October 2016 Windows cumulative updates might cause SCOM 2012R2/2016 console to crash on all OS Versions

Updated article 17.10.2016:

This is just a short note that you should be careful installing the October 2016 cumulative Windows updates KB3194798/3192392/3185330/3185331 on Windows Server releases from 2008R2 up tp 2016 and Windows client releases from 7 up to 10 with the SCOM 2012/2012R2/2016 console installed on it.

It might happen (in fact it will most certainly) that the console crashes regularly after the Patch installation.

Update 28.10.2016 7:00 am (CET):

The hotfix was also applied to the latest cumulative update for Windows 10 and Windows Server 2016:
For Windows 10 RTM:  https://support.microsoft.com/en-us/kb/3199125
For Windows 10 version 1511:  https://support.microsoft.com/en-us/kb/3200068
For Windows 10 version 1607 and Windows Server 2016:  https://support.microsoft.com/en-us/kb/3197954

These hotfixes are available via Windows Update.


Update 19.10.2016 7:00 am (CET):

The product group released a hotfix for this issue: https://support.microsoft.com/en-us/kb/3200006. I have successfully tested it so far for Windows 2012R2 and SCOM 2012R2.



All credits and thank's to my colleague Mihai Sarbulescu for finding this issue!


Comments (61)

  1. Tom says:

    Thanks for the confirmation.

    KB3192391 & KB3185330 (2008R2).
    Uninstall the patches on the affected 2008 R2 machines to fix the ntdll.dll crash.

  2. Stoyan Chalakov says:

    Hi Dirk,
    Is it possible that KB3185331 (October 2016 security monthly quality rollup for Windows 8.1 and Windows Server 2012 R2) is also involved?
    My console got stable after uninstalling 3185331 and not KB3192392?
    Can anyone confirm this?

  3. Kjetil says:

    We also just found out that all our SCOM 2012 R2 UR9 consoles gets the ntdll.dll crash on our servers… The SCOM console even crashes when we do a fresh console install on a server that has the KB3192392.

    We would not like to uninstall the whole KB3192392 package, so we are very interested if Microsoft will come out with a fix/update for the KB3192392, or a workaround of some sort.


    1. We are working on it. No ETA yet. Please follow the official SCOM blog for a fix.

      1. Kjetil says:

        Thank you, Dirk!

      2. Michael L Bell says:

        I see the fix for what I believe is MS16-126 but there is no fix listed for MS16-118 for Windows 7. This means we are still affected. We may have to contact our TAM but I’m hoping the SCOM team is still working on this. Please help, it will be appreciated.

  4. Mahesh Narayanan says:

    SCOM team is working tight to have this issue resolved, and deliver the fix at the earliest.

    We will keep posted with an update as we progress. Thanks in advance for the patience and support.

    1. lankesh says:

      Is there a link for SCOM blog that we can keep track of this issue

  5. Dominique says:

    Please could you provide the link for the official SCOM blog … where I will find a fix later on…

  6. Michael says:

    I’ve tried uninstalling KB3192392 from 2 different servers through add/remove programs and the uninstaller gets stuck at “Please wait while the updates are uninstalled” on both servers (1st is a MS, 2nd is a non-SCOM server). Both updates were deployed via SCCM SUP.

    Any ideas please?

  7. Kjetil says:

    Windows 10 also get the SCOM console crash with the latest updates.

    I think it is this KB for Windows 10: KB3192441


  8. Jesse says:

    Turning off details view fixes the crashing for me.

    1. Unfortunately that’s sheer luck. Due to the nature of the issue it can hit you almost everywhere in the Monitoring pane of the SCOM console…

  9. Gautam says:

    Yes it is true, We use Windows Server 2008 R2 SP1 with SCOM 2012 R2 UR9.

    And the console started crashing on few views, Post uninstallation the issue is solved.

    Just dont install those patches.

  10. Michael L Bell says:

    So that means not patching the following. Thank you Microsoft.

    This security update resolves the following vulnerabilities in Windows:

    •MS16-101 Security update for Windows authentication methods
    •MS16-118 Cumulative security update for Internet Explorer
    •MS16-120 Security update for Microsoft graphics component
    •MS16-122 Security update for Microsoft video control
    •MS16-123 Security update for kernel-mode drivers
    •MS16-124 Security update for Windows registry
    •MS16-126 Security update for Microsoft Internet Messaging API

    1. FranekK says:

      I was expecting such kind of issues when you have to remove all security patches from the month to resolve the problem, just was curious when this comes. So quickly… 🙂

  11. Mike Peters says:

    This is true. Definitely happening in our environment.

  12. Darren says:

    Any updates from the SCOM product team on this issue yet? It’s becoming rather pressing for the monitoring of our production environments.

    1. George says:

      The fix for this issue was release on Tuesday, 10/18 and is detailed in Microsoft KB3200006 – System Center Operations Manager Management Console crashes after you install MS16-118 and MS16-126. https://support.microsoft.com/en-us/kb/3200006

      1. Darren says:

        Thanks very much George, much appreciated!

  13. Andrew Williamson says:

    I guess we can just uninstall the single faulty patch then, so the rest of the machine doesn’t have its pants down while we wait for the fix?

    Oh.. .wait..

