We are using Secunia CSI to create and publish 3rd party software update packages to SCCM 2012.  I have one client computer running Windows 7 Pro x64 that is having a problem with one update.  When the user tries to install the Adobe Reader update in Software Center it fails and returns the following error.

The software change returned error code 0x87D00668(-2016410008).

I haven't been able to find any information on this error code.  I was just wondering if anyone else has encountered this error and might have any information on it??

• Moved by Moiz Rassiwala[MSFT]Microsoft employee Monday, July 09, 2012 6:22 PM (From:Configuration Manager 2012 - Application Management)

Error code 0x87D00668 means "Software update still detected as actionable after being applied".   In other words, it appears that even after the software update was applied to the system, it did not satisfy the conditions for making the system appear as "patched".

This question should be posted in the "Security and Compliance" forum.

• Edited by Ken RevelsMicrosoft employee Monday, July 09, 2012 5:39 PM

Yes, I know this is an old post but Im trying to clean up old posts.

Did you figure this out?

Since there have been no other people attempting to answer this question, At this point I would suggest contact Microsoft Support (CSS) directly for support.

Error code 0x87D00668 means "Software update still detected as actionable after being applied".   In other words, it appears that even after the software update was applied to the system, it did not satisfy the conditions for making the system appear as "patched".

This question should be posted in the "Security and Compliance" forum.

2 years later and this still appears to be an issue.

2 years later and this still appears to be an issue.

I'm encountering this exact issue.  I have two security updates that are indeed installed (according to Windows Update, the Windows Update log, and Add/remove programs), yet Software Center shows "failed" and with that exact same error.

I would love some help with this if possible and I'll happily provide more detail as needed.

SCCM 2012, client is Server 2003 R2, updates are KB2604092 and KB2729450.  I was able to get them to install successfully by using Windows Update. I've reinstalled client but am still getting this error.

TIA

I've been all through the logs and can't find the problem. Specifically which log should I look in and what do I look for?

EDIT: I just uninstalled the updates manually, rebooted, checked the software center, updates showed failed, reinstalled the updates via Windows Update, the updates installed successfully again (add/remove programs, windows update log) yet software center shows the same error message: The software change returned error code 0x87D00668(-2016410008).

• Edited by DavidJB Wednesday, July 09, 2014 6:50 PM

Ccmexec log showing this after the above attempt: <![LOG[CancelTask failed with error 87d00215]LOG]!><time="17:29:51.252+420" date="07-08-2014" component="CcmExec" context="" type="2" thread="5416" file="timertask.h:162">

0x87d00215 is "item not found".

Have you confirm it is on the DP?

Have you check the subnet mask of your PCs?

How are your boundaries configured?

The item it's referring to in that error would seem to be the task that can't be found. No?

The issue that needs to be addressed is that the updates aren't needed - they are installed on the server. I've installed the updates manually, rebooted, Software Center should not even be reporting that the updates need to be installed.  And back to the second post above, "Software update still detected as actionable after being applied" seems to be saying that it DOES see that the patch is installed.  The question is then, why is it still "actionable"?

Thanks

The item it's referring to in that error would seem to be the task that can't be found. No?

The issue that needs to be addressed is that the updates aren't needed - they are installed on the server. I've installed the updates manually, rebooted, Software Center should not even be reporting that the updates need to be installed.  And back to the second post above, "Software update still detected as actionable after being applied" seems to be saying that it DOES see that the patch is installed.  The question is then, why is it still "actionable"?

Thanks

Why do you think that they are not needed? Have you force CM to scan again for SU? Are they show as being applied in CM12? What does the Windowsupdate.log say about that SU?

I don't think it is a task that can't be found based on that single line from the log file.

The item it's referring to in that error would seem to be the task that can't be found. No?

The issue that needs to be addressed is that the updates aren't needed - they are installed on the server. I've installed the updates manually, rebooted, Software Center should not even be reporting that the updates need to be installed.  And back to the second post above, "Software update still detected as actionable after being applied" seems to be saying that it DOES see that the patch is installed.  The question is then, why is it still "actionable"?

Thanks

Why do you think that they are not needed? Have you force CM to scan again for SU? Are they show as being applied in CM12? What does the Windowsupdate.log say about that SU?

I don't think it is a task that can't be found based on that single line from the log file.

I have the exact same error. There is a reference to it here: http://technet.microsoft.com/en-us/library/bb735894.aspx

For my own issue it was for KB890830 which was overdue and I was watching it try again and again, with that error each time. I tried a few things, but found forcing a recreation of the c:\Windows\SoftwareDistribution folder was what worked. 

Here is what I did.

1. Opened services.msc
2. Stopped the Windows Update service
3. Browsed to and then renamed c:\windows\SoftwareDistribution to softwaredistribution.old
4. Start the Windows Update service
5. Waited until the SoftwareDistribution folder was created again. Happened in about 30 seconds for me.
6. Refreshed the Software Center where I was watching the update. It showed it was installing again, and quickly flipped to Installed. It has since checked in with SCCM and registered as compliant.

You may be able to delete the folder outright, but I took the cautionary route.

Well... that worked for a while, then it started happening again. Took me a bit but I think I have it figured out now. Now its installed and appears to have remained installed. I believe its specific  to KB890830, which is the Malicious Software Removal Tool that comes out each month, one of the files it copies into the system got locked, and remained on the last months file.

So I extracted the file update.

Windows-KB890830-x64-V5.22.exe /X:C:\ExtractedPackage

Then copied the mrt.exe over to c:\windows\system32 and let it replace the one there that had last months date.

It appears to be done.

No it's not at all related to any single KB article, Here I've same issue and there are around 9 KB article, and all are throwing the same error.

Can any one assist here ?

Below are the steps solved our Problem :-

1. Stop Windows Update service.
2. Rename C:\Windows\SoftwareDistribution
3. Rename C:\Windows\System32\GroupPolicy\Machine\registry.pol
4. Restart Windows Update service.

Regards,

Raman

SO... I ran into the problem again, on a freshly imaged machine. (New Windows install etc.)

Do you know what it was? Turns out at some point, during one of the patch installs I had an external drive plugged in. It saw that as a location to extract the patch. SO, while the external drive plugged in the patch successfully installed. If I watched the drive while it was installing, it created and then deleted the extract folder (random number-letter named folder), and then success. So now, for some reason that particular patch always wants an external drive to extract. Otherwise no go. I would suspect that a USB key would not work, as it is seen as a removable drive.

Cause: Windows at some point saw an external drive as a spot to extract the patch, and now needs it plugged in during patch installation.

Temp Solution: (although, not the one I like!) Plug in an external drive during patch installs. At the minimum when I see the patch failing.

Items I noticed that may indicate this is the issue:

• Some articles say to look at the install log here: C:\Windows\debug\mrt.log. This log never showed anything for when it failed. It would just show that last successful install. No indication of what failed and why. Once successful, it patchd with that successful install.
• If I ran the patch outside of SCCM (without the external drive), downloaded direct from MS (always a good way to try and determine why the patch failed in most cases), it gave no indication why it failed. Just quickly ran and closed.
• If I extracted the patch from the downloaded exe above, and then ran the MRT.exe file thats within, it would give a cryptic error, which when you follow the link provided, would tell you to look at the C:\Windows\debug\mrt.log

Permanent Solution (pending!): I'm on the lookout for a way to have Windows ignore that drive for future patch extraction. I found some info that says Windows automatically chooses the internal drive with the most space as an extraction point. Why it wont exclude this drive when not plugged in is a mystery. I'll update when I figure it out.