.NET Install Runs into Errors - How to Get it Installed?

[Radish]

Windows 7 Pro. SP1 x64
.NET v4.6.2 x86-x64 Offline Installer (Microsoft Official Filename NDP462-KB3151800-x86-x64-AllOS-ENU.exe)

I have the OS setup so that it cannot do Microsoft Updates - no Microsoft updates of any kind have been done on the system. Windows Update has been disabled in Group Policy and also blocked via TinyWall firewall. I run the system this way as I'm utterly paranoid over what Microsoft might be throwing onto Win7 systems by via updates - so called "telemetry" (i.e. spyware) and so on and I sure as hell don't want Win10.

.NET has never been installed on this system, but now I have a need for it (if I can get the damn thing installed!). I downloaded the offline installer for the latest version but when I try to install it produces the following error:

OS Version = 6.1.7601, SP = 1.0, Platform 2, Service Pack 1
OS Description = Win7 - x64 Service Pack 1
MSI = 5.0.7601.17514
Windows version = amd64_windowsfoundation_31bf3856ad364e35_6.1.7601.17514_none_615fdfe2a739474c.manifest
Windows servicing = 6.1.7601.17514
CommandLine = H:\b64ad360e62a6964ab5521c44ad4d9\\Setup.exe /x86 /x64 /redist
TimeZone = GMT Standard Time
Initial LCID = 2057
Using Simultaneous Download and Install mechanism
Operation: Installing
Package Name = Microsoft .NET Framework 4.6.2 Setup
Package Version = 4.6.01590
User Experience Data Collection Policy: Disabled
Number of applicable items: 8
H:\b64ad360e62a6964ab5521c44ad4d9\netfx_Full_x64.msi - Signature verification for file netfx_Full_x64.msi (H:\b64ad360e62a6964ab5521c44ad4d9\netfx_Full_x64.msi) failed with error 0x800b010a (A certificate chain could not be built to a trusted root authority.)
No FileHash provided. Cannot perform FileHash verification for netfx_Full_x64.msi
File netfx_Full_x64.msi (H:\b64ad360e62a6964ab5521c44ad4d9\netfx_Full_x64.msi), failed authentication. (Error = -2146762486). It is recommended that you delete this file and retry setup again.
Exe (H:\b64ad360e62a6964ab5521c44ad4d9\SetupUtility.exe) succeeded.
Exe Log File: dd_SetupUtility.txt
ServiceControl operation succeeded!
ServiceControl operation succeeded!
Exe (H:\b64ad360e62a6964ab5521c44ad4d9\SetupUtility.exe) succeeded.
Exe Log File: dd_SetupUtility.txt
Final Result: Installation failed with error code: (0x800B010A), "A certificate chain could not be built to a trusted root authority. " (Elapsed time: 0 00:00:19).

I have tried installing several times and with unblocking Windows Update in Tinywall but still I get the same error. How do I manage to install .NET?

Edited February 4, 2017 by Radish

[Mcinwwl]

Can you tell us something more, what have you tried, what is the exact error message, why are you trying to install it manually (should be installable via Windows Update) e.t.c

[Radish]

The exact error message I get I have already posted above, please read it - it specifically mentions a ""A certificate chain could not be built to a trusted root authority." whatever that means.

I tried the online-install but that also failed with the installer claiming there was no internet connection. In any case I only did that out of curiosity - I very much want to down the offline install route.

In case it is relevant I have the following settings made in Group Policy with respect to Windows Update:

Computer Configuration\Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates - Disabled
Computer Configuration\Administrative Templates\Windows Components\Windows Update\Turn on recommended updates via Automatic Updates - Disabled
(All other settings in that key area are "Not configured" i.e. as per default for clean install of Win7.)

User Configuration\Windows Components\Widows Update\Remove Access to use all Windows Update features - Enabled
(All other settings in that key area are "Not configured" i.e. as per default for clean install of Win7.)

I have Windows Update blocked in this way because I don't want this system subject to Microsoft installing whatever it wants to the system.

[dencorso]

You must install KB2813430 before you'll be able to install .NET 4.6.2... 

[Radish]

Thanks for the response dencorso. I tried the following:

(1) Downloaded KB2813430
(2) Double-clicked to run (seemed to install fine) then rebooted the machine.
(3) Tried again to install .NET but I get the identical error as described in my first post.

I did try reading the page for the hotfix download but it might as well be written in double-Dutch for all the sense it makes to me. I suspect there is something else I need to do but I don't know what. So stuck again. How to solve?

[dencorso]

Is 4.5.2 not an option for your need?

[Radish]

No, the earlier version isn't suitable. I want to install SnagIt and it says System Requirement is .NET 4.6 or later.

EDIT: Have to admit this "certificates" thing is well beyond my skill level - but for what it's worth should say: This system has never been updated at MS Updates. So what is on the system is what is installed via a clean install of Win7. Therefore, I'm thinking that there might not be any "certificates" on the machine at all unless they are installed during clean install of system. Maybe this KB2813430 that you mentioned to install only installs the capacity to manage certificates and doesn't actually install any certificates itself. That was my impression when I read the page KB2813430 - but as said I really don't understand the information given there. 

Edited February 5, 2017 by Radish

[abbodi1406]

Workaround:
https://blogs.msdn.microsoft.com/vsnetsetup/2016/03/28/a-certificate-chain-could-not-be-built-to-a-trusted-root-authority-2/

More details:
https://support.microsoft.com/en-us/help/3149737