Microsoft UNinstalling Updates Automatically?

[NoelC]

I periodically look over my Windows logs to make sure nothing unexpected is happening that I need to be aware of.

 

Something unexpected DID happen.  A Tcpip warning, event 4230 that had been logged every few days had STOPPED happening, since June 16..

 

EVENT_TCPIP_TCP_CONNECTIONS_PERF_IMPACTED

TCP/IP has chosen to restrict the congestion window for several connections due to a network condition.  This could be related to a problem in the TCP global or supplemental configuration and will cause  degraded throughput.

 

I thought to myself, it's nice that's no longer happening, but problems don't normally fix themselves, so I looked a little further into why...

 

It seems that on the 17th, in the wee hours (2:43 am) Microsoft initiated some kind of automatic cleanup activity.  Specifically, I found these 29 events logged:

 

• Initiating changes for package KB2894179. Current state is Installed. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2894179. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2894853. Current state is Installed. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2894179. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2894853. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2913270. Current state is Installed. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2894179. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2894853. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2913270. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2926765. Current state is Installed. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2894179. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2894853. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2913270. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2926765. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2933809. Current state is Installed. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2894179. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2894853. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2913270. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2926765. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2933809. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2961887. Current state is Installed. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2894179. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2894853. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2913270. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2926765. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2933809. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2961887. Current state is Absent. Target state is Absent. Client id: CbsTask.
• Initiating changes for package KB2964358. Current state is Installed. Target state is Absent. Client id: CbsTask.

Detail from the last one:

 

Log Name:      Setup
Source:        Microsoft-Windows-Servicing
Date:          6/17/2014 2:43:41 AM
Event ID:      1
Task Category: (1)
Level:         Information
Keywords:     
User:          SYSTEM
Computer:      NoelC4
Description:
Initiating changes for package KB2964358. Current state is Installed. Target state is Absent. Client id: CbsTask.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Servicing" Guid="{BD12F3B8-FC40-4A61-A307-B7A013A069C1}" />
    <EventID>1</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-06-17T06:43:41.057645800Z" />
    <EventRecordID>863</EventRecordID>
    <Correlation />
    <Execution ProcessID="9700" ThreadID="11392" />
    <Channel>Setup</Channel>
    <Computer>NoelC4</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <CbsPackageInitiateChanges xmlns="http://manifests.microsoft.com/win/2004/08/windows/setup_provider">
      <PackageIdentifier>KB2964358</PackageIdentifier>
      <InitialPackageState>Installed</InitialPackageState>
      <IntendedPackageState>Absent</IntendedPackageState>
      <Client>CbsTask</Client>
    </CbsPackageInitiateChanges>
  </UserData>
</Event>

 

Interestingly, there's not a lot of documentation on this out there, though I found a few folks inquiring on forums for occurrences of this they spotted last year.

 

Any idea what CbsTask is and why packages are being removed?

 

I assume it's some kind of normal cleanup, and I can't complain if it reduces logged Tcpip problems.

 

"Curiouser and curiouser". 

 

-Noe

[jaclaz]

 

I assume it's some kind of normal cleanup, and I can't complain if it reduces logged Tcpip problems.

Sure you cannot complain, NOW and for this SPECIFIC case, but what will you do when (if)  the "some kind of automatic cleanup activity" will affect next morning booting or will add a file you don't want (or remove a file that you do want)?

 

http://en.wikipedia.org/wiki/All_your_base_are_belong_to_us

 

jaclaz

[NoelC]

A bit more investigative info...

 

The last update "remove" above (KB2964358) describes a security fix to Internet Explorer.  I looked at one of the files (mshtml.dll) which that fix was supposed to bring up to version 11.0.9600.17105.  It's currently at 11.0.9600.17126.  The implication is that this "cleanup" activity isn't affecting current files.

 

-Noel

[NoelC]

Yes, it's a bit concerning since I have disabled automatic download and installation of Windows Updates.  I don't think Windows Update is without merit, but I want this stuff done on my terms, not Microsoft's.

 

-Noel

[jaclaz]

Yes, it's a bit concerning since I have disabled automatic download and installation of Windows Updates.  I don't think Windows Update is without merit, but I want this stuff done on my terms, not Microsoft's.

Yep, it is that kind of feeling when you sense that something is not going to end well :

 

jaclaz

[MagicAndre1981]

Yes, Windows cleans them automatically with the StartComponentCleanup task during the maintenance task.

[NoelC]

Thanks, Andre.

 

Indications are, so far, that it's cleaning up old stuff, no longer used.  It seems an interesting coincidence that an ongoing Tcpip warning that I've been seeing pretty regularly stopped at that same time, but of course it could be a coincidence.

 

-Noel