IE7 Update Failing Post Processing on clients from WSUS 0x800b0111

I have update (Windows Internet Explorer 7 for Windows XP) KB940767 approved
to deploy. It appears to be failing quite a lot with an error of "Download
Fialed".
If I go to any of the computers and goto the %systemRoot%\windowsupdate.log
and search for the update, I can cut and paste the download link it uses into
run line and it will run it from the server just fine. So I know the link
is good and the
update exists on server. But it appears as though when I look in the
\\%systemroot%\SoftwareDistribution\Download that the actual folder does
not exist that relates to the download location in the windowsupdate.log
file.

Does anyone know how else I can troubleshoot this? Some are windows 2k
machines upgraded to XP, some are native XP machines, all have SP3 on
them.

The only error in the log file of WSUS for each client is "Download
Failed".

Here is a snip from one of the windowsupdate.log files related to only
this
issue.

I have already tried deleting the two Microsoft Certs in the Untrusted tab
which expired in 2002. Still getting the same result. Primarily looking at
the following lines from below:---------
2009-10-01 00:46:03:393 816 760 Misc WARNING: Error: 0x800b0111 when
verifying trust for C:\WINNT\SoftwareDistribution\Download\2449abaa965
f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326
2009-10-01 00:46:03:393 816 760 Misc WARNING: Digital Signatures on file
C:\WINNT\SoftwareDistribution\Download\2449abaa965
f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326
are not trusted: Error 0x800b0111 2009-10-01 00:46:03:393 816 760 DnldMgr
WARNING: File failed postprocessing, error = 800b0111--------


--------------------------------------
2009-10-01 00:45:54:799 816 b44 DnldMgr * Updates to download = 1
2009-10-01 00:45:54:799 816 b44 Agent * Title = Windows Internet
Explorer 7 for Windows XP
2009-10-01 00:45:54:799 816 b44 Agent * UpdateId =
{83A56F7C-B154-4269-B665-42BB483C80C2}.102
2009-10-01 00:45:54:799 816 b44 Agent * Bundles 1 updates:
2009-10-01 00:45:54:799 816 b44 Agent *
{CFAC6A65-2A92-499B-933C-AB4B034AE58E}.102
2009-10-01 00:45:54:799 816 b44 DnldMgr *********** DnldMgr: New download
job [UpdateId = {CFAC6A65-2A92-499B-933C-AB4B034AE58E}.102] ***********
2009-10-01 00:45:55:221 816 b44 DnldMgr * BITS job initialized, JobId =
{5517F7C4-3BBF-42FC-BF2F-6C5E88C122CB}
2009-10-01 00:45:55:362 816 b44 DnldMgr * Downloading from
http://wsus.com:8530/Cont...00687A5326.exe to
C:\WINNT\SoftwareDistribution\Download\2449abaa965
f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326
(full file). 2009-10-01 00:45:55:424 816 70 AU AU checked download status
and it changed: Downloading is paused 2009-10-01 00:45:55:440 816 b44 Agent
*********
2009-10-01 00:45:55:440 816 b44 Agent ** END ** Agent: Downloading
updates [CallerId = AutomaticUpdates] 2009-10-01 00:45:55:440 816 b44 Agent
************* 2009-10-01 00:45:55:440 816 70 AU AU checked download status
and it
changed: Downloading is not paused 2009-10-01 00:45:55:440 816 70 AU AU
setting pending client directive to 'Download Progress' 2009-10-01
00:45:59:752 816 b44 Report REPORT EVENT:
{46709FFB-5B7C-4B75-B144-53D2E9AA80F8} 2009-10-01
00:45:54:753-0500 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0
AutomaticUpdates Success Software Synchronization Windows Update Client
successfully detected 1 updates. 2009-10-01 00:45:59:752 816 b44 Report
REPORT EVENT:
{380A08F9-9098-4CE8-8537-77F66477DE13} 2009-10-01
00:45:54:753-0500 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0
AutomaticUpdates Success Pre-Deployment Check Reporting client status.
2009-10-01 00:46:02:612 816 760 DnldMgr BITS job
{5517F7C4-3BBF-42FC-BF2F-6C5E88C122CB} completed successfully 2009-10-01
00:46:03:284 816 760 Misc Validating signature for
C:\WINNT\SoftwareDistribution\Download\2449abaa965
f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326:
2009-10-01 00:46:03:393 816 760 Misc WARNING: Error: 0x800b0111 when
verifying trust for C:\WINNT\SoftwareDistribution\Download\2449abaa965
f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326
2009-10-01 00:46:03:393 816 760 Misc WARNING: Digital Signatures on file
C:\WINNT\SoftwareDistribution\Download\2449abaa965
f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326
are not trusted: Error 0x800b0111 2009-10-01 00:46:03:393 816 760 DnldMgr
WARNING: File failed postprocessing, error = 800b0111
2009-10-01 00:46:03:393 816 760 DnldMgr Failed file: URL =

