089F.cab.
  • Anonymous
    April 21, 2016
    KB3148812 caused our WSUS server to crash. We removed WSUS role from the server, rebooted, and then reinstalled WSUS role. After initial WSUS setup the service would start but no clients could contact the server until the following was performed on each client: stop wuauserv and bits; rd windowssystemdistribution; start wuauserv and bits; perform update check. After that the client OS level and status would be shown properly on WSUS console.
  • Anonymous
    April 21, 2016
    After April round of patches, the WSUS server would fail to start and the Application Log had these error messages
    all over the place:

    Log Name: Application
    Source: MSSQL$MICROSOFT##WID
    Event ID: 18456
    Task Category: Logon
    Level: Information
    Keywords: Classic,Audit Failure
    User: NETWORK SERVICE
    Description:
    Login failed for user 'NT AUTHORITYNETWORK SERVICE'. Reason: Failed to open the explicitly specified database 'SUSDB'. [CLIENT: ]


    I uninstalled KB3148812 and rebooted the WSUS server, now WSUS Service Starts, I can connect to the WSUS admin page and clients can pull.
  • Anonymous
    April 21, 2016
    @BooBoo: The update that won't download has a certificate from
    "Microsoft Development Root Certificate Authority 2014" which is usually NOT in the trusted root store of a WSUS Server (or any other Computer).
    Someone over here
    https://social.technet.microsoft.com/Forums/windows/de-DE/156707fb-cb1b-4b81-9480-f3370257c25b/wsus-patches-in-netzlaufwerk-legen?forum=windowsserver8de
    extracted it and added it to the root store, but I wouldn't recommend that.
  • Anonymous
    April 21, 2016
    Steve Henry, to say that this is not an issue of code quality is ridiculous. The Windows patch caused WSUS to stop functioning properly, at least on Server 2012 R2. Therefore, it most certainly is an issue of code quality somewhere. The need for manual steps to rectify the issue after applying the patch indicates that the patch was missing something, which is, by definition, an issue of code quality. This is the second time in the past 3 months I've spent hours chasing my tail to figure out which Windows update broke key functionality in my organization. I and my colleagues are not amused by the lack of QA that goes into these patches.
  • Anonymous
    April 21, 2016
    The comment has been removed
  • Anonymous
    April 21, 2016
    TD - found the same page at the time, did try installing the Development Root CA - made no difference. we could do with the WSUS guys starting a new blog for kb3154879-x86.
  • Anonymous
    April 21, 2016
    I also agree with Greg H - it is absolutely unacceptable for a WSUS update to break WSUS itself. Come on, people!

    I came in to work yesterday to a broken server that needed remediation, and it wasn't clear which update broke it, and event log messages implied it was a WID authentication problem. I chased my tail all day yesterday in troubleshooting and rebuilding things, to finally zero in on which update was the root cause of the problem, and THEN discover via a Google search that this problem was known. Very frustrating.
  • Anonymous
    April 21, 2016
    Uninstalling this update saved my bacon - thanks
  • Anonymous
    April 21, 2016
    mmm...bacon.
  • Anonymous
    April 21, 2016
    I feel good that I only needed to spend an hour troubleshooting this. That is however, an hour of my life that is lost for no good reason. As far as I am concerned, this update will remain hidden and never be installed. If resolved, Microsoft can release under a different KB#. What a waste of time. Don't Break My WSUS Server For No Good Reason Please!
  • Anonymous
    April 21, 2016
    I had to troubleshoot our main wsus server today, Wsus admin told me about a reboot after applying updates, so, I read each KB description until I found KB3148812, was the only update related to WSUS, so I uninstalled, rebooted the server and WSUS start working again. Then, a bing search brought me here
  • Anonymous
    April 21, 2016
    Thanks for the tip Steve, the uninstall worked fine. However for those of you who are so upset.... give me a break. A simple google (bing) search found me this blog post. Are you really saying that you spent "hours" rebuilding a silly wsus server without a little googling to see if anybody else experienced similar issues?! Spare your tears. If everything always worked perfectly, you'd be out of a job. Deal with it.
  • Anonymous
    April 21, 2016
    Uninstalling KB3148812 resolved the problem we were having with our WSUS server too. Same problem as described above.
  • Anonymous
    April 21, 2016
    The comment has been removed
    • Anonymous
      May 17, 2016
      We were having the issue of the console not being able to connect to the server-we uninstalled the KB and restarted the services which corrected the issue for a time but we are now experiencing the same issue. -the application event log shows 18456-the system event log shows The WSUS Service service terminated unexpectedly. It has done this 105 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service. The KB is not listed in the installed updates list- it does not seem to still be installed but we are continuing to have this issue. any ideas?
    • Anonymous
      May 17, 2016
      now after restarting the service is still will not connect and we are getting this in the event logLogin failed for user 'NT AUTHORITY\NETWORK SERVICE'. Reason: Failed to open the explicitly specified database 'SUSDB'. [CLIENT: ]
  • Anonymous
    April 21, 2016
    Solve this problem:
    http://blogs.technet.com/b/wsus/archive/2016/04/22/what-you-need-to-know-about-kb3148812.aspx
  • Anonymous
    April 22, 2016
    Thank for your post, I removed this KS solved my problem.
  • Anonymous
    April 22, 2016
    Thanks for the post, this helped fix our WSUS servers.
  • Anonymous
    April 22, 2016
    Thanks for the update Steve, will hold fire and wait for the release of the newer file
  • Anonymous
    April 22, 2016
    Agreed on all the above, ended up declining the update and restoring the 2012R2 WSUS server from a backup. I too look forward to a new incarnation of the patch that works.
  • Anonymous
    April 22, 2016
    After some testing it appears that even when you reinstall WSUS on 2012 R2 (having deleted the WID database files) The WSUS console does then load. However, when you have finished configuring all the options your client PC's/server's will not talk to the update server. Error Code 80244007 on a Windows 2012 R2 server when trying to update. Error Code 80244008 for a Windows 7 client PC.
  • Anonymous
    April 22, 2016
    We have WSUS running on Windows Server 2012 R2. After installing KB3148812, I got WSUS down. WSUS Service was getting stopped automatically, and the reason behind it is that SUSDB was set to (Recovery Pending Mode) and wasn't coming up with error "Schema Verification Failed". After removing the update, all OK.
  • Anonymous
    April 22, 2016
    Still the same. Client not talking to server. Error Code 80244007 on a Windows 2012 R2 server. Error Code 80244008 for a Windows 7 client PC
  • Anonymous
    April 22, 2016
    As noted earlier, please run the steps at http://blogs.technet.com/b/wsus/archive/2016/04/22/what-you-need-to-know-about-kb3148812.aspx before reporting your results. The update is not expected to work without having taken the actions listed in that post.

