Recent updates are unchecked in Windows Update. Why?

Windows Update is showing that I need two "Important" updates. These are KB2656356 and KB2656351. No other updates are shown. Usually "Important" updates such as these are already check by windows update but these show up as unchecked updates. This is a little confusing. Does anyone know why these are not checked?
Windows 7 64bit Pro.

Those updates seem to be problematic on some machines. They may have tried to install and failed.

Try checking them and updating and see if they work. If they fail, look here:

My Win 7 Ultimate Windows Update KB2656356 continues to fail - Microsoft Answers

I had to manually install those on my work machine but not on my home machines. I didn't have to do anything too fancy, just DLed the stand alone installer and installed it fine.

It seems there are certain issues with these two updates in particular.

Have a look at this Microsoft article and click the link for each update for further information.

MS11-100: Vulnerability in the .NET Framework could allow elevation of privilege: December 29, 2011

@Seavixen32:

I also see these two updates unchecked (I have manually selected win updates)
I have a home system, and have not chosen to install SP1 .

Do you think I will have an issue installing those without SP1?

Maybe you can cull the information down a bit in the MS11-100 bulletin into layman's terms if possible.Thanks.

With apologies to Seavixen, and to you also legacy:

legacy7955 said:

@Seavixen32: I also see these two updates unchecked (I have manually selected win updates)
I have a home system, and have not chosen to install SP1 .

Do you think I will have an issue installing those without SP1?

Click to expand...

I seem to recall, but it escapes me now, that there was an update to Win7 that would facilitate future updates. Back around last Summer. (Northern Hemisphere) But that was with SP1 installed. There have been others.

Some developers at MS have enough foresight to realize that some future updates may compromise some machines, so in the next campaign they trot out a compatibility update that hopefully will not harm certain system configurations.

legacy7955 said:

@Maybe you can cull the information down a bit in the MS11-100 bulletin into layman's terms if possible.Thanks.

Click to expand...

To be blunt.....
If you have any form of .NET Framework installed on your machine, and do not install these updates, you are leaving your machine wide open to future infections of malware especially since these vulnerabilities are now known.

A set of previous updates that were thought to of fixed the problem, did not.
This set is supposed to take care of that.

Not sure if its related, but after selecting these two updates and installing them on my laptop (Sony Vaio Z 47G/D {HK}), I kept getting the BSoD. Finally decided to uninstall it and now waiting to see if that was the cause or not.

Anak said:

With apologies to Seavixen, and to you also legacy:

legacy7955 said:

@Seavixen32: I also see these two updates unchecked (I have manually selected win updates)
I have a home system, and have not chosen to install SP1 .

Do you think I will have an issue installing those without SP1?

Click to expand...

I seem to recall, but it escapes me now, that there was an update to Win7 that would facilitate future updates. Back around last Summer. (Northern Hemisphere) But that was with SP1 installed. There have been others.

Some developers at MS have enough foresight to realize that some future updates may compromise some machines, so in the next campaign they trot out a compatibility update that hopefully will not harm certain system configurations.

legacy7955 said:

@Maybe you can cull the information down a bit in the MS11-100 bulletin into layman's terms if possible.Thanks.

Click to expand...

To be blunt.....
If you have any form of .NET Framework installed on your machine, and do not install these updates, you are leaving your machine wide open to future infections of malware especially since these vulnerabilities are now known.

A set of previous updates that were thought to of fixed the problem, did not.
This set is supposed to take care of that.

Click to expand...

Anak:

By all means thank you for your directness. While I know quite a bit about Windows OS I am by no means an expert and thus for very complicated involved issues I have as much clue as the typical consumer.

I reread the MS11-100 Bulletin and I did gather that the patch from these two .net updates were very serious and critical ...but the only thing holding me back from trying to install them was that they were unchecked. I will attempt to install them and see how it goes. Worst case I uninstall them if they cause serious operating issues. At least I have MSE constantly updating automatically.

Your welcome!

It is an interesting conundrum, with no pun intended. Tweakit has asked an excellent question!

I found this buried in the Windows Update Applet in Control Panel under Help and Support.
Control Panel\All Control Panel Items\Windows Update\Change settings:

How does Windows determine which updates my computer needs?
Windows Update contains software tools that detect information about your computer, such as the make and model and the version of Windows and other Microsoft software that your computer is running. Microsoft uses that information to install only the updates your computer needs. For more information, read the Turn automatic updating on or off and Change how Windows installs or notifies you about updates.

Source: My computer

Click to expand...

To me, that statement would imply that under Microsoft's determination they are sure the user needs the checked ones, and not sure about the ones that are unchecked, but we are going to send you all the ones we have for this "Patch Campaign". We leave those up to you to install or not.

The patch Tuesday coming up next week is supposed to have 1 critical, and 6 important updates for a total of 7. It would be interesting for all of us to come back here next week and post how they were presented.

I would expect 1 would be checked, and the other 6 not.

If you go here Microsoft Security Bulletin Advance Notification for January 2012
Then click on Affected Software under Bulletin Information.
Then >Windows Operating System and Components.
Scroll down to Windows 7.

