[Todays' tip comes to us courtesy of Mark Stanfill]

This is just a quick note about the availability of a new KB published today to help consolidate some of the information that we've posted on this blog.

Best practices and known issues when you install Windows Server 2003 Service Pack 2 on a Windows Small Business Server 2003-based computer

http://support.microsoft.com/?kbid=939421

[Today's tip comes to us courtesy of Mark Stanfill]

Update:  The steps below are no longer needed.  To get past the errors, below, please download Service Pack 2 using the steps outlined in http://support.microsoft.com/default.aspx?scid=kb;EN-US;940276.

We're currently tracking an issue where Windows Server 2003 SP2 may fail to install for some Automatic Update clients.  There is a limitation in the database that Automatic Updates uses to track hotfix and service pack installations that may result in AU being unable to apply new patches if a very large number of fixes have been installed (>100).  This number is reset when a service pack is applied, so it is relatively hard to reach this threshold unless you are installing individual updates and have not upgraded to SP1.  That said, there are a certain number of SBS customers installed from the original 2003 media (i.e. pre-SP1 media), who may fall in to this category.

You can also see this error if you try to manually install SP2 manually.  In this case, you will receive the following pop-up error:

Failed to install catalog files.

The main symptom you will see in this case is that Automatic Updates/Windows Update/Microsoft Update will fail and you will see an error similar to the one below logged in svcpack.log:

960.484: InstallSingleCatalogFile: MyInstallCatalog failed for Tmp.0.ntprint.cat; error=0xfffffbfe.

There may be other issues that cause automatic updates to fail.  Unless you see the 0xfffffbfe error, you are dealing with another issue. These are documented in the following articles:

925931  You may be unable to apply more updates at a certain point on a Windows Server 2003-based computer

http://support.microsoft.com/default.aspx?scid=kb;EN-US;925931

822798  You cannot install some updates or programs

http://support.microsoft.com/default.aspx?scid=kb;EN-US;822798

Manual Method

To resolve this issue and allow SP2 to install, either use the manual steps below, or, alternatively, use the batch file below:

1. Make a full backup of your system.
2. Click on Start, click on Administrative Tools, Click on Services.  Right-click on Cryptographic Services and choose "Stop".
3. Open Explorer and browse to C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
4. Create a temporary folder called "backup" under CatRoot
5. Move all KB*.cat, Q*.* and TMP*.cat files to C:\WINDOWS\system32\CatRoot\backup.   DO NOT DELETE THEM!
6. If you moved KB912354.CAT, copy it back to C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} folder.  (This step is very important to prevent a potential error with SBS licensing. However, if the KB912354.cat file does not exist, go to step 7. The software update in KB 912354 is included in Windows Server 2003 SP2.)
7. Rename the C:\WINDOWS\SYSTEM32\CATROOT2\ folder to CATROOT2.old. Create a blank folder named CATROOT2. 
• NOTE: Make sure you rename CATROOT2 not CATROOT (without the 2).
• Again, make sure rename this folder, do not delete it.
8. Start Cryptographic Services from Services
9. Start the install of SP2.

Batch File Version

[Edit - batch file modified 11-09-2007]

Copy and paste between the "; --------" portions to a file called fixcatalog.bat and execute the batch file.  Watch for line wraps.):

 

; -----------------------------

@ECHO OFF
SETLOCAL EnableDelayedExpansion

net stop cryptsvc
cd /d %WINDIR%\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
attrib -s *.*
md %WINDIR%\system32\CatRoot\backup

FOR /F "delims=" %%a in ('REG QUERY "HKLM\Software\microsoft\Windows NT\CurrentVersion\Hotfix"') DO (REG QUERY "%%a" /v "Service Pack" | findstr /c:"0x2"
if !ERRORLEVEL!==0 (
For /f "delims=\ tokens=7" %%i in ('REG QUERY "%%a" /v "Service Pack"') do (
move %%i.cat %WINDIR%\system32\CatRoot\backup
)
)
)

if exist %WINDIR%\system32\CatRoot\backup\kb912354.cat copy %WINDIR%\system32\CatRoot\backup\kb912354.cat 

%WINDIR%\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
ren %WINDIR%\system32\catroot2 catroot2.old
md %WINDIR%\system32\CatRoot2
net start cryptsvc

@echo Ready for SP2 install.  You can now restart the SP2 installation.

