KB2506143 / KB2506146 Removed from MU

On December 19, 2012, in Security, by

http://social.technet.microsoft.com/Forums/en-US/smallbusinessserver/thread/76cfdd73-dace-4984-8896-fdaed0dcf818/

Another user, c_h_u_c_k_o, has replied to a thread you have subscribed to in the Small Business Server Forum.

Thread Title Do not install 2506143 (optional WMF 3.0 patch) on your SBS 2011
Started by: Susan Bradley

Reply:

Unfortunately, uninstalling it apparently brings forth another problem – it deletes a registry key that causes problems and errors with your event logs.

Here is the key that is deleted:  

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\ForwardedEvents

I had to export the key from another system and install it into the registry of the affected SBS2011 box to restore the ability to view the event logs without error.

Who knows what else it breaks. 

This update should be pulled.  NOW!

I can repro his reporting of the issue.

And as of around 5 p.m this evening:

http://marc.info/?l=patchmanagement&m=135588298213669&w=2

Thanks to each of you who reported this issue and helped identify the affec=
ted cases.

As a result of these regressions and feedback from customers and experts li=
ke you, we have expired the WMF 3.0 Update for all platforms (Windows 7, Se=
rver 2008, and Server 2008 R2) as of 5:07 pm PDT.

2506143 Windows Management Framework 3.0 for Windows 7 (KB2506143)
Windows Management Framework 3.0 for Windows 7 for x64-based System=
s (KB2506143)
Windows Management Framework 3.0 for Windows Server 2008 R2 for x64=
-based Systems (KB2506143)

2506146 Windows Management Framework 3.0 for Windows Server 2008 (KB2506146=
)
Windows Management Framework 3.0 for Windows Server 2008 for x64-ba=
sed Systems (KB2506146)

We’re engaged in an internal post-mortem to identify and resolve the issues=
that led to these updates being released that resulted in the regressions.

We work hard to ensure updates always release with an exceptionally high qu=
ality bar. That bar was not met for these updates and we’re working to ens=
ure we can prevent this from happening again. Thank you for your feedback =
through this and other channels – and please keep providing helpful feedbac=
k so we can continue to improve.

doug neal
Microsoft Update (MU)

 

4 Responses to KB2506143 / KB2506146 Removed from MU

  1. Pete P says:

    Thanks for this post. I only installed KB2506143 on one server and sure enough the Forwarded Events in the event viewer was broke.

  2. IT-Ex says:

    Since uninstalling the mentioned updates, I don’t get the weekly and daily SBS reports for NetAdmins anymore. No chance to restore them. They will be generated if executed through SBS console, but no way to get them by email.
    I guess the relevant script is PowerShell and is broken after installing and uninstalling PS3.0.

  3. bradley says:

    IE-Ex can you email me at susan-at-msmvps.com as I think this is unrelated. You need to dig into the log files of the datacollection to see what’s going on.

  4. TechPoetry says:

    I have seen that this same registry key is removed from Windows Server 2008 R2 box setup as a RDS server. The Event log gives the same 15007 error as stated above. Resolved by using the same method above –

    export the key from a box before the KB2506143 update is applied and import it into the Server 2008 box.

    I noticed it installed on a RDS box in my test lab. Not sure if it causes issues on a member 2008R2 server like it does on SBS but in testing I removed it. Then I got the issue in the Windows Event Viewer stated above. Since the update is now no longer available with Microsoft Updates I wander should be making sure it is not installed on our member servers too?