patching from a network share

[emolas]

I am still using WSUSOffline version 8.9 because I have a need to update offline XP machines. I downloaded all of the patches and everything into a USB folder then created an ISO of the patches. Everything runs fine from the disk but when I extract the disk to a mapped network drive, things begin to fail. It gets as far as "determining OS properties" then just quits without calling the DetermineSystemProperties.vbs. I went into the DoUpdate.cmd file and added a line "cd .\cmd" just before it calls the DetermineSystemProperties.vbs script and it then continued beyond that point. However, it is saying the medium does not support Windows xp and no patches are applied.

Code: Select all

Mon 09/08/2014 11:39:26.01 - Info: Starting WSUS Offline Updater (v. 8.9)
Mon 09/08/2014 11:39:43.31 - Info: Option /updatercerts detected
Mon 09/08/2014 11:39:43.38 - Info: Option /updatewmp detected
Mon 09/08/2014 11:39:43.41 - Info: Option /updatetsc detected
Mon 09/08/2014 11:39:43.42 - Info: Option /verify detected
Mon 09/08/2014 11:39:46.71 - Info: Found Microsoft Windows version 5.1.2600 (wxp x86 enu sp3)
Mon 09/08/2014 11:39:46.71 - Info: Found Windows Update Agent version 7.4.7600.226
Mon 09/08/2014 11:39:46.71 - Info: Found Windows Installer version 4.5.6001.22159
Mon 09/08/2014 11:39:46.71 - Info: Found Windows Script Host version 5.8.6001.23552
Mon 09/08/2014 11:39:46.73 - Info: Found Internet Explorer version 8.0.6001.18702
Mon 09/08/2014 11:39:46.73 - Info: Found Trusted Root Certificates' version 41.0.2195.0
Mon 09/08/2014 11:39:46.73 - Info: Found Revoked Root Certificates' version 5.0.2195.0
Mon 09/08/2014 11:39:46.73 - Info: Found Microsoft Data Access Components version 2.81.1132.0
Mon 09/08/2014 11:39:46.73 - Info: Found Microsoft DirectX core version 9.0c (4.09.00.0904)
Mon 09/08/2014 11:39:46.73 - Info: Found Microsoft Silverlight version 0.0.0.0
Mon 09/08/2014 11:39:46.73 - Info: Found Windows Media Player version 11.0.5721.5280
Mon 09/08/2014 11:39:46.73 - Info: Found Remote Desktop Client version 6.1.7600.16722
Mon 09/08/2014 11:39:46.73 - Info: Found Microsoft .NET Framework 3.5 version 3.5.30729.01
Mon 09/08/2014 11:39:46.73 - Info: Found Windows PowerShell version 2.0
Mon 09/08/2014 11:39:46.73 - Info: Found Microsoft .NET Framework 4 version 0.0.0
Mon 09/08/2014 11:39:46.73 - Info: Found Windows Management Framework version 0.0
Mon 09/08/2014 11:39:46.73 - Info: Found Microsoft Security Essentials version 0.0.0.0
Mon 09/08/2014 11:39:46.73 - Info: Found Microsoft Security Essentials definitions version 0.0.0.0
Mon 09/08/2014 11:39:46.74 - Info: Found Network Inspection System definitions version 0.0.0.0
Mon 09/08/2014 11:39:46.74 - Info: Found Windows Defender definitions version 0.0.0.0
Mon 09/08/2014 11:39:46.74 - Info: Found Microsoft Office 2007 Word version 12.0.6700.5000 (o2k7 enu sp3)
Mon 09/08/2014 11:39:46.74 - Info: Medium build date: 07/14/2014
Mon 09/08/2014 11:39:46.82 - Info: Medium does not support Microsoft Windows (wxp x86 enu)
Mon 09/08/2014 11:39:46.82 - Info: Medium supports Microsoft Office (ofc enu)
Mon 09/08/2014 11:40:47.68 - Info: Executed custom software installation hook (Errorlevel: 1)
Mon 09/08/2014 11:42:58.56 - Warning: Installation of "Q:\software\msi\Flash\flash player 13.msi" failed
Mon 09/08/2014 11:43:03.62 - Info: Installed "Q:\software\msi\Reader\Reader_11.0.7.msi"
Mon 09/08/2014 11:41:53.75 - Info: Installed selected MSI packages
Mon 09/08/2014 11:43:08.78 - Info: Detected state of service 'Windows Update': Stopped (start mode: Manual)
Mon 09/08/2014 11:43:10.96 - Info: Started service 'Windows Update' (wuauserv)
Mon 09/08/2014 11:47:13.26 - Info: Skipped update kb976002 (Browser Choice) due to matching black list entry
Mon 09/08/2014 11:47:13.26 - Info: Skipped update kb890830 (Malicious Software Removal Tool) due to matching black list entry
Mon 09/08/2014 11:47:31.86 - Info: Installation successful
Mon 09/08/2014 11:47:32.22 - Info: Executed custom finalization hook (Errorlevel: 0)
Mon 09/08/2014 11:47:32.89 - Info: Ending WSUS Offline Updater (v. 8.9)