'http://wsus.com:8530/Content/26/D39B89C360FBAA9706B5181AE4718100687A5326.exe',
Local path = 'C:\WINNT\SoftwareDistribution\Download\2449abaa96
5f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae47 18100687a5326'
2009-10-01 00:46:03:393 816 760 DnldMgr Error 0x800b0111 occurred while
downloading update; notifying dependent calls.
2009-10-01 00:46:03:440 816 70 AU ## RESUMED ## AU: Download update
[UpdateId = {83A56F7C-B154-4269-B665-42BB483C80C2}]
2009-10-01 00:46:03:440 816 70 AU # WARNING: Download failed, error =
0x800B0111 2009-10-01 00:46:03:440 816 70 AU #########
2009-10-01 00:46:03:440 816 70 AU ## END ## AU: Download updates
2009-10-01 00:46:03:440 816 70 AU #############

"Carito" <> wrote in message
news:36C99B8F-C7EA-4D65-A037-...

> 2009-10-01 00:46:03:393 816 760 Misc WARNING: Error: 0x800b0111 when
> verifying trust for C:\WINNT\SoftwareDistribution\Download\2449abaa965
> f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326
> 2009-10-01 00:46:03:393 816 760 Misc WARNING: Digital Signatures on file
> C:\WINNT\SoftwareDistribution\Download\2449abaa965
> f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326
> are not trusted:

That seems pretty straight forward to me.

When's the last time you applied a Root Certificates Update to these Windows
XP machines?

I would suggest deploying the Sept 2009 edition of KB931125 to these
machines, and then retry the IE7 download.


--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

My Blog: http://onsitechsolutions.spaces.live.com
Microsoft WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

Thanks. I checked WSUS console and all the Root Certs are already approved
along with KB931125. I also checked this updates deploy report against the
machine names that are failing with IE7 and the status for KB931125 on all of
them show as "Not Applicable".



"Lawrence Garvin [MVP]" wrote:

> "Carito" <> wrote in message
> news:36C99B8F-C7EA-4D65-A037-...
>
> > 2009-10-01 00:46:03:393 816 760 Misc WARNING: Error: 0x800b0111 when
> > verifying trust for C:\WINNT\SoftwareDistribution\Download\2449abaa965
> > f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326
> > 2009-10-01 00:46:03:393 816 760 Misc WARNING: Digital Signatures on file
> > C:\WINNT\SoftwareDistribution\Download\2449abaa965
> > f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326
> > are not trusted:
>
> That seems pretty straight forward to me.
>
> When's the last time you applied a Root Certificates Update to these Windows
> XP machines?
>
> I would suggest deploying the Sept 2009 edition of KB931125 to these
> machines, and then retry the IE7 download.
>
>
> --
> Lawrence Garvin, M.S., MCITP:EA, MCDBA
> Principal/CTO, Onsite Technology Solutions, Houston, Texas
> Microsoft MVP - Software Distribution (2005-2009)
>
> My Blog: http://onsitechsolutions.spaces.live.com
> Microsoft WSUS Website: http://www.microsoft.com/wsus
> My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin
>

"Carito" <> wrote in message
news0A5B425-0BA1-4E66-A86E-...

> Thanks. I checked WSUS console and all the Root Certs are already approved
> along with KB931125.

Okay.. but are they *installed*?

The error message would suggest otherwise.

> I also checked this updates deploy report against the
> machine names that are failing with IE7 and the status for KB931125 on all
> of
> them show as "Not Applicable".

Well, technically, they would show as "100%" in the Installed/Not
Applicable", which still may not be sufficient to determine that they're
actually installed -- as the update could be approved, not downloaded, and
thus not available; or it could be approved, downloaded, and have failed
installation. It could even be approved, downloaded, and not be successfully
detected by the client.

