Knowledge Base

You may be unable to apply more updates at a certain point on a Windows Small Business Server 2003-based computer

Article ID: 940276

Article Last Modified on 11/30/2007

APPLIES TO

Microsoft Windows Small Business Server 2003 Standard Edition
Microsoft Windows Small Business Server 2003 Premium Edition
Microsoft Windows Server 2003 Service Pack 2

SYMPTOMS

On a Microsoft Windows Small Business Server 2003 (Windows SBS)-based computer, you may be unable to use Windows Update or Microsoft Update to apply more updates at a certain point. When you try to install an update or a service pack, you may receive an error message that resembles one of the following:

Name of Update Package Setup could not verify the integrity of the file Update.inf. Make sure the Cryptographic service is running on this computer.
Failed to install catalog files.

If you check the Svcpack.log file when you install Windows Server 2003 Service Pack 2 (SP2), you may see an error message that resembles the following: 960.484: InstallSingleCatalogFile: MyInstallCatalog failed for Tmp.0.ntprint.cat; error=0xfffffbfe.

If you check the KB nnnnnn.log update installation log, you may see an error message that resembles the following: 708.797: InstallSingleCatalogFile: MyInstallCatalog failed for KB917734.cat; error=0xfffffbfe.

Notes

The nnnnnn placeholder represents the number of the Microsoft Knowledge Base article that refers to an update.
The update installation log is available at %windir%.
The "error=0xfffffbfe" entry represents the JET_errRecordTooBig column value.

Typically, this problem occurs on a computer that has many QFEs together with General Distribution Releases (GDRs). QFEs are hotfixes that are only available from Microsoft Customer Service and Support (CSS). GDRs are available on a public Microsoft Web site.

Note There may be other issues that cause automatic updates to fail. If you do not see the "error=0xfffffbfe" entry, another issue is responsible for the symptoms that you see.

CAUSE

This problem occurs because the number of update packages reaches an architectural limitation in the Windows security database.

RESOLUTION

To resolve this problem, use the following method.

Batch file procedure

Copy the following text to a file that is named "Fixcatalog.bat."

@ECHO OFF
SETLOCAL EnableDelayedExpansion
net stop cryptsvc
cd /d %WINDIR%\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
attrib -s *.*
md %WINDIR%\system32\CatRoot\backup
FOR /F "delims=" %%a in ('REG QUERY "HKLM\Software\microsoft\Windows NT\CurrentVersion\Hotfix"') DO (REG QUERY "%%a" /v "Service Pack" | findstr /c:"0x2"
if !ERRORLEVEL!==0 (
For /f "delims=\ tokens=7" %%i in ('REG QUERY "%%a" /v "Service Pack"') do (
move %%i.cat %WINDIR%\system32\CatRoot\backup 
)
)
)
if exist %WINDIR%\system32\CatRoot\backup\kb912354.cat copy %WINDIR%\system32\CatRoot\backup\kb912354.cat  
%WINDIR%\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
ren %WINDIR%\system32\catroot2 catroot2.old
md %WINDIR%\system32\CatRoot2
net start cryptsvc
@echo Ready for SP2 install.  You can now restart the SP2 installation.

Execute the batch file.

When you cannot complete the batch file procedure

In some cases, you cannot complete the batch file method. You cannot do this because one or more of the following conditions are true:

You may be unable to rename the CatRoot2 folder.
The Cryptographic Services service may not always stop gracefully, and the service may remain in a stopped state.

To complete the batch file method, you must restart the computer in safe mode, and then implement the method that is appropriate for your situation.

How to uninstall Windows Server 2003 SP2 after you complete the batch file method

After you complete the batch file method, your update history is removed. If you have to then remove Windows Server 2003 SP2, use one of the follow methods.

Method 1: Batch file procedure

Create a full backup of the system.
Start the Windows Server 2003 SP2 uninstallation, and then wait for the uninstallation to finish.
Restart the server when you are prompted.

Copy the following text to a file that is named "Fixuninstall.bat."

net stop cryptsvc
copy %WINDIR%\system32\CatRoot\backup\*  %WINDIR%\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
ren %WINDIR%\system32\catroot2 catroot2.old
md %WINDIR%\system32\CatRoot2
net start cryptsvc
@echo Ready for SP2 uninstall.

Execute the batch file.

Method 2: Manual procedure

Create a full backup of the system.
Start the Windows Server 2003 SP2 uninstallation.
Restart the server when you are prompted.
Click Start, click Administrative Tools, click Services, right-click Cryptographic Services, and then select Stop.
Open Windows Explorer, and then locate the following folder:

drive C:\WINDOWS\system32\CatRoot\backup
Copy all the files in the drive:\WINDOWS\system32\CatRoot\backup folder to the drive:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} folder.
Locate the following folder:

drive:\WINDOWS\SYSTEM32\CatRoot2
Rename the folder that you located in step 5 to the following folder name:

drive:\WINDOWS\SYSTEM32\CatRoot2.old

Note Make sure that you rename the CatRoot2 folder. Do not rename the CatRoot folder.
Create the following empty folder:

drive:\WINDOWS\SYSTEM32\CatRoot2
Start the Cryptographic Services service.

MORE INFORMATION

For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

925931 You may be unable to apply more updates at a certain point on a Windows Server 2003-based computer

822798 You cannot install some updates or programs

Keywords: kbtshoot kbexpertiseinter kbprb KB940276

Microsoft KB Archive/940276

Contents