"File is encrypted, but no key was provided." trying to upgrade Win10 1511 to 1607 via CM CB 1606

[hybrid]

We are experiencing an issue trying to install the 1607 Feature Update using a Windows 10 Servicing Plan in ConfigMgr CB (5.0.8412.1000). We have a simple single server SCCM infrastructure.

 

The required KB3159706 has been installed on the server, and the additional steps in "More information" at the bottom of that KB article have also been carried out. We've cleared the download of the Feature Update and downloaded it again after verifying the steps. Both the WSUS site and the Configuration Manager site in IIS have the .esd mimetype set to application/vnd.ms-cab-compressed.

 

The deployment appears on clients (5.00.8412.1007 CCM client), and downloads the 2 GB or so judging by the time taken, but fails to apply. We never get to reboot into the WinPE(?) stage to perform the upgrade.

 

The reported error code is 0xC180011

 

This is from $Windows.~BT\Sources\Panther\setupact.log:

2016-08-22 22:08:11, Info                  MOUPG  RecoverCrypto: Entering Execute Method
2016-08-22 22:08:11, Info                  MOUPG  DlpTask: Resetting action [0] progress start time.
2016-08-22 22:08:11, Error                 MOUPG  RecoverCrypto: File is encrypted, but no key was provided.
2016-08-22 22:08:11, Error                 MOUPG  CDlpActionRecoverCrypto::DoCrypto(1713): Result = 0xC1800118
2016-08-22 22:08:11, Error                 MOUPG  CDlpActionRecoverCrypto::ExecuteRoutine(2465): Result = 0xC1800118
2016-08-22 22:08:11, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2101]
2016-08-22 22:08:11, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2100]
2016-08-22 22:08:11, Error                 MOUPG  CDlpActionImpl<class CDlpErrorImpl<class CDlpObjectInternalImpl<class CUnknownImpl<class IDlpAction> > > >::Execute(441): Result = 0xC1800118
2016-08-22 22:08:12, Info                  MOUPG  RecoverCrypto: Leaving Execute Method
2016-08-22 22:08:12, Error                 MOUPG  CDlpTask::ExecuteAction(3243): Result = 0xC1800118
2016-08-22 22:08:12, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2004]
2016-08-22 22:08:12, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2003]
2016-08-22 22:08:12, Error                 MOUPG  CDlpTask::ExecuteActions(3397): Result = 0xC1800118
2016-08-22 22:08:12, Info                  MOUPG  Waiting for actions thread to exit.
2016-08-22 22:08:12, Info                  MOUPG  Actions thread has exited.
2016-08-22 22:08:12, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2004]
2016-08-22 22:08:12, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x2000]
2016-08-22 22:08:12, Error                 MOUPG  CDlpTask::Execute(1631): Result = 0xC1800118
2016-08-22 22:08:12, Warning               MOUPG  CSetupDiagnostics::ReportData - Not reporting WINDLP data point [0x3000]
2016-08-22 22:08:12, Info                  MOUPG  DlpTask: Leaving Execute Method
2016-08-22 22:08:12, Error                 MOUPG  CSetupManager::ExecuteTask(2067): Result = 0xC1800118
2016-08-22 22:08:12, Error                 MOUPG  CSetupManager::ExecuteTask(2030): Result = 0xC1800118
2016-08-22 22:08:12, Error                 MOUPG  CSetupManager::ExecuteInstallMode(690): Result = 0xC1800118
2016-08-22 22:08:12, Error                 MOUPG  CSetupManager::ExecuteDownlevelMode(391): Result = 0xC1800118
2016-08-22 22:08:12, Info                  MOUPG  Setup phase change: [SetupPhaseUnpack] -> [SetupPhaseError]
2016-08-22 22:08:12, Info                  MOUPG  SetupManager::OpenOrCreateTask: Found task [Exit] in state [0x6] - Action [0xFFFFFFFF].
2016-08-22 22:08:12, Info                  MOUPG  SetupManager::OpenOrCreateTask: Deleting...
2016-08-22 22:08:13, Info                  MOUPG  SetupManager::OpenOrCreateTask: Deleted task [Exit]
2016-08-22 22:08:13, Info                  MOUPG  SetupManager::OpenOrCreateTask: Creating new task [Exit].
2016-08-22 22:08:13, Info                  MOUPG  CreateTask: Name = [Exit], WorkingPath = [C:\$WINDOWS.~BT\Sources], TransportId = [00000000-0000-0000-0000-000000000000], Flags = [0x0]
2016-08-22 22:08:13, Info                  MOUPG  Finalize: Entering Prepare Method
2016-08-22 22:08:13, Info                  MOUPG  Finalize: Leaving Prepare Method
2016-08-22 22:08:13, Info                  MOUPG  DlpTask: Entering Execute Method
2016-08-22 22:08:13, Info                  MOUPG  DlpTask: Transport not set. Skipping download phase.
2016-08-22 22:08:13, Info                  MOUPG  DlpTask: Executing Actions...
2016-08-22 22:08:13, Info                  MOUPG  Action execution thread timeout period: [1000 ms]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing SetupResult: [0xc1800118]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing Extended:    [0x30002]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing Scenario:    [5]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing Mode:        [2]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing Target:      [C]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing SQM:         [TRUE]
2016-08-22 22:08:13, Info                  MOUPG  ImageExit: Initializing PostReboot:  [FALSE]

Even after clearing the CCM client cache, SoftwareDistribution folder, deleting the software update package from the CCM server and downloading and deploying it again, we see this issue across each of the several systems we have tried.

