Updating Windows 7

[steve30]

I did a fresh installation of Windows 7 SP1 on a Thinkpad T420 a while back. I would like to update it, but Windows Update returns an "Unknown Error" (see screenshot).

Does anyone have any ideas? Despite Windows 7's age, I am actually quite new to it. Until recently, the newest version of Windows I had any decent experience with was XP.

I did wonder if it may have something to do with SSL root certificates, as, out of the box, this Windows 7 system was unable to access quite a lot of HTTPS sites.

Thanks
steve30

[madires]

MS changed windows update back then. When you install a fresh WIn7 SP1 you have to disable automatic updates, install some updates manually and enable automatic updates again. I'm not sure if this still works, but the updates required are KB3020369, KB3125574, KB3138612 and KB3153199 (install in this order).

[andy3055]

If you have not already done, make sure that the clock has the correct time.

[Fraser]

I experienced this issue myself after a fresh installation of Win 7. As has been stated, there are problems with SSL certificates and accessing the Update Server. I had to download a load of Microsoft updates using another PC then manually installed them on the newly built PC to correct the issue.

Fraser

[edpalmer42]

You might want to use a tool like WSUSOffline and make an ISO of all the Windows 7 updates.  That way, you've got all the updates locally and don't have to worry about Microsoft messing around with or completely removing the updates.

Note that the current version (12.0) of WSUSOffline has removed support for Windows 7 so you'll need to use V11.9.1.

https://download.wsusoffline.net/

[steve30]

Thanks for the replies. I installed the updates madires suggested (downloaded from the MS Update Catalogue). Then I tried WSUSOffline and it downloaded most of the updates, but not all. However, after that, Windows Update itself worked and it was able to download and install every update it wanted, albeit with having to restart the machine and rerun Windows Update several times.

I'm now trying WSUSOffline again to see if that will download everything so I can save them on a USB memory stick.

[edpalmer42]

Tell WSUSOffline that you want to create an ISO.  It creates one that includes the updates and the installer.

It also has it's own blacklist of updates that it won't include for various reasons.

[RaymondMack]

Try using abbodi1406's WHD-W7UI. You will need WHDownloader to download all the updates. Abbodi's script then integrates them into a new installation media (.iso image). I use the same tools for my Win8.1 machine since Microsoft makes updating anything older than Win10 almost impossible and it saves a massive amount of time and wasted bandwidth for repeatedly downloading updates after a fresh install.

https://forums.mydigitallife.net/threads/abbodi1406s-batch-scripts-repo.74197/

https://forums.mydigitallife.net/forums/whdownloader.56/

There is also the Russian made SiMPLiX UpdatePack for Win7.

https://blog.simplix.info/update7/

(English translation)

https://blog-simplix-info.translate.goog/update7/?_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc

The various projects over at My Digital Life Forums (and other sites) are a huge time saver if you have to update and maintain older systems.

[coromonadalix]

Try using abbodi1406's WHD-W7UI. You will need WHDownloader to download all the updates. Abbodi's script then integrates them into a new installation media (.iso image). I use the same tools for my Win8.1 machine since Microsoft makes updating anything older than Win10 almost impossible and it saves a massive amount of time and wasted bandwidth for repeatedly downloading updates after a fresh install.

https://forums.mydigitallife.net/threads/abbodi1406s-batch-scripts-repo.74197/

https://forums.mydigitallife.net/forums/whdownloader.56/

There is also the Russian made SiMPLiX UpdatePack for Win7.

https://blog.simplix.info/update7/

(English translation)

https://blog-simplix-info.translate.goog/update7/?_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc

The various projects over at My Digital Life Forums (and other sites) are a huge time saver if you have to update and maintain older systems.

+1

And on some websites  cough cough loll   some people do them too ..  (originals iso's with updated  drivers) etc ...
 

Yes the  UpdatePack7R2 is well known  and work great

[Shock]

Please be aware Windows 7 has every update you need and some you might choose not to install on the MS website. All downloadable as optional (offline) full installs.

I suggest not using 3rd party websites, least you find you are now downloading their own "security" updates sometime in the future without your knowledge. The risk profile is like divorcing a cheating wife then dating a hooker.

[steve30]

It sucks that Windows can be so difficult to update. Last year, I did a fresh install of MacOSX 10.4 Tiger onto my iMac G5, ran the updater, and it updated itself over the internet straight away with no problems.

[gmb42]

It sucks that Windows can be so difficult to update. Last year, I did a fresh install of MacOSX 10.4 Tiger onto my iMac G5, ran the updater, and it updated itself over the internet straight away with no problems.

It sucks when using an unsupported and obsolete OS, tried that with macOS?

[Mechatrommer]

It sucks that Windows can be so difficult to update. Last year, I did a fresh install of MacOSX 10.4 Tiger onto my iMac G5, ran the updater, and it updated itself over the internet straight away with no problems.

maybe because most people didnt pay $129.95 for a Win7 license.. iirc i only need KB3102810 to make updater works correctly on my Win7 SP1 install. the trick was, i copy pasted the error the Windows Updater returned in google and some site suggested the patch number (of course must be from M$ official website)

[SiliconWizard]

Yes, never had any problem updating Win 7, I still use it. It has all the latest updates ever released, except the very last one which was marked optional: KB4539601 (2020-01-31, Preview of Monthly Rollup).

