OpsMgr 2007 R2 CU3 rollup hotfix ships – and my experience installing it

****NOTE OpsMgr 2007 R2 CU5 is now shipped and this is an old article.






***Note:  I recommend reading this article all the way through…. things didn’t go exactly as I’d expected, and there are some very critical order-of-operations steps to be aware of.  There is a known issue where the SDK or Config service will not restart during the update, and cause the failure to roll back.  Steps to correct this are covered in the known issues of the KB article, and below in my troubleshooting section.  Make sure you read both sections before you begin.


There is a known issue documented in the KB article where applying this CU3 (or CU4) on existing OpsMgr agents can cause an unexpected restart of several non-OpsMgr services. This is caused by the Windows Installer RestartManager trying to suppress a reboot as we attempt to update a locked file. This can potentially cause application outages as the services for other Microsoft core OS components and some 3rd party application services might be restarted. This only affects agents running Windows 2008 and Windows 2008 R2. For this reason, you should consider skipping this update and waiting for CU5. Or, consider applying this update ONLY to your OpsMgr server roles, and rejecting any agent updates until the next CU. Here is the actual text from the KB:

  • Restart of non-Operations Manager services
    In certain cases, non-Operations Manager services may be restarted when the Operations Manager agent is updated. This issue only affects computers that are running Windows Server 2008 or Windows Server 2008 R2. We recommend that you update agents at a time when a service restart or a server restart is acceptable. Or, only update agents that are experiencing one or more of the agent-related issues that are mentioned in the list of resolved issues. This issue will be addressed in an upcoming cumulative update.

Make sure you see the other known issues and troubleshooting section both in the KB and below at the bottom of this article.


Get it from the download Center:


The KB article describing the fixes, changes, and instructions:




The release notes in the KB article above cover the fixes that are included.  I have seen many of these issues manifested in the field, so I do recommend this update.  I have added it to my Recommended Hotfix page.


Here are the high level fixes:

  • Feature Addition: Azure Application Monitoring
  • Feature Addition: Parameter Extraction in Web Application Synthetic Transactions
  • Multi-selection in the alert view is not maintained during a view refresh
  • Upgrading MPs that include new properties may not recreate views correctly
  • The Operations Manager Console stops working when a high number of instances of State Views / Alert Views are left open for extended durations
  • The Operations Manager Console stops working when creating an override on the cluster resource group monitor
  • When using a remote console the notification wizards does not work in certain situations
  • The SDK Services stops working due to an unhandled exception, and the operations console becomes unresponsive
  • The SDK service may stop working due to an arithmetic overflow error in very rare circumstances
  • The notification scheduler does not compensate correctly for different time zones
  • Alerts using the “Specific Time Period” criteria are not included during automatic alert view refresh
  • Generic performance reports consume a large amount of temporary database space and can fail for Windows Server 2003 Computer Groups
  • SCOM 2007 SP1 Reports do not run after a shared Data Warehouse is upgraded to SCOM 2007 R2
  • Monitoringhost.exe does not work reliably on Windows 2003 SP2 X64 Domain Controllers
  • The total transaction response performance counter in URL monitoring is not accurate
  • MPs with empty knowledge elements cannot be imported in Operations Manager 2007 R2
  • Language packs authored for a previous version of an MP cannot be imported once an updated MP is released
  • Language Pack import fails if the MP contains strings which are not contained in the English Management Pack
  • When Agentless Exception Monitoring (AEM) is set up to use SharePoint, reports from Watson are blocked
  • Some ACS reports do not work as expected with Windows Server 2008
  • ACS forwarders with 15 character names in workgroups are unable to communicate with the ACS collector




Let’s Roll:


So – first – I download it.  The hotfix is about 1.2GB in size.  Yes, gigabytes.

Now – before your heart rate starts rising…. understand… this update is the first CU which combines the Cross Plat CU with the OpsMgr CU.  Aligning these is a very good thing – but it ends up increasing the size of the initial download.  No worries though – I will demonstrate later how to only have to copy specific files to lessen the impact of distributing this update to all your management servers and gateways, if copying a 1.2GB file around is a problem for you.


Next step – READ the documentation… understand all the steps required, and formulate the plan.



I build my deployment plan based on the release notes in the KB article.  My high level plan looks something like this:

  1. Backup the Operations and Warehouse databases, and all unsealed MP’s.
  2. Apply the hotfix to the RMS
  3. Run the SQL script(s) update against the OpsDB AND Warehouse DB.
  4. Import the updated management packs provided.
  5. Apply the hotfix to all secondary Management Servers.
  6. Apply the hotfix to my Gateway Servers.
  7. Apply the hotfix to my agents by approving them from pending
  8. Apply the hotfix my dedicated consoles (Terminal servers, desktop machines, etc…)
  9. Apply the hotfix to my Web Console server
  10. Apply the hotfix to my Audit collection servers
  11. Update manually installed agents…. well, manually.

Ok – looks like 11 easy steps.  This order is not set in stone – it is a recommendation based on logical order, from the release notes.  For instance – if you wanted to update ALL your infrastructure before touching any agent updates – that probably makes more sense and would be fine.

****Requirement – as a required practice for a major update/hotfix, you should log on to your OpsMgr role servers using a domain user account that meets the following requirements:

  • OpsMgr administrator role
  • Member of the Local Administrators group on all OpsMgr role servers (RMS, MS, GW, Reporting)
  • SA (SysAdmin) privileges on the SQL server instances hosting the Operations DB and the Warehouse DB.

These rights (especially the user account having SA priv on the DB instances) are often overlooked.  These are the same rights required to install OpsMgr, and must be granted to apply major hotfixes and upgrades (like RTM>SP1, SP1>R2, etc…)  Most of the time the issue I run into is that the OpsMgr admin logs on with his account which is an OpsMgr Administrator role on the OpsMgr servers, but his DBA’s do not allow him to have SA priv over the DB instances.  This must be granted temporarily to his user account while performing the updates, then can be removed, just like for the initial installation of OpsMgr as documented HERE.  At NO time do your service accounts for MSAA or SDK need SA (SysAdmin) priv to the DB instances…. unless you decide to log in as those accounts to perform an update (which I do not recommend).


Ok, Lets get started.


1.  I run a fresh backup on my OpsDB and Warehouse DB’s – just in case something goes really wrong.  Since I haven’t grabbed my RMS encryption key in a long while – I go ahead and make a backup of that too, just to make sure I have it somewhere.

I also will take a backup of all my unsealed MP’s.  This is good because there can be an issue with notifications, and having a fresh backup of the notifications MP is helpful.  You can do the backup in PowerShell, here is an example which will backup all unsealed MP’s to a folder C:\mpbackup: 

Get-ManagementPack | where {$_.Sealed -eq $false} | export-managementpack -path C:\MPBackup

We need to do this just in case we require restoring the environment for any reason.



2.  Apply the hotfix to the RMS.

Tip:  Here is a tip that I have seen increase the success rate:  Reboot your RMS/RMS nodes before starting the update.  This will free up any locked processes or WMI processes that are no longer working, and reduce the chances of a timeout for a service stopping, file getting updated, etc.


