jborean93
commented
3 years ago Sorry for not getting back to you earlier on this, I've tried to replicate this problem but cannot. I ran the following playbook twice on a Server 2019 host
- hosts: '2019'
gather_facts: no
tasks:
- win_updates:
category_names:
- Security Updates
state: installed
log_path: C:\temp\wua.log
register: res
- win_reboot:
when: res.reboot_requiredThe log produced the following output
2021-03-08 12:38:00Z WUA is available in current logon process, running natively
2021-03-08 12:38:00Z Creating Windows Update session...
2021-03-08 12:38:00Z Create Windows Update searcher...
2021-03-08 12:38:00Z Setting the Windows Update Agent source catalog...
2021-03-08 12:38:00Z Requested search source is 'default'
2021-03-08 12:38:00Z Search source set to 'default' (ServerSelection = 0)
2021-03-08 12:38:00Z Searching for updates to install
2021-03-08 12:38:04Z Found 1 updates
2021-03-08 12:38:04Z Creating update collection...
2021-03-08 12:38:04Z Adding update bcd58b64-3cef-42da-b169-a66060ae195e - 2021-02 Cumulative Update for Windows Server 2019 (1809) for x64-based Systems (KB4601345)
2021-03-08 12:38:04Z Calculating pre-install reboot requirement...
2021-03-08 12:38:04Z No reboot is pending...
2021-03-08 12:38:04Z Downloading updates...
2021-03-08 12:38:04Z Creating downloader object...
2021-03-08 12:38:04Z Creating download collection...
2021-03-08 12:38:04Z Adding update (1 of 1) bcd58b64-3cef-42da-b169-a66060ae195e
2021-03-08 12:38:04Z Downloading (1 of 1) bcd58b64-3cef-42da-b169-a66060ae195e
2021-03-08 12:39:15Z Download result code for (1 of 1) bcd58b64-3cef-42da-b169-a66060ae195e = 2
2021-03-08 12:39:15Z Installing updates...
2021-03-08 12:39:15Z Creating installer object...
2021-03-08 12:39:15Z Creating install collection...
2021-03-08 12:39:15Z Adding update bcd58b64-3cef-42da-b169-a66060ae195e
2021-03-08 12:50:57Z Update (1 of 1) bcd58b64-3cef-42da-b169-a66060ae195e succeeded
2021-03-08 12:50:57Z Performing post-install reboot requirement check...
2021-03-08 12:50:57Z Return value:
{
"updates": {
"bcd58b64-3cef-42da-b169-a66060ae195e": {
"id": "bcd58b64-3cef-42da-b169-a66060ae195e",
"title": "2021-02 Cumulative Update for Windows Server 2019 (1809) for x64-based Systems (KB4601345)",
"categories": [
"Security Updates"
],
"kb": [
"4601345"
],
"installed": true
}
},
"failed_update_count": 0,
"found_update_count": 1,
"changed": true,
"reboot_required": true,
"installed_update_count": 1,
"filtered_updates": {
}
}
2021-03-08 12:50:57Z Native job completed with output:
Name Value
---- -----
updates {bcd58b64-3cef-42da-b169-a66060ae195e}
failed_update_count 0
found_update_count 1
changed True
reboot_required True
installed_update_count 1
filtered_updates {}On the 2nd run
2021-03-08 12:54:52Z WUA is available in current logon process, running natively
2021-03-08 12:54:52Z Creating Windows Update session...
2021-03-08 12:54:52Z Create Windows Update searcher...
2021-03-08 12:54:52Z Setting the Windows Update Agent source catalog...
2021-03-08 12:54:52Z Requested search source is 'default'
2021-03-08 12:54:53Z Search source set to 'default' (ServerSelection = 0)
2021-03-08 12:54:53Z Searching for updates to install
2021-03-08 12:55:00Z Found 1 updates
2021-03-08 12:55:00Z Creating update collection...
2021-03-08 12:55:00Z Skipping update f71124b3-83b4-4dd4-918d-09490a61f861 - Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.331.2638.0) as it was not found in the category names filter
2021-03-08 12:55:00Z Calculating pre-install reboot requirement...
2021-03-08 12:55:00Z Native job completed with output:
Name Value
---- -----
updates {}
found_update_count 0
changed False
reboot_required False
installed_update_count 0
filtered_updates {f71124b3-83b4-4dd4-918d-09490a61f861}It goes to show that the update was installed and the subsequent run didn't detect it still needed to be installed. I'm not sure what else it could be, all these results are based on what the Windows Update API returns, we aren't actually checking if these updates are installed, just asking WUA to get the list and telling it what ones to install.
If you do come across it again you can use the following PowerShell code to try and get some more information about the update itself. It might contain some helpful info that could indicate what is going wrong.