Just because I never installed the previews of monthly rollups and this last one never got past the "preview" stage. And I highly suspected this last one to contain stuff to add more telemetry and possibly annoy you to update to Win 10.

But it still appears in Windows Update, and I'm pretty sure it's still going to install if I select it.

[Shock]

Does anyone have a list and order of updates without the telemetry or nagging updates? Perhaps that would be a better approach. With telemetry it's something like Windows 7, SP1, Service Stack Update, Convenience Rollup.

This link covers some of them, but not sure whats current.

[mariush]

I wrote instructions for someone in the past on another forum

from windows 7 home premium without service pack I bought retail

To get up to date, you'll then need to download these and INSTALL THEM IN THIS ORDER :

KB2533552 : https://www.catalog.update.microsoft.com/Search.aspx?q=kb2533552

Download the one without "Embedded" in text. It updates the "Windows Update" within Windows 7 to accept the big Service Pack 1 package (without it, it will take literally hours for the Service Pack 1 to install)


KB976932 :  https://www.catalog.update.microsoft.com/Search.aspx?q=KB976932

You'll want the one in the middle, titled "Windows 7 Service Pack 1 for x64-based Systems (KB976932)", 912.4 MB

From there, you have the unofficial service Pack 2 called "Convenience Rollup Update for Windows 7 SP1 and Windows 2008" : https://support.microsoft.com/en-us/topic/convenience-rollup-update-for-windows-7-sp1-and-windows-server-2008-r2-sp1-da9b2435-2a1c-e7fa-43f5-6bfb34767d65


In order to be able to install it, you need to first install:


KB30200369 : April 2015 servicing stack update for Windows 7 and Windows Server 2008 R2  : https://www.catalog.update.microsoft.com/Search.aspx?q=KB3020369

Second link is for 64 bit version - it's another update for "Windows update" to allow installing lots of updates in one shot


Then the actual cumulative update :


KB3125574 : Update for Windows 7 for x64-based Systems (KB3125574)  : https://www.catalog.update.microsoft.com/search.aspx?q=kb3125574

Last one in the list is for 64 bit, 477 MB.


Then you should be able to just get the latest cumulative security updates which is a package of security updates from this "SP2" until the end


Again, you need to install some small updates to be able to install the big update


KB4490628  2019-03 Servicing Stack Update for Windows 7 for x64-based Systems (KB4490628)  : https://www.catalog.update.microsoft.com/Search.aspx?q=KB4490628


KB4474419 : a hashing/encryption library update , library is used by windows update (last entry is windows 7 64 bit) :  https://www.catalog.update.microsoft.com/Search.aspx?q=KB4474419


KB4536952 : another " windows update" update : https://www.catalog.update.microsoft.com/Search.aspx?q=KB4536952


and now you can actually get the last package of updates


kb4534310 : Security rollup  : https://www.catalog.update.microsoft.com/Search.aspx?q=KB4534310

Second link is Windows 7 64 bit

Google for that KB number for each update to read the description and see if there are prerequisites I may have missed ...

They were saying the 2020 rollup is the last, but they kept releasing some critical fixes and they still release security rollups
See https://www.catalog.update.microsoft.com/Search.aspx?q=security%20monthly%20rollup%20for%20Windows%207  and sort by last updated ... for example here's the June 2022 one, 380 MB of fixes and updates (they're cumulative, you don't need to download and install all the ones in between, the most recent has everything the previous updates had) : https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=d4babf22-3c2c-4c63-87e5-ed21431895da

[Shock]

Just to clarify this is with or without telemetry or any of the nag updates included?

[mariush]

The quality monthly rollups should not include the nagware. 

Last time I reinstalled Windows 7 - around 1 year ago - I basically did what I wrote above and had no nags no issues.  I upgraded to a Ryzen 5800x and went with Windows 10 - the serial from my Windows 7 worked and Windows 10 installed a Windows 10 Home Edition.
Bought the Windows 7 from Amazon UK for around $70 back (in British pounds) then ... so I think I got my money's worth.

Anyway, you can test by installing in Virtualbox everything and see what happens.

btw .. i still have my copy of windows 7 home premium retail on google drive, if interested i can give you the link to download it (a bunch of 7zip password protected files, because google drive scans file names otherwise). The iso checksum is same as the public checksums if you care to check.

[Shock]

I did similar a few years back, but it's been a while. I'll do a clean virtualized install and see what it asks for.

Thanks for the offer am good though for media and licenses. I've never actually used an oem version of Windows, been fortunate over the years to be either gifted or buy full retail copies through work.

[Mechatrommer]

Just to clarify this is with or without telemetry or any of the nag updates included?

you can always google and find people (or some organization?) made a website with nice graphics about it... https://windowsreport.com/block-telemetry-windows-7/ and you can also google on how to uninstall updates and read each of their description... if you can uninstall "windows genuine activation number authentication" service, guess how easy it is to remove telemetry services?