****Note: If applying this update to a RMS cluster – FIRST see:  How to apply a SCOM hotfix to a clustered RMS

****Note: – many people struggle with OpsMgr hotfixes – for failing to follow instructions.  When applying an OpsMgr hotfix – you need to copy the downloaded MSI file (such as SystemCenterOperationsManager2007-R2CU3-KB2251525-X86-X64-IA64-ENU.MSI) to EACH and EVERY Management server and Gateway.  You need to INSTALL this hotfix installer utility to EACH Management Server and Gateway.  Don’t try and just copy the update MSP files.  This wont work and you will fail to update some components.  Common complaints are that the agents never go into pending actions, or the agent update files never get copied over to the \AgentManagement folders.  In almost ALL cases, people were taking a shortcut and making assumptions.  Don’t.  Copy the 1.2GB file to each machine, then install the hotfix utility, then run the hotfix from the splash screen that comes up, immediately after installing the downloaded MSI.


Since my RMS is running Server 2008 – I need to open an elevated command prompt to install any SCOM hotfixes. That is just how it is.  So I launch that – and call the MSI I downloaded (SystemCenterOperationsManager2007-R2CU3-KB2251525-X86-X64-IA64-ENU.MSI).  This will install the Hotfix Utility to the default location. 

Tip: (This part may take a LONG TIME to complete if calling the 1.2GB file on a system will limited memory resources.  This is because it must consume 1.2GB of RAM to open the file, temporarily.  For production systems meeting the minimum supported 4GB, this probably wont be much of an issue.  For virtualized labs and test environments where you are running very limited memory, you will see this process take a considerable amount of time.  On my 1GB memory virtualized management servers, it would not install.  I upped them to 2GB and they took about 10-20 minutes to open and run the setup program.  See section at the end of this article **Command line install** for ideas on how to mitigate this issue if affected)

Then – a splash screen comes up:



I choose Run Server Update, and rock and roll.


Setup Failed on my first try.

I went through the log at %temp% (which is C:\Users\kevinhol\AppData\Local\Temp on my system) and took a gander at KB2251525-x86_0.log.  I really couldn’t find easily why it failed.  I did see some issues in the application event log about a product connector failing to connect to the SDK, and a WMI process locking EventCommon.dll…..   I would bet the reason for the failure was the service not starting up in time.  See troubleshooting section below.

So – I go ahead and reboot my RMS, just to free up any locked processes, if that was the issue.

Try number 2 begins:

I kick off the install again FROM THE 1.2GB MSI.  Since this is installed already – I choose “repair” and eventually the splash screen comes up again.  I choose “Run Server Update”.  This time, I get a SUCCESS! 

But wait!  As soon as I click “Finish” on the success screen, ANOTHER setup starts rolling.  I think that’s really odd…. but I let it complete.  It is also a success.  I click Finish again…. but then ANOTHER setup kicks off.  This just doesn’t look right, so I click cancel.  Bad idea.

After digging through the logs – I realize – this is all by design.  There are truly three installs going on, from three different MSI’s – that are chained together.  This is because it is installing the core OpsMgr CU3 update, then the ENU localization files, then the SCX cross platform update.  I just screwed up the last install because I haven’t seen this before, and assumed it was broken and in a loop.

So – to clean things up again – I reboot my RMS, again.

Try number 3 begins.

I kick off the install again FROM THE 1.2GB MSI.  Since this is installed already – I choose “repair” and eventually the splash screen comes up again.  I choose “Run Server Update”. 

This time, I get a success, three times, from all three installs.  Phew!

Lesson learned, be patient, and as long as you see a success, click finish, and keep going.


You could see this potentially three times:



Then I click finish on the last one, then wait around 30 seconds for any post install processes to complete, and then click “Exit” on the splash screen.

IF you ever get prompted for a REBOOT – ALWAYS choose NO.


Now – it is time to validate the update applied correctly.  I can see the following files got updated on the RMS in the standard install path:  \Program Files\System Center Operations Manager 2007\


**note – this isn’t all the files included in the hotfix package, just a spot check to make sure they are getting updated. 


Next I check my \Agentmanagement folder.  This is the folder that any agents will get updates from.  I check the \x86, \AMD64, and \ia64 directories:



It is good – that our KB2251525 CU3 agent MSI’s got copied over.

In this CU3, we did not remove the previous CU1 (974144) and CU2 (979257) MSI files.  However, those files will be ignored on future agent updates, repairs, and push installs.  You don’t need it.  The key thing to check here is that you DID get a KB2251525 agent msp file.


***NOTE – it is CRITICAL to perform the next step in this order.  The SQL scripts MUST be deployed at this time, immediately after installing the update on the RMS.  If you don’t, you will see multiple events on the RMS about errors from the SDK (26319) and DataAccessLayer (33333).  The RMS will not generate new config until these scripts are executed.  Your consoles might also show the following, until you run the SQL scripts:





3.  Time to run the SQL scripts.  There are 3 scripts, located on the RMS, in the \Program Files\System Center 2007 R2 Hotfix Utility\KB2251525\SQLUpdate\ folder:

  • DiscoveryEntitySprocs.sql
  • CU3_Database.sql
  • CU3_DataWarehouse.sql

Let’s start with DiscoveryEntitySprocs.sql

**Note – this is the EXACT same patch file that was included in CU1 and CU2 for R2.  If you are upgrading from CU1 > CU3, or CU2 > CU3, you can skip this step.  If you are upgrading from R2-RTM > CU3, then you need to run this step.  This is called out in the release notes.  If you aren’t sure, RUN IT.  It will not hurt anything if it is executed again.

I simply need to open this file with SQL management studio – or edit it with notepad – copy the contents – and paste it in a query window that is connected to my Operations (OperationsManager) Database.  I paste the contents of the file in my query window, it takes about 10 seconds to complete, and returns “Command(s) completed successfully”.

Second – we will execute the CU3_Database.sql file.  Open a NEW query window, make sure it is connected to your Operations database, and execute.  This one takes a little longer, and will return a long string of output stating (nn row(s) affected) multiple times, upon success.

Last – we now need to connect to the Warehouse database instance, and open a new query window against the OperationsManagerDW database.  We will execute CU3_DataWarehouse.sql which will return “Command(s) completed successfully”.


DO NOT skip step number 3 above, and do not continue on until this is completed.




4.  Next up – import the MP updates.  That’s easy enough.  They are located at \Program Files\System Center 2007 R2 Hotfix Utility\KB2251525\ManagementPacks\ and are named:

  • Microsoft.SystemCenter.DataWarehouse.Report.Library
  • Microsoft.SystemCenter.WebApplication.Library.mp
  • Microsoft.SystemCenter.WSManagement.Library.mp

These will upgrade existing MP’s in your environment.  They take a few minutes each to import.



5.  Time to apply the hotfix to my management servers.  I have 3 secondary MS servers, one is Windows 2008 and the other two are older, they are running Windows 2003.  So on the 2008 server I open an elevated command prompt to apply the hotfix utility MSI, and just run it directly on the older servers. 

Again – I MUST RUN SystemCenterOperationsManager2007-R2CU3-KB2251525-X86-X64-IA64-ENU.MSI on each Management server.  This installs the hotfix utility, which will then launch the splash screen.

Tip: (This part may take a LONG TIME to complete if calling the 1.2GB file on a system will limited memory resources.  This is because it must consume 1.2GB of RAM to open the file, temporarily.  For production systems meeting the minimum supported 4GB, this probably wont be much of an issue.  For virtualized labs and test environments where you are running very limited memory, you will see this process take a considerable amount of time.  On my 1GB memory virtualized management servers, it would not install.  I upped them to 2GB and they took about 10-20 minutes to open and run the setup program.  See section at the end of this article **Command line install** for ideas on how to mitigate this issue if affected)

Once the splash screen comes up I “Run Server Update”  These all install without issue.  I spot check the \AgentManagement directories and the DLL versions, and all look great.  REMEMBER – you can sure patch all your management servers at the same time, however, your agents WILL fail over during this time because we stop the MS HealthService during the update.  Keep this in mind.  It is best to update management servers one at a time, synchronously, to keep your agents from failing over to the RMS and overloading it, or causing massive Heartbeat failures because they have nowhere to report to.

