Repetitive Root Certificate updates

I have a Windows XP Pro SP3 machine under WSUS with two Root Certificate
updates alternating as ready to install. Each appears to install, and is
noted in the event log as such, then shortly after the other update is
showing ready to install. This cycle continues. No error messages are shown
on-screen or in the event log.

I have tried a manual Windows Update, which again installs the update, then
shows it ready again.
I have tried installing one update, rebooting, installing the other,
rebooting, installing the other, rebooting. This gets nowhere either.

I have looked to see if either update can be uninstalled, but cannot see
either listed in Add/Remove Programs.

Other updates have been installed without problem whist this has been
happening.

The update descriptions are:

Size: 295 KB

This item updates the list of root certificates on your computer to the list
that is accepted by Microsoft as part of the Microsoft Root Certificate
Program. Adding additional root certificates to your computer enables you to
use Extended Validation (EV) certificates in Internet Explorer 7, a greater
range of security enhanced Web browsing, encrypted e-mail, and security
enhanced code delivery. After you install this item, you may have to restart
your computer. Once you have installed this item, it cannot be removed.

More information for this update can be found at
http://support.microsoft.com/kb/931125

Size: 286 KB

This item updates the list root certificates on your computer to the latest
list that is accepted by Microsoft as part of the Microsoft Root Certificate
Program. Adding additional root certificates to your computer enables the
use of Extended Validation (EV) certificates in Internet Explorer 7, a
greater range of security enhanced Web browsing, encrypted e-mail, and
security enhanced code delivery.

More information for this update can be found at
http://msdn.microsoft.com/library/de...otcertprog.asp

[Cross-posted to the WSUS group]

PaulLG wrote:

> I have a Windows XP Pro SP3 machine under WSUS with two Root Certificate
> updates alternating as ready to install. Each appears to install, and is
> noted in the event log as such, then shortly after the other update is
> showing ready to install. This cycle continues. No error messages are shown
> on-screen or in the event log.

I take it there is just this one machine having problems?

I suggest downloading the more recent of the two updates:

<http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=f814ec0e-ee7e-435e-99f8-20b44d4531b0>

http://www.microsoft.com/downloads/d...8-20b44d4531b0

First deapprove the older update, then manually install the new update via the
downloaded installer while booted to Safe Mode. When you boot back to normal
mode, do a scan (type "wuauclt /detectnow" at the command line) and see whether
the older update is still detected as needed.

Let us know if this works.

Harry.

> I have tried a manual Windows Update, which again installs the update, then
> shows it ready again.
> I have tried installing one update, rebooting, installing the other,
> rebooting, installing the other, rebooting. This gets nowhere either.
>
> I have looked to see if either update can be uninstalled, but cannot see
> either listed in Add/Remove Programs.
>
> Other updates have been installed without problem whist this has been
> happening.
>
> The update descriptions are:
>
> Size: 295 KB
>
> This item updates the list of root certificates on your computer to the list
> that is accepted by Microsoft as part of the Microsoft Root Certificate
> Program. Adding additional root certificates to your computer enables you to
> use Extended Validation (EV) certificates in Internet Explorer 7, a greater
> range of security enhanced Web browsing, encrypted e-mail, and security
> enhanced code delivery. After you install this item, you may have to restart
> your computer. Once you have installed this item, it cannot be removed.
>
> More information for this update can be found at
> http://support.microsoft.com/kb/931125
>
> Size: 286 KB
>
> This item updates the list root certificates on your computer to the latest
> list that is accepted by Microsoft as part of the Microsoft Root Certificate
> Program. Adding additional root certificates to your computer enables the
> use of Extended Validation (EV) certificates in Internet Explorer 7, a
> greater range of security enhanced Web browsing, encrypted e-mail, and
> security enhanced code delivery.
>
> More information for this update can be found at
> http://msdn.microsoft.com/library/de...otcertprog.asp
>
>
>
>

Thanks for the reply.

I'm having trouble idenifying which is the latest update. With quite a bit
of digging in WSUS I have tracked that the two updates concerned are;
Root Certificates Update revision 100 dated 25/11/08 and
Update for Root Certificates revision 100 dated 22/2/08

To confuse things further, some machines on the network are requiring the
above "Root Certificates Update" revision 100 plus;
Root Certificates Update revision 101 dated 22/4/08

How can revision 101 precede revision 100 by 7 months? And both be needed?

A pity these updates are not annotated with the month/year in the title as
per the Malicious Software Removal Tool updates from KB890830.

