Root certificate updates

[Smirnoff]

XP Pro, SP3, MSE

When going to the Microsoft Update site and clicking "Custom", I am
continually being offered two different versions of updates for Root
certificates.

One is plain Update for Root Certificates, the other is Update for Root
Certificates [September 2009] (KB931125).

The updates are offered one at a time after I have installed the previous
one.

I have downloaded and installed both (installation successful) but when
searching for updates again, I am presented with the previous one that I
have installed.

When clicking on "Review and install updates.....", it tells me that the
file is downloaded and ready to install.

In "Review your update history" both files are repeatedly listed with a
green tick under "Status".

[wcoenen]

On Nov 24, 11:03 am, "Smirnoff" <some...@nospam.invalid> wrote:
> XP Pro, SP3, MSE
>
> When going to the Microsoft Update site and clicking "Custom", I am
> continually being offered two different versions of updates for Root
> certificates.

I have the same issue with the automatic updates. It keeps prompting
me to install one of these two updates:.

"Update for Root Certificates [September 2009] (KB931125)"

"Update for Root Certificates"

If I install one, it prompts to install the other a few moments later.
Two reboots didn't help. The second update appears to be also for
KB931125.

[Smirnoff]

"wcoenen" <wco...@gmail.com> wrote in message
news:39e6704a-516f-464d...@m33g2000vbi.googlegroups.com...

Yes, it appears they are the same, but have different titles.

As there is no error message and they are both registered as being
installed, there is no troubleshooting fix.

[Tom Svehla]

MS expired the May 09 Root certificate update last night. The May 09 update
superseded the update labeled "Update for Root Certificates" dated Feb 09. So
that made the Feb 09 update "think" that it needed be installed, because the
update that superseded it was gone. So something must be broken on the Feb 09
or the Sept. 09 update in regards to the supersedence, and they just looping
back and forth as to which one is needed. I just manually declined the Feb 09
update and that will take care of it

"Smirnoff" wrote:

> .
>

[jamie]

I have this same problem I have in side of WSUS declined

"Update for Root Certificates [May 2009] (KB931125)"
"Update for Root Certificates"

We left approved

"Update for Root Certificates [September 2009] (KB931125)"

I have some machines though that still get this loop with the sept
update and Update for Root Certificates.

Any ideas?

In article <72574380-A933-46DA...@microsoft.com>,
TomS...@discussions.microsoft.com says...

[J Sykes]

How do you manually decline the update? I hit "cancel" but the update
remains...

[jamie]

I'm in an organization and we declined the update in WSUS. Which is
basically Windows update for the company.

Here is what I had to do to stop this issue on a machine that got
affected by this.

stop the service "Automatic Updates"
go to C:\windows
delete the softwaredistribution folder
start the service "Automatic Updates"

Run a check for updates and it should not come back once you have it
declined.

Jamie

In article <593E3630-FDFD-4026...@microsoft.com>,
JSy...@discussions.microsoft.com says...

[MowGreen]

jamie,

You only have to delete the contents of the
SoftwareDistribution\Download subfolder to remove the downloaded
problematic root cert update.

Using XP SP3 and visiting Microsoft Update shows the Update for Root
Certificates [November 2009] (KB931125) offered. Following the link to
the MS Download Center yields:

Update for Root Certificates [September 2009] (KB931125)

http://www.microsoft.com/downloads/details.aspx?FamilyId=c14f8940-71b7-41e3-8749-a00e01e22f17&displaylang=en

From WSUS MVP Lawrence Garvin:

" From what I can see on my server, the May 2009 update is not properly
marked as hasSupercedingUpdates, so that's likely the one that continues
to get offered for installation, or is causing the Sep '09 update to be
re-offered.

Effectively the May '09 update fails the isInstalled test (because the
Sept 09 update is actually the one installed), and passes the
isInstallable test (because it's not installed), so it gets installed.
Then the Sep '09 update fails the isInstalled test, and it wants to install.

As noted, the appropriate resolution (and IMNSHO, should have already
been done anyway!) is to decline the Feb 09 and May 09 updates. I have
not been challenged with this issue as I declined the May 09 update in
September when the Sep '09 update was first released (and had declined
the Feb 09 update in May 09 when that update was released).

Note also that the November update, which was released last week
(thought it wasn't coming until today!), also has flaws, as it reports
that the SEP 09 update supercedes it. <sigh> The good news is that it
looks like the Nov 09 (11/19) update was EXPIRED so this supercession
flaw isn't a factor in the Nov '09 update. I presume there's a new
package for the Nov '09 update in the works and will be out very soon.

A revision to expire (or repair) the May 09 updates would be quite
useful as well!! "

MowGreen
===============
*-343-* FDNY
Never Forgotten
===============

banthecheck.com
"Security updates should *never* have *non-security content* prechecked"

[Smirnoff]

"wcoenen" <wco...@gmail.com> wrote in message
news:39e6704a-516f-464d...@m33g2000vbi.googlegroups.com...

MS Update now offers the November update.

Update for Root Certificates [November 2009] (KB931125)

I downloaded and installed it, did a new "Custom" search and no other root
certificate update was offered.

Hopefully, this has solved the problem.

[Smirnoff]

"wcoenen" <wco...@gmail.com> wrote in message
news:39e6704a-516f-464d...@m33g2000vbi.googlegroups.com...

Have just noticed that you refer to "Automatic Updates".

I thought that only "Critical" updates were offered via this.

As far as I know the Root Certificate updates are "Optional", so I am
wondering why AU would offer them.

Should therefore have said in my other reply to you:

Go to MS Update page and select "Custom". This should offer the November
update. After I installed this, no other Root Certificate update was
offered, either in "Custom" or "Express".

[PA Bear [MS MVP]]

That bug was reported and has been fixed.

[Smirnoff]

"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message
news:#k440pab...@TK2MSFTNGP02.phx.gbl...

Yes, after installing the November release, updates are not re-offered.
Thanks

[PA Bear [MS MVP]]

Smirnoff wrote:
>>> XP Pro, SP3, MSE
>>>
>>> When going to the Microsoft Update site and clicking "Custom", I am
>>> continually being offered two different versions of updates for Root
>>> certificates.
>>>
>>> One is plain Update for Root Certificates, the other is Update for Root
>>> Certificates [September 2009] (KB931125).
>>>
>>> The updates are offered one at a time after I have installed the
>>> previous
>>> one.
>>>
>>> I have downloaded and installed both (installation successful) but when
>>> searching for updates again, I am presented with the previous one that I
>>> have installed.
>>>
>>> When clicking on "Review and install updates.....", it tells me that the
>>> file is downloaded and ready to install.
>>>
>>> In "Review your update history" both files are repeatedly listed with a
>>> green tick under "Status".
>
> Yes, after installing the November release, updates are not re-offered.
> Thanks

Note quite right but close enough for government work. (The original Nov-09
release showed up as "expired" so the Sept-09 version was re-offered. Later
in the day, a revised Nov-09 version was released.)