Duplicate cumulative kb, Windows 11 update returns false information

Question

Duplicate cumulative kb, Windows 11 update returns false information

Simon Fonteneau 105

I use the windows update api to check which cabs are installed on the machine:

https://learn.microsoft.com/en-us/windows/win32/wua_sdk/using-the-windows-update-agent-api

On Windows 11 the scan sends incorrect information and duplicate cabs.

What I was able to observe is that for a 24h2, the API also sees the cumulative updates of the 23h3 and the 22h2 (the cab numbers are indicated but not their update id.).

In addition, the API indicates that the cab is installed, which is false since it has just been detected.
Is the 24h2 cab considered not installed. Which is true

Looks like there is a detectoid problem.

This is problematic because if we base ourselves on the kbids, Windows makes us believe that the cab is properly installed... Finally we have two contradictory results.

MotoX80 37,676 Reputation points

2025-02-13T14:13:56.2666667+00:00

Can you share the code that you are running?

Answer accepted by question author

4 additional answers

Your answer

MotoX80 37,676 Reputation points

2025-02-13T14:13:56.2666667+00:00

Can you share the code that you are running?

Answer 1

Anonymous

Hello,

If this is indeed a detectoid issue in the WUA API, it’s important to report it to Microsoft:

File Feedback:

Use the Feedback Hub app in Windows 11 to report the issue.

Provide detailed steps to reproduce the issue, including the WUA API query and the observed results.

Contact Microsoft Support:

Provide them with the following information:

Windows version (24H2).

WUA API query details.

Logs from Get-WindowsUpdateLog or dism /get-packages.

Best Regards,

Hania Lian

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Simon Fonteneau 105 Reputation points

2025-02-25T15:11:08.07+00:00

thank you for your response

I sent a message on the “Feedback Hub app”

I hope to have an answer... Microsoft support has deteriorated a lot recently. I bought tickets for other bugs for $800, they are still open... How can I get more advanced support to develop them?

Answer 2

Simon Fonteneau 105

I use the script presented here:

https://learn.microsoft.com/en-us/windows/win32/wua_sdk/using-wua-to-scan-for-updates-offline?tabs=vbscript

I just replace the filter with

Type='Software'

0 comments

Answer 3

Simon Fonteneau 105

I can confirm that this bug is still present in Windows 11 25H2. The API keeps reporting older cumulative KBs as “installed” even when they are not. It’s really frustrating to see that nothing has changed after all this time.

0 comments

Answer 4

Simon Fonteneau 105

I just saw that the problem is also visible on a wsus server (which seems logical). I have the impression that the 24h2 windows update engine is completely crap.

Is there still someone at the helm at Microsoft to take things in hand?

0 comments

Answer 5

MotoX80 37,676

I think that you just need to look at the IsInstalled peoperty.

I used the PowerShell version and made a slight change to the output.

$UpdateSession = New-Object -ComObject Microsoft.Update.Session
$UpdateServiceManager = New-Object -ComObject Microsoft.Update.ServiceManager
$UpdateService = $UpdateServiceManager.AddScanPackageService("Offline Sync Service", "c:\temp\wsusscn2.cab")
$UpdateSearcher = $UpdateSession.CreateUpdateSearcher()
Write-Host "Searching for updates..."
$UpdateSearcher.ServerSelection = 3 # ssOthers
$UpdateSearcher.ServiceID = [string] $UpdateService.ServiceID
$SearchResult = $UpdateSearcher.Search("Type='Software'")   #IsInstalled=0")
$Updates = $SearchResult.Updates
If ($SearchResult.Updates.Count -eq 0) {
    Write-Host "There are no applicable updates."
    return
}
Write-Host "List of applicable items on the machine when using wssuscan.cab:"
For ($i = 0; $i -lt $SearchResult.Updates.Count; $i++) {
    $update = $SearchResult.Updates.Item($i)
    #Write-Host ($i + 1) "> " $update.Title
    [PSCustomObject]@{
        IsInstalled = $update.IsInstalled
        Type = $update.Type
        Title = $update.Title
    }
}

On my Win11 laptop it reports this.

User's image

I have a Win10 VM that I don't use very often. It reports that it is missing some updates.

User's image

....

Simon Fonteneau 105 Reputation points

2025-02-14T14:57:23.26+00:00
Hi Motox80,

on your Win11 screenshot, it shows that all three KB are installed (isInstalled=True) :

2025-02 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5051987)

2025-02 Cumulative Update for Windows 11 Version 23H2 for x64-based Systems (KB5051989)

2025-02 Cumulative Update for Windows 11 Version 22H2 for x64-based Systems (KB5051989)

But only KB5051987 has been installed (you are on a 24h2 computer like the one I'm testing right now). So the reporting from the IUpdate interface is plain wrong.

And moreover, if you uninstall KB5051987, then KB5051989 and KB5051989 will still show as installed...

This behavior is shown with $UpdateSearcher.ServerSelection = 3 (wsusscn2.cab method), but also with method $UpdateSearcher.ServerSelection = 1 (connection to a wsus server), and I think also on method $UpdateSearcher.ServerSelection = 2 (windows update online).

There is no such issue on Windows 10. This erratic behavior is only shown on Win11 23h2 and above.

Another question would then be : what interface should I query to have the correct reporting?

Thanks for the feedback,

Simon
MotoX80 37,676 Reputation points

2025-02-14T19:34:37.7433333+00:00
And moreover, if you uninstall KB5051987, then KB5051989 and KB5051989 will still show as installed...

Maybe the answer is that "installed" should be interpreted as "installed or does not apply"?

I've been using the PSWindowsUpdate module from Powershell Gallery.

https://www.powershellgallery.com/packages/PSWindowsUpdate/2.2.1.5

PS C:\> Get-WUHistory -Last 200 | where-object -Property Title -like "*24H2*" | Format-Table -Property Result, Date, Title Result Date Title ------ ---- ----- Succeeded 2/11/2025 9:23:27 PM 2025-02 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5051987) Succeeded 1/14/2025 9:20:59 PM 2025-01 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5050009) Succeeded 1/14/2025 9:07:54 PM 2025-01 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 11, version 24H2 for x64 (KB5049622) Succeeded 12/11/2024 9:24:27 AM 2024-12 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5048667) Succeeded 12/5/2024 7:44:24 AM Windows 11, version 24H2

Even if I uninstalled all of the 24H2 cumulative updates, I would still be at base 24H2 which would (should?) supersede anything related to 23H2 or 22H2. If I tried to install KB5051989, I would expect it to fail because it does not apply to 24H2.

I would have to test it, but I would expect that if I had skipped installing 2025-01 (KB5050009) and went right to 2025-02 (KB5051987), then KB5050009 would show up as being installed because KB5051987 is a cumulative update and contains both 2024-12 (KB5051987) and 2025-01 (KB5050009).

Share via

Duplicate cumulative kb, Windows 11 update returns false information

4 additional answers

Your answer