After the most recent (February) security updates released by Microsoft, we noticed an issue with one of the downloaded updates (namely: Cumulative Security Update for Internet Explorer 7 for Windows XP (KB2482017) – although this isn’t really relevant). At the same time, we also noticed the same issue with an update dating back to October 2010. This update was one for .Net Framework 4.0 and I presume we only started noticing this now as .Net 4 is becoming more of a necessity on machines, and therefore the install base is higher than it was back in October.
Certain clients would attempt to download the update but would get stuck installing it. The installer would get to 66% and then just sit there. The timer would increment indefinitely and no further messages would be logged in any of the log files. No error messages seemed to be logged anywhere on the system. The Software Updates window looked like the below.
I checked that the updates were available on all Distribution Points and that the DP in question had all the IIS BITS exceptions set to allow transfer and everything looked fine. I then checked the built-in Compliance report 9 (Report ID 171) – ‘Computers in a specific compliance state for an update’, selected the Security Update for Internet Explorer 7 article, and checked for machines in the ‘Update is installed‘ state.
This brought back a bunch of machines from Hong-Kong and not much else, there were a few machines from other regions/offices but 95% was from Hong-Kong. This confused me slightly as there was nothing infrastructure-wise that would affect only machines in HK. The problem soon became evident however when looking in the ConfigMgr console.
I expanded Update Lists and selected the most recent update list which contained the IE7 update in question. I went into the Properties for the update and went to the Content Information Tab. Scrolling the window showed the below.
The English language version of the update had not been downloaded, whereas the Chinese language version had. Therefore those machines in Hong-Kong with the Chinese version installed, received and installed the update fine, whereas machines in the rest of the world that use the English version had not. Retrospectively checking the other machines in the report that were not in Hong-Kong revealed that the update had been installed manually.
I checked the same tab for the .Net Framework 4 update and noticed that although there are not multiple languages, one component of the update had not been downloaded.
I went to the Software Updates node, redownloaded both updates into their original update list, updated the existing update package and then redistributed to the DPs. As soon as the update reached the DPs, those Software Updates that were stuck at 66% completed their download immediately, began installing, then reported back as completed.