Windows update icon on shutdown button

[NigelD]

Hello - as the title says, the Windows update exclamation mark is showing on the shutdown button but I have no updates to install. There are 35 optional updates which I haven't downloaded. How can I clear this please?

 

[NoelDP]

Please follow the Windows Update Posting Instructions and post the requested data

If the file is too large (8MB compressed), remove the older CBSPersist cab files until the final file is below the limit - you can always post them separately after zipping them. (the forum doesn't allow the upload of bare CAB files, for a number of reasons)

Please also post the C:\Windows\windowsudpate.log file

 

[NigelD]

I have some errors on my event viewer as well which I wondered , were they related to this? I'll work on the other logs in the meantime but intial thoughts appreciated and thank you for your initial reply.

Logs attached thanks

 

[NigelD]

There are no errors shown on sfc /scannow.
The latest CBS file I have is 11.5MB (14.37pm today) the one before it from today at midday is 7.21MB - which would you like bearing in mind 8MB limit?

I also have no errors reported in Windows update, just 35 optional updates which I have chosen not to download.

 

[NoelDP]

If you compress the file it should come down to below 1MB - unless you're talking about the CBSPersist files.

You *should* be getting WU errors?

2015-09-12	19:13:48:208	 620	b24	Misc	===========  Logging initialized (build: 7.6.7601.18979, tz: +0100)  ===========
2015-09-12	19:13:48:395	 620	b24	Misc	  = Process: C:\Windows\system32\svchost.exe
2015-09-12	19:13:48:457	 620	b24	Misc	  = Module: c:\windows\system32\wuaueng.dll
2015-09-12	19:13:48:208	 620	b24	Service	*************
2015-09-12	19:13:48:457	 620	b24	Service	** START **  Service: Service startup
2015-09-12	19:13:48:457	 620	b24	Service	*********
2015-09-12	19:13:48:504	 620	b24	Agent	  * WU client version 7.6.7601.18979
2015-09-12	19:13:48:566	 620	b24	Agent	  * Base directory: C:\Windows\SoftwareDistribution
2015-09-12	19:13:48:566	 620	b24	Agent	  * Access type: No proxy
2015-09-12	19:13:48:566	 620	b24	Agent	  * Network state: Connected
2015-09-12	19:14:34:491	 620	b24	Report	CWERReporter::Init succeeded
2015-09-12	19:14:34:491	 620	b24	Agent	***********  Agent: Initializing Windows Update Agent  ***********
2015-09-12	19:14:34:507	 620	b24	Agent	  * Prerequisite roots succeeded.
2015-09-12	19:14:34:507	 620	b24	Agent	***********  Agent: Initializing global settings cache  ***********
2015-09-12	19:14:34:507	 620	b24	Agent	  * WSUS server: <NULL>
2015-09-12	19:14:34:507	 620	b24	Agent	  * WSUS status server: <NULL>
2015-09-12	19:14:34:507	 620	b24	Agent	  * Target group: (Unassigned Computers)
2015-09-12	19:14:34:507	 620	b24	Agent	  * Windows Update access disabled: No
2015-09-12	19:14:34:507	 620	b24	DnldMgr	Download manager restoring 0 downloads
2015-09-12	19:14:34:507	 620	b24	AU	###########  AU: Initializing Automatic Updates  ###########
2015-09-12	19:14:34:507	 620	b24	AU	  # Approval type: Pre-download notify (User preference)
2015-09-12	19:14:34:507	 620	b24	AU	  # Will interact with non-admins (Non-admins are elevated (User preference))
2015-09-12	19:14:34:553	 620	b24	AU	OSUpdate detected - allowing forced install
2015-09-12	19:14:34:741	 620	b24	Report	***********  Report: Initializing static reporting data  ***********
2015-09-12	19:14:34:741	 620	b24	Report	  * OS Version = 6.1.7601.1.0.65792
2015-09-12	19:14:34:741	 620	b24	Report	  * OS Product Type = 0x00000001
2015-09-12	19:14:34:756	 620	b24	Report	  * Computer Brand = System manufacturer
2015-09-12	19:14:34:756	 620	b24	Report	  * Computer Model = System Product Name
2015-09-12	19:14:34:756	 620	b24	Report	  * Bios Revision = 0403   
2015-09-12	19:14:34:756	 620	b24	Report	  * Bios Name = BIOS Date: 08/25/09 16:29:12 Ver: 08.00.15
2015-09-12	19:14:34:756	 620	b24	Report	  * Bios Release Date = 2009-08-25T00:00:00
2015-09-12	19:14:34:756	 620	b24	Report	  * Locale ID = 2057
2015-09-12	19:14:34:834	 620	b24	AU	Successfully wrote event for AU health state:0
2015-09-12	19:14:34:834	 620	b24	AU	Initializing featured updates
2015-09-12	19:14:34:834	 620	b24	AU	Found 0 cached featured updates
2015-09-12	19:14:34:834	 620	b24	AU	Successfully wrote event for AU health state:0
2015-09-12	19:14:34:834	 620	b24	AU	Currently AUX is enabled - so not show any WU Upgrade notifications.
