Issue:-

Error 0x800f0818 while installing Service Pack1 on Windows 2008 R2 x64

Cause:-
Dot net framework patch corruption (KB2518867)

Steps taken to resolve the issue:-

Check the "CheckSur.log" file located at "%windir%\Logs\CBS"

You may see the below error in the files.

Unavailable repair files:

 servicing\packages\Package_for_KB2518867_RTM~31bf3856ad364e35~amd64~~6.1.1.0.mum

 servicing\packages\Package_for_KB2518867_RTM~31bf3856ad364e35~amd64~~6.1.1.0.cat
Once you have the files which are causing the issue then download the patch, in my case, I have downloaded KB2518867 patch.Windows6.1-KB2518867-x64.msu

Launch the command prompt in Admin mode; extract it to “C:\temp” location by running the command "Windows6.1-KB2518867-x64.msu /extract"

Once extracted, now extract the “Windows6.1-KB2518867-x64.cab” file in the “C:\temp\KB2518867-Cab”.
Now we have to take the ownership and change the permission.

Take Ownership

takeown /f C:\Windows\servicing\Packages\Package_for_KB2518867_RTM~31bf3856ad364e35~amd64~~6.1.1.0.mum

takeown /f C:\Windows\servicing\Packages\Package_for_KB2518867_RTM~31bf3856ad364e35~amd64~~6.1.1.0.cat

Change Permission

icacls C:\Windows\servicing\Packages\Package_for_KB2518867_RTM~31bf3856ad364e35~amd64~~6.1.1.0.mum /GRANT Administrator:F

icacls C:\Windows\servicing\Packages\Package_for_KB2518867_RTM~31bf3856ad364e35~amd64~~6.1.1.0.cat/GRANT Administrator:F

Now replace the below two files from “C:\temp\KB2518867-Cab” and paste it to “C:\Windows\servicing\Packages\” 

Package_for_KB2518867_RTM~31bf3856ad364e35~amd64~~6.1.1.0.mum

Package_for_KB2518867_RTM~31bf3856ad364e35~amd64~~6.1.1.0.cat

Restart the Windows Update service
Issue Resolved!!! :-)

Error message#
Getting below error message while installing Patchlink Agent

Error:1720. There is a problem with this Windows Installer package. A script required for this install to complete could not be run. Contact your support personnel or package vendor. Custom action SetRegistryPermisson script error -2147024894, : …

Resolution Steps #

·         Download Orca.exe software from the below URL and install it on the server.

·         http://www.technipages.com/download-orca-msi-editor.html

·         Little bit information about Orca Software.

·         Orca.exe is a database table editor for creating and editing Windows Installer packages and merge modules. The tool provides a graphical interface for validation, highlighting the particular entries where validation errors or warnings occur.

·         Once orca is installed then open the software via Start-> All Programs -> Orca

·         File -> Open -> Navigate the location of updateagent.msi -> Click OK

·         In the left side pane, select ‘InstallExecuteSequence’ then drop down in the right side pane and select the value ‘SetRegistryPermisson’.

·         Right click on the ‘SetRegistryPermisson’ then click ‘DropRow’

·         Go to File menu-> Save

·         Exit the editor.

Now patchlink agent got installed successfully.

Issue with Patchlink # Unable to install patches from patchlink server.

Resolution Steps#

• Checked and found that the ‘PatchLink Replication Service’ was in hung state.
• To check this service, Go to Patchlink Console Page -> Options -> Subscription Service.
• Check the last start date for ‘Vulnerabilities’, ‘License’ & ‘Packages’
• There should be updated date as per the scheduled ‘Subscription Communication Interval’. Currently it’s scheduled 1 Day at 8:30 am.
• So restarted the service by doing the below options.
• Go to Patchlink Console Page -> Options -> Subscription Service -> Configure -> Restart -> Apply -> Save.

This is all that we did to resolve the issue.

PS: PatchLink Replication Service - Downloads vulnerability details and packages from the Global Subscription Service (GSS) to ensure that the patch management server remains current.  If this service is disabled or stopped, the server will be unable to download vulnerability details and packages from the GSS.

Trend- Uninstall OfficeScan client without password

Do it in two ways….

1. Run this command.
   C:\Program Files\Trend Micro\OfficeScan Client>ntrmv.exe -980223
   
2.  Change the registry:-
   HKLM_SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc or
   HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc.
   AllowUninstall from 0 to 1

Issue

Unable to communicate PatchLink agent client with PatchLink server. It was throwing ‘HTTP problem. The error code is 12057’ error messages in the logs.

Steps taken to resolve the issue
During SSL communication, which PLUS uses to connect with the PatchLink Subscription Server, Windows 2003 Server requires the computer to access the certificate revocation list (CRL) for the company that issued the SSL certificate (in order to verify that the certificate is still valid). The CRL must be accessed via the Internet but as we don’t have the internet on the server that’s why it was throwing the exception.

There are two options to fix the problem either we install the certificate revocation list (CRL) or we disable it from the registry. By disabling it from the registry it will skip to check the certificate revocation list.

I disabled it by doing the below steps.

1. HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\InternetSettingsDo the right click on the InternetSettings -> Click on the Dword Value -> Keyname-CertificateRevocation -> Value-0 

2. HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software PublishingEdit the State Value, Select decimal and put the 146944 value then click ok. 

3. Restart the PatchLink Service from the services console.

  Let me know if you have any questions or queries.

AD Account lockout issue:-
To find out the bad password attempts and sources from below tools.

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18465
http://www.netwrix.com/requeste.html?product=ale

After getting the source machine check if your account is using old credentials for any following task on source machine.

1-            Mapped network drives
2-            Scheduled tasks
3-            Accounts that are used for service account logons
4-            Run as shortcuts