Error 80070643 installing KB 974417 on Windows XP

First off, I apologize for the lack of pictures. I find they make explanations easier. Unfortunately I resolved this months ago and so all my pictures have been mislaid...

Trying to push out KB 974417 a while back I noticed that certain machines were getting an error. A lot of research via the web uncovered that the issue lay in the fact that those machines had KB 976569 already installed. For some reason this later, not critical update (only important) was preventing KB 974417 from installing. This can happen when a machine is running a variety of updates and gets the order off.

The solution was fairly simple - you just needed to UNINSTALL KB 976569 and INSTALL 974417 and you would be fine. The problem is that you can not UNINSTALL KB 976569 via WSUS. You get a little notification that it can not be selected for uninstall. The probable reason is that it is part of a .net 2.0 update and other updates follow after. So you have to manually uninstall it, or some such.

One of the nice things about WSUS (and also a rather scary security question) is that it runs with higher privileges, which it needs to install the updates. As a result if you have locked users out from installing software willy-nilly (technical term) than you run into a problem when you try to uninstall in that you need to give them the same permissions.

Okay, let's start at the beginning - I won't bore you with all the different permutations I went through in determining my final process - I was writing code to wrap the uninstall in a security wrapper, etc, etc. I will take you to what I did and you can decide for yourself if this is how you want to do it.

• Note #1 - use MSIExec to uninstall the package. Critical note, you can not specify the package itself (since this is an update to .net) you need to specify the GUID of .net and then the GUID of the package itself. Like so:
  msiexec /package {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} /uninstall {621253FA-14E8-34AB-82B3-22590E6A961A} /passive
• Note #2 - I wrapped the MSIExec in a little C# program I used to bump up the perms - basically I used the ability of ProcessStartInfo to pass in a username and password (thanks to David Hayden's nice post on this). I will expand on that in another post if someone asks. I had the dickens of a time (another technical term) using Runas which might seem the more obvious way to go for you non-programmers, but never could get it to work. This was quick and dirty for me.
• Note #3 - I stuck the C# program (called RemoveKB976569.exe) out on Netlogon and used schtasks to remotely create a timed task to run on whatever remote computer I wanted to affect. Like so:
  schtasks /create /s \\<computername> /RU <adminUsername> /RP <adminPassword> /TN RemoveKB /TR <domainControllerNetlogonPath>\RemoveKB976569.exe /SC ONCE /ST <timeToRunTasks> /V1

Now, granted, you could touch every box if you wanted to. This was my attempt not to have to. Complicated, yes. Successful, yes.

Have fun...