On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019

[Dave-H]

Both files are fine, no complaints from Malwarebytes at all!

[AstroSkipper]

22 minutes ago, AstroSkipper said:

I will see how things go with the error messages and let you know.

You can upload your current WindowsUpdate.log if you want. A look at the log can do no harm. Maybe there is any useful information!  I would say: same procedure as last time! 

[Dave-H]

OK, here it is!

WindowsUpdate.log

[maile3241]

34 minutes ago, Dave-H said:

OK, here it is!

WindowsUpdate.log

It looks like the file cannot be downloaded. Execute the command proxycfg -u in cmd.
Then press Windows+R and type wuauclt /detectnow. And check the Wu.log again afterwards.

Edited April 5, 2022 by maile3241

[AstroSkipper]

2 minutes ago, maile3241 said:

It looks like the file cannot be downloaded. Execute the command proxycfg -u in cmd.

But only when HTTPSProxy is running. Otherwise it would be senseless.

Edited April 5, 2022 by AstroSkipper

[AstroSkipper]

27 minutes ago, maile3241 said:

It looks like the file cannot be downloaded. Execute the command proxycfg -u in cmd.

The file which cannot be updated by AU is wuident.cab from url https://fe2.update.microsoft.com/v11/3/win7sp1/windowsupdate/selfupdate/wuident.cab with error code 0x80072efe. So we have to find out why AU is not able to download it. Is service wuauserv still in your exclusion list of your firewall?
Fact is: error code 0x80072efe = ERROR_INTERNET_CONNECTION_ABORTED = The connection with the server has been terminated.

Edited April 5, 2022 by AstroSkipper
addition

[maile3241]

Just now, AstroSkipper said:

The file which cannot be updated by AU is wuident.cab from url https://fe2.update.microsoft.com/v11/3/win7sp1/windowsupdate/selfupdate/wuident.cab with error code 0x80072efe. So we have to find out why AU is not able to download it. Is service wuauserv still in your exclusion list of your firewall?

I can say from my own experience that the error comes from the fact that the address uses ECDHE ciphers and these are known not to work without a proxy. He will probably then get the error 0x80096010, as I did. However, I have not yet found the cause.

[AstroSkipper]

6 minutes ago, maile3241 said:

I can say from my own experience that the error comes from the fact that the address uses ECDHE ciphers and these are known not to work without a proxy. He will probably then get the error 0x80096010, as I did. However, I have not yet found the cause.

I think AU tries to download a file for Windows 7 SP1. Have a look: https://fe2.update.microsoft.com/v11/3/win7sp1/windowsupdate/selfupdate/wuident.cab
I've downloaded this file manually and it is not identical to the version located in my system.

[maile3241]

14 minutes ago, AstroSkipper said:

I think AU tries to download a file for Windows 7 SP1. Have a look: https://fe2.update.microsoft.com/v11/3/win7sp1/windowsupdate/selfupdate/wuident.cab
I've downloaded this file manually and it is not identical to the version located in my system.

This comes from the WU patch. As you know, the patch adds registry entries which contain a download address as a value, it downloads the file "wuredir.cab". This file contains other addresses including the new endpoint but also the address of "wuident.cab". However, the file for Win7 only applies to the AU service. The WU website downloads the one for Xp.

Edited April 5, 2022 by maile3241

[AstroSkipper]

41 minutes ago, maile3241 said:

This comes from the WU patch. That's why you can check for updates on the WU website. The file contains the new endpoint. Without the file, nothing works, so to speak.

Ok, thinking, the system is Windows 7 or whatever, AU tries to download a wrong file version due to the patch. But why does it still work? The last time I got the notification shield with missing updates. And why doesn't occur a similar error while connecting to MU website? Anyway,  I can confirm if ProxHTTPSProxy is enabled and set to system-wide, the new error code is 0x80096010.
Just to complete information: 0x80096010 = Trust_E_Bad_Digest = The digital signature of the object did not verify. That means the digital signature of wuident.cab couldn't be verified. I think no chance to solve error without more patching. My recommendation is to disable AU in system panel because it's useless.

Edited April 5, 2022 by AstroSkipper
addition

[maile3241]

1 minute ago, AstroSkipper said:

Ok, thinking, the system is Windows 7 or whatever, AU tries to download a wrong file version due to the patch. But why does it still work? The last time I got the notification shield with missing updates. And why doesn't occur a similar error while connecting to MU website? Anyway,  I can confirm if ProxHTTPSProxy is enabled and set to system-wide, the new error code is 0x80096010.

I apologise, I had to revise my post again as it was not quite correct. Sorry for the inconvenience.

[maile3241]

40 minutes ago, AstroSkipper said:

Ok, thinking, the system is Windows 7 or whatever, AU tries to download a wrong file version due to the patch. But why does it still work? The last time I got the notification shield with missing updates. And why doesn't occur a similar error while connecting to MU website? Anyway,  I can confirm if ProxHTTPSProxy is enabled and set to system-wide, the new error code is 0x80096010.
Just to complete information: 0x80096010 = Trust_E_Bad_Digest = The digital signature of the object did not verify. That means the digital signature of wuident.cab couldn't be verified. I think no chance to solve error without more patching. My recommendation is to disable AU in system panel because it's useless.

The web page downloads the file for Xp. This is probably because the wuweb.dll file is not patched. wuweb.dll = Windows Update Web Control

[AstroSkipper]

41 minutes ago, AstroSkipper said:

I think no chance to solve error without more patching. My recommendation is to disable AU in system panel because it's useless.

@Dave-H But one positive thing is for sure: we are able to delay Windows XP services.

[AstroSkipper]

34 minutes ago, maile3241 said:

The web page downloads the file for Xp. This is probably because the wuweb.dll file is not patched. wuweb.dll = Windows Update Web Control

Thanks for clarifying! I forgot about it completely! BTW I already deactivated AU many years ago. I always use WU/MU web site for searching updates. 

Edited April 5, 2022 by AstroSkipper
correction

[LonghornXP]

15 hours ago, maile3241 said:

The web page downloads the file for Xp. This is probably because the wuweb.dll file is not patched. wuweb.dll = Windows Update Web Control

Here is the patched one. Grab it here

wuweb.dll