Deploy IE7 Silently With WSUS

I'm sure this question must have been answered already but I can't find it!
I'm desperately trying to get IE7 to deploy using WSUS3. The update has been
approved for certain workstations but the installation only occurs when a
user with local administrator rights logs in. The status of the update on
each client is showing as 'Downloaded'.

None our users are local admins so this is a real problem. Is there any way
to have IE7 install via WSUS siliently without an admin logging in?

PA
Thu May 08 10:35:06 PDT 2008

Your previous thread in WSUS NG about this (Feb-08):
http://groups.google.com/group/microsoft.public.windows.server.update_services/browse_frm/thread/6c63ffca555e9aac

Other related threads in WSUS NG, sorted by date:
http://groups.google.com/group/microsoft.public.windows.server.update_services/search?q=deploy+%2B+ie7&start=0&scoring=d
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/


Philip Stratford wrote:
> I'm sure this question must have been answered already but I can't find
> it!
> I'm desperately trying to get IE7 to deploy using WSUS3. The update has
> been approved for certain workstations but the installation only occurs
> when a user with local administrator rights logs in. The status of the
> update on each client is showing as 'Downloaded'.
>
> None our users are local admins so this is a real problem. Is there any
> way
> to have IE7 install via WSUS siliently without an admin logging in?

Harry
Thu May 08 14:01:48 PDT 2008

Philip Stratford wrote:

> I'm sure this question must have been answered already but I can't find it!
> I'm desperately trying to get IE7 to deploy using WSUS3. The update has been
> approved for certain workstations but the installation only occurs when a
> user with local administrator rights logs in. The status of the update on
> each client is showing as 'Downloaded'.

Is this the only update that this happens for?

Are you using the WSUS-provided package for IE7, or did you import from the
Microsoft Update Catalog?

Harry.

PA
Thu May 08 14:21:27 PDT 2008

See
http://blogs.technet.com/wsus/archive/2008/01/23/internet-explorer-7-to-be-distributed-via-wsus-february-12-2008.aspx
and http://support.microsoft.com/kb/946202.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Philip Stratford wrote:
> I'm sure this question must have been answered already but I can't find
> it!
> I'm desperately trying to get IE7 to deploy using WSUS3. The update has
> been approved for certain workstations but the installation only occurs
> when a user with local administrator rights logs in. The status of the
> update on each client is showing as 'Downloaded'.
>
> None our users are local admins so this is a real problem. Is there any
> way
> to have IE7 install via WSUS siliently without an admin logging in?

PhilipStratford
Fri May 09 00:46:00 PDT 2008

My previous post related to the clients in WSUS not recognizing that they
needed this update and so not downloading it or installing it. Now they do
show as needing it and they even download it, they just won't install it
without local admin intervention.

I've had a look through those other posts, most of which I'm starting to
become quite familiar with as a result of my quest to crack this. Very few
people are reporting the same problem as me, and most of the issues pre-date
the official re-release of IE7 into WSUS in Feb 08.

It may not even be a 'bug' that I'm experiencing, as such. If this update
isn't intended to install itself unattended through WSUS then at least it's
behaving as expected, but it's very inconvenient if this is the case.

"PA Bear [MS MVP]" wrote:

> See
> http://blogs.technet.com/wsus/archive/2008/01/23/internet-explorer-7-to-be-distributed-via-wsus-february-12-2008.aspx
> and http://support.microsoft.com/kb/946202.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
> Philip Stratford wrote:
> > I'm sure this question must have been answered already but I can't find
> > it!
> > I'm desperately trying to get IE7 to deploy using WSUS3. The update has
> > been approved for certain workstations but the installation only occurs
> > when a user with local administrator rights logs in. The status of the
> > update on each client is showing as 'Downloaded'.
> >
> > None our users are local admins so this is a real problem. Is there any
> > way
> > to have IE7 install via WSUS siliently without an admin logging in?
>
>

PhilipStratford
Fri May 09 00:52:01 PDT 2008

Yes, this is the only update that this is happening for. Everything else
just installs itself at the time determined in Group Policy.

I originally imported the IE7 update from the WSUS catalogue but never got
around to deploying it. The IE7 update I have now is showing as Revision
103, revised on April 29th 2008. That sounds pretty up to date!