There it shows only 6 updates/bulletins 2 are not applicable, and nothing critical, only important.

I have seen here in posts made by members, recent campaigns were a user will receive the right total of updates, some have received less, and even some, more that what was listed.

So I might only get 4 updates, maybe none checked, only time will tell.

Anak said:

legacy7955 said:

@Seavixen32: I also see these two updates unchecked (I have manually selected win updates)
I have a home system, and have not chosen to install SP1 .

Do you think I will have an issue installing those without SP1?

Click to expand...

I seem to recall, but it escapes me now, that there was an update to Win7 that would facilitate future updates. Back around last Summer. (Northern Hemisphere) But that was with SP1 installed. There have been others.

Some developers at MS have enough foresight to realize that some future updates may compromise some machines, so in the next campaign they trot out a compatibility update that hopefully will not harm certain system configurations.

Click to expand...

Just a random snippet of information

Those updates update the Servicing Stack. Simplistically, those updates tell Windows the version numbers of a new Service Pack. Microsoft cannot predict the future, and so Windows cannot recognise something newer than itself when it was last built. For this reason, those updates just let Windows recognise a new milestone or service pack, and so work better with that Service Pack.

I think that you were talking about An update that prevents a "0xC0000034" error message when you try to install Windows 7 SP1 or Windows Server 2008 R2 SP1 is available, which was soon replaced by An update that prevents a "0xC0000034" error message when you try to install Windows 7 SP1 or Windows Server 2008 R2 SP1 is available

@Tweakit: As far as I know, and I am confident in my answer here, Microsoft can directly control which updates will be automatically selected, and which ones won't be. Quite how they decide, I don't know!

Just because an update doesn't mean that it doesn't apply to your computer (it will apply), or that it is likely to fail (it isn't).

Richard

Well here is how my patches were presented. The first is a snip of our 7box (6), and the second is the XPbox (7).


I did select, and install KB2585542

You know, that's odd. The same update was unchecked on mine, that's the 1st time I've seen that happen. I did install it and apparently, there are no problems (knock on wood).

Borg 386 said:

You know, that's odd. The same update was unchecked on mine, that's the 1st time I've seen that happen. I did install it and apparently, there are no problems (knock on wood).

Click to expand...

Yep. Same. That particular update always seems to be unchecked, hence my suspicion that Microsoft controls it. Technically, this proves nothing. There could be something about that update which triggers an un-checking event on everyone's computer. Quite what that is I do not know.

This morning I trawled through every last piece of package data, and could find no such setting. When I get time, I shall have a look through the wsusscn2.cab XML data.

After that, I don't really know. Without access to the source code, it will be very difficult to track down without insider help.

Richard

P.S. But I *still* suspect the answer to lie within package or wsusscn data.

This is what the site says. It was marked as important, so it should have been checked...curious.

A security issue has been identified that could allow an unauthenticated remote attacker to compromise your system and gain access to information. You can help protect your system by installing this update from Microsoft. After you install this update, you may have to restart your system.

Click to expand...

MS12-006: Description of the security update for Webio, Winhttp, and schannel in Windows: January 10, 2012

Well I mentioned earlier that in some cases that update fails. It's getting to be a rather old update now so my bet is that it tried to install along with a lot of other updates and failed. So it remains in the list unchecked.

You can actually check your failure list and see if it's in there... Open Windows Update, then click View Update History. In mine, those two updates tried to install and failed /repeatedly/. I think after some number of tries it just gives up but leaves it in the list so you know that there is an update that needs attention.

For Borg386:
So far, so good for me also!

niemiro
I would be interested in what you find in the wsusscn2.cab file.

fseal
I feel left out.
After checking mine, yesterday's instance is the only time its been offered, and thankfully passed.

Anak said:

For Borg386:
So far, so good for me also!

niemiro
I would be interested in what you find in the wsusscn2.cab file.

fseal
I feel left out.
After checking mine, yesterday's instance is the only time its been offered, and thankfully passed.
View attachment 192590

Click to expand...

Heh yeah

Well all my machines at home did NOT have the problem. But my work machine did. At work our admin filters the updates and it's possible that the update fails given a certain set of updates applied or not applied previously, maybe in a certain combination or order that causes the situation.

Okay, now I don't feel so bad

I didn't want to put all the weight on niemiro, so I tried looking for that wsusscn2.cab file.
Even though I un-hid? system, and protected files I still couldn't come up with it.

My system installed this update last night, and I had massive bsod the second I tried to use my machine this morning. Every 2-3 minutes after login, bsod.
I system restored to yesterday, and so far the system has gone back to it's normal happy self.

Consider yourself lucky, some patches are un-instaliable.

Your machine store bought or home brew? Couldn't tell you didn't fill in your system specs.

Anak said:

Consider yourself lucky, some patches are un-instaliable.

Your machine store bought or home brew? Couldn't tell you didn't fill in your system specs.

Click to expand...

Sorry about that. New to the forum obviously. I've updated my specs. It's a home brew, few years old now.

Yes I was luck I could uninstall. I checked everything else out, nothing seems to have an issue, it looks like it was very much that update that had an issue.

Cheers