Troubleshooting update deployment publishing using System Center Update Publisher 4.5 and Configuration Manager 2007

Troubleshooting update deployment publishing using System Center Update Publisher 4.5 and Configuration Manager 2007

  • Comments 5
  • Likes

Here’s an issue I ran into when I was trying to deploy Adobe Flash Player update 9.0.246.0. and since I didn’t see it documented anywhere I thought I’d post it here.

The Adobe patch APSB09-10 for Adobe Flash Player 9.0.246.0 was failing to install on client machines when pushed through Configuration Manager Software updates deployment. The patch was failing at the “Install verifying” state and the status message returned was “Install Failed”, but the patch was being installed on the client machine as you could see the patch in Add\Remove programs.  Below is the error you receive:

clip_image001

When you see the Status Message details in the reports you see the following error:

clip_image003

11751 Software Updates Installation Agent Updates failures occured during enforcement for assignment {51583BD3-054B-490B-9691-D2AA5AEF741B}. The operating system reported error -2145124329:

Here’s what I did to troubleshoot the issue:

I imported the Adobe patch from the catalogue using System Center Update Publisher (SCUP) 4.5.  I flagged the Adobe update and published the update in the Update Server (i.e. The System Center Configuration Manager). Please see images below:

clip_image005

Once you publish the updates (in our example these were Adobe updates) these are then made available in the Update Server (Configuration Manager 2007) for deployment:

clip_image007

The publishing of the patch was smooth and it was reflected in the SCCM console under the “All Update” section. After advertising the Adobe patch to a group of machines, the advertisement was received by those machines. When the advertisement was run it failed in the “Install Verifying” state, but the patch was updated in that particular machine. Moreover while referring to the Report from the SCCM consoles those machines are still in the Downloaded Update state.

When you look into the execmgr.log you see the exit code 0 for the update deployment.

To continue troubleshooting I performed the following test in the lab:

Lab Setup

SCCM 2007 SP1 Server: SCCM2K7.mgmt.in
Database Server: SQL2K5.mgmt.in

Installed SCUP 4.5 (System Center Update Publisher) on the SCCM Server
The database for SCUP was hosted on the remote SQL Server SQL2K5

Note: Created a self-sign WSUS cert.  Added the WSUS Certificate to the Trusted Publisher certificate and Trusted Root CA Certificate containers on both the Update Server and the client machines

Before the Windows Update Agent (WUA) will scan for updates that were created and published with the System Center Updates Publisher, a Group Policy setting must be enabled to allow signed content from an intranet Microsoft update service location. When the policy setting is enabled, WUA 3.0 will accept updates received through an intranet location if the updates are signed in the Trusted Publishers certificate store on the local computer. There are several methods for configuring Group Policy on computers in the environment.

The Group Policy is available only to computers that have WUA 3.0 installed.

For computers that are not on the domain, a registry key setting can be configured that will allow signed content from an intranet Microsoft update service location.

Make sure you add the WSUS Self Signed Cert to the Trusted Root CA Certificate container and the Trusted Publisher store, and also add the following registry key.

For more details on how to configure Group Policy to allow signed content from an intranet Microsoft Update Service location, see the SCUP Help file.

Repro Steps

- Imported the catalogue for Adobe Flash Player updates.

Flagged these updates in SCUP.
After that i was able to publish the flagged updates to the SCCM database.

- Created deployment for the Adobe package in SCCM 2007.

The Adobe Updates were made available to the targeted clients.
The installation failed, however in the execmgr.log we see the returns exit code 0 though.

- I Checked the Installed rule of the Adobe patch APSB09-10 Adobe Flash Player 9.0.246.0.

