Microsoft KB Archive/823836

= Removing Windows software updates in the wrong order may cause the operating system to stop functioning =

Article ID: 823836

Article Last Modified on 10/30/2006

-

APPLIES TO


 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Service Pack 2
 * Microsoft Windows 2000 Service Pack 3
 * Microsoft Windows 2000 Service Pack 4
 * Microsoft Windows XP Professional
 * Microsoft Windows XP Professional
 * Microsoft Windows XP Service Pack 1a
 * Microsoft Windows XP Professional
 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Service Pack 1a
 * Microsoft Windows XP Home Edition
 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Service Pack 2
 * Microsoft Windows 2000 Service Pack 3
 * Microsoft Windows 2000 Professional Edition

-





SYMPTOMS
Your operating system may not function correctly or may not function at all after you remove a Microsoft Windows software update by using the Add or Remove Programs tool in Control Panel or by using the Spuninst.exe file. When you remove a Windows software update, you may receive a warning message that is similar to the following:

Setup detected the following programs on your computer:

If software update is removed, these programs may not run correctly. Do you want to continue?



CAUSE
This issue occurs if you remove the Windows software updates from the operating system in the wrong order.

Note To keep the files on the operating system consistent, remove Windows software updates in the opposite order of the order that you installed the updates. Remove the most recently installed Windows software update first, remove the next most recently installed software update next, and then so on.

The following scenarios may cause the operating system to stop functioning correctly.

Scenario 1

 * 1) You install.
 * 2) You install a service pack that was released before.
 * 3) You remove.

Scenario 2

 * 1) You install.
 * 2) You install.
 * 3) You remove.

Note We do not support these scenarios. We do not recommend that you remove software updates.



RESOLUTION
To work around this issue, remove the software updates in the opposite order of the order that you installed the updates.

Scenario 1

 * 1) Install.
 * 2) Install a service pack that was released before.
 * 3) Remove the service pack that you installed in step 2.
 * 4) Remove.
 * 5) Reinstall the service pack that you installed in step 2.

Scenario 2

 * 1) Install.
 * 2) Install.
 * 3) Remove.
 * 4) Remove.

To determine the order that the software updates were installed, you can create a TimeLine.log file. To do this, follow these steps:

 Click Start, click Run, type cmd, and then click OK. At the command prompt, type the following command:

dir %windir%\*.log /o:d | findstr /i /r /c:q......\.log /c:kb......\.log /c:q......uninst\.log /c:kb......uninst\.log > %systemdrive%\TimeLine.log

 Press ENTER

When you open the TimeLine.log file (%systemdrive%\TimeLine.log), the software updates that are installed are listed in order by date. The most recently installed software update is listed at the end.

To remove a software update, remove the software update that is listed at the end of the TimeLine.log file, and then progress upward. Remove one software update at a time until you remove the software update that you ultimately want to remove.

If you are already experiencing an issue because you removed a software update in the incorrect order, and you are using Windows XP or Windows 2000, you can use the Qfecheck.exe tool to identify what software updates may be broken. You can use the Qfecheck.exe tool to track and to verify installed Windows software updates. When the Qfecheck.exe tool reports that a software update is broken, reinstall that software update to make sure that the correct file versions are installed. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

282784 Qfecheck.exe verifies the installation of Windows 2000 and Windows XP hotfixes



MORE INFORMATION
When you install a software update, an uninstall folder is created at %SystemRoot%\$NtUninstall[KBArticleNumber]$\. This uninstall folder contains the original files that the software update replaced.

When a software update is removed, the files from its uninstall folder are copied back to the operating system directories. Additionally, registry keys are set back to their original values.

If you remove a software update that is not the most recently installed software update, you receive a warning message that is similar to the following:

Setup detected the following programs on your computer:

If software update is removed, these programs may not run correctly. Do you want to continue?

This message contains a list of all software updates and applications that you applied to the computer since you applied the software update that you are trying to remove. When you install software updates in unattended mode by using the /quiet or /passive command line switch, you do not receive this warning message and the software update removal process proceeds.

For additional information about the command line switch options that are available when you install Windows software updates, click the following article number to view the article in the Microsoft Knowledge Base:

262841 Command line switches for Windows software update packages

Generally, applications do not depend on software updates, but they may depend on service packs. Contact the software developer or an appropriate newsgroup if you have questions about an application’s dependencies on a particular software update or service pack.

Windows service packs are cumulative. The issues that are fixed in one service pack are also fixed in subsequent service packs. To determine whether a software update is included in a service pack, examine the Add or Remove Programs list. After service pack installation, software updates that are part of the latest installed Windows service pack do not appear in the Add or Remove Programs list, because service pack installation removes those entries from the list.

You can also review the following KB articles to determine whether a software update is included in a particular Windows Service Pack:

811113 List of fixes included in Windows XP Service Pack 2

324720 List of fixes in Windows XP Service Pack 1 and Windows XP Service Pack 1a

327194 List of bugs that are fixed in Windows 2000 Service Pack 4

320853 List of bugs that are fixed in Windows 2000 Service Pack 3

Scenario 1

 * 1) You install Windows 2000 Service Pack 3 (SP3) on a computer.
 * 2) You install a post-Service Pack 4 (SP4) software update.
 * 3) You install Windows 2000 SP4.

Note The service pack installation performs version checking on the software update. It does not replace the later-version software update files.
 * 1) At a later date, you remove the post-Windows 2000 SP4 software update.

The software update removal process replaces the files in the operating system directories with the files from the software update uninstall folder. This folder was created when the software update was installed. These files are the pre-Windows 2000 SP4 versions. This may cause a file mismatch between these files and the other operating system files. Therefore, Windows may stop functioning.

Scenario 2

 * 1) You install Windows XP software update 828274 on a computer.
 * 2) You install Windows XP software update 820128.
 * 3) At a later date, you remove Windows XP software update 828274.

Software update 828274 updates kernel files. Software update 820128 updates kernel files, but it also updates Services.exe. Software update 820128 does not update Ntdll.dll. When you remove software update 828274, you replace the kernel files in the operating system directory with the original files from the directory's uninstall folder. This may cause a file mismatch, because the original kernel files may require different versions of Services.exe and Ntdll.dll than the versions of the files provided by software update 820128 that currently are on the system. This mismatch may cause Windows to behave incorrectly or to stop functioning.

Note We do not support these scenarios. We do not recommend that you remove software updates.

