Highlighted
Absent Member.
Absent Member.
19492 views

Cabinet Maker Popup Windows

It seems like with every new Patch Tuesday that when patches are deployed to my systems there is at least one that prompts the command window to pop up with the "Cabinet Maker- Lossless Data Compression Tool" which decompresses a log file. What is this and why does this happen? It is a real sore point for my users because when it pops up it usually pops up with about a dozen instances and gets to be very annoying as a result. Thank you for any information.
Labels (2)
0 Likes
19 Replies
Highlighted
Knowledge Partner
Knowledge Partner

Re: Cabinet Maker Popup Windows

marklar23;2401802 wrote:
It seems like with every new Patch Tuesday that when patches are deployed to my systems there is at least one that prompts the command window to pop up with the "Cabinet Maker- Lossless Data Compression Tool" which decompresses a log file. What is this and why does this happen? It is a real sore point for my users because when it pops up it usually pops up with about a dozen instances and gets to be very annoying as a result. Thank you for any information.


I've never seen/heard that happen. The only thing I can think of is that perhaps on some devices, you have file types set to "open" with Cabinet Maker?
If you look in the Event Viewer -> Application logs, and filter for WSH
You'll what's really going on for most (not all) patches and how ZPM applies them.

You'll see things like:
DEPLOYMENT: Information File Name: windows6.1-kb3065979-x86.cab FLAGS: The flags that were passed into the script. Script Flags: -z -q -c -sc -PLDEBUG -2 -PLNP The flags that were passed into the executable. Executable Flags: /quiet /norestart

or

File Name: windows6.1-kb3065979-x86.cab

EXPAND CAB FILE:
Expand CAB command 'EXPAND -r "C:\Windows\TEMP\windows6.1-kb3065979-x86.cab" -F:* "C:\Windows\TEMP\776EA8B6-6A1A-446E-9C48-A8B704DF31CA"'

So you can see that it's just running native Windows commands for the extraction, and then doing some custom stuff for the installation that are specific to ZPM/Lumension with the .CAB file.
0 Likes
Highlighted
Absent Member.
Absent Member.

Re: Cabinet Maker Popup Windows

According to what you have posted, the Event Viewer instances look like what you say that I should be expecting. I have always suspected the popup windows that I experience to be something related to how the update cleans itself up after deployment, and like to blame Microsoft for that. A little more detail about what I am actually seeing is as follows:

A command box seems to show up with "Critical" updates rather than recommended as ZPM identifies them. Along the menu bar I see the path C:\Windows\system32\makecab.exe. The first line seems to be a menu saying "Cabinet Maker - Lossless Data Compression Tool", and the last line starts with a percentage indicator followed by "- CbsPersist_20141010150046.log (1 of 1)"

In every instance of this window that shows up it is always the same log file, I have not paid enough attention to determine if is the same CbsPersist...log file each time but will pay attention for when I probably revisit this with next month's updates.
0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Re: Cabinet Maker Popup Windows

marklar23;2401843 wrote:
According to what you have posted, the Event Viewer instances look like what you say that I should be expecting. I have always suspected the popup windows that I experience to be something related to how the update cleans itself up after deployment, and like to blame Microsoft for that. A little more detail about what I am actually seeing is as follows:

A command box seems to show up with "Critical" updates rather than recommended as ZPM identifies them. Along the menu bar I see the path C:\Windows\system32\makecab.exe. The first line seems to be a menu saying "Cabinet Maker - Lossless Data Compression Tool", and the last line starts with a percentage indicator followed by "- CbsPersist_20141010150046.log (1 of 1)"

In every instance of this window that shows up it is always the same log file, I have not paid enough attention to determine if is the same CbsPersist...log file each time but will pay attention for when I probably revisit this with next month's updates.


Only thing I could find is this:

http://answers.microsoft.com/en-us/ie/forum/ie8-windows_7/error-cwindowssystem32makecabexe-when-surfing-the/857421f5-362f-4f57-ae09-b3cde2ff0619

Not terribly helpful, but seems to indicate it's not normal for this to happen, but "other" things can cause it. Not sure about malware/AV, but I'm fairly certain even the Lumension stuff doesn't call makecab.exe.

--Kevin
0 Likes
Highlighted
Absent Member.
Absent Member.

Re: Cabinet Maker Popup Windows

marklar23;2401802 wrote:
It seems like with every new Patch Tuesday that when patches are deployed to my systems there is at least one that prompts the command window to pop up with the "Cabinet Maker- Lossless Data Compression Tool" which decompresses a log file. What is this and why does this happen? It is a real sore point for my users because when it pops up it usually pops up with about a dozen instances and gets to be very annoying as a result. Thank you for any information.



Hi,

I just want to add a +1 here. I see the same behaviour in my environment running ZENworks 11.3.2 with PatchPolicies. (Windows 7 Clients)
0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Re: Cabinet Maker Popup Windows

ccsh2014;2401995 wrote:
Hi,

I just want to add a +1 here. I see the same behaviour in my environment running ZENworks 11.3.2 with PatchPolicies. (Windows 7 Clients)


Probably in that case, an SR is in order. Unless you want to use one of the sysinternals software to find out what's actually calling it? But if you google for it, you will find that the situation can and does arise without ZPM even being in the picture.
0 Likes
Highlighted
Absent Member.
Absent Member.