When the AdobeFlashPlayerCatalogue.cab file for Flash Player is imported using the "System Center Update Publisher" we see that the Installed rule has the following entries:

<lar:Or>
<msiar:MsiProductInstalled ProductCode="{74B3FB8A-2A0F-4CEA-84FD-12C9B03EE377}" />
<bar:RegSz Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Macromedia\FlashPlayer" Value="CurrentVersion" Comparison="EqualTo" Data="9,0,151,0" />
<bar:RegSz Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32" Value="" Comparison="EndsWith" Data="flash9g.ocx" />
</lar:Or>

clip_image009

- As per the above "Installed" rule, it does the following verification test to evaluate if Adobe flash 9.0.246.0 is installed.

“If the version equal to 9.0.151.0 or the inprocserver32 ends with flash9g.ocx or productcode equal to 74B3FB8A-2A0F-4CEA-84FD-12C9B03EE377”, then Adobe Flash Player 9.0.246.0 is installed“

I installed the patch APSB09-10 Adobe Flash Player 9.0.246.0 manually on one of the machines and checked the following registry locations:

HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Macromedia\FlashPlayer

HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32

The values set for these registry keys were 9,0,246,0 and flash9i.ocx respectively.

- The fact that manually installing the patch succeeded and installing the patch through SCCM is failing now seems clear, when installing manually there is no "Installed rule" or verification done to test whether the patch is installed, or even if it's done which I am not sure of it is done by checking for values 9,0,246,0 and flash9i.ocx.

- When we import the Adobe catalogue files the "Installed rules" by default are configured for checking for some previous version of Adobe Flash (e.g. 9,0,151,0 and flash9g.ocx).

So whenever these "Install verifying" rules are run on target machines after the patch is installed it’s always failing since the version and string flash9g.ocx does not match in the registry.

So in the reports we see the status error message that the patch has failed to install, however it's only the install verification that has failed because of faulty "Installed rules".

- After correcting the "Installed rules" for the Adobe patch, it looked like this:

<lar:Or>
<msiar:MsiProductInstalled ProductCode="{74B3FB8A-2A0F-4CEA-84FD-12C9B03EE377}" />
<bar:RegSz Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Macromedia\FlashPlayer" Value="CurrentVersion" Comparison="EqualTo" Data="9,0,246,0" />
<bar:RegSz Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32" Value="" Comparison="EndsWith" Data="flash9i.ocx" />
</lar:Or>

clip_image011

clip_image005[1]

- Published this updated patch to the Update Server from the SCUP 4.5 console.

Re-synchronized the SCCM update repository.

Re-created the deployment and targeted the updated Adobe patch to some new machines having a previous version of Adobe Flash player.

- This time the patch got installed successfully and also returned a install success status in the deployment reports.

Solution:

- Modified the "Installed rules" for the Adobe patch as follows:

<lar:Or>
<msiar:MsiProductInstalled ProductCode="{74B3FB8A-2A0F-4CEA-84FD-12C9B03EE377}" />
<bar:RegSz Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Macromedia\FlashPlayer" Value="CurrentVersion" Comparison="EqualTo" Data="9,0,246,0" />
<bar:RegSz Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32" Value="" Comparison="EndsWith" Data="flash9i.ocx" />
</lar:Or>

clip_image013

Chances are you won’t run into this exact problem, but if you run into something similar then you should be able to follow the same method I outlined here and be able to determine what may be causing your issue.

Hope this helps,

Adnan Ezzi | Configuration Manager Support Engineer

Additional readings

System Center Updates Publisher: http://technet.microsoft.com/en-us/systemcenter/bb741049.aspx

System Center Updates Publisher (TechNet Library): http://technet.microsoft.com/en-us/library/bb531022.aspx

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment
  • my flash keeps saying component flash9i.ocx`or one of its dependentcies not correctly registered:a file is missing

  • my flash keeps saying component flash9i.ocx`or one of its dependentcies not correctly registered:a file is missing

  • my flash keeps saying component flash9i.ocx`or one of its dependentcies not correctly registered:a file is missing

  • sigue igual

    no puedo usar el penguin storm 12.3

  • putooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo  pone algo q sea verdadero