Removing Windows software updates in the wrong order may cause the operating system to stop functioning (823836)


The information in this article applies to:

  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Advanced Server SP3
  • Microsoft Windows 2000 Advanced Server SP4
  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Server SP3
  • Microsoft Windows 2000 Server SP4
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Professional SP1
  • Microsoft Windows XP Professional SP1a
  • Microsoft Windows XP Professional SP2
  • Microsoft Windows XP Home Edition
  • Microsoft Windows XP Home Edition SP1
  • Microsoft Windows XP Home Edition SP1a
  • Microsoft Windows XP Home Edition SP2
  • Microsoft Windows 2000 Professional SP1
  • Microsoft Windows 2000 Professional SP2
  • Microsoft Windows 2000 Professional SP3
  • Microsoft Windows 2000 Professional SP4

SYMPTOMS

Your operating system may not function correctly or may not function at all after you remove a Microsoft Windows software update by using the Add or Remove Programs tool in Control Panel or by using the Spuninst.exe file. When you remove a Windows software update, you may receive a warning message that is similar to the following:Setup detected the following programs on your computer:
List of software updates and applications
If software update is removed, these programs may not run correctly. Do you want to continue?

CAUSE

This issue occurs if you remove the Windows software updates from the operating system in the wrong order.

Note To keep the files on the operating system consistent, remove Windows software updates in the opposite order of the order that you installed the updates. Remove the most recently installed Windows software update first, remove the next most recently installed software update next, and then so on.

The following scenarios may cause the operating system to stop functioning correctly.

Scenario 1

  1. You install Software Update 1.
  2. You install a service pack that was released before Software Update 1.
  3. You remove Software Update 1.

Scenario 2

  1. You install Software Update 1.
  2. You install Software Update 2.
  3. You remove Software Update 1.
Note We do not support these scenarios. We do not recommend that you remove software updates.

RESOLUTION

To work around this issue, remove the software updates in the opposite order of the order that you installed the updates.

Scenario 1

  1. Install Software Update 1.
  2. Install a service pack that was released before Software Update 1.
  3. Remove the service pack that you installed in step 2.
  4. Remove Software Update 1.
  5. Reinstall the service pack that you installed in step 2.

Scenario 2

  1. Install Software Update 1.
  2. Install Software Update 2.
  3. Remove Software Update 2.
  4. Remove Software Update 1.
To determine the order that the software updates were installed, you can create a TimeLine.log file. To do this, follow these steps:
  1. Click Start, click Run, type cmd, and then click OK.
  2. At the command prompt, type the following command:

    dir %windir%\*.log /o:d | findstr /i /r /c:q......\.log /c:kb......\.log /c:q......uninst\.log /c:kb......uninst\.log > %systemdrive%\TimeLine.log

  3. Press ENTER
When you open the TimeLine.log file (%systemdrive%\TimeLine.log), the software updates that are installed are listed in order by date. The most recently installed software update is listed at the end.

To remove a software update, remove the software update that is listed at the end of the TimeLine.log file, and then progress upward. Remove one software update at a time until you remove the software update that you ultimately want to remove.

If you are already experiencing an issue because you removed a software update in the incorrect order, and you are using Windows XP or Windows 2000, you can use the Qfecheck.exe tool to identify what software updates may be broken. You can use the Qfecheck.exe tool to track and to verify installed Windows software updates. When the Qfecheck.exe tool reports that a software update is broken, reinstall that software update to make sure that the correct file versions are installed. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

282784 Qfecheck.exe verifies the installation of Windows 2000 and Windows XP hotfixes

MORE INFORMATION

When you install a software update, an uninstall folder is created at %SystemRoot%\$NtUninstall[KBArticleNumber]$\. This uninstall folder contains the original files that the software update replaced.

When a software update is removed, the files from its uninstall folder are copied back to the operating system directories. Additionally, registry keys are set back to their original values.

If you remove a software update that is not the most recently installed software update, you receive a warning message that is similar to the following:Setup detected the following programs on your computer:
List of software updates and applications.
If software update is removed, these programs may not run correctly. Do you want to continue? This message contains a list of all software updates and applications that you applied to the computer since you applied the software update that you are trying to remove. When you install software updates in unattended mode by using the /quiet or /passive command line switch, you do not receive this warning message and the software update removal process proceeds.

For additional information about the command line switch options that are available when you install Windows software updates, click the following article number to view the article in the Microsoft Knowledge Base:

262841 Command line switches for Windows software update packages

Generally, applications do not depend on software updates, but they may depend on service packs. Contact the software developer or an appropriate newsgroup if you have questions about an application's dependencies on a particular software update or service pack.

Windows service packs are cumulative. The issues that are fixed in one service pack are also fixed in subsequent service packs. To determine whether a software update is included in a service pack, examine the Add or Remove Programs list. After service pack installation, software updates that are part of the latest installed Windows service pack do not appear in the Add or Remove Programs list, because service pack installation removes those entries from the list.

You can also review the following KB articles to determine whether a software update is included in a particular Windows Service Pack:

811113 List of fixes included in Windows XP Service Pack 2

324720 List of fixes in Windows XP Service Pack 1 and Windows XP Service Pack 1a

327194 List of bugs that are fixed in Windows 2000 Service Pack 4

320853 List of bugs that are fixed in Windows 2000 Service Pack 3

Sample Scenarios

Scenario 1
  1. You install Windows 2000 Service Pack 3 (SP3) on a computer.
  2. You install a post-Service Pack 4 (SP4) software update.
  3. You install Windows 2000 SP4.

    Note The service pack installation performs version checking on the software update. It does not replace the later-version software update files.
  4. At a later date, you remove the post-Windows 2000 SP4 software update.
The software update removal process replaces the files in the operating system directories with the files from the software update uninstall folder. This folder was created when the software update was installed. These files are the pre-Windows 2000 SP4 versions. This may cause a file mismatch between these files and the other operating system files. Therefore, Windows may stop functioning. Scenario 2
  1. You install Windows XP software update 828274 on a computer.
  2. You install Windows XP software update 820128.
  3. At a later date, you remove Windows XP software update 828274.
Software update 828274 updates kernel files. Software update 820128 updates kernel files, but it also updates Services.exe. Software update 820128 does not update Ntdll.dll. When you remove software update 828274, you replace the kernel files in the operating system directory with the original files from the directory's uninstall folder. This may cause a file mismatch, because the original kernel files may require different versions of Services.exe and Ntdll.dll than the versions of the files provided by software update 820128 that currently are on the system. This mismatch may cause Windows to behave incorrectly or to stop functioning.

Note We do not support these scenarios. We do not recommend that you remove software updates.

REFERENCES

For additional information about the standard terminology that is used to describe Microsoft software updates, tools, and add-ons, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

For more information about Update.exe, the package installer for Windows and Windows components, view the "Inside Update.exe - the package installer for Windows and Windows components" white paper located at the following Microsoft Web site:

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/deployment/winupdte.mspx

Modification Type:MajorLast Reviewed:1/12/2005
Keywords:kbsetup kbenv kbtshoot kbprb kberrmsg kbnofix kbBug KB823836 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.