Re: Cabinet Maker Popup Windows

I see this happen nearly every month when I push patches out and even logged an SR. Not a lot came out of the SR, but it was clear to me that it's a Lumension issue.

The actual cab files are in c:\windows\logs\cbs. You'll notice that there's a CBS.log in this directory that's currently in use and there are details about it here. In that folder are also the .cab files created by the makecab.exe process mentioned above. If you extract the logs, they appear to have details on patch detections. You will also see references to "LM.Detection" all through it.

2015-07-06 13:39:08, Info                  CBS    Session: 30455784_3227653522 initialized by client LM.Detection.

And you should see entries like this when the .cab files get created.
2015-07-06 13:39:18, Info                  CBS    Archived backup log: C:\Windows\Logs\CBS\CbsPersist_20150706123906.cab
.

We find that our users get this regardless of whether patch bundles or policies are used.
0 Likes
Highlighted
Absent Member.
Absent Member.

Re: Cabinet Maker Popup Windows

dantutty;2402096 wrote:
I see this happen nearly every month when I push patches out and even logged an SR. Not a lot came out of the SR, but it was clear to me that it's a Lumension issue.

The actual cab files are in c:\windows\logs\cbs. You'll notice that there's a CBS.log in this directory that's currently in use and there are details about it here. In that folder are also the .cab files created by the makecab.exe process mentioned above. If you extract the logs, they appear to have details on patch detections. You will also see references to "LM.Detection" all through it.

2015-07-06 13:39:08, Info                  CBS    Session: 30455784_3227653522 initialized by client LM.Detection.

And you should see entries like this when the .cab files get created.
2015-07-06 13:39:18, Info                  CBS    Archived backup log: C:\Windows\Logs\CBS\CbsPersist_20150706123906.cab
.

We find that our users get this regardless of whether patch bundles or policies are used.


Hi,

Thanks for sharing your research. I will go ahead and rise an SR. Could you please share your SR-No. with me?

To all who have seen this error: Did you have the windows service "Windows Update" disabled on your machines? We do.

Kind Regards
Sebastian
0 Likes
Highlighted
New Member.

Re: Cabinet Maker Popup Windows

I have seen this also. We do not have the Windows Update service disabled, as we use it for other things (like manually installing other updates, such as the Remote Server Administration Tools and some out-of-band 802.1x patches).
0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Re: Cabinet Maker Popup Windows

ccsh2014;2402109 wrote:
Hi,

Thanks for sharing your research. I will go ahead and rise an SR. Could you please share your SR-No. with me?

To all who have seen this error: Did you have the windows service "Windows Update" disabled on your machines? We do.

Kind Regards
Sebastian


It used to be (I'll have to check again) that you should NOT disable Windows Update service, but rather leave it be manual. I thought at one point in time it was needed for ZPM to function properly.

But I could be wrong on the current state of things.

--Kevin
0 Likes
Highlighted
Absent Member.
Absent Member.

Re: Cabinet Maker Popup Windows

kjhurni;2402114 wrote:
It used to be (I'll have to check again) that you should NOT disable Windows Update service, but rather leave it be manual. I thought at one point in time it was needed for ZPM to function properly.

But I could be wrong on the current state of things.

--Kevin



Another +1. We have this as well and it's annoying the heck out of our users as it's usually not only a single instance of these popups, but they're literally bombarded with them during a patch rollout, with up to 10 of them popping up and closing again simultaneously. Patch Bundle or Patch Policy doesn't make a difference (we use policies). The Windows Update service is enabled on our devices.

Think I'll open an SR as well, the more the merrier. 🙂

Steffen
0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Re: Cabinet Maker Popup Windows

sreinhart;2402119 wrote:
Another +1. We have this as well and it's annoying the heck out of our users as it's usually not only a single instance of these popups, but they're literally bombarded with them during a patch rollout, with up to 10 of them popping up and closing again simultaneously. Patch Bundle or Patch Policy doesn't make a difference (we use policies). The Windows Update service is enabled on our devices.

Think I'll open an SR as well, the more the merrier. 🙂

Steffen


Not sure if this helps at all. While I don't see it here in our environment (we have plenty of other issues), we are:

ZCM 11.3.2 on SLES11 SP3 primaries (no FRU1)
Windows 7 Enterprise 32-bit with SP1
UAC is disabled

MOST (but not all) agents are 11.3.2 as well.

We are using Policies (strictly policies) with the settings defined at the:
Devices -> Workstations folder set to run on refresh with a delay of 90 minutes.
DAU is set to run globally (zone) at refresh
Refresh is random timed between 5-6 minutes after service startup.

We run McAfee VSE 8.8 with Patch 4, and the ePO agent, and also HIPS, although I doubt HIPS would matter (just the firewall portion). McAfee is set with the proper AV exclusions per Novell's latest TID.

--Kevin
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.