Approved for Removal Patch does not uninstall

Last Modified

Thu Nov 12 19:45 GMT 2020

Description

  • Patch removal fails and PatchInstall.log has an entry such as the following:
    [84] 2016-07-27 16:15:27,564 <<*>> Title[Security Update for Microsoft Excel 2010 (KB3115322) 32-Bit Edition] Guid[79a0a428-8946-4a19-907f-f8febf7733e7][84] 2016-07-27 16:15:27,564 <<*>> C:\Windows\Sysnative\\wusa.exe /uninstall /kb:3115322 /silent /norestart[84] 2016-07-27 16:15:57,827 WARN ExitCode[0x240007] Message[Patch was not installed. Nothing to remove] EventLogMessage[Windows update could not be uninstalled because of error 2359303 "" (Command line: ""C:\Windows\Sysnative\\wusa.exe" /uninstall /kb:3115322 /silent /norestart")]

Environment

  • N-able N-central
  • MS Office and related component patches

Solution

  • In most cases the patch will still be installed, however, the Windows Update Agent is telling the N-able N-central agent that it is not.
  • The cause is often a problematic patch and is a known issue with office related components (including Office, Outlook, and so on); the solution is a particular method of executing the uninstall that currently cannot be handled by Patch Management as it is only required in these specific cases.
  • We have a Feature request open to look into implementing a method to re-try with the alternative method via NCPM-2955; while the alternative method is not normally recommended, it is the only way to get the patches removed in this case.

  1. Find the GUIDs

  • The first step will be to find the necessary information about the patch, which can be done via command prompt or batch file with the following command:
    • REG QUERY HKLM\SOFTWARE\wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s /f "3115322"
    • Simply replace the KB number in the quotes with whatever problem KB, and the output should look something like this:
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0012-0000-0000-0000000FF1CE}_Office14.STANDARD_{70DAB69D-244C-403A-9C0F-CB7748CD2991} DisplayName REG_SZ Security Update for Microsoft Outlook 2010 (KB3203467) 32-Bit Edition MoreInfoURL REG_SZ https://support.microsoft.com/kb/3203467 URLInfoAbout REG_SZ https://support.microsoft.com/kb/3203467 HelpLink REG_SZ https://support.microsoft.com/kb/3203467 Publisher REG_SZ Microsoft ParentKeyName REG_SZ Office14.STANDARD ParentDisplayName REG_SZ Microsoft Office Standard 2010 UninstallString REG_SZ "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Oarpmany.exe" /removereleaseinpatch "{90140000-0012-0000-0000-0000000FF1CE}" "{70DAB69D-244C-403A-9C0F-CB7748CD2991}" "1033" "0" NoRemove REG_DWORD 0x0 NoModify REG_DWORD 0x1 IsMinorUpgrade REG_DWORD 0x0 NoRepair REG_DWORD 0x1
  • You will want the UninstallString value or simply the very first line and pull the keys to place into the removal command.
  • Removal of the Patch
    • To remove the patch, simply run the following:
      • msiexec /I {90140000-0012-0000-0000-0000000FF1CE} MSIPATCHREMOVE={70DAB69D-244C-403A-9C0F-CB7748CD2991} /qn REBOOT=REALLYSUPPRESS
      • Replace the contents of the brackets {} with the values from the query above. Note that they are presented in the same order.