    Your first month into “just trust us to get it right” and you’ve dropped the ball already. *slow hand clap*

  14. Funky1 says:

    Nice job microsoft, a single update for all the monthly patches is so much better than individual patches.
    Why give your customers the option to remove only patches that break things while remaining protected against all other vulnerabilities that were patched?

  15. George says:

    The fix for this issue was release on Tuesday, 10/18 and is detailed in Microsoft KB3200006 – System Center Operations Manager Management Console crashes after you install MS16-118 and MS16-126. https://support.microsoft.com/en-us/kb/3200006.

  16. Mads Glud says:

    Is there a fix for Windows 10 , it is not in the https://support.microsoft.com/en-us/kb/3200006 fixes ?

    1. See KB article:
      Note This update is also included in the following updates:

      3199125 Cumulative Update for Windows 10 RTM: October 18, 2016
      3200068 Cumulative Update for Windows 10 Version 1511: October 18, 2016

      1. Mads Glud says:

        Thanks , but how about 1607 ?

        1. I am currently checking that.

          1. JJ says:

            Please also check on Windows Server 2016. Thanks!

          2. PG is working on it. No ETA yet.

  17. JonH says:

    Installation of the “Patch” resolved my problem, Windows 7 x64 Client, SCOM Console Rollup 11 is installed.

  18. JonH says:

    The stand-alone patch resolved my 3 console installations.
    Windows 7 x64
    Microsoft Windows Server 2008 R2 Standard
    Microsoft Windows Server 2012 R2 Datacenter

  19. Michael L Bell says:

    Is the hotfix to install 2 patches that were included in the rollup? If that is correct then what are the individual KBs for those 2 patches so I can uninstall first or can we install over them? It was my understanding that with this month’s new patch module we cannot uninstall individual patches for IE and the OS. The link in your referenced page was to the Windows Update Catalog and not hotfixes are listed as far as I can tell.

    1. Michael L Bell says:

      I am replying to my own comment. I think I can tell the hotfix for 16-126 but there does not appear to be one for IE on Win 7 systems to address 16-118.

  20. Thank you for the updates. We now confirmed that the new released hotfix resolved the SCOM console crashing issue. Kudos!

    1. Michael L Bell says:

      There is no fix for MS16-118, the IE patch, for Windows 7 in the catalog so not all of us can resolve the issue.

  21. ITBillBNE says:

    No patch for KB3200006 for Windows Server 2016 or Windows 10…

  22. Bob Robinson says:

    Successfully tested with SCOM 2007R2 on Windows 2008R2 and Windows 7 x64.

  23. Derik Petrillo says:

    We are running Windows Server 2012 R2 for the SCOM management server and Windows 10 Enterprise(mixture of 1607 and 1511) and we do not have any of these updates references above installed on our servers or desktops though continuously the last week and a half getting the ntdll.dll crashing error while using the operations console. We have SCOM 2012 r2 CU11 installed on both server and client.

    1. That’s strange. Please open up a PSS Case to further investigate the issue.

  24. Paul Wilson says:

    .Is there a version of this Hotfix for Windows Server 2012R2?

  25. Nithin KG says:

    I have noticed October 2016 Windows cumulative updates also breaks the communication between Workgroup agent and Gateway Servers. I have an issue when I uninstall these KB3185331 and KB3192392 resolves the grayed out agent from the Console. Did anyone has a similar issues?
    Workgorup Servers installed with October 2016 Windows cumulative security updates [KB3185331 and KB3192392] are grayed out from Console, showing errors related communication/authentication to GW servers. Any information on that?

    1. Personally I have not experienced that behaviour at one of my customers nor have I heard similar behaviour from colleagues. Probably a different issue?

  26. Elliot Belloli says:

    Is the hotfix link dead for anyone else? I cannot download it.

  27. Goodly says:

    The link provided here for the hotfix takes you to another Microsoft page that provides the fix under the “Resolution” section of the article. That link (labled Microsoft Update Catalog) does not work!! It takes you to a page indicating “File or directory not found”. Is anyone else experiencing this when attempting to apply the fix?

      1. Craig Teasdale says:

        That link also is not working

        1. Just checked: link works with IE11

      2. Goodly says:

        Thanks Dirk. I had to switch to IE in order for Microsoft Update Catalog to come up properly

      3. Christopher Jacobsen says:

        Thank you for the link, I was having a hard time finding the file to download. This update resolved our console crash issues on Server2012 R2

  28. Martijn says:

    Why is there no direct download of the KB3200006 (for Win2K8R2). I can’t use the catalog behind proxy and restricted to install software to access it.

    1. Michelle says:

      I second this, I’m unable to access the Catalog site. Please provide direct link!

      1. See my comments to other posts

  29. Brahimh says:

    Any news for Windows Server v2016 & Scom 2016 Fix?

    1. Update is now available, see updated post for links

      1. Really appreciate the updates Dirk! Thanks!!!

  30. Simon Jones says:

    I’ve installed this update on my client machine running W10 (1607) and this has fixed OpsMan 2016 UR1 console crashing – Thanks Dirk!

  31. Jason says:

    Just ran into this same problem, Uninstalling the patches didn’t work either. We also tried installing the fix , but states its not applicable to Windows Server 2012 R2.

    Busy redoing a production server.

    This really is a nasty piece of work update.

Skip to main content