Note:  You might see the following pop up after the last setup routine is complete.  Just ignore this for now and hit OK, and then we will need to reboot this server when we are finished.  This box says “Error” when there really isn’t a problem – this is noted in the KB article as a known issue.




6.  I would patch my Gateway machines here.  I still don’t have a GW in my lab, so I move on to the next step.  Remember to spot check your DLL and \AgentManagement directories.  Previous hotfixes did not copy the hotfix MSI to the \AgentManagement directories, and so you might have to do that manually.



7.  I check my pending actions view in the console – and sure enough – all the agents that are set to “Remotely Manageable = Yes” in the console show up here pending an agent update.  I approve all my agents (generally we recommend to patch no more than 200 agents at any given time.)

After the agents update – I need to do a quick spot check to see that they are patched and good – so I use the “Patchlist” column in the HealthService state view to see that.  For creating a “Patchlist” view – see LINK



The CU3 actually REPLACES any previous patches applied in the PatchList table – this is NICE.   Looks good.  (Note) I will have to formulate a plan to go and update my manually installed agents (Remotely Manageable = No)

Note: experienced 100% success rate on the agent updates…. however, some of my agents are still reporting both the CU2 and CU3 in patchlist.  I am investigating this as it should not be reporting this way.



8.  I have a few dedicated consoles which need updating.  One is a desktop machine and the other is my terminal server which multiple people use to connect to the management group.  So – I kick off the installer – and just choose “Run Server Update as well.  I do a spot check of the DLL files – and see the following was updated on the terminal server:




9.  Next up – Web Consoles.  I actually have two – and both are running on management servers, which I have already patched.  So – I will simply just go check their DLL files to ensure they got updated:

From:   \Program Files\System Center Operations Manager 2007\Web Console\bin




10.  I don’t have ACS set up at the moment – but at this point if I did – I would go hit those Management servers that have already been patched – but this time run the update and choose to “Run ACS Server Update”




11.  Manually installed agents.  I have a fair bit of these… so I will do this manually, or set up a SCCM package to deploy them.  Most of the time you will have manually installed agents on servers behind firewalls, or when you use AD integration for agent assignment, or when you installed manually on DC’s, or as a troubleshooting step. 


Now – the update is complete.


The next step is to implement your test plan steps.  You should build a test plan for any time you make a change to your OpsMgr environment.  This might include scanning the event logs on the RMS and all MS for critical and warning events… looking for anything new, or serious.  Testing reporting is working, check the database for any unreasonable growth, run queries to see if anything looks bad from a most common alerts, events, perf, state perspective.  Run a perfmon – and ensure your baselines are steady – and nothing is different on the database, or RMS.  If you utilize any product connectors – make sure they are functioning.

The implementation of a solid test plan is very important to change management.  Please don’t overlook this step.




*** Command line install option 

In some situations, you might want to perform a command line installation of the update on your RMS/management server.  Most of the time – I don’t recommend this, because you generally need the feedback if each part was successful or not.  However, there are situations where it is required. 

One example is for users who have issues with the 1.2GB MSI file, and getting the hotfix installer running, especially on limited memory systems.  For those, you can use a command line options which removes the issue.

The KB article has a section which documents how to set up the arguments correctly.  I used a variation of that, because I did NOT want /silent to be used… as I want to visibly see the feedback and interact with the installation.  Here is the command line I ran, for an US/English installation:

SetupUpdateOM.exe /x86msp:KB2251525-x86.msp /amd64msp:KB2251525-x64.msp /ia64msp:KB2251525-ia64.msp /x86locmsp:KB2251525-x86-ENU.msp /amd64locmsp:KB2251525-x64-ENU.msp /ia64locmsp:KB2251525-ia64-ENU.msp /Agent /noreboot

In order for this to work – you need to INSTALL the hotfix utility somewhere, then copy the ENTIRE FOLDER STRUCTURE starting with the KB2251525 folder and all folders below.  Here is an example copied to C:\temp\ directory:


Just remember – you cannot run just specific MSP files in these folders individually, there are post install processes that must be run, and should be called by the SetupUpdateOM.exe.  You also cannot just run SetupUpdateOM.exe by double-clicking it, or the post install processes wont run.  Use the default method of installing the original downloaded MSI file, OR use this command line option.


For additional command line options, including how to make a CU3 package smaller, and how to patch consoles, agents, etc…. see the following post:





Troubleshooting/Common Issues:


1.  CU3 fails to apply.  The SDK service will not start after this, and CU3 fails on subsequent retries.  Emre Guclu of Microsoft PFE has come up with the following approach which has seen much success:  Using http://support.microsoft.com/kb/922918 set the ServicesPipeTimeout entry for all services to have 3 minutes (180000 milliseconds) and REBOOT the server.  Then try and apply CU3.  It will apply.  You likely will see a few warning messages about failure to start the OMCFG service – just click ok and the setup will continue.

2.  Agent patchlist information incomplete.  The agent Patchlist is showing CU3, but also CU2 or CU1 or nothing.  The localization ENU update is not showing in patchlist.  This appears to be related to the agents needing a reboot after having the first CU3 package installed.  Once they are rebooted, and a repair initiated, the patchlist column looks correct with the ENU (localized) information.

3.  26319 Error events on the RMS OperationsManager event log every 60 seconds: 

Event ID:      26319
An exception was thrown while processing SetupAlertsByCriteriaAndMonitoringClassReader for session id uuid:fd790420-2ace-4756-beba-242f49e9f838;id=27.
Exception Message: Object reference not set to an instance of an object.

This is caused by the SCVMM integration with OpsMgr, and an issue with CU3.  If you are impacted with this issue, please contact Microsoft support.

4.  Restart of non-Operations Manager services.  In certain cases, non-Operations Manager services may be restarted when the Operations Manager agent is updated. This issue only affects computers that are running Windows Server 2008 or Windows Server 2008 R2. We recommend that you update agents at a time when a service restart or a server restart is acceptable. Or, only update agents that are experiencing one or more of the agent-related issues that are mentioned in the list of resolved issues. This issue will be addressed in an upcoming cumulative update.

Comments (84)

  1. Kevin Holman says:

    @Carsten –

    Yes – that is normal – and the KB article has been updated to reflect that in the Known Issues section:  (see last sentence)

    CU3 Rollback / SDK Start Failure: In some cases, Cumulative Update 3 (CU3) rolls back multiple times or the SDK Service does not restart after a rollback of CU3. This is caused by a service timing issue that affects a small percentage of computers. If you encounter this issue, follow the steps that are outlined in Microsoft Knowledge Base article KB992918 (support.microsoft.com/…/922918) , and then set the ServicePipeTimeout to 120000. Restart the affected computer, and then reapply CU3. The CU3 installer may show an error or warning during the installation process. If this occurs, you have to click through the error or warning.

    As to it still being necessary, after applying CU3, it depends.  It depends on how fast your disk subsystem is, how powerful your CPU, how much memory you have, etc.  On some VM's on shared environments, it could take a little longer to start services.  You can test it by simply removing the value, or setting it back to the default.  It will not hurt anything to leave the modification in place.