2015-09-12	19:14:34:834	 620	b24	AU	Evaluate OSUpgrade Notification already. Skip the regular notification
2015-09-12	19:14:34:834	 620	b24	AU	Successfully wrote event for AU health state:0
2015-09-12	19:14:34:834	 620	b24	AU	AU finished delayed initialization
2015-09-12	19:14:34:928	 620	10ec	Misc	Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2015-09-12	19:14:34:959	 620	10ec	Misc	 Microsoft signed: NA
2015-09-12	19:14:34:975	 620	10ec	Misc	Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2015-09-12	19:14:34:975	 620	10ec	Misc	 Microsoft signed: NA
2015-09-12	19:14:34:975	 620	10ec	Misc	Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMPDE1E.tmp with dwProvFlags 0x00000080:
2015-09-12	19:14:34:990	 620	10ec	Misc	 Microsoft signed: NA
2015-09-12	19:14:34:990	 620	10ec	Misc	Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2015-09-12	19:14:34:990	 620	10ec	Misc	 Microsoft signed: NA
2015-09-12	19:14:34:990	 620	10ec	Misc	Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2015-09-12	19:14:34:990	 620	10ec	Misc	 Microsoft signed: NA
2015-09-12	19:14:35:006	 620	10ec	Misc	Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMPDE2F.tmp with dwProvFlags 0x00000080:
2015-09-12	19:14:35:006	 620	10ec	Misc	 Microsoft signed: NA
2015-09-12	19:14:35:006	 620	10ec	Report	Uploading 1 events using cached cookie, reporting URL = http://statsfe2.update.microsoft.com/ReportingWebService/ReportingWebService.asmx
2015-09-12	19:14:38:095	 620	10ec	PT	WARNING: ReportEventBatch failure, error = 0x8024400E, soap client error = 7, soap error code = 400, HTTP status code = 200
2015-09-12	19:14:38:095	 620	10ec	PT	WARNING: SOAP Fault: 0x000190
2015-09-12	19:14:38:095	 620	10ec	PT	WARNING:     faultstring:Server was unable to process request. ---> The type initializer for 'Microsoft.UpdateServices.Internal.Reporting.WebService' threw an exception. ---> Could not find a part of the path 'D:\data\Logs\ReportingWebServiceEvents'.
2015-09-12	19:14:38:095	 620	10ec	PT	WARNING:     ErrorCode:(null)(0)
2015-09-12	19:14:38:095	 620	10ec	PT	WARNING:     Message:(null)
2015-09-12	19:14:38:095	 620	10ec	PT	WARNING:     Method:(null)
2015-09-12	19:14:38:095	 620	10ec	PT	WARNING:     ID:(null)
2015-09-12	19:14:38:095	 620	10ec	Report	WARNING: Reporter failed to upload events with hr = 8024400e.
2015-09-12	19:14:38:095	 620	10ec	Misc	Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2015-09-12	19:14:38:110	 620	10ec	Misc	 Microsoft signed: NA
2015-09-12	19:14:38:110	 620	10ec	Misc	Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2015-09-12	19:14:38:110	 620	10ec	Misc	 Microsoft signed: NA
2015-09-12	19:14:38:126	 620	10ec	Misc	Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMPEA60.tmp with dwProvFlags 0x00000080:
2015-09-12	19:14:38:126	 620	10ec	Misc	 Microsoft signed: NA
2015-09-12	19:14:38:126	 620	10ec	Misc	Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2015-09-12	19:14:38:141	 620	10ec	Misc	 Microsoft signed: NA
2015-09-12	19:14:38:141	 620	10ec	Misc	Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\wuredir.cab with dwProvFlags 0x00000080:
2015-09-12	19:14:38:141	 620	10ec	Misc	 Microsoft signed: NA
2015-09-12	19:14:38:141	 620	10ec	Misc	Validating signature for C:\Windows\SoftwareDistribution\WuRedir\7971F918-A847-4430-9279-4A52D1EFE18D\TMPEA80.tmp with dwProvFlags 0x00000080:
2015-09-12	19:14:38:141	 620	10ec	Misc	 Microsoft signed: NA
2015-09-12	19:14:38:141	 620	10ec	Report	Uploading 1 events using cached cookie, reporting URL = http://statsfe2.update.microsoft.com/ReportingWebService/ReportingWebService.asmx
2015-09-12	19:14:38:297	 620	10ec	PT	WARNING: ReportEventBatch failure, error = 0x8024400E, soap client error = 7, soap error code = 400, HTTP status code = 200
2015-09-12	19:14:38:297	 620	10ec	PT	WARNING: SOAP Fault: 0x000190
2015-09-12	19:14:38:297	 620	10ec	PT	WARNING:     faultstring:Server was unable to process request. ---> The type initializer for 'Microsoft.UpdateServices.Internal.Reporting.WebService' threw an exception. ---> Could not find a part of the path 'D:\data\Logs\ReportingWebServiceEvents'.
2015-09-12	19:14:38:297	 620	10ec	PT	WARNING:     ErrorCode:(null)(0)
2015-09-12	19:14:38:297	 620	10ec	PT	WARNING:     Message:(null)
2015-09-12	19:14:38:297	 620	10ec	PT	WARNING:     Method:(null)
2015-09-12	19:14:38:297	 620	10ec	PT	WARNING:     ID:(null)
2015-09-12	19:14:38:297	 620	10ec	Report	WARNING: Reporter failed to upload events with hr = 8024400e.