"Harry Johnston [MVP]" wrote:

> Philip Stratford wrote:
>
> > I'm sure this question must have been answered already but I can't find it!
> > I'm desperately trying to get IE7 to deploy using WSUS3. The update has been
> > approved for certain workstations but the installation only occurs when a
> > user with local administrator rights logs in. The status of the update on
> > each client is showing as 'Downloaded'.
>
> Is this the only update that this happens for?
>
> Are you using the WSUS-provided package for IE7, or did you import from the
> Microsoft Update Catalog?
>
> Harry.
>

Lawrence
Sat May 10 12:22:14 PDT 2008

"Philip Stratford" <PhilipStratford@discussions.microsoft.com> wrote in
message news:86723802-1D32-4409-8F6B-D4C5B5DC10A2@microsoft.com...

> My previous post related to the clients in WSUS not recognizing that they
> needed this update and so not downloading it or installing it. Now they
> do
> show as needing it and they even download it, they just won't install it
> without local admin intervention.

[1] What is the /scheduled/ installation time for updates on these systems?

[2] Have you confirmed (via Application Event Log, ReportingEvents.log, or
WindowsUpdate.log) that the update has, in fact, been /scheduled/ for
installation?

[3] Have you reviewed the Release Notes for XP SP3 and verified these
machines meet all of the pre-requisites -- including no RDC 6.1 prerelease,
no RDC 6.0 MUI pack, and they have sufficient hard disk space for the
installation?

[4] Have you reviewed the WindowsUpdate.log for the time at which the
scheduled installation is supposed to occur? What is logged?


--
Lawrence Garvin, M.S., MCITP, MCBMSP, MCTS(x4), MCP
Senior Data Architect, APQC, Houston, Texas
Microsoft MVP - Software Distribution (2005-2008)

MS WSUS Website: http://www.microsoft.com/wsus
My Websites: http://www.onsitechsolutions.com;
http://wsusinfo.onsitechsolutions.com
My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin

Harry
Sun May 11 20:28:51 PDT 2008

Philip Stratford wrote:

> Yes, this is the only update that this is happening for. Everything else
> just installs itself at the time determined in Group Policy.
>
> I originally imported the IE7 update from the WSUS catalogue but never got
> around to deploying it. The IE7 update I have now is showing as Revision
> 103, revised on April 29th 2008. That sounds pretty up to date!

Odd; I have the same date (give or take a timezone) but the revision number is
102. Perhaps this is an artefact of having imported the update from the
Microsoft Update Catalog - I assume this is what you meant?

What does your revision history for the update show? (While you're looking,
make sure that only the latest revision is approved.)

I've just doublechecked and the IE7 update does install silently on my clients.

Harry.

PhilipStratford
Mon May 12 02:39:00 PDT 2008

The revision history showed version 102 revised 13th November 2007, which is
Not Approved, and version 103, revised 29th April 2008, which is set to
Install.

I envy your silent installations! I'm reluctantly starting to think about
using the IEAK to install by GPO but I don't want to - WSUS is cleaner and
tidier and I don't like admitting defeat!

"Harry Johnston [MVP]" wrote:

> Philip Stratford wrote:
>
> > Yes, this is the only update that this is happening for. Everything else
> > just installs itself at the time determined in Group Policy.
> >
> > I originally imported the IE7 update from the WSUS catalogue but never got
> > around to deploying it. The IE7 update I have now is showing as Revision
> > 103, revised on April 29th 2008. That sounds pretty up to date!
>
> Odd; I have the same date (give or take a timezone) but the revision number is
> 102. Perhaps this is an artefact of having imported the update from the
> Microsoft Update Catalog - I assume this is what you meant?
>
> What does your revision history for the update show? (While you're looking,
> make sure that only the latest revision is approved.)
>
> I've just doublechecked and the IE7 update does install silently on my clients.
>
> Harry.
>

PhilipStratford
Mon May 12 03:19:02 PDT 2008

[1] The scheduled installation time is 11:00.

[2] Looking at windowsupdate.log the updates seem to be scheduled for the
correct time. I say 'seem' because the log reports that the update time is
set to 10:00 and not 11:00 but the scheduled install still begins at 11:00.
Perhaps this is something to do with BST.

[3] What does XP SP3 have to do with this? It's IE7 I'm trying to install.
In any case, our clients meet the pre-requisites for SP3.

[4] At the time when the installation is supposed to occur there are three
lines in the log as follows:
- Forced install timer expired for scheduled install
- UpdateDownloadProperties: 0 download(s) are still in progress.
- Setting AU scheduled install time to 2008-05-13 10:00:00

Any idea what this means? Is it waiting for a download which isn't actually
happening to complete?