  2. Anonymous says:

    o.k. we had this problem during installation CU1. We didn't pause the inactive clusternode. Hope Kevin may help you asap. Good luck!

  3. MedeBay says:

    Hi Kevin,

    Thanks for the guide, it was very helpful in getting our servers updated. The only issue I ran into was with my GWS servers. I had to manually stop the healthservice for the upgrade to continue.

    Now I am working on agent updates. All our agents are installed via SCCM so I am using SCCM to apply CU3. So far i have only been testing it and have run into a problem. Apparently the patch uses Restat Manager. Restart Manager is restarting lots of services on our 2008 servers. I am going to have a very hard time getting approval from all my app owners to push this, especially when I can't guarantee what services may be restarted. I don't think my Exchange or AD will ever buy off on it.

    The other problem I found is that when Restart Manager tries to restart the HealthService it hangs at starting and you have to kil the process and restart it. This happened of 8 out of 45 servers.

    I am not the only person who has encountered this: discussitnow.wordpress.com/…/scom-r2-cu3-agent-update-and-windows-2008

    So the big question: Is there a way to run the update with Restart Manager disabled? Here is the command I am using my script now:

    objShell.Run "CU3SetupUpdateOM.exe /amd64MSP:KB2251525-x64.msp /x86MSP:KB2251525-x86.msp /ia64MSP:KB2251525.msp /x86LOCMSP:KB2251525-x86-ENU.msp /amd64LOCMSP:KB2251525-x64-ENU.msp /ia64LOCMSP:KB2251525-ia64-ENU.msp /UpdateAgent /NoReboot /Silent",0,True



  4. I am about to now. I'll let you guys know what we find.


  5. Kevin Holman says:

    Ian – look at the troubleshooting steps – try increasing the timeout for services – reboot RMS – and then try CU3.

  6. Kevin Holman says:

    @Jeremy – when you push agents – this is done over netbios/rpc, not 5723tcp.  

    @Ian – you are the second person reporting this.  Did you open a case?  I will be looking at that this morning.

    @Marcus – NO!  Sorry – the agent can be updated by simply grabbing the correct core msp and ENU msp files from the extracted directories…. for manual patching.  I will look into command lines for those.

  7. Kevin Holman says:

    So I just re-read that post from Blake at:  discussitnow.wordpress.com/…/scom-r2-cu3-agent-update-and-windows-2008

    Man – I wasnt aware of this happening.  I havent had any customers report it – but then – if it was successful, then I guess a lot of them would never know.  I will see what I can find out… talking to Zia too.

  8. Anonymous says:

    Thanks for the response Kevin. I can only hope that after the deployment I can leave the agents in their current state and then slowly address the servers per region.

  9. Anonymous says:

    This was a tad scary with multiple failed attempts, registry hacks and clicking through Warning 25362's several times.

    Not what we have come to expect from MSFT for updates.

    Could not have done it without this guide and the references to other user's experiences.


    John Bradshaw

  10. Kevin Holman says:

    @dikkehaaj –

    No you dont.  Just follow the instructions.

  11. Anonymous says:

    Kevin, I have a question regarding the patchlist issue. We currently do not have CU1 or CU2 deployed to our environment. I deployed CU3 into the lab and the patchlist has a few different results after the agent deployment. I see some agents that only list System Center Operations manager 2007 R2 Cumulative Update 3 (KB2251525) while others list both the hotfix and the ENU localization. Can you confirm if all agents in the end should list both the hotfix and the ENU package? I am not sure if i have the issue where I need a reboot and a reapir in this case as there are no CU1 and Cu2 updates etc.

    I did reboot and run a repair on one of the agents only showing the hotfix and not the ENU package. After the repair the agent now has both listed in the patchlist. I have 2800 servers globally and rebooting and running a repair (manual install from SMS and not pushed from the console) is not feasible for me if 1/2 of them don't list both. Would there be any issues with the agents that only list the KB hotfix and not the ENU package?

  12. Kevin Holman says:

    @Max – you skipped a critical step – applying the scripts.

    Besides – CU3?  CU5 is already out!

  13. Kevin Holman says:

    Yes – everything is the same except for the license.  Yes – evals are upgradable to full license.

    The difference is – our hotfixes and updates historically checked to make sure it was licensed version before allowing a fix to be applied.  I am surprised that CU1 and 2 would apply.  Our individual hotfixes used to always bomb out of they found eval license.
     I am not sure what the reasoning behind this is… you’d have to ask the product group – which you can do by reaching out to them on the MOMTEAM blog or


  14. Kevin Holman says:

    @Paul –

    Just an oversight.  Since this was the first CU to include xPlat, I didnt think of validating that it was a success as well…. I wasn't used to doing that from other CU's.  You are correct – that will be a good idea moving forward, especially since xplay is a seperate MSP being called and executed.  I will look to include that method in future CU articles.

  15. Kevin Holman says:

    @Bryan –

    Bryan – please use the command line install per my next post (link in this one).  It covers specifically how to make sure agents get put in pending – and agent files get copied over correctly.  If it is run from an elevated command prompt – I have never seen it fail.

    If everything did fail – you can always highlight your agents – run "repair" and that will update them – provided the agent update MSP files are located in the AgentManagement folder.

  16. Anonymous says:

    @Ian Do you have a clusterd RMS? Did you pause the node during installation? Marcel

  17. MedeBay says:

    Restart Manager:

    So I have begun pushing CU4. I had some SCCM servers restat most of their services, however these were the same boxes that did it with CU3 so i thought maybe it was related to CU3 not finishing.

    But then I hit another groups of servers. ALL of my ADRMS servers had most of their services restarted.

    So at this point it seems it effects certain types of application servers such as SCCM and ADRMS.

    I have only 400 of 7k servers so i will see if any other groups stand out.

  18. Kevin Holman says:

    @MedeBay –

    Yes – I have a customer now where I am collecting some good data from – and we saw CU4 restart a lot of services on some of the Windows 2008 OS machines.  This even caused some cluster failovers – which os how they noticed this.  I am feeding this data up so we can identify the issue and try to block it from future CU's as this is not by design of the CU to restart services.

    We are also hearing some level of machines not fulling updating to CU4… requiring a reboot before the Localization (ENU) MSP would apply and fully update Patchlist.  However – one of my customers deployed CU4 to 1300 agents and only 17 agents were in this situation, so that is 1.4% and I would find that completely acceptable given that scale.

    Thanks for the info!

  19. Anonymous says:

    I wanted to provide a quick update to my question, in case anyone else is wondering. I created a rule and monitor against one of the lab machines that only shows the CU3 hotfix installed, and not the ENU hotfix. All of the workflows were fine and the agent logged the events you would expect to see.

    21024 – out of date config

    21025 – new config received

    1200 – new MP requested

    1201 – new MP received

    1210 – new config became active

    I feel confident that if 1/2 of my agents do not show the ENU hotfix that all will be ok as we slowly fix them.

  20. Murad Akram says:


    What about the SCOM RS server should that be upgraded if yes at what point?



  21. Kevin Holman says:

    @ mknowlesus –

    Yes – all agents should list both the hotfix and the ENU (localization).

    Yes – the most common cause is that windows installer is blocked because the agent machine requires a reboot to install the next package.

    I agree – this could be a real pain if the agent count is very high where it does not apply.  I am sending this information up the chain.