 

Any further insights would be greatly appreciated! Is there anywhere else we should be looking on the server to do with decrypting the .esd?

[anyweb]

hi Peter, can you zip up all the logs (*.xml files, *.log) in that folder and send them to me to look at please ?

[anyweb]

from the logs, I can see that this is Windows 10 Education, did you service it with the corresponding update ? (edu>edu)

[hybrid]

Indeed: our deployment is for the Feature Update to Windows 10 Education 1607. The en-us and en-gb versions of that SKU are the only upgrades downloaded. Our machines believe they are on en-us language pack(?) (although we have UK regional settings).

 

Our Servicing Plan rule:

 

 

The results of previewing this:

 

 

Our deployments to two collections:

 

[anyweb]

ok try deleting the 1607 updates (all of them) in WSUS (the wsus console), then resync the sup in ConfigMgr, and try again.

[rayddi]

Hi Hybrid,

to fix the issue, you need to re-install the SUP.

More info here;

https://venusingireddy.blogspot.com.au/2016/08/recovercrypto-file-is-encrypted-but-no.html?showComment=1472377988261#c7202095427114772578

thanks

[anyweb]

not according to Microsoft you don't, where did you get the idea that you need to reinstall the SUP ?

[hybrid]

Here's what we've done:

 

• Removed the test deployments of the Feature Update
• Removed the Servicing Plan associated with those deployments (so there are no Servicing Plans)
• Removed the Deployment Package that Servicing Plan was attached to
• Deleted the folder associated with that Deployment Package from the disk
• Rebooted the SCCM & WSUS server
• Altered the SUP configuration to remove the "Upgrades" classification (Administration > Sites > (Primary site) > Configure Site Components > Software Update Point > Classifications)
• Altered the WSUS configuration to also not include the "Upgrades" classification: Get-WsusClassification | Where-Object -FilterScript {$_.Classification.Title -Eq "Upgrades"} | Set-WsusClassification -Disable [reference]
• Ran a Synchronize Software Updates from Software Library > All Software Updates in the SCCM console.
• Verified that the Upgrades category is off in both SCCM console and WSUS.
• Removed updates with PowerShell:
  • $s = Get-WsusServer
  • $s.SearchUpdates("version 1607") | Foreach { Write-Host $_.Id.UpdateId; $s.DeleteUpdate($_.Id.UpdateId) }
  • $s.SearchUpdates("version 1511, version 10586") | Foreach { Write-Host $_.Id.UpdateId; $s.DeleteUpdate($_.Id.UpdateId) }
• Ran the WSUS Server Cleanup Wizard with only "unneeded update files" checked.
• Ran a Synchronize Software Updates from Software Library > All Software Updates in the SCCM console.
• Rebooted the SCCM/WSUS server.
• Altered the SUP configuration to add the "Upgrades" classification (Administration > Sites > (Primary site) > Configure Site Components > Software Update Point > Classifications)
• Ran a Synchronize Software Updates from Software Library > All Software Updates in the SCCM console.

 

I've run out of time to continue with this today, so I will update this post when we try to deploy again...

[hybrid]

I've now also:

 

• Created a new servicing plan "Windows 10 Education 1607 Servicing Plan". It uses a new deployment package.
  • 
• Clicked Run now on this new Servicing Plan.
• Verified that the content download is in progress:
  • 
• Verified that the two expected upgrades (en-us and en-gb that matched our rule when previewed) are "Downloaded". (Not "Deployed" yet)
• Got impatient and ran a Software Update point synchronisation to try and get the deployment to appear.
• Verified that the two expected upgrades are now "Downloaded" and "Deployed":
  • 
• Went to a client that is in the deployed collection and cleared the CCM cache from the Control Panel UI
• Deleted C:\~WINDOWS.BT from the client (from its previous upgrade attempt)
• Ran all the Action cycles in the Control Panel UI for the ConfigMgr client
• Went to Software Center > Updates > Windows 10 Feature Update... and ran the upgrade.

 

We still see the same error on the client after the download and install attempt.

 

 

Really trying to avoid a SUP reinstall if possible!

[RLC-Andrew]

I had some other issues...recorded in a different post. Having said that, I have finally reached this error message and this point in my troubleshooting.

 

From a Social.TechNet discussion, I have also come to the conclusion that I need to reinstall the SUP. I really don't want to have to do it...but there is compelling reason to believe it will work (knowing that I have tried all the other options).

 

Back when my SCCM environment was smaller and unused for production, I remember having to do the remove and add the sup role and it fixed the problem that day.

 

I'm not sure what gotchas and/or side-effects are involved now. I know you basically remove the roll. Watch the sup log till its done. Reboot?. Then Add the role back in and configure it as you had it configured before. What I don't know is...what else needs done (or re-done). How will doing this effect the existing software updates, groups, packages etc.