"Lawrence Garvin [MVP]" wrote:

> "Philip Stratford" <PhilipStratford@discussions.microsoft.com> wrote in
> message news:86723802-1D32-4409-8F6B-D4C5B5DC10A2@microsoft.com...
>
> > My previous post related to the clients in WSUS not recognizing that they
> > needed this update and so not downloading it or installing it. Now they
> > do
> > show as needing it and they even download it, they just won't install it
> > without local admin intervention.
>
> [1] What is the /scheduled/ installation time for updates on these systems?
>
> [2] Have you confirmed (via Application Event Log, ReportingEvents.log, or
> WindowsUpdate.log) that the update has, in fact, been /scheduled/ for
> installation?
>
> [3] Have you reviewed the Release Notes for XP SP3 and verified these
> machines meet all of the pre-requisites -- including no RDC 6.1 prerelease,
> no RDC 6.0 MUI pack, and they have sufficient hard disk space for the
> installation?
>
> [4] Have you reviewed the WindowsUpdate.log for the time at which the
> scheduled installation is supposed to occur? What is logged?
>
>
> --
> Lawrence Garvin, M.S., MCITP, MCBMSP, MCTS(x4), MCP
> Senior Data Architect, APQC, Houston, Texas
> Microsoft MVP - Software Distribution (2005-2008)
>
> MS WSUS Website: http://www.microsoft.com/wsus
> My Websites: http://www.onsitechsolutions.com;
> http://wsusinfo.onsitechsolutions.com
> My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
>

Lawrence
Mon May 12 16:13:35 PDT 2008

"Philip Stratford" <PhilipStratford@discussions.microsoft.com> wrote in
message news:96349F6D-0BF3-4727-8919-3705B3EA1AFB@microsoft.com...

> [1] The scheduled installation time is 11:00.
>
> [2] Looking at windowsupdate.log the updates seem to be scheduled for the
> correct time. I say 'seem' because the log reports that the update time
> is
> set to 10:00 and not 11:00 but the scheduled install still begins at
> 11:00.

Hmmm.....

> [3] What does XP SP3 have to do with this? It's IE7 I'm trying to
> install.
> In any case, our clients meet the pre-requisites for SP3.

My mistake. :-)


> [4] At the time when the installation is supposed to occur there are three
> lines in the log as follows:
> - Forced install timer expired for scheduled install
> - UpdateDownloadProperties: 0 download(s) are still in progress.
> - Setting AU scheduled install time to 2008-05-13 10:00:00
>
> Any idea what this means?

It means there's nothing scheduled for installation, which brings us back to
Question #2.

Can you post the =actual= entries from ReportingEvent.log or the Application
Event log that show the update being scheduled for installation?


--
Lawrence Garvin, M.S., MCITP, MCBMSP, MCTS(x4), MCP
Senior Data Architect, APQC, Houston, Texas
Microsoft MVP - Software Distribution (2005-2008)

MS WSUS Website: http://www.microsoft.com/wsus
My Websites: http://www.onsitechsolutions.com;
http://wsusinfo.onsitechsolutions.com
My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin

Harry
Mon May 12 17:09:39 PDT 2008

Philip Stratford wrote:

> The revision history showed version 102 revised 13th November 2007, which is
> Not Approved, and version 103, revised 29th April 2008, which is set to
> Install.
>
> I envy your silent installations! I'm reluctantly starting to think about
> using the IEAK to install by GPO but I don't want to - WSUS is cleaner and
> tidier and I don't like admitting defeat!

If you have the facilities to try it, install a separate WSUS server on a test
machine (doesn't need to be server class hardware, and I guess you could use a
trial license) and point one of your clients at it. This will identify whether
the issue is client configuration or at the server. You should set the test
server up independently of the original server, of course, but you only need to
approve and download the IE7 update.

One other thing you could try, though I'm not all that hopeful: decline the
update, then delete the update's files (keep a backup!); then run

wsusutil reset

as described in the operations guide; then reapprove the update. You might or
might not need to run wsusutil reset again at this point to get it to download.

Harry.

Harry
Tue May 20 16:44:27 PDT 2008

Philip Stratford wrote:

> The revision history showed version 102 revised 13th November 2007, which is
> Not Approved, and version 103, revised 29th April 2008, which is set to
> Install.

Is there another update for IE7 present, the one that you imported from the
update catalog? Apparently they should appear as two different updates, and
perhaps they're interfering with one another.

Harry.