    I dont know if/what the issues are with an agent having the hotfix, but not the localization update….. I sure haven't seen any.

  22. Kevin Holman says:

    @Bhansen –

    Thats crazy!  I have not seen or heard reported where SCOM is actually restarting other services.  Is this only when you run your manual command line?  I cannot imagine why we would need to do this.  I have heard from others complaining about needing to log on and manually intervene (or reboot) a large percentage of servers in order to get the last MSP to apply, but have not heard anything about restarting of other services.  Strange.  Personally – I dont know what is the risk of not applying the localization update – but I dont think there is a whole lot in that.  I sure would hold off and wait for CU4/CU5 which should not have this issue.  Opening a case and reporting this is the best thing you can do – to make sure that we have the information for the next CU released.

  23. MedeBay says:

    Restart manager;

    Apparently this is not new with CU3. I ran the regular agent install (almost 2 years old) and it envokes restart manager on Server 2008. I have not tested, but I would guess CU1 and CU2 did it as well. I am guessing that no one noticed before because it was not restarting services. I ran this on 45 SCCM servers and 6 of them had the DHCP, TCP, windows server and event log services restarted. On these same servers the healthservice got stuck "starting".  Needing to log on to 10% of my 7500 servers to kill the Healthservice process and restart it is not a very comforting thought, and neither is the rath of the Exchange or AD team for restarting their services.

    What is the downside to not applying the location updates?

    My servers have alrady been updated to CU3. What is the risk with not immediatley updating my agents?



  24. Kevin Holman says:

    @Bob C. – the issue with notifications was never reproduced… I just overheard it and we never say any reported issues.

  25. Kevin Holman says:

    @ Kevin B.

    SQL 2008 SP2 is unsupported.  

    Eval versions are not tested with CU's to my knowledge as we are expecting Select media only.  I would guess that part of the CU applied, but other parts that do the version check (of the Windows Installer registry) failed.  There is no support for CU's on Eval versions.

  26. Kevin Holman says:

    That is correct.  A "repair" is identical to approving the agent for an update.

    What isnt working?  The repair fails, or it is a success, but the agent doesnt get upgraded?

    Check your agentmanagement folders to make sure agent files are updated there.

  27. Kevin Holman says:


    The ENU package is the localization package – there will be different localized version if your environment is installed with some other version than US/English.

  28. Anonymous says:

    Thanks, that's what I figured.  This happened on about half of the 470 servers I patched.  Running a repair on them seems to be working also.

  29. Kevin Holman says:

    Patchlist not updated for RMS, MS, and GW is by design.  That information is collected for agent purposes only.  It is critical to validate all facets of a hotfix being applied on the OpsMgr server roles as in the article above, as opposed to a simple windows installer information tidbit.

  30. Kevin Holman says:

    @Dave –   yes – the script would need to return that service name as a property bag to be used in the alert description…. or write that information to an event and then use a rule to get the service name from a simple event log.

    I dont really recommend using such a script… unless you can validate it does not consume a lot of resources…. using a script to monitor all services, would need to run pretty frequently… you just want to make sure it does not consume too many resources and does not cause any leaks.

  31. Kevin Holman says:

    Enrique – yes – and this is covered in the blog post above:

    For additional command line options, including how to make a CU3 package smaller, and how to patch consoles, agents, etc…. see the following post:


  32. Kevin Holman says:

    @Richard –

    No – that is a unique issue….  here is what is happening when you see both CU2 and CU3 in patchlist:

    The agent MSI is installed first…. this gets applied.  Then CU3 primary MSI gets applied.  However – there is a locked file, and a reboot is required.  Subsequent windows installer packages that check for a pending reboot will file, until the server is rebooted.  Therefore – the ENU (localization) package will not install…. until the server is rebooted.  The ENU (localization) package is what clears out the CU2 from patchlist.

    Therefore – to completely "resolve" this patchlist issue… you would need to reboot the server/agent in question, and then either manually apply the ENU package MSI, or run a repair on the agent.

    I consider this a bug… I will report this and see if there is something we can do for this condition in the next CU.

  33. MedeBay says:

    Thanks Kevin – I will start testing it i the next couple of weeks as well.


  34. Kevin Holman says:

    @Brian –

    I can only say this was investigated – and they found the root cause, and believe they resolved it.

    From a testing perspective – I can say this – when I deployed CU3 – I had a fair percentage of systems chow CU2 and CU3 – caused by the RestartManager issue.  I had to fix all of these manually by rebooting the agents eventually.

    When I deployed CU4 to my 41 agents, I had almost 100% success.  I only had a SINGLE agent that got hit by needing a restart to fully patch, and it was on a WIndows 2000 machine.  I had them open a bug to track that for testing for CU5.

    So my assumption – based on what I know from discussions with the product group, and from my own testing and validation, is that CU4 does not have this issue, EXCEPT on Windows 2000.  Hopefully you dont have a whole lot of Windows 2000 still around.  🙂

  35. Kevin Holman says:

    @Bhansen –

    I have seen the issue you are referring to.  I dont know how to apply this and exclude restart manager – that is a the root cause of the agents sometimes needing a reboot to completely install all the components, most of the time it is required in order to apply the last CU3 locaition update.  

    I have been told we are monitoring for this condition and CU4 will not have this issue moving forward.

  36. Kevin Holman says:

    Guys – I added this to the troubleshooting section in this post.  You need to set it to 180000 for most cases.

    3.  CU3 fails to apply.  The SDK service will not start after this, and CU3 fails on subsequent retries.  This is being investigated.  Emre Guclu of Microsoft PFE has come up with the following approach which has seen some success:  Using support.microsoft.com/…/922918 set the ServicesPipeTimeout entry for all services to have 3 minutes (180000 milliseconds) and restart the server.  Then try and apply CU3.

  37. MedeBay says:

    Kevin – The other problem that goes along with this is that on the servers that have the srevices restart the HealthService hangs (starting). If I kill the process and restart the service then it will show CU4 was applied but not the ENU. Rerunning the update then applies the ENU fine.My suspiscion is that the users who state they have to reboot then reinstall the ENU actaully don't need to reboot, only need to kill the healthservice process.

    i actually only had about 30 out 0f 7000 that I know had the problem, so you are correct that percentage wise it is not a big deal.

    Just to restate something I stated earlier this seems to be somewhat application specifi. ALL of my ADRMS servers had this issue and most of my SCCM servers had the issue. Besides those there just a few here and there.

  38. Jose Fehse (MVP) says:

    Hi all, I figured what I had wrong with my clients. I had installed only one of the agent update files. When you install both, CU2 goes away. You still get two entries, one for the normal agent and another for ENU Components.


    Jose Fehse


  39. MedeBay says:


    So CU4 is out. Any reason to believe they fixed the restart managerreboot problem?


  40. Kevin,

    This was a 2008 virtual server in a lab environment with only 3 gigs of ram. I followed the KB (support.microsoft.com/…/922918) article you mentioned above and it worked “with some trial and error”. It says to set it to 60,000, and I did with no luck :

    I rebooted again after setting ServicesPipeTimeout to 90,000, It failed the first update but finished the second. Still the SDK was not coming up… I then changed it to 250,000 and rebooted again. Tried the patch again and presto, Completed Successfully. I plan to grant the Hyper-V virtual server 2 more gigs of ram and remove the ServicesPipeTimeout entry added to  HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControl.

