KB2871997 update failure

<consumer response>

If you never attach to a corporate network I would skip this update.  This is backporting the "pass the hash" protection that was included in Windows 8.1  In a peer to peer network none of these security enhancements can be enabled.

<I hate it when patches barf response>

I would still like to get to a root cause.  We've already seen interaction with A/V is a root cause so by all means disable any antivirus before attempting an install.  If you have any other third party software of a security nature, disable that as well.

I'm also having this same issue.  I can't install KB2871997 on one Windows 7 Pro SP1 64-bit machine.  This is the only Windows Update I'm having a problem with, and I'm not having an issue with KB2871997 on any other machines.  The update seems to progress about 50% of the way through, then it pauses, and then it seems to complete - but then it fails with error 800736B3.

I tried sfc /scannow per Method 1.  The System File Checker didn't find any issues, and I still wasn't able to install the update.

I ran the System Update Readiness Tool per Method 2.  I gave it plenty of time to install and run, and then I opened the CheckSUR logs which showed no errors detected.  I still wasn't able to install the update.

I performed a clean boot per Method 3.  That made no difference - I still wasn't able to install the update.

Method 4 as listed doesn't make much sense.  The link you provided simply redirects to a download page for Microsoft Security Essentials, which was already installed on this PC by the way.  I searched the page I was redirected to, and the only thing that seemed similar to the "Protection" scan you called out was the Microsoft Safety Scanner, which appears to be a virus-scanning tool.  So I downloaded that and ran a full scan.  Nothing was found, and I was still unable to install KB2871997.

I also tried a few other things.  I downloaded the stand-alone installer for KB2871997 and ran it, but I got the same error.  I disabled Real Time protection in Microsoft Security Essentials, but that didn't help.  I then completely uninstalled Security Essentials, but that also didn't help.  I ran a few other third-party antivirus tools and registry clean-up utilities that I know to be effective, both in normal mode and in safe mode with networking, but those didn't find anything either and I still can't install this update.

So can anyone shed some more light on what exactly this update is trying to do and/or what system files or registry entries it's trying to modify?  Is there anything else to try?  TCP/IP stack, Winsock/LSPs, anything?  (I read the Fix it solution, so I have a rough idea I think, but that solution also says it only takes effect if KB2871997 is already installed, so I didn't run that.)  I really don't want to reinstall the entire OS on this machine, do a repair install, or even just hide the update.  Resolving this is the last thing I need to do to get this PC ready for a user.

One thing I'm curious about is the references I've read in this thread and others about Norton or McAfee being installed at any point.  This machine was loaned to a customer of mine for awhile, and their corporate McAfee was installed on it.  But I did a clean uninstall of that before installing Security Essentials on it, or at least I thought I did.  I use a combination of Add/Remove Programs, a third-party uninstaller, and a third-party registry cleaner.  I also removed just about everything else on the PC that's not something I regularly install on my machines, and I'm normally very thorough - I'm my company's network/domain/Exchange administrator.  But this one has me stumped right now, and it's VERY frustrating.

Hi Sage Eagle

It does help to know that someone with your obvious expertise is having trouble with this too.  I have given up with this download based on the earlier advice from Susan Bradley.  Now I can't wait for the June updates......................................................

Try an in place upgrade:

http://support.microsoft.com/kb/2255099

I already said I didn't want to do a repair install, a.k.a. an in-place upgrade.  So I went ahead and tried a few more things first on the off chance they'd help.  I reset the TCP/IP stack, reset the Winsock catalog, and I blew away the Software Distribution folder and let all of the Windows updates be detected over again, etc.  It had been on a domain too, so I went through local Group Policy and undid all of the settings that had been applied from the domain Group Policy.  (I also forgot to mention in my first post that I'd run a CHKDSK /R too and no issues were found.)  None of those things made a difference - KB2871997 still wouldn't install.

Since it didn't seem like there would be any more useful information forthcoming here, I decided I might have to do a repair install after all.  I wanted to avoid doing that because I'd found that while my customer had my machine they hadn't simply put the PC on their domain and installed their corporate McAfee on it, they actually imaged the entire machine, and I wasn't sure what media/installer they'd used: OEM (the PC is a Dell), retail, or volume, etc.  After pulling up some info using SLMGR and a couple of third-party tools, I actually found that they installed/activated Windows using a Key Management Server (KMS) which requires the PC to hit the KMS periodically to renew its activation.  Well on this machine that wasn't going to work at all going forward.  So I'm about to reinstall the entire OS from scratch or put one of my images on it.

So I'm not happy that I spent so much time on this.  We often loan PCs to customers or prospective customers as demos, but they shouldn't have imaged the computer - especially without informing me.  It's possible that something in their image or something related to one of the applications they installed caused this problem.  I would've reinstalled it right when it came back if I knew that.

However, Microsoft still needs to address this.  I doubt that the other people posting in this thread are having the problem on a PC that was subject to the same conditions as mine was.  So Microsoft still needs to "fix" this update or at least provide some more detailed or useful information about what it's for and what things might cause the update to fail.