This is running the same EXACT files installed on the same exact VM only they were made into an ISO and run from a disk:

Code: Select all

Mon 09/08/2014 13:02:32.37 - Info: Starting WSUS Offline Updater (v. 8.9)
Mon 09/08/2014 13:02:32.50 - Info: Option /nobackup detected
Mon 09/08/2014 13:02:32.53 - Info: Option /updatercerts detected
Mon 09/08/2014 13:02:32.54 - Info: Option /updatecpp detected
Mon 09/08/2014 13:02:32.56 - Info: Option /updatewmp detected
Mon 09/08/2014 13:02:32.59 - Info: Option /updatetsc detected
Mon 09/08/2014 13:02:32.60 - Info: Option /verify detected
Mon 09/08/2014 13:02:32.62 - Info: Option /autoreboot detected
Mon 09/08/2014 13:02:35.39 - Info: Found Microsoft Windows version 5.1.2600 (wxp x86 enu sp3)
Mon 09/08/2014 13:02:35.39 - Info: Found Windows Update Agent version 7.4.7600.226
Mon 09/08/2014 13:02:35.39 - Info: Found Windows Installer version 4.5.6001.22159
Mon 09/08/2014 13:02:35.39 - Info: Found Windows Script Host version 5.8.6001.23141
Mon 09/08/2014 13:02:35.39 - Info: Found Internet Explorer version 8.0.6001.18702
Mon 09/08/2014 13:02:35.39 - Info: Found Trusted Root Certificates' version 41.0.2195.0
Mon 09/08/2014 13:02:35.39 - Info: Found Revoked Root Certificates' version 5.0.2195.0
Mon 09/08/2014 13:02:35.39 - Info: Found Microsoft Data Access Components version 2.81.1132.0
Mon 09/08/2014 13:02:35.39 - Info: Found Microsoft DirectX core version 9.0c (4.09.00.0904)
Mon 09/08/2014 13:02:35.39 - Info: Found Microsoft Silverlight version 0.0.0.0
Mon 09/08/2014 13:02:35.39 - Info: Found Windows Media Player version 11.0.5721.5280
Mon 09/08/2014 13:02:35.39 - Info: Found Remote Desktop Client version 6.1.7600.16385
Mon 09/08/2014 13:02:35.39 - Info: Found Microsoft .NET Framework 3.5 version 3.5.30729.01
Mon 09/08/2014 13:02:35.39 - Info: Found Windows PowerShell version 2.0
Mon 09/08/2014 13:02:35.40 - Info: Found Microsoft .NET Framework 4 version 0.0.0
Mon 09/08/2014 13:02:35.40 - Info: Found Windows Management Framework version 0.0
Mon 09/08/2014 13:02:35.40 - Info: Found Microsoft Security Essentials version 0.0.0.0
Mon 09/08/2014 13:02:35.40 - Info: Found Microsoft Security Essentials definitions version 0.0.0.0
Mon 09/08/2014 13:02:35.40 - Info: Found Network Inspection System definitions version 0.0.0.0
Mon 09/08/2014 13:02:35.40 - Info: Found Windows Defender definitions version 0.0.0.0
Mon 09/08/2014 13:02:35.40 - Info: Found Microsoft Office 2007 Word version 12.0.6662.5003 (o2k7 enu sp3)
Mon 09/08/2014 13:02:35.40 - Info: Medium build date: 07/14/2014
Mon 09/08/2014 13:02:35.43 - Info: Medium supports Microsoft Windows (wxp x86 enu)
Mon 09/08/2014 13:02:35.43 - Info: Medium supports Microsoft Office (ofc enu)
Mon 09/08/2014 13:02:36.39 - Info: Executed custom software installation hook (Errorlevel: 1)
Mon 09/08/2014 13:03:09.50 - Info: Installed "D:\software\msi\Flash\flash player_14.0.0.145.msi"
Mon 09/08/2014 13:03:16.10 - Info: Installed "D:\software\msi\Reader\Reader_11.0.7.msi"
Mon 09/08/2014 13:03:08.03 - Info: Installed selected MSI packages
Mon 09/08/2014 13:03:18.07 - Info: Detected state of service 'Windows Update': Running (start mode: Auto)
Mon 09/08/2014 13:07:37.12 - Info: Skipped update kb976002 (Browser Choice) due to matching black list entry
Mon 09/08/2014 13:07:37.12 - Info: Skipped update kb890830 (Malicious Software Removal Tool) due to matching black list entry
~truncated to save space~
Mon 09/08/2014 13:35:55.62 - Info: Installed 58 updates
Mon 09/08/2014 13:36:12.16 - Info: Executed custom finalization hook (Errorlevel: 0)
Mon 09/08/2014 13:36:38.89 - Info: Ending WSUS Offline Updater (v. 8.9)


Anyone have any ideas as to why it won't work on a mapped drive but runs fine from an ISO?

