Server 2012 (not R2) RODC fails to install Windows Updates

Question

Good morning all
Since around October, our 80-odd 2012 (non-R2) RODCs have been failing to install windows updates, rolling them back on reboot. Patches that don't require a reboot are fine. The short version is, please log a call with MS and reference this thread, if you're
having this issue as currently they're saying they won't fix this!!
Our product support group opened an official case and reported this with Microsoft and they've found the cause. PLEASE NOTE however, that this relates to RODC and ALL patches failing, not just 3000061 on non-RODC.
There was some chat relevant to this as originally it was thought KB3000061 was to blame, and a few other people had had the same issue there (see links at the bottom). I think however, that this issue now stands alone as any patch we try to install will
fail.
000093 2015-01-23 20:18:30, Info CSI 00000015 Begin executing advanced installer phase 38 (0x00000026) index 4 (sequence 43)
000094 Old component: [ml:350{175},l:348{174}]"Microsoft-Windows-Web-Services-for-Management-Core, Culture=neutral, Version=6.2.9200.16384, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=wow64, versionScope=NonSxS"
000095 New component: [ml:350{175},l:348{174}]"Microsoft-Windows-Web-Services-for-Management-Core, Culture=neutral, Version=6.2.9200.17100, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=wow64, versionScope=NonSxS"
000096 Install mode: install
000097 Installer ID: {118ca598-79a0-4297-953d-e82183960fd2}
000098 Installer name: [13]"Group Trustee"
000099 2015-01-23 20:18:30, Error CSI 00000001@2015/1/23:20:18:30.673 (F) CMIADAPTER: Inner Error Message from AI HRESULT = HRESULT_FROM_NT(STATUS_NOT_SUPPORTED)
000100 [
000101 (null)
000102 ]
000103 [gle=0x80004005]
000104 2015-01-23 20:18:30, Error CSI 00000002@2015/1/23:20:18:30.673 (F) CMIADAPTER: AI failed. HRESULT = HRESULT_FROM_NT(STATUS_NOT_SUPPORTED)
000105 Element:
000106 [372]"<groupTrustee xmlns="urn:schemas-microsoft-com:asm.v3" name="WinRMRemoteWMIUsers__" description="Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user." type="User" enabled="true">
000107
000108 <members></members>
000109
000110 </groupTrustee>"
000111 [gle=0x80004005]
000112 2015-01-23 20:18:30, Error CSI 00000003@2015/1/23:20:18:30.673 (F) CMIADAPTER: Exiting with HRESULT code = HRESULT_FROM_NT(STATUS_NOT_SUPPORTED).
000113 [gle=0x80004005]
Cause:
The installer uses SAM API calls to manage the group. It always connects to the local SAM instance. The component also handles an uninstall task in the same function. On uninstall the group is being deleted.
So the SAM handle is requested with "Create Group" and "Delete" access.
The error happens because a RODC does not allow any changes and thus returns STATUS_NOT_SUPPORTED.
More information about the prevent from accidental deletion feature please refer :
http://technet.microsoft.com/en-us/library/cc773347(v=WS.10).aspx
http://technet.microsoft.com/en-us/library/cc739350(v=WS.10).aspx
Recommendation:
This is a Bug in the RODC running on server 2012, However you may do an in place upgrade to Server 2012 R2 and then proceed with the installation of the patch.
The bad news is this is fixed in 2012 R2 with a hotfix - but it isn't fixed in 2012 and it won't be because.. they've only had one official report logged. And that was by us. So, if you want this fixed, you need to start logging this with MS now.
What I can say just now is that this isn't related to the registry fixes with WinEVT we've all been trying, it's NOT limited to 2008 that has been upgraded in place to 2012 (our product support group replicated it in the lab with a brand new 2012 promoted
to RODC) and it IS only happening with RODC. Possible fix might be to make your RODC RW for a bit and install your patches then.
Background reading:
https://social.technet.microsoft.com/Forums/en-US/f77691d8-a9d0-4714-98ad-71665cfa8965/kb3000061-fails-to-install-on-server-2012?forum=winserver8gen
https://social.technet.microsoft.com/Forums/en-US/70219bcb-36a8-466e-900b-cbf390db38d2/failure-configuring-windows-updates-reverting-changes-postreboot-status-0x800f0922?forum=winserver8gen

Answer 1

The error indicates that IIS is returning a "404 not found" error back to the Windows Update Agent.  That might mean that you need to specify the correct port that WSUS is listening on, e.g.:
WSUSServer=http://yourserver:8530
Thanks,
-Michael Niehaus
Senior Product Marketing Manager, Windows Deployment
http://blogs.technet.com/mniehaus
[email protected]