KB4014984 doesn't install on Vista (standalone either)

Anonymous

Hello there,

once again I have installed my beloved Vista Business (x86), everything goes fine except one of the last updates.

The system finds and suggests me to install the one which is exactly called

"April, 2017 Security and Quality Rollup for NET. Framework 2.0, 3.0, 4.5.2, 4.6 on Windows Vista SP2 and Server 2008 SP2 (KB4014984)".

Installing via Windows Update Center throws out the 800B0109 error.

What I have already tried: I do have NET. Framework 4.6 installed and there is an appropriate (?) update for it (KB4014553) as well as its standalone installer.

After successful file extracting this installer shows the same message with explanation in which it is said that

"A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider (error 800B0109)".

I also tried to download a standard Microsoft certificate file (found somewhere over the internet) and to import it to MMC (Run/mmc/etc.) - DOES NOT WORK.

But this rollup update (KB4014984) DID work during the last year, what could have happened?

Please help. Appreciated in advance.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Hi Great White North, (COMPLETE SOLUTION TO PROBLEM)

Happy Easter.

I tried the method you suggested posted by Greenhillmaniac by downloading his Microsoftrootcertificate2011.cer file and installed it by the command line method he suggested. Like Mikey said, this method "worked like a charm", and windows update installed the April 2017 rollup perfectly. The "meticulous scientist" in me (you can probably tell by the way I post) was curious as to why this method worked so much better than the solution I posted yesterday, so I ended up restoring the Windows Vista partition several times and running several trials to answer this question. It turns out that his certificate file is identical to the one I exported from a Windows 7 computer; however, the "command line" method of installing this certificate is a superior method of installing it that the method I was using, which was to import the certificate into the Trusted Root Certification Authorities tab by using the import button.

To anyone else who may encounter this problem, my recommended solution is outlined below:

Obtain a copy of the Microsoft Root Certificate Authority 2011 certificate either by downloading it (see previous posts in this thread) or exporting it from a more modern up to date computer (I used a Windows 7 computer.) I would recommend also obtaining the Microsoft Root Certificate Authority 2010 certificate, but for the purposes of this solution the 2011 certificate alone works fine. Copy this root certificate file (or files) to your C: drive by clicking the My Computer button, then the C: hard drive icon, and move or copy the file(s) to this window (for simplicity, do not put the file inside any folder on the C drive.) Click the start button, then move the cursor to programs, then the accessories folder, then RIGHT CLICK the command prompt icon and choose "Run as administrator" from the pop up menu that appears. Type cd\ and hit enter. Then type certutil -addstore "Root" "c:\XX.cer" and hit enter. Type this command exactly as written including the quotation marks except substitute the name you chose for the certificate file for the XX. You should get a confirmation message telling you that the command action was successful. Run this command twice if you are installing both the 2010 and 2011 certificates. Close the command prompt window and restart the computer. You should now be able to install the Security and Quality Rollup April 2017 now either by running Windows update (easiest way) or by using the stand alone installers that I discussed yesterday (earlier in this thread.) You can now delete the Microsoft Root certificates from your C: drive, or move them to a storage folder, or just leave them where they are (they won't hurt anything.) My thanks to GREAT WHITE NORTH and GREENHILLMANIAC for their contributions to this solution.

0 comments

56 additional answers

Anonymous

2020-04-11T15:19:56+00:00

It installed because it updated .net 2.0. Then when you installed .net 4.5.2, this version of .net needed the same update. But it is the .net 4.5.2 update that always fails (this reply is in reference to when Peter installed the April Security and Quality rollup for .net 2.0 3.0 4.5.2 4.6 before installing .net 4.5.2.)
Was this answer helpful?

0 comments No comments
Anonymous

2020-04-11T14:59:06+00:00

Hi Peter, (SOLVED)

Sorry to take so long to get back to you, the real world calls sometimes. Anyway, I have a solution worked out for you (us, actually.) Good job discovering the missing root certificates. The certificates you need are Microsoft Root Certificate Authority 2010 (expires 06/23/2035) and Microsoft Root Certificate Authority 2011 (expires 03/22/2036.) The easiest way to obtain these certificates is to export them from a Windows 7 computer (you could probably do it from a Windows 8 or 10 computer, but I do not know how.) If you need help doing this, write me back and I will send detailed instructions on how do do it with Windows 7. Once you import these certificates into your "Trusted Root Authorities" tab and restart the machine, the stand alone installers for the .net 4.5.2 and .net 4.6 April 2017 updates will work perfectly (Note, Windows update itself will still fail to install the April 17 rollup.) Now, to install the April, 2017 Security and Quality Rollup for NET. Framework 2.0, 3.0, 4.5.2, 4.6 on Windows Vista SP2 and Server 2008 SP2 (KB4014984) go to the Windows update catalog and search "Security Quality Rollup Vista" and hit download button by the April 2017 rollup. 4 download links come up. You will need to download 2 files from the Window Update catalog. The first one is Windows6.0-kb4014561-x86(etc) (or -x64 if you need the 64 bit version) which applies the update to .net 2.0 and then either NDP45-kb4014559-x86(etc) to update .net 4.5.2. or NDP46-kb4014553-x86(etc) to update .net 4.6. Once these stand alone updates are installed and the computer restarted, Windows update will report that there are no further updates for your system. Note that the update history will not show that the April rollup is installed. The Windows6.0 file will show up as a "Security update for Windows" and the NDP46 file will not show up in the history at all.

I actually had .net 4.52 installed and installed the Windows6.0 file and the NDP45 file. After appropriate restarts, I ran Window update and got "no further updates." Then I installed .net4.6 and ran Windows update and got 1 update, the same April 2017 rollup. I installed NDP46 and restarted, then got "There are no updates to your computer." So these stand alone updates absolutely do install the April 2017 rollup. Hope this helps.
Was this answer helpful?

0 comments No comments
Anonymous

2020-04-08T07:20:46+00:00

I suggested installing the Dec 2016 rollup, the last official rollup for Windows Vista before the April 2017 rollup.

Ah, Dec 2016, sorry.
Was this answer helpful?

0 comments No comments
Anonymous

2020-04-08T05:14:15+00:00

Hi Peter,

You misread my answer. I suggested installing the Dec 2016 rollup, the last official rollup for Windows Vista before the April 2017 rollup. There is a preview rollup in March 2017, but I had the same difficulty installing it that I had with the April Rollup. The December rollup stand alone installer (available from the MS update catalog) worked perfectly. Then simply right clink on the April 2017 rollup in Windows update and "hide update" and WU will stop bugging you to install the April update. The December rollup is kb3210129.

Not a perfect solution, but one that works. I was interested in trying your solution. Thanks for the rootsupd.exe program.
Was this answer helpful?

0 comments No comments