none
KB928365 bootstrapper package

    Question

  • I want to ensure KB928365 is installed before my application gets installed. Can this be done with a custom bootstrapper prerequisite? If not, can it be done by requiring a newer version of .NET be installed, that already has the patch applied?

    To create a custom bootstrapper package I think I'll need the GUID of the patch, where can I find this?

    Many thanks in advance,

    Ben
    Wednesday, October 03, 2007 9:54 AM

Answers

  • Hi BenDowling,

    I suggest that you can detect that whether the patch has been installed using the method provided in this article: Detecting repair, patch install, and patch uninstall for Windows Installer.

    If the patch has not been installed, you can download the patch from here or include it in your setup package and install it on the machine, all these actions can be done programmatically at background.

    Hope this helps!

    Thanks!

    Friday, October 05, 2007 5:38 AM
  • The contents of the patch corresponding to KB928365 (a security update) are included in the .NET Framework 2.0 SP1 so if you have SP1 installed you do not need to install the patch for KB928365.

     

    The binaries in .NET Framework patches contain cumulative fixes. So a newer .NET Framework binary always carries the fix in an older binary.

     

    The file version in KB928365 is 50720.832 and the file version in the.NET Framework 2.0 SP1 is 50727.1433 or 50727.1434 (depending upon your platform). So SP1 does include the fixes in KB928365.

     

    As a practice the KB articles for the .NET Framework do not explicitly list the rolled up security updates so you would not find any of the security updates listed.

     

    FYI - all Service Packs for all Microsoft products always include security updates targeting the earlier baseline i.e. SPn-1 so SP1 will always include the security updates applicable to RTM i.e. SP0 released previously.

     

    Thanks,

    Jamshed Damkewala

    Security Program Manager, DevDiv

    Microsoft Corp.

    Wednesday, April 30, 2008 5:52 AM
  • You could deploy .Net 3.5 which is the latest shipped Fx with your application - to find instructions on the same please see http://blogs.msdn.com/astebner/archive/2008/01/25/7249161.aspx.

    Or, you can check for the version of file to check if it is later than the KB version or not.

     

    Wednesday, April 30, 2008 2:26 PM
    Moderator

All replies

  • Hi BenDowling,

    I suggest that you can detect that whether the patch has been installed using the method provided in this article: Detecting repair, patch install, and patch uninstall for Windows Installer.

    If the patch has not been installed, you can download the patch from here or include it in your setup package and install it on the machine, all these actions can be done programmatically at background.

    Hope this helps!

    Thanks!

    Friday, October 05, 2007 5:38 AM
  • That article seems to describe how to check is a patch is being installed, rather than has been installed, unless I'm misreading it?
    Wednesday, October 10, 2007 3:53 PM
  • I've made some progress with this. I can now check for the presence of KB928365 with the following check:

    Code Block

      <InstallChecks>     
        <RegistryCheck Property="UpdateExists"
        Key="HKLM\Software\Microsoft\Updates\Microsoft .NET Framework 2.0\KB928365" Value="Installed" />
      </InstallChecks> 



    And if it isn't detected the the bootstrapper runs NDP20-KB928365-X86.exe to install it. However, towards the end of the installation I see the error message:

    Microsoft .NET services installation utility has encountered a problem and needs to close. We are sorry for the inconvenience.


    The actual installation continues and reports a success though. I've looked at the windows events log, and at the same time that error is displayed there is this event:

    Event Type:    Warning
    Event Source:    ASP.NET 2.0.50727.0
    Event Category:    Setup
    Event ID:    1020
    Date:        29/10/2007
    Time:        16:52:17
    User:        N/A
    Computer:    BMD-PC1
    Description:
    Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.


    Is there any way to prevent this warning event from happening during the install, or a way to prevent the error message it causes?

    Thanks again, Ben
    Tuesday, October 30, 2007 9:27 AM
  • Does anybody have any suggestions?
    Thursday, November 08, 2007 1:03 PM
  • I was also interested in this problem.  The knowledge base entries on KB928365 don't seem to have this as a known problem or any clues as to how to work around it.  Does this patch require IIS to be installed and running?
    Wednesday, November 28, 2007 3:45 PM

  • The check for the patch detects whether the patch has been installed.  It seems though that my installation of .Net 2.0 doesn't need the patch - perhaps it is already included within it.  This causes the check to fail and hence trigger the install of KB928365.  Is there a better way to tell if the patch needs installing?  I can't seem to find what it is on my machine that has replaced it. 
    Tuesday, April 29, 2008 10:42 AM
  • Do you have .Net 2.0 SP1 installed on the m/c?

    If yes, that may block the install for this update (you may look at this for more details).

    Tuesday, April 29, 2008 2:41 PM
    Moderator
  • I do.  But .Net 2.0 SP1 doesn't seem to contain a fix for KB928365 according to the documentation on it I can find.

    http://support.microsoft.com/?id=945757

    Surely it should not block it, should it?
    Tuesday, April 29, 2008 3:21 PM
  • The contents of the patch corresponding to KB928365 (a security update) are included in the .NET Framework 2.0 SP1 so if you have SP1 installed you do not need to install the patch for KB928365.

     

    The binaries in .NET Framework patches contain cumulative fixes. So a newer .NET Framework binary always carries the fix in an older binary.

     

    The file version in KB928365 is 50720.832 and the file version in the.NET Framework 2.0 SP1 is 50727.1433 or 50727.1434 (depending upon your platform). So SP1 does include the fixes in KB928365.

     

    As a practice the KB articles for the .NET Framework do not explicitly list the rolled up security updates so you would not find any of the security updates listed.

     

    FYI - all Service Packs for all Microsoft products always include security updates targeting the earlier baseline i.e. SPn-1 so SP1 will always include the security updates applicable to RTM i.e. SP0 released previously.

     

    Thanks,

    Jamshed Damkewala

    Security Program Manager, DevDiv

    Microsoft Corp.

    Wednesday, April 30, 2008 5:52 AM

  • Given that detecting KB928365 in a bootstrapper only detects if that hotfix has been installed and not if a fix for it has been applied (it doesn't detect that .Net 2.0 SP1 has fixed it), is there a way to have .Net 2.0 SP1 as a bootstrapper?  And will it avoid trying to install .Net 2.0 SP1 if a future service pack is installed?  I wouldn't want to get to a point (as has been reached with the KB928365 bootstrapper) where the bootstrapper is prompting the user to install something that they have a more recent version of.

    Thanks,
    Brunwin
    Wednesday, April 30, 2008 8:24 AM
  • You could deploy .Net 3.5 which is the latest shipped Fx with your application - to find instructions on the same please see http://blogs.msdn.com/astebner/archive/2008/01/25/7249161.aspx.

    Or, you can check for the version of file to check if it is later than the KB version or not.

     

    Wednesday, April 30, 2008 2:26 PM
    Moderator