Link to home
Start Free TrialLog in
Avatar of Mark
Mark

asked on

How to resolve problem with KB2949927 corrupting system

I have a huge problem. The recent October Microsoft updates included KB2949927 which trashes one of the workstations in the office. The automatic startup repair program runs for hours after reboot and can't fix the system. I can't even restore back to a restore point. I have spent since yesterday morning, all evening and so far all morning trying to fix this. I've restored from Acronis image numerous times.

One complication is that this is a required update, so even if all other updates are installed and this one is skipped, it automatically installs the next time the user shuts down or reboots. Another complication is that this is a workstation on a domain with an auto-update policy, so this update will ultimately get applied automatically even if the user avoids reboots.

This problem is all over the Internet right now. One example: http://www.bobistheoilguy.com/forums/ubbthreads.php/topics/3511807/KB2949927_failing_to_install. Advice on fix/work-around is to enable Bit Locker, and/or enable automount in Diskpart "automount enable". Here is a site that mentions both of these solutions: https://social.technet.microsoft.com/Forums/en-US/bc191121-94ab-483f-ae9f-d5056ca3aae5/kb2949927-fails-to-install-if-bitlocker-fvevol-service-is-disabled?forum=w7itproinstall

I'm having a problem figuring out what to do. The Bit Locker solution says:

The "fvevol" service must be started, and it must be registered in the "LowerFilters" value under this registry key:
 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}

This workstation doesn't have the ...\Class\ key at all, I'd have to create it, and it doesn't say what to set the value to. Also, another site gives a different key: {4D36E965-E325-11CE-BFC1-08002BE10381}. I'm a bit hesitant to add this registry entry without a bit more EExpert advice. Also, I don't see the "fvevol" service in my list of services.

I'm sure some EE experts has had to deal with this problem as it seems to be somewhat pervasive. Please advise on how I should proceed. Thanks
ASKER CERTIFIED SOLUTION
Avatar of jcimarron
jcimarron
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Mark
Mark

ASKER

jcimarron: > Bit Locker is installed only with the Ultimate and Enterprise versions of Win 7.  Does either apply to that work station?  

This is Win7 Pro, not Ultimate or Enterprise, so I suppose that means no BitLocker.

> If you are able to get to Control Panel|Programs and Features|View Installed Updates, I suggest you uninstall KB2949927 from there.

The problem is, once installed, the computer is unbootable, even in safe mode, and un-repairable, so no access to the update. I have to do an image restore to before the update was installed.

> If you are again offered this Update, you can right click on it in the "Select Updates to Install" window and choose Hide.  It will not install again.

The problem here is that, even though the update is currently de-selected, the Start > Shutdown button has the yellow "updates" shield shown and it installs the update anyway when the computer is rebooted. I know, I've tried.

> I also have fvevol registered under LowerFilters

Where would I find this?

I will try the right-click, hide when the workstation becomes available in 2 hours. However, I'm skeptical that it will remove the Shutdown/update action. If that doesn't work, I'll try the "hide" idea after the next image restore.

I had checked that link you referenced, but it has nothing to say about this issue.

Has anyone actually experienced this problem?
jmarkfoley--
"Bit Locker is installed only with the Ultimate and Enterprise versions of Win 7.  Does either apply to that work station?  "
I cannot tell what is installed on your PC.  Open Control Panel and see if BitLocker Drive Encryption is listed.

" If you are again offered this Update, you can right click on it in the "Select Updates to Install" window and choose Hide. "
"the Start > Shutdown button has the yellow "updates" shield shown and it installs the update anyway when the computer is rebooted"
That happens only when you have allowed the Update to be downloaded and installed.  Go into your Windows Updates settings
Control Panel\All Control Panel Items\Windows Update\Change settings
and under Important Updates choose the option "Check for Updates but let me choose when to download and install".
Avatar of Mark

ASKER

jcmarron: > Open Control Panel and see if BitLocker Drive Encryption is listed.

It is not listed. Hence, I think that registry mod is not appropriate for this computer.

> under Important Updates choose the option "Check for Updates but let me choose when to download and install".

This is a domain managed workstation and the current setting "Managed by your system administrator" cannot be changed without changing the Group Policy, which would change it for everyone which I'm not prepared to do.

In any case, I think I've got it fixed. I skipped the BitLocker registry change and I did both the diskpart "automount enabled" as suggested in one of the links I posted and was able to right-click on the update and set it to "hide" per your previous suggestion. This did remove the yellow "install updates" shield icon from the Start > Shutdown button. I restarted the computer and voila! It came back up and DID NOT apply this update. I went into 'Windows Update' and clicked "check for updates" and no new updates were found. I am now going to wait overnight until after the domain controller runs automated updates at around 3:00AM and see if this setting also thwarts the group policy. If so, mission accomplished. I'll post back with results in the A.M.
jmarkfoley--
Looking forward to your post.
Avatar of Mark

ASKER

Sorry, thought I posted. The computer worked OK in the A.M. and has done so on subsequent days. There were probably no new domain controller managed updates, but neither did the Update Manager attempt to re-install the evil KB2949927. As mentioned, I right-clicked on the update and selected "hide". I also applied the diskpart "automount enable" alleged fix. I would have liked the leisure to first try the 'diskpart' solution by itself, but the recovery procedure is so time consuming that I didn't feel like experimenting any more. My suspicion is that the "hide" update function has simply prevented the update from happening and is honored by the domain Group Policy, and that 'diskpart' is of no effect at the moment. One day, I may get cavalier and apply the update and see if the diskpart solution works or is a net-legend.

Another black mark on Microsoft's corporate soul for releasing an update that has such a catastrophic effect on quite a lot of computers (based on Internet postings) and apparently no comment, apology, or better: a fix!
Avatar of Mark

ASKER

Hiding the update seemed to do the trick!
jmarkfoley--
Glad to have helped.