KB971033

[cdgoldin]

I run WSUSOU once a month, after the "Patch Tuesday". Both last month and this month, WSUSOU somehow reinstalled KB971033, but I don't see it in the ...\client\w61 folders. This never happened in the past. How can I exclude this, so I don't have to remove it every time I run WSUSOU? [The reason I have removed it is so I don't have to telephone M$, and spend an hour speaking Urdu, to convince them that my copy of W7 is legitmate, and obtain another 64-character "product key".]

[Dalai]

I very much doubt that WSUS Offline installed this update because it's not in the repository since it's not a security update. You can check C:\Windows\wsusofflineupdate.log if it contains the KB number (I don't think so). It's much more likely that the update gets installed by the regular automatic update procedure - check for the KB number in C:\Windows\WindowsUpdate.log file.

Regards
Dalai

[cdgoldin]

I very much doubt that WSUS Offline installed this update because it's not in the repository since it's not a security update. You can check C:\Windows\wsusofflineupdate.log if it contains the KB number (I don't think so). It's much more likely that the update gets installed by the regular automatic update procedure - check for the KB number in C:\Windows\WindowsUpdate.log file.

Since I do NOT have automatic updates specified, it is not possible (unless M$ has rendered this setting meaningless) that it got installed via the "regular automatic update procedure". It does NOT appear in C:\Windows\wsusofflineupdate.log. However, it DOES appear in the C:\Windows\WindowsUpdate.log file!

2016-12-14 18:43:28:058 1172 b6c Handler Adding Windows6.1-KB971033-x86.cab (entire file) to request list.

2016-12-14 18:43:28:067 1172 b6c Misc Validating signature for C:\windows\SoftwareDistribution\Download\2d98fb38cd6e00c9ffc17cd1115a7810_ctc\Windows6.1-KB971033-x86.cab with dwProvFlags 0x00000080:

2016-12-14 18:43:28:094 1172 b8 Agent * Title = Update for Windows (KB971033)

2016-12-14 18:43:28:172 5544 c88 Handler Installing self-contained with source=C:\windows\SoftwareDistribution\Download\2d98fb38cd6e00c9ffc17cd1115a7810\Windows6.1-KB971033-x86.cab, workingdir=C:\windows\SoftwareDistribution\Download\2d98fb38cd6e00c9ffc17cd1115a7810\inst

2016-12-14 18:43:28:102-0700 1 181 101 {91EF3E39-513C-4225-95E0-ADE120861BC1} 501 0 wusa Success Content Install Installation Started: Windows successfully started the following update: Update for Windows (KB971033)

2016-12-14 18:43:30:489-0700 1 183 101 {91EF3E39-513C-4225-95E0-ADE120861BC1} 501 0 wusa Success Content Install Installation Successful: Windows successfully installed the following update: Update for Windows (KB971033)

[Denniss]

MAybe it's a drive-by update from one of the rollup packs.

[boco]

If WSUSOU or Windows Update installed anything that requires OS validation, KB971033 would be downloaded and installed by the WGA validation process (not by WSUSOU). After all, KB971033 IS the validation.

One example for a package requiring validation is Microsoft's Antimalware client (MSSE). Probably the Live utilities need it, too. Heck, MS could also slap it onto an anything like IE or WMP... Usually these packages fail to install if you're offline at that time. As @Deniss told you, it could even be downloaded by the big "Quality Rollups", either as a drive-by download or voluntarily as part of their "great" Telemetry campaign.


Did you install any of the 'big' things during this cycle?

[cdgoldin]

MAybe it's a drive-by update from one of the rollup packs.

Except I didn't install any of the rollup packs.

[cdgoldin]

If WSUSOU or Windows Update installed anything that requires OS validation, KB971033 would be downloaded and installed by the WGA validation process (not by WSUSOU). After all, KB971033 IS the validation.

One example for a package requiring validation is Microsoft's Antimalware client (MSSE). Probably the Live utilities need it, too. Heck, MS could also slap it onto an anything like IE or WMP... Usually these packages fail to install if you're offline at that time. As @Deniss told you, it could even be downloaded by the big "Quality Rollups", either as a drive-by download or voluntarily as part of their "great" Telemetry campaign.

Did you install any of the 'big' things during this cycle?

This is what I've done (as far as Windoze updates) in the past four months:

08/22/2016 - Ran WSUSOU followed by KB3179573 (via WU). No problem.

09/15/2016 - Ran WSUSOU. Upon reboot, "This copy of Windows is not Genuine" watermark. Removed KB971033 again. Applied KB3172605 (Windows 7 Rollup!) via WU. No problem.

09/21/2016 - Via WU: KB3177467. No problem.

10/12/2016 - WSUSOU, WU (Malicious Software Removal Tool). No problem.

11/09/2016 - Ran WSUSOU, which did NOT intall KB3917868. Installed it from Windoze catalog. No problem.

12/14/2016 - Ran WSUSOU. Upon reboot, "This copy of Windows is not genuine" again! Removed KB971033 again.

Prior to running WSUSOU on 12/14, WU showed KB3207752 (December 2016 Security Monthly Quality Rollup) "ready to download". After running WSUSOU, it no longer shows it. So, presumably it was installed by WSUSOU, and this triggered the reinstallation of Kb971033?

Another anomoly is that WSUSOU failed to install KB3205402 (Security and Quality Rollup .NET Framework) even though .Net IS selected.

[boco]

Since October, WSUSOU does install the Rollup, since that's what MS offers. No more separate patches.

The next version of WSUSOU will have a checkbox to use the "Security-only" packs. Note that those are not distributed over WU, and those will not silence WU's demand for the FullPacks. But the system will be secure.