$session = New-Object -ComObject Microsoft.Update.Session
$searcher = $session.CreateUpdateSearcher()
$searchResult = $searcher.Search("IsInstalled = 0")
$searchResult.Updates | ForEach-Object -Process {
[PSCustomObject]@{
Title = $_.Title
AutoSelectOnWebSites = $_.AutoSelectOnWebSites
CanRequireSource = $_.CanRequireSource
Categories = $_.Categories | ForEach-Object -Process {
[PSCustomObject]@{
Name = $_.Name
CategoryID = $_.CategoryID
Description = $_.Descripiton
Type = $_.Type
}
}
Deadline = $_.Deadline
DeltaCompressedContentAvailable = $_.DeltaCompressedContentAvailable
DeltaCompressedContentPreferred = $_.DeltaCompressedContentPreferred
Description = $_.Description
EulaAccepted = $_.EulaAccepted
EulaText = $_.EulaText
HandlerID = $_.HandlerID
Image = $_.Image
InstallationBehavior = [PSCustomObject]@{
CanRequestUserInput = $_.InstallationBehavior.CanRequestUserInput
Impact = switch ($_.InstallationBehavior.Impact) {
0 { 'Normal' }
1 { 'Minor' }
2 { 'RequiresExclusiveHandling' }
default { $_ }
}
RebootBehavour = switch ($_.InstallationBehavior.RebootBehavior) {
0 { 'NeverReboots' }
1 { 'AlwaysRequiresReboot' }
2 { 'CanRequestReboot' }
default { $_ }
}
RequiresNetworkConnectivity = $_.InstallationBehavior.RequiresNetworkConnectivity
}
IsBeta = $_.IsBeta
IsDownloaded = $_.IsDownloaded
IsHidden = $_.IsHidden
IsInstalled = $_.IsInstalled
IsMandatory = $_.IsMandatory
IsUninstallable = $_.IsUninstallable
LastDeploymentChangeTime = $_.LastDeploymentChangeTime
MaxDownloadSize = $_.MaxDownloadSize
MinDownloadSize = $_.MinDownloadSize
MsrcSeverity = $_.MsrcSeverity
RecommendedCpuSpeed = $_.RecommendedCpuSpeed
RecommendedHardDiskSpace = $_.RecommendedHardDiskSpace
RecommendedMemory = $_.RecommendedMemory
ReleaseNotes = $_.ReleaseNotes
SupportUrl = $_.SupportUrl
Type = switch ($_.Type) {
1 { 'Software' }
2 { 'Driver' }
default { $_ }
}
UninstallationNotes = $_.UninstallationNotes
UninstallationBehavior = [PSCustomObject]@{
CanRequestUserInput = $_.UninstallationBehavior.CanRequestUserInput
Impact = switch ($_.UninstallationBehavior.Impact) {
0 { 'Normal' }
1 { 'Minor' }
2 { 'RequiresExclusiveHandling' }
default { $_ }
}
RebootBehavour = switch ($_.UninstallationBehavior.RebootBehavior) {
0 { 'NeverReboots' }
1 { 'AlwaysRequiresReboot' }
2 { 'CanRequestReboot' }
default { $_ }
}
RequiresNetworkConnectivity = $_.UninstallationBehavior.RequiresNetworkConnectivity
}
KBArticleIDs = $null
DeploymentAction = switch ($_.DeploymentAction) {
0 { 'None' }
1 { 'Installation' }
2 { 'Uninstallation' }
3 { 'Detection' }
default { $_ }
}
DownloadPriority = switch ($_.DownloadPriority) {
0 { 'Low' }
1 { 'Normal' }
2 { 'High' }
3 { 'ExtraHigh' }
default { $_ }
}
RebootRequired = $_.RebootRequired
IsPresent = $_.IsPresent
BrowseOwnly = $_.BrowseOwnly
PerUser = $_.PerUser
AutoSelection = switch ($_.AutoSelection) {
0 { 'LetWindowsUpdateDecide' }
1 { 'AutoSelectIfDownloaded' }
2 { 'NeverAutoSelect' }
3 { 'AlwaysAutoSelect' }
default { $_ }
}
AutoDownload = switch ($_.AutoDownload) {
0 { 'LetWindowsUpdateDecide' }
1 { 'NeverAutoDownload' }
2 { 'AlwaysAutoDownload' }
default { $_ }
}
}
}
dpower1985
larkoie
vijainimmala
agibson2
a-stoyanov
dannykorpan
SUMMARY
When running the ansible.windows.win_updates module Cumulative security updates for Windows Server 2019 are not being correctly installed on target hosts. During a first run of the module the cumulative update shows as being installed successfully, however on subsequent runs of the module it detects that the same update is still outstanding installation and so attempts to install it again.
Opening the Control Panel in the OS shows the update as installed, but on opening the built in Windows Updater the update is detected as not installed and then once again installed via Windows. After the first pass the subsequent installations by both the windows_updates module and the built in Windows Updater are extremely quick, so it appears the first pass is actually performing the installation but not then marking it as correctly installed.
This is coming from a fresh vanilla installation of Windows Server 2019 being built in Packer with Packer invoking the ansible playbooks. The only configuration carried out prior to Ansible playbook is configuration of WinRM and creation of additional local administrator account, performed in autounattend.xml
Other updates appear to install correctly, but not the larger cumulative update.
ISSUE TYPE
COMPONENT NAME
ansible.windows.windows_updates
ANSIBLE VERSION
CONFIGURATION
OS / ENVIRONMENT
Target OS is Windows Server 2019
STEPS TO REPRODUCE
EXPECTED RESULTS
Installation of updates to complete successfully
ACTUAL RESULTS
As can be seen in the log below the same update,
2021-02 Cumulative Update for Windows Server 2019 (1809) for x64-based Systems (KB4601345)is picked up as requiring installation in all three runs, then shows as not being present in the post-update search run.First run update log
Second update log
Third update log
After all update runs are complete a search pass of the module shows the same update as not installed,