WSUS Offline Update deletes previous kb file

Hello group,

I updated wsus to latest esr version 9.2.4 (I am under windows xpsp3), and do a new run to see if something changed (last run was one year ago). After running I found in the download.log file that some kb files were deleted, namely:

Deleted ..\client\wxp\enu\windowsxp-kb2555917-x86-enu_b668468f7827df5298064a02b7199daea03010ee.exe
Deleted ..\client\wxp\enu\windowsxp-windowsmedia-kb968816-x86-enu_24b80d1e59290349253fcc59102970784ccc3c45.exe
Deleted ..\client\wxp\chs\windowsxp-kb2279986-x86-chs_ea26aa2b2c77c84389370f27200cf74f99e7c585.exe
Deleted ..\client\wxp\chs\windowsxp-kb2485376-x86-chs_2ee1f886b60345568a4e8fcaf561e74f85ee2f64.exe
Deleted ..\client\wxp\chs\windowsxp-kb981322-x86-chs_b73f140fba65d90fc9cb76f0fcd63b5c9b53a86d.exe

I did some searching, not finding a statement that these updates are retracted. Am I alone?

--
Regards,
Lu Wei
IM:
PGP: 0xA12FEF7592CCE1EA

Lu Wei wrote:
Hello group,

I updated wsus to latest esr version 9.2.4 (I am under windows xpsp3), and do a new run to see if something changed (last run was one year ago). After running I found in the download.log file that some kb files were deleted, namely:

Deleted ..\client\wxp\enu\windowsxp-kb2555917-x86-enu_b668468f7827df5298064a02b7199daea03010ee.exe
Deleted ..\client\wxp\enu\windowsxp-windowsmedia-kb968816-x86-enu_24b80d1e59290349253fcc59102970784ccc3c45.exe
Deleted ..\client\wxp\chs\windowsxp-kb2279986-x86-chs_ea26aa2b2c77c84389370f27200cf74f99e7c585.exe
Deleted ..\client\wxp\chs\windowsxp-kb2485376-x86-chs_2ee1f886b60345568a4e8fcaf561e74f85ee2f64.exe
Deleted ..\client\wxp\chs\windowsxp-kb981322-x86-chs_b73f140fba65d90fc9cb76f0fcd63b5c9b53a86d.exe

I did some searching, not finding a statement that these updates are retracted. Am I alone?


Run the info through catalog.update.microsoft.com .

KB2555917

https://i.postimg.cc/rFN0WncW/catalog-supersede.gif

KB2555917 was replaced by other patches.

Paul

Lu Wei wrote:

Hello group,

I updated wsus to latest esr version 9.2.4 (I am under windows xpsp3), and do a new run to see if something changed (last run was one year ago). After running I found in the download.log file that some kb files were deleted, namely:

Deleted ..\client\wxp\enu\windowsxp-kb2555917-x86-enu_b668468f7827df5298064a02b7199daea03010ee.exe
Deleted ..\client\wxp\enu\windowsxp-windowsmedia-kb968816-x86-enu_24b80d1e59290349253fcc59102970784ccc3c45.exe
Deleted ..\client\wxp\chs\windowsxp-kb2279986-x86-chs_ea26aa2b2c77c84389370f27200cf74f99e7c585.exe
Deleted ..\client\wxp\chs\windowsxp-kb2485376-x86-chs_2ee1f886b60345568a4e8fcaf561e74f85ee2f64.exe
Deleted ..\client\wxp\chs\windowsxp-kb981322-x86-chs_b73f140fba65d90fc9cb76f0fcd63b5c9b53a86d.exe

I did some searching, not finding a statement that these updates are retracted. Am I alone?

As Paul mentioned, KBs can be superceded by other KBs.

I don't know if WSUSoffline logs the deletion of KBs and later records
their re-addition due to a new version. You would have to look in its
log to see if the same KB got deleted and then re-added. For example,
if you search the log on each "KBxxxxxxx" string, does it appear only in
the log entry about getting deleted? KBs can get new revisions. I know
a lot of users that hid the GWX update only to find it later offered
again. They hid the old version but Microsoft later pushed out a new
version.

On 2018-11-28 5:45, VanguardLH wrote:
Lu Wei wrote:

Hello group,

I updated wsus to latest esr version 9.2.4 (I am under windows xpsp3), and do a new run to see if something changed (last run was one year ago). After running I found in the download.log file that some kb files were deleted, namely:

Deleted ..\client\wxp\enu\windowsxp-kb2555917-x86-enu_b668468f7827df5298064a02b7199daea03010ee.exe
Deleted ..\client\wxp\enu\windowsxp-windowsmedia-kb968816-x86-enu_24b80d1e59290349253fcc59102970784ccc3c45.exe
Deleted ..\client\wxp\chs\windowsxp-kb2279986-x86-chs_ea26aa2b2c77c84389370f27200cf74f99e7c585.exe
Deleted ..\client\wxp\chs\windowsxp-kb2485376-x86-chs_2ee1f886b60345568a4e8fcaf561e74f85ee2f64.exe
Deleted ..\client\wxp\chs\windowsxp-kb981322-x86-chs_b73f140fba65d90fc9cb76f0fcd63b5c9b53a86d.exe

I did some searching, not finding a statement that these updates are retracted. Am I alone?

As Paul mentioned, KBs can be superceded by other KBs.

I don't know if WSUSoffline logs the deletion of KBs and later records
their re-addition due to a new version. You would have to look in its
log to see if the same KB got deleted and then re-added. For example,
if you search the log on each "KBxxxxxxx" string, does it appear only in
the log entry about getting deleted? KBs can get new revisions. I know
a lot of users that hid the GWX update only to find it later offered
again. They hid the old version but Microsoft later pushed out a new
version.

