Resolving SIMATIC PCS 7 v8.2 Installation Freezes at Microsoft Update KB2905569

During the installation of SIMATIC PCS 7 v8.2 on Windows 7 SP1 (64-bit), the setup process freezing indefinitely at Microsoft security update KB2905569 occurs because the Windows Update Standalone Installer (wusa.exe) stalls while attempting to validate root certificates or resolve servicing stack dependencies. To resolve this, terminate the hung wusa.exe process in Task Manager to allow setup to continue, pre-install the required Windows Servicing Stack Updates (SSU KB3177467 / KB4490628) and SHA-2 code signing support (KB4474419), or remove the KB entry from the installation media's Setup.ini file.

Root Cause of Setup Hangs at Microsoft Update KB2905569

When installing SIMATIC PCS 7 v8.2 or WinCC v7.4 on Windows 7 SP1 (64-bit):
* The Dependency Call:
The PCS 7 master installer checks for mandatory Microsoft security updates. One of these updates is KB2905569 (a Windows kernel and certificate security patch).
* The wusa.exe Deadlock:
The Siemens setup invokes the Windows Update Standalone Installer (wusa.exe /quiet /norestart). In many offline industrial PCs or newly installed Windows 7 images:
1. The Windows Update service (wuauserv) is disabled or stuck scanning for superseding patches.
2. The installer attempts to query Microsoft online certificate revocation lists (CRL) over an air-gapped network, hanging indefinitely.
3. The master Siemens setup waits for wusa.exe to return an exit code, stalling the entire installation for hours.

The Role of the Windows Servicing Stack and SHA-2 Code Signing

Microsoft transitioned all Windows updates to exclusive SHA-2 Code Signing:
* The Missing Foundation:
Original Windows 7 SP1 media only supports SHA-1. Modern updates (including KB2905569 and PCS 7 security components) require SHA-2 validation.
* Mandatory Pre-Requisites:
Before installing PCS 7 v8.2, two critical updates must be installed in order:
1. KB4490628 / KB3177467: Servicing Stack Update (SSU).
2. KB4474419: SHA-2 Code Signing Support Update.
Without these updates, wusa.exe cannot parse modern security update packages, causing the installation loop.

Comparison Table: Workaround Strategies for Setup Update Freezes

The table below evaluates methods to resolve the KB2905569 installation freeze:

Workaround StrategyImplementation MechanismRisk LevelReliabilityKill wusa.exe in Task ManagerEnd process tree when setup stallsLowHigh (Setup immediately advances to next item)Pre-Install SSU and SHA-2 UpdatesInstall KB4474419 & SSU before PCS 7ZeroHighest (Recommended Manufacturer Best Practice)Edit Setup.ini on Installation MediaRemove KB2905569 from [GLOBALPRODUCTORDER]ModerateHigh (Requires copying DVD to local disk)Disable Windows Update ServiceStop wuauserv serviceHighLow (May cause other pre-requisite checks to fail)

Step-by-Step Procedure to Bypass KB2905569 and Complete PCS 7 Installation

Method 1: Interactive Task Manager Bypass (Immediate Fix):
* While the PCS 7 setup is stuck on "Installing KB2905569...", press Ctrl+Shift+Esc to open Task Manager.
* Switch to the Processes tab and check Show processes from all users.
* Locate wusa.exe (Windows Update Standalone Installer).
* Right-click wusa.exe and select End Process.
* The Siemens setup detects the termination, assumes the check is complete, and immediately advances to installing SIMATIC components.
Method 2: Pre-Requisite Stacking (Clean Engineering Approach):
* Before running PCS 7 setup, manually install Microsoft updates in strict sequence:
1. Install KB3177467 (Servicing Stack).
2. Install KB4474419 (SHA-2 Code Signing).
3. Install KB2905569 manually from the Microsoft Update Catalog.
4. Reboot the PC.
  * Launch PCS 7 Setup.exe. The installer recognizes that KB2905569 is already present and skips it.
Method 3: Modifying Setup.ini on Local Media:
* Copy the PCS 7 v8.2 installation DVD files to a local folder (e.g., D:\PCS7_Setup\).
* Open Setup.ini in Notepad.
* Search for KB2905569.
* In the [GLOBALPRODUCTORDER] section, delete or comment out the line referencing KB2905569.
* Save Setup.ini and run Setup.exe from the local drive.

Configuring Windows Pre-Requisites (IIS, MSMQ, Windows Update Services)

Ensure all Windows OS features are configured before setup:
* Internet Information Services (IIS): Enable ASP.NET, Windows Authentication, and IIS Management Console.
* Message Queuing (MSMQ): Enable Microsoft Message Queue Server Core.
* Windows Update Service: Ensure the service is set to Manual or Automatic, not Disabled.

Verification

To verify successful PCS 7 installation:
1. Confirm that the PCS 7 v8.2 setup finishes with the summary prompt: 'Installation completed successfully.'
2. Reboot the PC as requested by the installer.
3. Open SIMATIC Manager -> Help -> About -> Installed Software.
4. Confirm that STEP 7 V5.5 SP4, CFC V8.2, WinCC V7.4, and APL V8.2 appear in the registered components table.

Limitations and Operational Precautions

Pending Reboot Traps: If Windows reports a pending reboot loop, clear the registry key PendingFileRenameOperations under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager.
Air-Gapped Certificate Check: On networks without internet access, disable automatic root certificate updates in Local Group Policy (gpedit.msc -> Administrative Templates -> System -> Internet Communication Management -> Turn off Automatic Root Certificates Update) to prevent wusa.exe timeouts.
Licensing Disclaimer: SIMATIC PCS 7 v8.2 engineering and runtime packages require valid licenses transferred via Automation License Manager.