    Thanks for the guidance 🙂


  41. Jose Fehse (MVP) says:

    Thanks for the guide Kevin, once again, very good. I updated two MGs so far. No big issues. My question is regarding the patchlist. A have a bunch of remote servers (authenticating via certificates) that I updated manually. All of them show as if they have both patches (CU2 and CU3) in the patchlist.

    Will this go away or it’s a feature? I noticed that the servers that I updated automatically are showing the correct version.

    Thank yoy,

    Jose Fehse


  42. Kevin Holman says:

    @Josh – we never plan to enforce reboots.  However, some times there are locked files and those will require a reboot in order to update the files.  For agents – the design is to never require a repboot for an agent upgrade/update.  Again – in CU3 there was an issue where for a percentage of agents – in order to apply ALL of the update (agent msi + CU3 + CU3 localization) there was sometimes a reboot required before the CU3 localization update would apply.

  43. MedeBay says:

    Restart manager:

    Sorry or the double post 🙁

    I just ran CU2 and it envokes restart manager too.

  44. No clusterd RMS. 3 Servers, RMS, MS, and DB.

  45. Kevin Holman says:

    Andrew – see my latest post on creating trimmer packages for servers, consoles, and agents.

  46. Anonymous says:


    Do you think a reboot is all that is required to remedy the issue where the PatchList is showing both CU2 and CU3?  I've logged onto some of my servers that show both in the PatchList and in Add/Remove Programs, it shows the same (and doesn't show the localization ENU update).  I've been running the update on these servers again, but doing it manually from the server and it's immediately updating and showing the correct information.  It seems the localization ENU update install wasn't actually running either (or was failing but not reporting as such) as it shows an install date of today rather than yesterday when the 1st update ran.

  47. Tim Johnson LJMU says:

    Hi Kevin,

    Thanks for another helpful guide. I deployed CU3 at the university earlier and had perfect success messages at every stage – none of the problems you appear to have had. Very strange stuff!

  48. jeremy says:

    Hi Kevin,  

    Thanks for the another great guide.  When you push out the agents updates, what ports are being used?  Does it use the default 5723?  

  49. Ian Smith says:

    Followed the steps, first install did not complete, SDK service never came back up.



  50. Marcus says:

    Hi Kevin,

    did I read it correctly and do I need to upload 1.2GB (for a manual installation) data to update an agent only installation of typically 90MB??

  51. Marcel says:

    Hi Kevin

    Thanks for your guide.

    May you tell me, what's the difference between KB2251525-xx-ENU-Agent.msp and  KB2251525-xx-Agent.msp. If I install it, there isch shown two fixes: "System Center Operations Manager 2007 R2 Cumulative Update 3 (KB2251525)" AND "ENU Components; System Center Operations Manager 2007 R2 Cumulative Update 3 (KB2251525)". We gonna deploy with SCCM and I need to know, witch files they have to package.

    Thanks a lot for your help.

  52. Nick Mansfield says:

    Hi Kevin,

    I had the same problem as Ian had with the SDK service not starting. I followed his instructions and all is well now. Yay!!!

    Thanks guys


  53. Andrew says:

    How are folks doing with stand alone consoles and gateways? Most of our staging GW's are VM's behind firewalls, and some of them are disk space constrained. Every try pushing 1.2 GB over RDP through remote VPN? Multiply that by 12. I have tested updating a GW by running the 2 platform specific GW msp's and manually copying the agent patches to Agent Management. Based on comparing updated files, this appears to yield the same results as running SetupOM on a test GW. We have no cross platform functions with our GW's so it seemed OK to skip that install. Pending Management agents requiring update appeared to patch OK, so this may work.

    As for the console, I tried running the 2 platform specific msp's (example: KB2251525-x64-ENU.msp and KB2251525-x64.msp), but noticed the main console executable was not updated. There was no reason to continue looking after that. We have so many users with consoles, it's not going to be reasonable to push something with SCCM or ask them to copy the KB directory structure locally, then run commandline install.

    Any thoughts? Would love to hear how others are doing.


  54. Joe Bloggs says:

    Trap for Young Players….I hate to admit this (hence the alias) but for the good of the team…in the haze of battle i.e. manual agent install, I installed the x64 msp's on an x32 system, very surprised I was allowed to do that, would have expected an OS check, but they ran and then the service was stuffed.

    Resolution was agent removal with reboot to cleanly remove service, followed by install of correct versions!

    Joe Bloggs 😉

  55. Bob Cornelissen says:

    I was actually also looking at the command version for some of the console machines and non-MS servers (like the webconsole box). The command seems to call msp files for three architectures. I only see the msp files for two of them in the download. I assume we can bring the command down to just the architecture we are using on a box.The command does call the SCX update as well it seems (it ran three times and did update the unix agents to a new version). Wonder what happens if the scx update is not included in the directory where the other msp files are that are actually needed for non-managementserver machines. I think the KB at MS should have some additional notes added on these subjects. Also see question from Andrew.

    Thanks, Bob

  56. Chris Wood says:


    We are running SCOM on SQL2008 SP1 CU7. Now that SQL2008 SP2 is out, is this a good time to upgrade SQL alomg with this SCOM CU?



  57. Peter says:

    GRANT EXECUTE ON dbo.ReportDisplayStringGet TO OpsMgrWriter, OpsMgrReader come with an error (CU3_DataWarehouse.sql) – Is this equal to data warehouse reader/writer account – if this is the case this this should be a comment in the installations guide

    Cannot find the user 'OpsMgrWriter', because it does not exist or you do not have permission.

  58. Peter says:

    Read the manual or your txt

    forgot to connect to OperationsManagerDW – it works

  59. Neal says:

    Great article Thanks for posting. I am currently dealing with agents that I accidentally rejected. I read in a previous post of yours that a repair should push the agent updated I have not had that work yet.

  60. carsten says:

    We're running on SCOM 2007R2 with CU2 W2K3R2x64, but cannot Upgrade. There is allways a Rollback of MSI after Removing Backups.

    RMSuns on different Host than DBs. This is a W2K3R2x64 with MS-SQL2005EE. Any Host is uptodate pached. There are some Errors within installation log like:

    Product: System Center Operations Manager 2007 R2 – Update 'System Center Operations Manager 2007 R2 Cumulative Update 3 (KB2251525)' could not be installed. Error code 1603.

    Property(C): ReadyToInstall_DlgText_InstallText.68918168_3885_4F75_BBF8_0CC84213F8D1 = Click Install to begin the installation.

    Property(C): ReadyToInstall_DlgText_RemoveText.68918168_3885_4F75_BBF8_0CC84213F8D1 = Click remove to begin uninstallation.

    Property(C): ReadyToInstall_DlgText_UpgradeText.68918168_3885_4F75_BBF8_0CC84213F8D1 = Click Upgrade to begin the upgrade.

    Property(C): This_Computer.68918168_3885_4F75_BBF8_0CC84213F8D1 = (this Computer)

    Property(C): SummaryDlg_Help.68918168_3885_4F75_BBF8_0CC84213F8D1 = If you want to review or change any of your installation settings, click Back. Click Cancel to exit the setup wizard.

    Property(C): ManagementGroupInfoDlg_Title.68918168_3885_4F75_BBF8_0CC84213F8D1 = Management Group Configuration

    Property(C): ManagementGroupInfoDlg_Desc.68918168_3885_4F75_BBF8_0CC84213F8D1 = Specify the management group information that is necessary for this computer to connect to.