Paul

"Harry Johnston [MVP]" <> wrote in message
news:...
> [Cross-posted to the WSUS group]
>
> PaulLG wrote:
>
>> I have a Windows XP Pro SP3 machine under WSUS with two Root Certificate
>> updates alternating as ready to install. Each appears to install, and is
>> noted in the event log as such, then shortly after the other update is
>> showing ready to install. This cycle continues. No error messages are
>> shown on-screen or in the event log.
>
> I take it there is just this one machine having problems?
>
> I suggest downloading the more recent of the two updates:
>
> <http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=f814ec0e-ee7e-435e-99f8-20b44d4531b0>
>
> http://www.microsoft.com/downloads/d...8-20b44d4531b0
>
> First deapprove the older update, then manually install the new update via
> the downloaded installer while booted to Safe Mode. When you boot back to
> normal mode, do a scan (type "wuauclt /detectnow" at the command line) and
> see whether the older update is still detected as needed.
>
> Let us know if this works.
>
> Harry.
>
>> I have tried a manual Windows Update, which again installs the update,
>> then shows it ready again.
>> I have tried installing one update, rebooting, installing the other,
>> rebooting, installing the other, rebooting. This gets nowhere either.
>>
>> I have looked to see if either update can be uninstalled, but cannot see
>> either listed in Add/Remove Programs.
>>
>> Other updates have been installed without problem whist this has been
>> happening.
>>
>> The update descriptions are:
>>
>> Size: 295 KB
>>
>> This item updates the list of root certificates on your computer to the
>> list that is accepted by Microsoft as part of the Microsoft Root
>> Certificate Program. Adding additional root certificates to your computer
>> enables you to use Extended Validation (EV) certificates in Internet
>> Explorer 7, a greater range of security enhanced Web browsing, encrypted
>> e-mail, and security enhanced code delivery. After you install this item,
>> you may have to restart your computer. Once you have installed this item,
>> it cannot be removed.
>>
>> More information for this update can be found at
>> http://support.microsoft.com/kb/931125
>>
>> Size: 286 KB
>>
>> This item updates the list root certificates on your computer to the
>> latest list that is accepted by Microsoft as part of the Microsoft Root
>> Certificate Program. Adding additional root certificates to your computer
>> enables the use of Extended Validation (EV) certificates in Internet
>> Explorer 7, a greater range of security enhanced Web browsing, encrypted
>> e-mail, and security enhanced code delivery.
>>
>> More information for this update can be found at
>> http://msdn.microsoft.com/library/de...otcertprog.asp
>>
>>
>>

PaulLG wrote:

> I'm having trouble idenifying which is the latest update. With quite a bit
> of digging in WSUS I have tracked that the two updates concerned are;
> Root Certificates Update revision 100 dated 25/11/08 and
> Update for Root Certificates revision 100 dated 22/2/08

The latest root certificates update is dated February 2009. To locate it, sort
the updates by KB number and look for 931125. One of the 931125 updates should
have a February 2009 date; this will also be the only one that isn't marked as
superceded.

Is this update approved? If not, that's likely to be causing your problem; you
should approve the latest version.

> To confuse things further, some machines on the network are requiring the
> above "Root Certificates Update" revision 100 plus;
> Root Certificates Update revision 101 dated 22/4/08
>
> How can revision 101 precede revision 100 by 7 months? And both be needed?

Revision numbers are per-package. All this means is that the package dated
22/4/08 was revised once, and the other packages weren't.

> A pity these updates are not annotated with the month/year in the title as
> per the Malicious Software Removal Tool updates from KB890830.

Yes, that would make things a lot clearer.

Harry.

>
> Paul
>
> "Harry Johnston [MVP]" <> wrote in message
> news:...
>> [Cross-posted to the WSUS group]
>>
>> PaulLG wrote:
>>
>>> I have a Windows XP Pro SP3 machine under WSUS with two Root Certificate
>>> updates alternating as ready to install. Each appears to install, and is
>>> noted in the event log as such, then shortly after the other update is
>>> showing ready to install. This cycle continues. No error messages are
>>> shown on-screen or in the event log.
>> I take it there is just this one machine having problems?
>>
>> I suggest downloading the more recent of the two updates:
>>
>> <http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=f814ec0e-ee7e-435e-99f8-20b44d4531b0>
>>
>> http://www.microsoft.com/downloads/d...8-20b44d4531b0
>>
>> First deapprove the older update, then manually install the new update via
>> the downloaded installer while booted to Safe Mode. When you boot back to
>> normal mode, do a scan (type "wuauclt /detectnow" at the command line) and
>> see whether the older update is still detected as needed.
>>
>> Let us know if this works.
>>
>> Harry.
>>
>>> I have tried a manual Windows Update, which again installs the update,
>>> then shows it ready again.
>>> I have tried installing one update, rebooting, installing the other,
>>> rebooting, installing the other, rebooting. This gets nowhere either.
>>>
>>> I have looked to see if either update can be uninstalled, but cannot see
>>> either listed in Add/Remove Programs.
>>>
>>> Other updates have been installed without problem whist this has been
>>> happening.
>>>
>>> The update descriptions are:
>>>
>>> Size: 295 KB
>>>
>>> This item updates the list of root certificates on your computer to the
>>> list that is accepted by Microsoft as part of the Microsoft Root
>>> Certificate Program. Adding additional root certificates to your computer
>>> enables you to use Extended Validation (EV) certificates in Internet
>>> Explorer 7, a greater range of security enhanced Web browsing, encrypted
>>> e-mail, and security enhanced code delivery. After you install this item,
>>> you may have to restart your computer. Once you have installed this item,
>>> it cannot be removed.
>>>
>>> More information for this update can be found at
>>> http://support.microsoft.com/kb/931125
>>>
>>> Size: 286 KB
>>>
>>> This item updates the list root certificates on your computer to the
>>> latest list that is accepted by Microsoft as part of the Microsoft Root
>>> Certificate Program. Adding additional root certificates to your computer
>>> enables the use of Extended Validation (EV) certificates in Internet
>>> Explorer 7, a greater range of security enhanced Web browsing, encrypted
>>> e-mail, and security enhanced code delivery.
>>>
>>> More information for this update can be found at
>>> http://msdn.microsoft.com/library/de...otcertprog.asp
>>>
>>>
>>>
>

Finally realised that I could add columns to the WSUS updates view, which
made things much easier!

