.NET-Framework Update KB4556399 throws install error 643

[German]The .NET framework update KB4556399 from May 12, 2020 fails for some Windows 7 users users with an installation error 643. Most of this affected are using the unofficial BypassESU solution from MDL.

Shortly after release of .NET framework update KB4556399, I had a discussion about installation error 643 within my German blog (see the comments here). Later I blocked the comments, because it has nothing to do with the article's topic and asked to continue the discussion at the German blog post Patchday: Updates für Windows 7/8.1/Server (12. Mai 2020). Also at deskmodder.de there is this discussion about the issue. There are two groups of people affected:

• The error occurs sometimes on systems where the .NET framework is broken. At askwoody.com there is this comment, where someone has the bug on machines with official ESU license.
• Currently it seems to me that the 0x643 bug has consistently affected users who use the unofficial BypassESU solution from the My Digital Life forum.

Those affected people with a valid ESU key installed on Windows 7 SP should try the solutions outlined below.

Error 0x643 on systems with ESU license

The 0x643 error occurs more frequently when installing .NET Framework Update installations if the .NET Framework is broken or the MSI Software Update registry is corrupted. Microsoft has published this KB article on this topic. There you will find hints what you can do.

Error 0x643 on systems without ESU license

In the current case, however, most affected systems are using the unofficial BypassESU, to receive Windows 7 security updates after support end. Then the error is caused by fact that the required license check fails during update installation. There are two solutions to overcome this error.

Manual fix for the installation error

The error occur because the update installer performs certain checks on an ESU license and then concludes in BypassESU that the requirements are not met. The developer of BypassESU has published an explanation and a workaround in My Digital Life forum – a copy of his post may be found at pastebin.

I've captured the custom action dll from NDP48-KB4552921.msp and analyzed it in IDA. The custom action dll exports a function ValidateESULicense which initially queries a msi property "ESU_LOCK" and compares it to several values that determine the further path of action. Long story short, if that value is "2D40812E-974C-4EA2-8DCC-63C992D505B9" the code path logs "ESU Validation is OFF"

The colleagues at deskmodder.de have published the download links for the required files (and also a link to the MDL forum, requires an account) in this article. Here are the steps to fix the install error.

1. You need the file ndp48-kb4552921 in the 32- or 64-bit variant suitable for Windows. It is an .exe file.

2. Then open an administrative command prompt by choosing Run as administrator and type the appropriate command.

For 32-bit Windows 7, use the following command at the command prompt.

ndp48-kb4552921-x86_608b67e4011b9e103ca18deadbfc013d1c328508.exe /msioptions "ESU_LOCK=2D40812E-974C-4EA2-8DCC-63C992D505B9"

The ndp48-kb4552921 …exe must be located in the folder that is the default in the command prompt. Otherwise, the path must be specified. For 64-bit Windows 7, the command is as follows.

ndp48-kb4552921-x64_6912af0422fc16a14f4f398fda98117f1e2f01b8.exe /msioptions "ESU_LOCK=2D40812E-974C-4EA2-8DCC-63C992D505B9"

In the (German) comments here there was the problem that the blog software modified the quotation marks in the ESU_LOCK GUID – so the users that typed the wrong characters faced another error.

A summary of the procedure (in German) can be found by Joe_Gerhard in this comment. Meanwhile I formatted his commands in the comment in a way, that the quotation marks are not changed anymore – the commands should work (otherwise try the hints from Scyllo here). If there are still problems – go through the hints from Andreas.

dotNetFx4_ESU_Installer.cmd from the MDL forum

Within this German comment blog reader Gerold points out that the developer of BypassESU has posted a dotNetFx4_ESU_Installer.cmd batch file in the My Digital Life (MDL) forum to install the stubborn update. If you have access to the MDL forum, you can find the links to the respective thread in the comments linked several times here or at deskmodder.de.