[Microcheap]

Just had the same problem recently reinstalling Win7 in a VM. The solutions is simply update Windows Update 

https://docs.microsoft.com/en-us/troubleshoot/windows-client/deployment/update-windows-update-agent

After that, Windows will download and install all patches normally.

[RaymondMack]

Please be aware Windows 7 has every update you need and some you might choose not to install on the MS website. All downloadable as optional (offline) full installs.

I suggest not using 3rd party websites, least you find you are now downloading their own "security" updates sometime in the future without your knowledge. The risk profile is like divorcing a cheating wife then dating a hooker.

The MDL tools I suggested download updates directly from Microsoft's Update Catalog... Abbodi's script then integrates these *untouched* files into *your* installation media. I fail to see why this is like dating a hooker. Though I do generally agree with your sentiment: Do not, under any circumstances, use an image made by someone other than yourself. MDL actively prevents the sharing of image files for this very reason. Hence tools and scripts provided by members to do the heavy lifting and which can be scrutinized before being deployed.

At the end of the day, why waste time and bandwidth updating fresh installs when there are legitimate and safe solutions for integrating updates? Win7 is an EOL OS. Unless there is some new and glaring vulnerability that MS feels the burning need to patch, there will not be any further updates from them. So it’s a one and done deal.

[Shock]

I explained the risk clearly in my post. Obviously scripts need checking, downloading repacks or downloader replacements or any 3rd party executables is bad.

[coromonadalix]

Never had any problems with reputable sources,   done tons of slipstreaming

used tools to download updates etc ...   integration etc ...

yes you have to do some homework before you do something  ...

[ESXi]

All you should do without going through the update process to get it to work.

New cert
ISRG_Root_X1
https://search.censys.io/certificates/96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
https://mega.nz/file/cUxBhT6a#jzRjAiL6e5Y4baCOl9sfTWSuEkcE3uKd5hGJjFMmUXk

SHA-1
cabd2a79a1076a31f21d253635cb039d4329a5e8

VT
https://www.virustotal.com/gui/file/96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6/community

Install (update ieframe.dll & other libs e.g IE11):
Windows6.1-KB3004394-v2-x64.msu
https://www.microsoft.com/en-us/download/details.aspx?id=45633

Add by doing:
Start > Run "rundll32.exe cryptui.dll,CryptUIStartCertMgr"

Remove old certs in the tab "trusted root certification authorities" add the new one from above and that should be it.

Neat to have things:

(Disable Windows Error Recovery nonsense. Had multiple times it suddenly messed up sth trying to "repair" it when I had a few bad block(s), you can fix it yourself it won't break it for you automatically during boot because that just sucks big time)

Code: [Select]

@echo off
bcdedit /set {default} bootstatuspolicy ignoreallfailures
pause
Fixes:
Disable update to Windows 10 from Windows 7/8/8.1

Code: [Select]

; DisableOSUpgrade.reg
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"DisableOSUpgrade"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Gwx]
"DisableGwx"=dword:00000001
https://github.com/aakkam22/windowsUpdateLoopFix
Windows update glitch fixes:

Code: [Select]

Windows6.1-KB3020369-x64.msu
Windows6.1-KB3102810-x64.msu
Windows6.1-KB3135445-x64.msu
Windows6.1-KB3138612-x64.msuRemove bloated updates:
https://gist.github.com/xvitaly/eafa75ed2cb79b3bd4e9

Disable UPnP media service and such, because, local exploits (test with msf framework)..
Don't use RDP, and if at least install the security patches and use two factory auth. Maybe just better avoid this, and VNC is less secure (they don't encrypt the entire session) anyway so think about this. What you can do is tunnel through SSH and local port forward to get access to local services over secure connection or use a VPN in between them.

Customized WIM images (unattended windows images):
Can't find the right website anymore but it was sth like with DISM so you can make a updated image (WIM) aka slipstreaming after applying all the new changes. I used to do this it is somewhat more work but you can make a pendrive bootable ready to install without doing all the work over and over again.

http://woshub.com/manually-install-cab-msu-updates-windows/
https://download.wsusoffline.net/

I want to add a disclaimer here, if you make your image test it completely in a virtual machine and on a physical test system debug it before you start installing it.
Make sure your updates cab, msu files and such came from a trusted source and in the end promiscuous mode the OS image to make sure nothing bad crawled in the installation. Just because of possible 3rd party promiscuity tends and just security in general, you don't want to ship a old OS with built in virus (wet dream for hackers). Also I highly advise any users on old OS to use noscript and use a sandbox in the cloud such as Falcon or locally e.g is a free open solution https://github.com/sandboxie-plus/Sandboxie or block 70% of the www with peerblock or hardware fw. Rule of thumb in general but just my two cents to add here.. Don't use IE11, it's full of ROP memory exploits. Use Mozilla or chromium engine they are better and still updated.

Regarding win8.1 and higher. The telemetry is so terrible all the crap. I have tried to block updates on windows 10 and without hardware firewall it's really a endless war.