Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Windows bulletin - Duplicate update?

Created: 23 Apr 2013 | 16 comments

Hello, we are having an issue/confusion with one of the Microsoft Bulletin. MS13-023 shows 2 updates for the same kb: KB2760762. For that reason, one of the updates has a really good compliance, while the other is around 0.2 percent. One is called office2010-kb2760762, while the other is called visio2010-kb2760762. Looking at the microsoft page for that bulletin,only visio2010-kb2760762 should be displayed. Our reports are indicating very low numbers because of this update. So, why is it showing twice? And if there is no fix to exclude that specific update from the bulletin, how could I exclude it from the compliance report by Bulletin? Thanks for any help!

Operating Systems:

Comments 16 CommentsJump to latest comment

whitezombie's picture

I am also having this issue? Does anyone have an answer? See the attached screen shot.

4-29-2013 1-05-08 PM.png
richietheprogrammer's picture

Good to know Im not the only one. Now can we get some support?

akbar_alam's picture

We are also having the same issue, we will open a case with Symantec and will post the result, if anyone else finds a solution please update

mahbu_basha2003@yahoo.com's picture

Good , We dont observ this issue, We have MS13 - 23 for visio alone correctly .

richietheprogrammer's picture

mahbu, if you double click on the MS13 - 23 bulletin, do you see a duplicate update "KB2760762"?

Roman Vassiljev's picture

Hi richietheprogrammer,

This patch was originally released as just affecting Visio 2010 SP1, but later another case was found where WSUS was offering same patch to Office 2010 suite that didn't have Visio. So separate 'update' was added(with new detection logic but same Download URL) for Office suite without Visio.  Additionally Patch Data team added a dependency to detection logic so the patch should not show up twice if Office suite and Visio are both installed on same machine.

So I guess office2010-kb2760762 and visio2010-kb2760762 are applicable to different machines in your setup depending on installed software.
Could you please double check this? In case if you have at least one machine where both patches are detected as applicable, please attach STPatchAssessment.xml and STPatchAssessment.log from this affected machine. Usually these files are located at "C:\Program Files\Altiris\Altiris Agent\Agents\SoftwareManagement\Software Delivery\{6D417916-467C-46A7-A870-6D86D9345B61}\cache\"

Thank you,
Roman

Roman Vassiljev's picture

Hi whitezombie,

According to attached logs only 1 update kb2760762 (with name 'office2010-kb2760762-fullfile-x86-glb.exe') is detected as applicable and missing on client, where these logs were collected. It is expected in case if this update has not been installed yet on machine.

Please let me know if you have any troubles with installing office2010-kb2760762-fullfile-x86-glb.exe on this machine.

Thanks,
Roman

whitezombie's picture

I think Symantec may have corrected this now. When I look at the patch compliance there is no longer a duplicate entry for this. See my previous screeen shot and the new one. But the patch is still not deploying so I'm going to remove it from the policy and recreate it. After recreating the policy it's showing up so I'll give it a few days and see if it deploys.

5-16-2013 9-24-31 AM.png old_policy.png new_policy.png
richietheprogrammer's picture

I never saw a duplicate entry in the bulletins list. However, when I expand bulletin "MS13-023" compliance, below is what I see. Notice the duplicate "...kb2760762.."; This is causing the compliance to be at 1.5 percent since the "Visio2010-kb2760762.." is around 0.5 percent.

Capture.PNG
Roman Vassiljev's picture

Hi richietheprogrammer,

In case if compliance report on your NS says that update is missing on number of clients then you need to distribute this update and install it on these clients in order to increase compliance level.
MS13-023 includes two separate updates office2010-kb2760762 and visio2010-kb2760762(please see my comment) To increase compliance level of MS13-023 you need to ensure that office2010-kb2760762 is installed on machines, where it is missing and that visio2010-kb2760762 is installed on machines, where it is missing.

Firstly I would recommend to check SWU policy containing bulletin MS13-023 - it should contain both updates(kb2760762 for Office and kb2760762 for Visio). In case if it does not include them, please check that revise option is enabled in PM Import settings.
If SWU policy includes these updates, if updates are enabled and if SWU policy is enabled as well then these updates should be distributed and installed(according to define schedule) on all targeted machines where they are missing.

Please let me know in case if you have any problem with installing any of these updates.

Thanks,
Roman

richietheprogrammer's picture

Thanks for your answer. Yes, they both show up in the SWU policy. Where can I find the PM Import settings?

cbleeson's picture

I also have workstations that are trying to install both of these updates.  Here are my log files that came from a computer with this problem.  I am getting an error saying that this update is already installed. 

I have about 10 computers that were recently imaged that are doing this.  I am guessing its some how tied to an issue with the image. 

I noticed that Patch was looking for a reg key to prove the update was installed and can't find it so it keeps trying to install the update but then the patch management log shows the error code stating it is already installed.

Thanks,

Chris

AttachmentSize
STPatchAssessment.zip 272.44 KB
Roman Vassiljev's picture

Hi Chris,

According to attached logs only office2010-kb2760762-fullfile-x86-glb.exe is detected as applicable to this affected machine.
Also it looks like Visio 2010 is not installed on this machine, is it correct?

Is my understanding correct that detected as missing office2010-kb2760762-fullfile-x86-glb.exe attempts to install however it always says that ii is actually already installed?
Have you installed visio2010-kb2760762 from MS13-023 on same machine before? If Yes, was it installed using Patch Management Solution? Note: Updates installed via Patch Management Solution are listed in InstalLog.csv(usually it is located at C:\Program Files\Altiris\Altiris Agent\Agents\PatchMgmtAgent\InstallLog.csv on Client)

Thanks,
Roman

cbleeson's picture

I'm sorry I did not get back to you sooner.  Visio was not installed on that computer.  You are correct that it does try to install and says it was already installed.  I did use Patch Management Solution to install it.

I tricked the workstations by adding the reg key it was looking for.  This only was an issue on 8 machines that I was reimaging and have not run into it since then.  I have used these same patches on many other computers and they installed correctly.