 

[NigelD]

I think I was talking about CBSPersist files - not used to this! I didn't see any windows update errors (presume wu) so don't understand why the wu icon is on my shutdown button. Do the errors on event viewer mean anything untoward?

 

[NoelDP]

Those, I'm not sure of- I'd know more with a full set if Event logs...

Open Event Viewer
click on the Windows logs entry in the left pane to expand it.
Now click on the Application entry - wait while it loads.
Click on 'File' in the menu bar and select Save...
Save the file as Appevt.evtx
Repeat for the System log
then zip both, and upload them.

 

[NigelD]

CBS log attached

 

[NoelDP]

There's no significant data in that log - I need the latest two CBSPersist files, please.

In respect of the WU problems I see, try this...

Open an Elevated Command Prompt, and run the following command.

wuauclt /resetauthorization /detectnow

WAIT 30 minutes - WU should rebuild the database - then post the new Windowsupdate.log file.

 

[NigelD]

One file coming in at just over 7MB the other 10.7. Here's the first, please advise about the second. In the meantime I'll carry out above instruction thank you.

 

[NoelDP]

Interesting - an update is trying to install (KB3022345) which is not only old, but also should be superseded.
There is also another update which appears to be attempting to install - KB2871997 - which is failing because it seems to be already installed?

How long have updates not worked?

There are no CBS errors showing.
No point in posting another CBSPersist files, I doubt it will show us anything new.

 

[NigelD]

I haven't received any update failure notices when updates have been installed. Having said that - I recently changed from automatic install to "notify me first" so maybe one is stuck somewhere. The (KB3022345) - I uninstalled that today because I read that it might help with the event viewer error I've been receiving.

Here's the Windowsupdate log.

 

[NoelDP]

As far as WU is concerned the last successful install was on 9/9? - KB3083324

Neither of the updates I mentioned earlier appear at all.

 

[NigelD]

KB2871997 looks like it was installed in March when the system was re-built. Where do I go from here?

 

[NoelDP]

That would make sense - why it appears in the CBS log I have no idea, unless you were running the Advanced Disk Cleanup?

 

[NigelD]

Wouldn't know how to do that Noel.

Incidentally - I had a PC freeze up whilst trying to reply a couple of minutes ago - couldm't do a thing and had to power off at the main power button.

 

[NoelDP]

How long did you leave the freeze before doing the power-off? I always check that the hard drive light is NOT flickering, and that t least 5 minutes have passed before doing something like that.

 

[NigelD]

I think I hit the button straight away....

 

[NoelDP]

You appear to be having a lot of problems with the Performance Counters -
YOu also seem to have problems with permissions for the PNRP service - which is affecting other services.


Open an Elevated Command Prompt, and run the following commands:

lodctr /r
ICACLS C:\ProgramData\Microsoft\Crypto\RSA

post the results.

Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.