Thank you and Paul. Now I know a place to check superseding.

I compared the files and only deletion is performed, no addition. So
maybe 9.2.2 had some problem parsing superseding relations, since the
superseding relation should not be added in the last year providing MS
has stopped maintaining XP, and the new KB files had been downloaded in
the previous run.

--
Regards,
Lu Wei
IM:
PGP: 0xA12FEF7592CCE1EA

Lu Wei wrote:
On 2018-11-28 5:45, VanguardLH wrote:
Lu Wei wrote:

Hello group,

I updated wsus to latest esr version 9.2.4 (I am under windows xpsp3), and do a new run to see if something changed (last run was one year ago). After running I found in the download.log file that some kb files were deleted, namely:

Deleted ..\client\wxp\enu\windowsxp-kb2555917-x86-enu_b668468f7827df5298064a02b7199daea03010ee.exe
Deleted ..\client\wxp\enu\windowsxp-windowsmedia-kb968816-x86-enu_24b80d1e59290349253fcc59102970784ccc3c45.exe
Deleted ..\client\wxp\chs\windowsxp-kb2279986-x86-chs_ea26aa2b2c77c84389370f27200cf74f99e7c585.exe
Deleted ..\client\wxp\chs\windowsxp-kb2485376-x86-chs_2ee1f886b60345568a4e8fcaf561e74f85ee2f64.exe
Deleted ..\client\wxp\chs\windowsxp-kb981322-x86-chs_b73f140fba65d90fc9cb76f0fcd63b5c9b53a86d.exe

I did some searching, not finding a statement that these updates are retracted. Am I alone?
As Paul mentioned, KBs can be superceded by other KBs.

I don't know if WSUSoffline logs the deletion of KBs and later records
their re-addition due to a new version. You would have to look in its
log to see if the same KB got deleted and then re-added. For example,
if you search the log on each "KBxxxxxxx" string, does it appear only in
the log entry about getting deleted? KBs can get new revisions. I know
a lot of users that hid the GWX update only to find it later offered
again. They hid the old version but Microsoft later pushed out a new
version.

Thank you and Paul. Now I know a place to check superseding.

I compared the files and only deletion is performed, no addition. So
maybe 9.2.2 had some problem parsing superseding relations, since the
superseding relation should not be added in the last year providing MS
has stopped maintaining XP, and the new KB files had been downloaded in
the previous run.


That is something you have to watch.

Microsoft doesn't want to update the main wsusscn2 file with
the WinXP updates any more. If an update was issued
for some reason, then it's quite possible the
supersedence could not be worked out because the
main wsusscn2 file didn't get the changes.

But rest assured, if you download an MSU from catalog.update.microsoft.com,
it has a tiny chunk of wsusscn2 inside the .msu. And the installer
can work out whether the file is "appropriate" or not. It does not
deliver a detailed summary, like "install A, then install B, then
try this file again". It just reports that the file is "not for this
OS", when in fact installing a dependency will make it work. There's
sufficient logic to "protect" the OS, but not sufficient
logic to help the person doing the install. You have to use
your crystal ball, to "guess" what the dependency might be.

Many of the older WinXP updates are in .cab format, and
I don't think that is protected quite as well. On later OSes,
I think you use DISM to install a cab, but there's another
procedure to do them on WinXP. The wsusoffline has a lot of
this stuff boiled into its scripts, so you can trace down
how each type is handled. I think a .cab is expanded first,
but I don't know off hand what the next step is.

Paul

On 2018-11-28 13:09, Paul wrote:

That is something you have to watch.

Microsoft doesn't want to update the main wsusscn2 file with
the WinXP updates any more. If an update was issued
for some reason, then it's quite possible the
supersedence could not be worked out because the
main wsusscn2 file didn't get the changes.

I noticed that all KB files did not change (except deleted) but
wsusscn2.cab downloaded again. So maybe MS did updated that wsusscn2
file. But since no old file is left, that trivial question could be left
too.

But rest assured, if you download an MSU from catalog.update.microsoft.com,
it has a tiny chunk of wsusscn2 inside the .msu. And the installer
can work out whether the file is "appropriate" or not. It does not
deliver a detailed summary, like "install A, then install B, then
try this file again". It just reports that the file is "not for this
OS", when in fact installing a dependency will make it work. There's
sufficient logic to "protect" the OS, but not sufficient
logic to help the person doing the install. You have to use
your crystal ball, to "guess" what the dependency might be.

Many of the older WinXP updates are in .cab format, and
I don't think that is protected quite as well. On later OSes,
I think you use DISM to install a cab, but there's another
procedure to do them on WinXP. The wsusoffline has a lot of
this stuff boiled into its scripts, so you can trace down
how each type is handled. I think a .cab is expanded first,
but I don't know off hand what the next step is.

All the KB files are exe format here, only one cab file wsusscn2.cab.

--
Regards,
Lu Wei
IM:
PGP: 0xA12FEF7592CCE1EA

Lu Wei wrote:

All the KB files are exe format here, only one cab file wsusscn2.cab.


In my notes file, I have a reference

Expand.exe KB925029.cab -F:* "destinationdir"

It appears I might have been searching inside some .msu files.

https://i.postimg.cc/pr75tP35/msu-using-cab.gif

I had some other collection though, where the KBs were
in .cab format. I just can't find a source now.

I'm getting these .cabs from somewhere, because
I have references in my notes for some reason.

dism /online /Add-Package /Package-Name:F:\some.cab

Paul