    Property(C): ManagementGroupInfoDlg_CfgLabel.68918168_3885_4F75_BBF8_0CC84213F8D1 = Management &Group Name:

    Property(C): ManagementGroupInfoDlg_ConsLabel.68918168_3885_4F75_BBF8_0CC84213F8D1 = &Management Server:

    Property(C): ManagementGroupInfoDlg_PortLabel.68918168_3885_4F75_BBF8_0CC84213F8D1 = Management Server &Port:

    Property(C): ManagementServerOrPortErrDlg_Title.68918168_3885_4F75_BBF8_0CC84213F8D1 = Invalid Configuration

    Property(C): ManagementServerOrPortErrDlg_EmptyMSOrAMS.68918168_3885_4F75_BBF8_0CC84213F8D1 = The given Management Server name is invalid. None of the configuration fields can be empty.

    Property(C): ManagementServerOrPortErrDlg_EmptyMSOrAMSHelp.68918168_3885_4F75_BBF8_0CC84213F8D1 = To continue, go back and provide the Management Server name and Management Group name.

    Property(C): ManagementServerOrPortErrDlg_SpecialChars.68918168_3885_4F75_BBF8_0CC84213F8D1 = The Management Server name is either blank or contains special characters. The Management Server name should not contain the following special characters: (:^)~!@`#%*+$|,&&='["]/<{;?>}.

    Property(C): ManagementServerOrPortErrDlg_SpecialCharsHelp.68918168_3885_4F75_BBF8_0CC84213F8D1 = To continue setup, go back and change the Management Server name.

    Property(C): ManagementServerOrPortErrDlg_Port.68918168_3885_4F75_BBF8_0CC84213F8D1 = The Management Server port number is either blank or not in the range 1024-65535.

    Property(C): ManagementServerOrPortErrDlg_PortHelp.68918168_3885_4F75_BBF8_0CC84213F8D1 = To continue setup, go back and change the Management Server port number.


    Wether the Hostname nor the Management Group Names contains any of these Characters, We use '-', or '_', which hasn't been a problem until now.

    There is another error, which makes me crazy:

    Property(C): SummaryDlg_Title.68918168_3885_4F75_BBF8_0CC84213F8D1 = Ready to Install

    Property(C): MinimumUserPrivilegeMsg.68918168_3885_4F75_BBF8_0CC84213F8D1 = This product requires administrator privileges to install.

    Property(C): ManagementGroupErrDlg_Title.68918168_3885_4F75_BBF8_0CC84213F8D1 = Invalid Management Group name

    Property(C): ManagementGroupErrDlg_Desc.68918168_3885_4F75_BBF8_0CC84213F8D1 = This problem occurs when the Management Group name is:

    Property(C): ManagementGroupErrDlg_EmptyOrNull.68918168_3885_4F75_BBF8_0CC84213F8D1 = – Empty or Null

    Property(C): ManagementGroupErrDlg_LeadingOrTrailingSpaces.68918168_3885_4F75_BBF8_0CC84213F8D1 = – Leading or Trailing spaces

    Property(C): ManagementGroupErrDlg_AlreadyExists.68918168_3885_4F75_BBF8_0CC84213F8D1 = – Already exists on this computer

    Property(C): ManagementGroupErrDlg_SpecialChars.68918168_3885_4F75_BBF8_0CC84213F8D1 = – Contains special characters. The Management Group name should not contain following special characters: ^@)~(:!`#%*+$|,&&='["]/<.{;?>}

    Property(C): ManagementGroupErrDlg_Help.68918168_3885_4F75_BBF8_0CC84213F8D1 = To continue setup, go back and change the Management Group name.

    Property(C): ActionsAccountDlg_Type1.68918168_3885_4F75_BBF8_0CC84213F8D1 = &Local System

    Property(C): ActionsAccountDlg_Type0.68918168_3885_4F75_BBF8_0CC84213F8D1 = Do&main or Local Computer Account

    Property(C): AccountVerificationErrDlg_Title.68918168_3885_4F75_BBF8_0CC84213F8D1 = Account Verification Error

    Property(C): AccountVerificationErrDlg_Text1.68918168_3885_4F75_BBF8_0CC84213F8D1 = Setup is unable to confirm the account details. For Operations Manager SDK account make sure it is a Local Administrator account.

    Property(C): AccountVerificationErrDlg_Text3.68918168_3885_4F75_BBF8_0CC84213F8D1 = To continue setup, go back and enter the correct account information.

    Property(C): User_Account.68918168_3885_4F75_BBF8_0CC84213F8D1 = &User Account:

    Property(C): User_Password.68918168_3885_4F75_BBF8_0CC84213F8D1 = &Password:

    Property(C): User_Domain.68918168_3885_4F75_BBF8_0CC84213F8D1 = &Domain or local computer:

    Property(C): AgentServerCompatibilityErrDlg_Title.68918168_3885_4F75_BBF8_0CC84213F8D1 = Incompatible Management Server Found

    Property(C): AgentServerCompatibilityErrDlg_Text1.68918168_3885_4F75_BBF8_0CC84213F8D1 = A different version of System Center Operations Manager was found on the system. Setup cannot continue.

    This is realy strange, because there are the latest patches installed, as you recommend on your page.

    The installer account has any necessary rights. So what else could be the reason?

    Thank you

  61. guillermo says:

    Since installing the RU3, I have a message in the event viewer RMS, with the event 26319, source OpsMgr SDK Service,

    Exception was thrown while processing SetupAlertsByCriteriaAndMonitoringClassReader for the session ID uuid: 5c734fbf-7983-40cb-916b-4d8db5ec3ab7, id = 662.

    Exception message: Object reference not set to an instance of an object.

    Full Exception: System.NullReferenceException: Object reference not set to an instance of an object.

      in Microsoft.EnterpriseManagement.Mom.ServiceDataLayer.SdkDataAccess.SetupAlertsByCriteriaAndMonitoringClassReaderWithProperties (String criteria, monitoringClassId Guid, Boolean recurse, String languageCode, Nullable `1 lastModified, Byte [] alertProperties)

      in Microsoft.EnterpriseManagement.Mom.ServiceDataLayer.SdkDataAccess.SetupAlertsByCriteriaAndMonitoringClassReader (String criteria, monitoringClassId Guid, Boolean recurse, String languageCode, Nullable `1 lastModified)

      in Microsoft.EnterpriseManagement.Mom.ServiceDataLayer.SdkDataAccessTieringWrapper.SetupAlertsByCriteriaAndMonitoringClassReader (String criteria, monitoringClassId Guid, Boolean recurse, String languageCode, Nullable `1 lastModified)

      in Microsoft.EnterpriseManagement.Mom.ServiceDataLayer.SdkDataAccessExceptionTracingWrapper.SetupAlertsByCriteriaAndMonitoringClassReader (String criteria, monitoringClassId Guid, Boolean recurse, String languageCode, Nullable `1 lastModified)

  62. Johansen says:

    Trying to install CU3 – fails and after multiple attempts always get the following error during the 'removing backup files' part of the install –

    "Failed to start OMCFG service" – the installer then does a rollback.  Log file : "CAStartServices: WaitForServiceState failed for start request. Error Code: 0x80070102. OMCFG". I have increased the ServicesPipeTimeout value to 10 mins (600000) but still getting same issue.

    Does anybody have any ideas?


  63. Neal says:

    Its working now. I had just forgotten to update the gateway that these clients connect to and thus there was nothing for the gateway to update. Thanks!

  64. Neal says:

    I actually noticed one other issue. It seems that the patch list field for my Managment servers and gateways is not getting updated with the CU 3 KB numbers like my other agents. Anyone else see this?