[WSUSUpdateAdmin]

Hi.

Sounds like a UAC problem.
Please map your network drive with administrative privileges or leave it unmapped and let UpdateInstaller do the job.

Regards
T. Wittrock

[emolas]

Thank you for the quick reply. I originally had tried running it without mapping a drive because the AutoIT script maps one for you but the script was failing to call DoUpdate.cmd so I manually mapped the drive (using admin credentials) prior to running. After manually mapping the drive it would run as far as calling the DetermineSystemProperties.vbs and fail there. I added a bunch of log file notes to the cmd and vbs files to determine failure points and it seems that whenever it tries to call another script, it can't find it. I even went so far as to edit all of the paths to scripts called in DoUpdate.cmd to use hard paths instead of relative paths (like Q:\WSUS\cmd\DetermineSystemProperties.vbs instead of ..\cmd\DetermineSystemProperties.vbs) but still won't run properly.

[aker]

What happens, if you run it from a local HDD?

[emolas]

Files copied to local hard drive run fine as well. Since I can't get the full patching script to run automatically, I have decided to pare the image down to the bare minimum amount of patches then have them copied and run locally through network policy.

[aker]

Is there a folder .\client\wxp\enu?

Maybe you selected Windows XP x64 in UpdateGenerator.

[emolas]

I works fine from an ISO or local drive. Only when running from network share does it say "Medium does not support Microsoft Windows (wxp x86 enu)"

[aker]

Maybe the permissions fo .\wxp or .\wxp\enu are not correct...

[emolas]

@Aker: That was my first thought so I gave everyone full control of the entire WSUS directory but that didn't help any.

Let me just clarify what I am trying to do here. I modified the UpdateInstaller AutoIT script to be completely hands-off with no GUI and to use the ini file for all of the settings. My goal was to have network policy run the unattended UpdateInstaller (renamed SilentInstaller) as a startup script so every time the machine booted it would see if there were available patches and install them. Of course, using an actual WSUS server would be the better option but for some reason the guys in charge don't want to install it on the network so I have to try doing it this way.

Here is where the weirdness comes in. If I map a drive to the server share and click my way there then click on the SilentInstaller, it works. If I burn a disk and put it in the machine then click the SilentInstaller, it works. If I set it as a startup script, it fails to map the drive and fails to call DoUpdate.cmd. If I pre-map the drive then have it in the startup scripts, it successfully calls DoUpdate.cmd but fails to call DetermineSystemProperties.vbs. If I have a batch file running on startup that calls the script from a mapped network share, it fails to call DetermineSystemProperties.vbs If I get on the server and run psexec \\computer "\\sharename\silentinstaller.exe" (with or without -u and -p) it fails to call DetermineSystemProperties.vbs. If I click a bat file on the client that maps a drive and runs the SilentInstaller, it works fine.

So basically, it works fine if you run it manually but not if you automate it. I was hoping someone had run into this before but it seems not so I'll keep plugging away at it. I think I may even try to rewrite the whole thing into one massive AutoIT script instead of a whole bunch of seperate cmd and vbs files.

[WSUSUpdateAdmin]

viewtopic.php?f=7&t=2691.

...and from ...\doc\faq-enu.txt:
--------------------------------------------------------------------------------
Q: Can I start update installation from a shared network resource?
A: Yes, but you should only use the "Automatic reboot and recall" feature, if the shared resource permits anonymous access. Otherwise the automatic recall will fail, because the share won't be accessible for the temporary administrator account "WOUTempAdmin".
If the network share doesn't have a drive letter assigned to, the "UpdateInstaller" script will automatically do a drive mapping, because cmd.exe does not support UNC paths (\\<server>\<share>) as the current directory (see http://support.microsoft.com/kb/156276/).
If you like to assign a drive letter yourself using the "map network drive" feature or "net use" command, you'll have to do this in an administrative context/command shell (Windows Vista/7/Server 2008(R2)), because the "UpdateInstaller" script requests administrative privileges for patch installation.
Please keep in mind that installing patches over the network is against the philosophy of an Offline update, and the machine may be vulnerable to attacks while the update process is still in progress.
--------------------------------------------------------------------------------

You have to switch to admin context before you map your network share and call the first or entry script.

RTW