The Feb 2009 update was approved, but so were two previous KB931125 updates.
I Declined both previous updates, did a "wuauclt /detectnow" on the problem
machine and installed the update it found.

No more updates are found for this machine, so the problem has been
resolved.

Many Thanks for your help.

Paul


"Harry Johnston [MVP]" <> wrote in message
news:%...
> PaulLG wrote:
>
>> I'm having trouble idenifying which is the latest update. With quite a
>> bit of digging in WSUS I have tracked that the two updates concerned are;
>> Root Certificates Update revision 100 dated 25/11/08 and
>> Update for Root Certificates revision 100 dated 22/2/08
>
> The latest root certificates update is dated February 2009. To locate it,
> sort the updates by KB number and look for 931125. One of the 931125
> updates should have a February 2009 date; this will also be the only one
> that isn't marked as superceded.
>
> Is this update approved? If not, that's likely to be causing your
> problem; you should approve the latest version.
>
>> To confuse things further, some machines on the network are requiring the
>> above "Root Certificates Update" revision 100 plus;
>> Root Certificates Update revision 101 dated 22/4/08
>>
>> How can revision 101 precede revision 100 by 7 months? And both be
>> needed?
>
> Revision numbers are per-package. All this means is that the package
> dated 22/4/08 was revised once, and the other packages weren't.
>
>> A pity these updates are not annotated with the month/year in the title
>> as per the Malicious Software Removal Tool updates from KB890830.
>
> Yes, that would make things a lot clearer.
>
> Harry.
>
>>
>> Paul
>>
>> "Harry Johnston [MVP]" <> wrote in message
>> news:...
>>> [Cross-posted to the WSUS group]
>>>
>>> PaulLG wrote:
>>>
>>>> I have a Windows XP Pro SP3 machine under WSUS with two Root
>>>> Certificate updates alternating as ready to install. Each appears to
>>>> install, and is noted in the event log as such, then shortly after the
>>>> other update is showing ready to install. This cycle continues. No
>>>> error messages are shown on-screen or in the event log.
>>> I take it there is just this one machine having problems?
>>>
>>> I suggest downloading the more recent of the two updates:
>>>
>>> <http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=f814ec0e-ee7e-435e-99f8-20b44d4531b0>
>>>
>>> http://www.microsoft.com/downloads/d...8-20b44d4531b0
>>>
>>> First deapprove the older update, then manually install the new update
>>> via the downloaded installer while booted to Safe Mode. When you boot
>>> back to normal mode, do a scan (type "wuauclt /detectnow" at the command
>>> line) and see whether the older update is still detected as needed.
>>>
>>> Let us know if this works.
>>>
>>> Harry.
>>>
>>>> I have tried a manual Windows Update, which again installs the update,
>>>> then shows it ready again.
>>>> I have tried installing one update, rebooting, installing the other,
>>>> rebooting, installing the other, rebooting. This gets nowhere either.
>>>>
>>>> I have looked to see if either update can be uninstalled, but cannot
>>>> see either listed in Add/Remove Programs.
>>>>
>>>> Other updates have been installed without problem whist this has been
>>>> happening.
>>>>
>>>> The update descriptions are:
>>>>
>>>> Size: 295 KB
>>>>
>>>> This item updates the list of root certificates on your computer to the
>>>> list that is accepted by Microsoft as part of the Microsoft Root
>>>> Certificate Program. Adding additional root certificates to your
>>>> computer enables you to use Extended Validation (EV) certificates in
>>>> Internet Explorer 7, a greater range of security enhanced Web browsing,
>>>> encrypted e-mail, and security enhanced code delivery. After you
>>>> install this item, you may have to restart your computer. Once you have
>>>> installed this item, it cannot be removed.
>>>>
>>>> More information for this update can be found at
>>>> http://support.microsoft.com/kb/931125
>>>>
>>>> Size: 286 KB
>>>>
>>>> This item updates the list root certificates on your computer to the
>>>> latest list that is accepted by Microsoft as part of the Microsoft Root
>>>> Certificate Program. Adding additional root certificates to your
>>>> computer enables the use of Extended Validation (EV) certificates in
>>>> Internet Explorer 7, a greater range of security enhanced Web browsing,
>>>> encrypted e-mail, and security enhanced code delivery.
>>>>
>>>> More information for this update can be found at
>>>> http://msdn.microsoft.com/library/de...otcertprog.asp
>>>>
>>>>
>>>>
>>