; ------------------------------

Like the last line of the batch file says, SP2 installation must be restarted after running the batch file.

Notes

In some situations, you may not be able to use the steps above (either manual or batch file) because of one or both of the following conditions:

• You may be unable to rename catroot2
• Cryptographic Services (cryptsvc) may fail to stop gracefully and remain in a "stopping" state

If you are unable to complete any of the steps above, you will need to boot in to safe mode to complete the process

Uninstalling SP2 After Using These Steps

One of the side-effects of using this procedure is that we are effectively removing your update history.  In the event that you need to remove SP2 afterwards, you will need to use these steps:

1. Make a full backup of your system.
2. Click on Start, click on Administrative Tools, Click on Services.  Right-click on Cryptographic Services and choose "Stop".
3. Open Explorer and browse to C:\WINDOWS\system32\CatRoot\backup
4. Copy all files in C:\WINDOWS\system32\CatRoot\backup to C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}. 
5. Rename the C:\WINDOWS\SYSTEM32\CATROOT2\ folder to CATROOT2.old. Create a blank folder named CATROOT2. 
• NOTE: Make sure you rename CATROOT2 not CATROOT (without the 2).
• Again, make sure rename this folder, do not delete it.
6. Start Cryptographic Services from Services
7. Start the uninstall of SP2.

Uninstall Batch File Version

Copy and paste between the "; --------" portions to a file called fixuninstall.bat and execute the batch file):

; -----------------------------

net stop cryptsvc

copy %WINDIR%\system32\CatRoot\backup\*  %WINDIR%\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}

ren %WINDIR%\system32\catroot2 catroot2.old

md %WINDIR%\system32\CatRoot2

net start cryptsvc

@echo Ready for SP2 uninstall.

; ------------------------------

[Today's post comes to us courtesy of Mark Stanfill]

Kevin Beares and company are hosting a new Community Survey.  From http://blogs.technet.com/kevin_beares/archive/2007/05/24/announcing-the-sbs-community-survey-for-2007.aspx:

Announcing the SBS Community Survey for 2007!

[Today's post comes to us courtesy of Mark Stanfill and Wayne McIntyre]

Just a quick follow-up on something we discussed while ISA 2006 was in beta (http://blogs.technet.com/sbs/archive/2006/03/14/422020.aspx).  ISA 2006 installed on SBS 2003 is not supported by either the ISA or SBS groups.  It is supported in SBS environments, of course, but must be installed on to a separate server.  The best reference for the question of "is product X supported on SBS" is the Product Technologies Compatibility Chart at http://www.microsoft.com/WindowsServer2003/sbs/techinfo/planning/chartsbs.mspx.

[Today's post comes to us courtesy of Justin Crosby]

Whenever you install new client access licenses to you SBS 2003 server you should backup those licenses.  Follow the steps below to back up your licenses.  Please note that you should also safely store your licensing paperwork.

1. Open SBS 2003 Server Management.

2. Click the Licensing node.

3. Click the Back Up Licenses task.

4. Click Next to continue.

5. Enter a path for the backup file (include file name) and click Next.

6. Click Finish to complete the process.

[Today's post comes to us courtesy of Justin Crosby and Cloud Xu]

We are investigating an issue with the SBS 2003 R2 Update Services Configuration Wizard.  Within the wizard you have the option to set the update level for both your clients and servers.  The options are High, Medium, Low, and None.  The definition of Low is "Approve all security updates for installation".  We have discovered that when Low is selected instead of receiving security updates you will only receive critical updates.  If you are using the default values for SBS 2003 R2 you will not be impacted by this issue and the default for clients is High and the default for servers is Medium.

To verify your settings:

1. Open SBS 2003 R2 Server Management.

2. Click the Update Services node.

3. Click the Change Update Services Settings task.

4. Select the Server Updates tab and verify the radio button for Medium is selected:

5. Select the Client Updates tab and verify the radio button for High is selected:

6. Click OK to save your changes.