Kaseya Community

Internet Explorer 9 Roll out failing...?

  • Good
    morning/Afternoon or Evening where ever you are around the world

    So I’m attempting to roll out IE 9 via Kaseya but it has been no joy for me Sad

    - I schedule the patch KB982861 to be installed, but then nothing seems to
    happen, all I see is that the patch goes into the pending queue and then after
    a few minutes gets relocated to the User Not Ready queue?

    - I've checked the command line and the switch being used for IE9 is /quiet
    /norestart which would indicate to me that it requires no user interaction?

    - The patch has been approved and it’s not listed in the KB override list either

    - Running windows update on the workstations works fine and I can install IE9
    from there with no problems, can also install IE9 by downloading the installer
    from MS website

    - But when trying to run it via Kaseya it just says User Not Ready?

    - I've tried installing all patches through Windows Updates and left IE9 there,
    than ran it via Kaseya as I hopped maybe there were some prerequisite patches
    missing and that it was due to that reason, after patching the workstation
    fully while excluding IE 9 Kaseya is still stating User Not Ready?

    - Rebooted workstations a number of times, post install and pre install and that
    makes no difference

    - Workstations are part of the correct memberships I've checked this a number of
    times, even made a new test membership which also results in the same message
    User Not Ready

    - Tried Changing "File source" from "File server" to
    "Internet" this also made no difference

    - I've run the install package on workstation via CMD using the /quiet /norestart and once the workstation is rebooted it installs fine

    - Anyone thats successfully deployed IE 9 via patch management that could possibly point me in the right direction would very much appreciated

  • what do you mean with 'user not ready'?

    when I approve a patch, it get's in the 'pending patches'  list and installs at the moment I setup patch update. when the patch failes you get a 'patch failed' and the patch restarts over in the 'pending' queue.

    at that point, you should check the logfiles (windowsupdate.log and for each update in the windows folder).

    also, when the installer runs when you execute the command listed in the patch management commands, K should be able to install the patch.

  • IE9 and Windows7 SP1 both require (as coded from Microsoft) an interactive user be logged into the machine at the time of installation.  If you have attempted to install the patch through Kaseya using Automatic Update where the file source is set to "download from internet", you can review the windowsupdate.log file (located at c:\windows\windowsupdate.log).  This log (which logs all WUA activity, whether invoked by Kaseya, by a Microsoft process, or by another third party) should include the failure of the installation attempt with a code of 0x80240020.  At technet.microsoft.com/.../cc720432(WS.10).aspx, you will find that this error code translates to "Interactive user is missing to finish the operation."

    This can sometimes be worked-around by Kaseya.  Most admins I've worked with on this issue have found success installing the patch using one of the following methods:

    1.  Schedule the installation of the patch at a time when a user is actually logged into the machine.  The user will not likely be prompted for any interaction, but the active presence of that user may allow the patch to install successfully.  Results may vary based on environmental configurations.


    2.  With the file source configured to use a LAN Share, LAN Cache, or System Server AND the installation method used is Patch Management > Automatic Updates, OR with the file source configured to use any option (including download from internet) AND the installation method used is Patch Management > Machine Update or Patch Update:

        a.  Navigate to Agent > Set Credential and ensure a credential is present (add a credential if one is not already defined)

        b.  Navigate to Patch Mgmt > Command Line

        c.  Filter to the appropriate KB article number

        d.  Add the switch /INSTALL-AS-USER to the existing switches for all versions of this KB

        e.  Allow the installation process to run

    In many cases, method 2 has lead to a high-level of success for the installation of the patch. The requirement of the interactive user is one that is defined by Microsoft.  When you install the patch by logging into the machine and running Windows Update, the patch will install successfully because you are logged into the machine.  When no user is logged in and Kaseya attempts to install the patch using the Windows Update Agent (WUA) through its .api, the patch will not install, even though the overall functionality is leveraging the same utility, because there is no user logged into the machine.  By adding the /INSTALL-AS-USER switch and using the distributable version of the patch (rather than the WUA-based version of the patch), the patch can be 'tricked' into 'believing' a user is present and will often allow the installation to proceed.  

    Depending on your environment's configuration, the installation may still fail.  If it does, you may need to log into the machines locally to install the patch.  Microsoft can provide additional information regarding why these patches require the interactive user and what environmental changes might allow for the installation to complete successfully without an interactive user.

    [edited by: Brande Schweitzer at 4:29 PM (GMT -8) on Jan 4, 2013] edit
  • So helpful!! I'm sitting here trying to figure out why IE9 was approved months ago and I see a ton of machines with 1 missing approved patch. The file is already copied to the workstations and even after an Initial Update while logged into the PC, still not installed. I rebooted after Initial Update completed- still nothing. I spent the last 2 hours trying to figure out what the heck is going on. Thank you for making a thread for this!!

  • I don't think IE9-Windows7-x86-enu.exe /quiet /norestart /INSTALL-AS-USER is correct because it's not recognizing /INSTALL-AS-USER as a valid switch. Is this the proper method because this command isn't working on a 32 bit machine?

  • /INSTALL-AS-USER is a Kaseya-specific switch.  Most individuals I've worked with regarding this issue have found success using the methods outlined above when all the described conditions are met.  The install method and file source can have an impact on success.  This switch (all switches, actually) will not be used if the install method is Automatic or Initial Update AND the file source is download from internet.  Other install methods and/or file sources as described above will lead to success in many cases.  

  • Didn't work for me. I added the /INSTALL-AS-USER to KB982861 as stated. Machines were all behind 1 patch and scheduled to install patches last night and reboot in morning. It looks like only 8 machines rebooted out of 127. Everything should have rebooted at 4 AM and IE9 should be installed, but it's not the case. Creating support ticket...

  • You should probably sticky this thread or something because it's going to frustrate a lot of users when they realize IE9 roll-outs are failing for their clients.