>> > 2009-10-01 00:46:03:393 816 760 Misc WARNING: Error: 0x800b0111 when
>> > verifying trust for C:\WINNT\SoftwareDistribution\Download\2449abaa965
>> > f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326
>> > 2009-10-01 00:46:03:393 816 760 Misc WARNING: Digital Signatures on
>> > file
>> > C:\WINNT\SoftwareDistribution\Download\2449abaa965
>> > f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326
>> > are not trusted:


--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

My Blog: http://onsitechsolutions.spaces.live.com
Microsoft WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

Thanks again. I checked a few machines from the failed list. Some of them are
not showing KB931125 in the Windowsupdate.log at all. Maybe not downloaded
yet?

Others though did get it and install it as below:
2009-09-29 10:21:15:309 1128 294 Report REPORT EVENT:
{E1C94F85-68EB-482F-885B-CFE5F48D4674} 2009-09-29
10:20:53:312-0500 1 183 101 {20E6483F-EBA9-40D1-89F4-1940F79CBA3B} 101 0 AutomaticUpdates Success Content
Install Installation Successful: Windows successfully installed the following
update: Update for Root Certificates [September 2009] (KB931125)

and these computers also failed IE7 install.

Any suggestions?? Not sure why else the update failed yet the root cert
applied.



"Lawrence Garvin [MVP]" wrote:

> "Carito" <> wrote in message
> news0A5B425-0BA1-4E66-A86E-...
>
> > Thanks. I checked WSUS console and all the Root Certs are already approved
> > along with KB931125.
>
> Okay.. but are they *installed*?
>
> The error message would suggest otherwise.
>
> > I also checked this updates deploy report against the
> > machine names that are failing with IE7 and the status for KB931125 on all
> > of
> > them show as "Not Applicable".
>
> Well, technically, they would show as "100%" in the Installed/Not
> Applicable", which still may not be sufficient to determine that they're
> actually installed -- as the update could be approved, not downloaded, and
> thus not available; or it could be approved, downloaded, and have failed
> installation. It could even be approved, downloaded, and not be successfully
> detected by the client.
>
> >> > 2009-10-01 00:46:03:393 816 760 Misc WARNING: Error: 0x800b0111 when
> >> > verifying trust for C:\WINNT\SoftwareDistribution\Download\2449abaa965
> >> > f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326
> >> > 2009-10-01 00:46:03:393 816 760 Misc WARNING: Digital Signatures on
> >> > file
> >> > C:\WINNT\SoftwareDistribution\Download\2449abaa965
> >> > f28258b006979384ff8c9\d39b89c360fbaa9706b5181ae471 8100687a5326
> >> > are not trusted:
>
>
> --
> Lawrence Garvin, M.S., MCITP:EA, MCDBA
> Principal/CTO, Onsite Technology Solutions, Houston, Texas
> Microsoft MVP - Software Distribution (2005-2009)
>
> My Blog: http://onsitechsolutions.spaces.live.com
> Microsoft WSUS Website: http://www.microsoft.com/wsus
> My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin
>

"Carito" <> wrote in message
news:2BA3B6EC-6539-48FC-9A53-...

> Thanks again. I checked a few machines from the failed list. Some of them
> are
> not showing KB931125 in the Windowsupdate.log at all. Maybe not downloaded
> yet?

Maybe . . .

> Others though did get it and install it as below:
> 2009-09-29 10:21:15:309 1128 294 Report REPORT EVENT:
> {E1C94F85-68EB-482F-885B-CFE5F48D4674} 2009-09-29
> 10:20:53:312-0500 1 183 101 {20E6483F-EBA9-40D1-89F4-1940F79CBA3B} 101 0
> AutomaticUpdates Success Content
> Install Installation Successful: Windows successfully installed the
> following
> update: Update for Root Certificates [September 2009] (KB931125)
>
> and these computers also failed IE7 install.

Then on these we'd want to inspect the reason for the IE7 installation
failure
and verify that the installation failure occurred after the installation
date of KB931125.

> Not sure why else the update failed yet the root cert applied.

There are a gazillion reasons why an =IE= update might fail on a machine.
:-)

--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

My Blog: http://onsitechsolutions.spaces.live.com
Microsoft WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin