KB4484119 for November 2019 causing issues?

Content Authoring
1

This security update is causing havoc on my enterprise, Microsoft has acknowledged that this patch is buggy. I need to get his off 400 machines this morning and I can’t get it to work using the Bigfix uninstall Wizard. It works if I go to the machine and manually uninstall it, but who wants to go to 400 machines tomorrow. I need help!

Thanks.

2

Try this in on a command line, if it works, but a ‘waithidden’ in front of it in actionscript.

wusa.exe /uninstall /kb:4484119 /quiet

3

Jason, I’m trying it now. Will hit you back with results. thanks.

4

I’m getting an Exit Code of 87. Doesn’t appear to work. Ugh!

5

Try it without the /quiet, interactively, outside of bigfix, and see what the message is saying

6

KB4484119 is an Office patch. The Uninstall Wizard doesn’t support these.

If I’m not mistaken, you won’t be able to use wusa to do this.

You would need to use msiexec instead and would also need to know the specific product GUID .

7

I haven’t quite figured out how to do it yet, but you can get the guids you need by pulling the name of the keys:

keys whose (exists values "DisplayName" whose( it as string as lowercase contains "kb4484119" ) of it) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of ( x64 registries; x32 registries )

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.SharePointDesigner_{3B7EE494-CBED-477C-AF90-8B8653C86985}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}

or

values "UninstallString" of keys whose (exists values "DisplayName" whose( it as string as lowercase contains "kb4484119" ) of it) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of ( x64 registries; x32 registries )

"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\Oarpmany.exe" /removereleaseinpatch "{90150000-006E-0409-0000-0000000FF1CE}" "{3B7EE494-CBED-477C-AF90-8B8653C86985}" "1033" "0"
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\Oarpmany.exe" /removereleaseinpatch "{90150000-006E-0409-0000-0000000FF1CE}" "{3B7EE494-CBED-477C-AF90-8B8653C86985}" "1033" "0"
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\Oarpmany.exe" /removereleaseinpatch "{91150000-0011-0000-0000-0000000FF1CE}" "{3B7EE494-CBED-477C-AF90-8B8653C86985}" "1033" "0"

so all you need to do is extract the unique Office Guids and run this for each one:

waithidden "{pathname of system folder & "\msiexec.exe"}" /package {"{OfficeGuid}}"} /uninstall "{3B7EE494-CBED-477C-AF90-8B8653C86985}}"} /qn REBOOT=ReallySuppress /l*v “C:\Windows\temp\KB4484119_uninstall.log”

For this machine, I would need to run:

waithidden "{pathname of system folder & "\msiexec.exe"}" /package {"{Office Guid}}"} /uninstall "{90150000-006E-0409-0000-0000000FF1CE}}"} /qn REBOOT=ReallySuppress /l*v "C:\Windows\temp\KB4484119_uninstall.log"
waithidden "{pathname of system folder & "\msiexec.exe"}" /package {"{Office Guid}}"} /uninstall "{91150000-0011-0000-0000-0000000FF1CE}}"} /qn REBOOT=ReallySuppress /l*v "C:\Windows\temp\KB4484119_uninstall.log"

@JasonWalker I have hit a wall with tuples, substrings, unique values and concatenation trying to extract the values. I bet you can do some magic in a couple seconds of typing.

8

Challenge accepted :slight_smile:

9

My registry looks a bit different. My Office patch uninstall keys don’t have DisplayName values, but the key names themselves indicate the Office GUID, Patch GUID, and Patch Name, as in

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573

I don’t have that particular KB installed, so I started off parsing based on your registry key name, before moving on to a different KB that happens to be installed on mine

q: "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}"
A: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}
T: 12.485 ms

q: preceding text of first "}" of following text of first "{" of "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}"
A: 90150000-006E-0409-0000-0000000FF1CE
T: 12.449 ms

q: concatenation ", "  of (preceding texts of firsts "}" of it) of substrings separated by "{" of  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}"
A: 90150000-006E-0409-0000-0000000FF1CE, 3B7EE494-CBED-477C-AF90-8B8653C86985
T: 12.349 ms

q: ("%22" & pathname of file "msiexec.exe" of system folder & "%22 /I {" & tuple string item 0 of it & "}} /MSIPATCHREMOVE={" & tuple string item 0 of it & "}} /qn") of concatenation ", "  of (preceding texts of firsts "}" of it) of substrings separated by "{" of  "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUSR_{3B7EE494-CBED-477C-AF90-8B8653C86985}"
A: "C:\windows\system32\msiexec.exe" /I {90150000-006E-0409-0000-0000000FF1CE}} /MSIPATCHREMOVE={90150000-006E-0409-0000-0000000FF1CE}} /qn
T: 12.124 ms

q: ("%22" & pathname of file "msiexec.exe" of system folder & "%22 /I {" & tuple string item 0 of it & "}} /MSIPATCHREMOVE={" & tuple string item 1 of it & "}} /qn") of concatenations ", "  of (preceding texts of firsts "}" of it) of substrings separated by "{" of names of keys whose (name of it as lowercase contains "kb2565063" or value "DisplayName" of it as string as lowercase contains "kb2565063" ) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of ( x64 registries; x32 registries )
A: "C:\windows\system32\msiexec.exe" /I {1D8E6291-B0D5-35EC-8441-6616F567A0F7}} /MSIPATCHREMOVE={F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}} /qn
T: 11.259 ms

So for kb4484119, I think the actionscript could be

action uses wow64 redirection false

delete __appendfile

appendfile {("%22" & pathname of file "msiexec.exe" of system folder & "%22 /I {" & tuple string item 0 of it & "}} /MSIPATCHREMOVE={" & tuple string item 1 of it & "}} /qn") of concatenations ", "  of (preceding texts of firsts "}" of it) of substrings separated by "{" of names of keys whose (name of it as lowercase contains "kb4484119" or value "DisplayName" of it as string as lowercase contains "kb4484119" ) of keys "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of ( x64 registries; x32 registries )}

delete RemoveOfficeKB.cmd

move __appendfile RemoveOfficeKB.cmd

waithidden cmd.exe /C RemoveOfficeKB.cmd

Before actually running it, I’d suggest you keep enough of the action script to create the RemoveOfficeKB.cmd, and run the cmd file manually on one machine before mass-deployment. I don’t have that KB installed, and haven’t tested the uninstall commands themselves either.

3 Likes