    For those that are seeing client scan issues even after taking those actions, look forward to an update to that post later today, and feel free to Email Blog Author if you're unable to wait for resolution.
  • Anonymous
    April 22, 2016
    First step works. brings console up online. second step doesn't work. clients never wsus again.
    by the way the link to the WSUS blog has stopped working. results in an endless loop to login to microsoft account.
  • Anonymous
    April 22, 2016
    Looks like the new link is:
    http://blogs.technet.com/b/wsus/archive/2016/04/22/what-you-need-to-know-about-kb3148812-part-two.aspx
  • Anonymous
    April 22, 2016
    http://jepatoke.blogspot.com
  • Anonymous
    April 23, 2016
    Thanks for letting us now! Important post!
  • Anonymous
    April 25, 2016
    uninstalling this fixed my broken 2012 R2 WSUS console issue.

    Thank you
  • Anonymous
    April 26, 2016
    For those wondering where the original "what you need to know" post went, it contained manual steps that made you unable to simply uninstall KB3148812 to resolve the reported issues. To minimize the number of people in an irreversible situation, we pulled that post (and the KB), so these steps are no longer available. Feel free to watchhttp://blogs.technet.com/b/wsus/archive/2016/04/22/what-you-need-to-know-about-kb3148812-part-two.aspx for the latest on this issue.
  • Anonymous
    April 26, 2016
    Hi Steve, Can now see kb3154879 as been declined, have also declined kb3148812. - cheers
  • Anonymous
    April 29, 2016
    Ditto...uninstalling the KB fixed our 2012R@ WSUS issue as well.
  • Anonymous
    April 30, 2016
    Thanks for taking lead on this. It happens sometimes...glad you were able to get word out quickly!
  • Anonymous
    May 16, 2016
    Seems like same issue happenes to KB 3159706 on our server. Microsoft mentiones that you need to do manual steps on server to make the this update work (why do they even publish it on wupdate then?)https://support.microsoft.com/en-us/kb/3159706
    • Anonymous
      May 19, 2016
      It was published on Windows Update to allow the WSUS servers that could not distribute updates to sync and apply the update directly. The Microsoft Update Catalog requires IE, and not everyone has that installed.
    • Anonymous
      May 20, 2016
      The comment has been removed
  • Anonymous
    May 17, 2016
    Uninstall did fix. Before I uninstall, the SUSDB was showing as Restore Pending. Once unistalled, the DB came backup ok and WSUS started to work.
    • Anonymous
      May 19, 2016
      Glad to hear it. Now you'll need to deploy the new KB, which you can learn about at https://blogs.technet.microsoft.com/wsus/2016/05/05/the-long-term-fix-for-kb3148812-issues/, in order to enable this functionality as we'd originally intended.
      • Anonymous
        May 30, 2016
        The update KB3159706 is installed. But again my DB is recovery pending state and I see these errors in the Event Viewer. Login failed for user 'NT AUTHORITY\NETWORK SERVICE'. Reason: Failed to open the explicitly specified database 'SUSDB'. [CLIENT: ]What should I do next.
  • Anonymous
    May 20, 2016
    just installed a load of updates and WSUS is broken and KB3148812 is not installed so which one is it!
  • Anonymous
    June 20, 2016
    Hello SteveI tried whatever you instructed but the same result that is WSUS service keeps stopping. Kindly assist me as soon as possible because all the computers of my company cannot be updated through WSUS server.Thanks & regards
    • Anonymous
      August 03, 2016
      Please refer to the new blog post for the latest on fixing this issue, and let us know if you continue to have problems.