  65. Maxwell Smart says:

    Well, can I just say thankyou, I battled for a morning with this,and the timeout reg fix solved my problem..

  66. carsten says:

    After setting the ServicesPipeTimeout DWORD value to 180000, the CU3 update finished successfully. On the way, I recieved a couple of 'Warning 25362. Failed to start OMCFG Service', due to timing problems in starting the System Center Data Access Service, which I had to accept by 'OK', but any msi installer packed then were installed.

    Is the ServicesPipeTimeout key still necessary?

  67. Andrew says:

    Update regarding a trimmer package for just gateways–as much as it stings, I decided to go ahead and bundle in the *NIX agent updates despite knowing we will likely never need them. To build the package I took the files/directories mentioned in the previous post regarding a console-only package and add these directories:



    I don't want these to silently update, so the command is:

    SetupUpdateOM.exe /x86msp:KB2251525-x86.msp /amd64msp:KB2251525-x64.msp /ia64msp:KB2251525-ia64.msp /x86locmsp:KB2251525-x86-ENU.msp /amd64locmsp:KB2251525-x64-ENU.msp /ia64locmsp:KB2251525-ia64-ENU.msp /gateway /agent /noreboot

    Tested fine with Win 2003 and 2008. Final size is 680 MB. A note to those with really tight limits and a single logical drive: in addition to Kevin's statement that you need to have 2x the disk space to install, in my testing it was also required to have another 270 MB because the SCX install spawned its own temp .msp–which also required manual deletion afterwards while everything else removed itself nicely.

    Hope this helps someone–

  68. GallEsco says:

    Hi Kevin,

    Is there any way to update SCOM Console from command line without running the entire msi?


  69. Bryan Heath says:

    In my VM lab the GUI would not start up. I applied the hotfix manually and it seemd to work. However It did not copy the agent update over. After manually installing them things looked good. If this were to happen on a larger scale would I deploy the update with SCCM? Also how would I insure the latest agent gets pushed or manually installed going forward? Would I have to script the KB after agent installs ETC? Thanks for putting this together.

  70. Kevin B. says:

    I created a new Server 2008 R2 VM, and installed SQL 2008 SP2 on it.  I then downloaded an eval version of SCOM 2007 R2 and ran the prerequisites check and evrything passed.  I installed all SCOM components on this single server and everything was working fine.  I then tried to install the latest SCOM 2007 R2 CU3 update and it got all the way to the very end when I click on finish I get an error box stating the following:

    "The upgrade patch cannot be installed by the Windows Installer service because the program to be upgraded may be missing, or the upgrade patch may update a different version of the program.  Verify that the program to be upgraded exists on your computer and that you have the correct upgrade patch."

    It looks like all the .dll's have copied over properly but I am concerned with this message and one other telling me that the software update did not install properly.

    I am able to take this same machine and install CU1 or CU2 or both withouth issue.  Its only when I try and install CU3 that I receive this error message.  Any ideas?



  71. Kevin B says:

    Are'nt Eval/Trial versions the exactly the same (except for the license) as full blown version?  I mean, I can upgrade this 6 Mos Eval copy to a full licensed copy so what is the difference?

    I also redid this same machine with SQL 2008 SP1 and got the exact same result when trying to apply CU3 ,but not when I install CU1 or CU2?



  72. Dave Brockington says:

    Hi Kevin, I have question that I was hoping that you could answer for me.

    I found a VB script  from another posting and setup a 2-state monitor that monitors ALL Windows Services (set to start 'Automatically') and sends a critical alert which I get via email.

    However, the email just tells me that a "Windows Service has Stopped" on the particular server it happened to stop on.

    Is there a way to identify which service is actually stopping and have that show up in my email description?



  73. vincent says:

    Thanks for the nice guide 🙂

    Same here, experienced 100% success rate on the agent updates but few agents still reporting both the CU2 and CU3 in patch list. This can be solved without rebooting by using agent repair feature: Administration > Device Management > Agent Managed > Right-click and choose repair.

    To view agent patch list: Monitoring > Operation Manager > Agent > Agent By Version

  74. paul says:

    Hi Kevin,

    I notice that in your spot check to see if the cumulative update applied successfully, you did not check any of the cross-platform related files. Is this just an oversight, or do you leave that out on purpose for some reason? See Microsoft KB article 2222955 for the full list of DLL, MP, GZ, Z and RPM files that are affected.  The reason I ask is that in my environment, the cross-platform portion of the update fails to apply, though the rest of the update seems to apply successfully.

    Thanks for all the excellent articles!


  75. dikkehaaj says:

    Do i need to run the Run Server Update also on a SQL Report Server that has SCOM Reporting (role) installed?

  76. dikkehaaj says:

    Thanks for your reply Kevin

    I just finished and in your tutorial are no RS steps so i was a bit confused but all clear now!

    Much appreciated!

  77. Kevin Ginn says:

    Hi Kevin,

    we have ACS installed and running quite happily but have also had the problem of certain reports not supporting Windows 2008 events as the username is now buried in the target user field. Have updated everything here to R2 CU3 and that has all gone OK except the ACS reports haven't been updated or replaced. On our ACS collector, I ran the appropriate install of CU3, but what do I need to do on the actual ACS database/reporting server – so far I have just updated the agent, but that clearly is not enough. Are there some new rdl files lurking somewhwhere that I need to upload or do I need to do a different type of cu3 update on the database/srs server?

    Any help much appreciated

    Kevin Ginn

    London Borough of Brent

  78. Dikkehaaj says:

    Murad Akram.

    No the SCOM RS dont have to be upgraded.

    Read page 4 i asked the same question 🙂

  79. Tim Daley says:

    Getting error code 0x80070102 installingCU3 on non-RMS server. The HealthService apparently goes into a loop. Reinstalling CU3 doesn't fix the problem

  80. Bob C. says:


    We updated to CU3 last fall. Everything went well. Just before Christmas, we had a system go offline and the responsible group did not receive the alert – system not reachable. Our server support group did receive the alert. You had indicated in your instructions that there were “issue with notifications”. We have been working with Microsoft and they have yet to come up with anything helpful. In fact we have made it worse since our overnight Help Desk no longer receives these alerts at this point.  Any suggestions on where we should concentrate?



  81. Josh Shand says:

    Hi Kevin,

    I may have missed this in the comments but I'm going to ask anyway…

    As our environment is a "reasonable" size 200+ agent managed servers and we are in a change controlled environment I am wondering about the impact of upgrading to CU3 with regard to reboots etc.  I am happy that the RMS server will need a reboot, how about the agents?  Also if the machines being monitored are not updated to the newest agent i.e. because they need manual install, will the continue to check in with the old version?

    Thanks in advance

  82. Dominique says:

    Hello Kevin,

    I am trying to install on a brown new server CU3 on the R2 install but I am getting an error:

    "The program failed to apply the Software Update.

    Please Cjheck the patch file in the patch folder and proper version of MOM is installed on the machine."

    I checked the folder Program FilesSystem Center Operations Manager 2007 nothing chnaged 6.1.7221.0…

    Any idea why it does not run… I have used the elevated privileges and now I have this issue on three RMS in different environment (Prod, Test and Staging)



  83. Dominique says:


    The servers have been rebooted.


  84. Max says:

    hi  Kevin, we have sucessfully upgraded to CU3, however we do not see anything in different views on the monitoring view,All views are blank, can you help me on this