Installing Internet Explorer 10 Failure: Process exit code 0x800B0101 -2146762495

On this magnificent voyage of Internet Explorer 10 deployment throughout the environment here, I often came across the following error message on some newly deployed/imaged workstations, causing the installation of Internet Explorer 10 to fail:

” Process exit code 0x800B0101 (-2146762495) [A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. ] “

Side point: If your internet explorer 10 installation is failing, make sure you check out the exact error message in C:\Windows\IE10_main.log (or %SYSTEMROOT\IE10_main.log if you don’t use c:\ as your default OS drive).

Now that I’ve pin-pointed an exact error message of why the installation is failing, it would seem fairly logical that it would be an easy search in Google and be able find a solution? Wrong. Every post I went through led nowhere. With limited time to spare, I tried to update the root certificates on the box to the latest & greatest in case that was causing the issue, no luck.

Due to some other project-based priorities, I worked with some of my other colleagues on my help desk team to open a ticket with Microsoft to do some troubleshooting on several affected machines. My colleagues and Microsoft worked together for several days and could not come up with an explanation for the issue; Also, after several days of a machine being connected to the network, the issue would go away and IE10 would install properly (my guess at the time was that a patch was coming down as part of our SCCM MS Update deployments that was resolving the issue…SPOILER Alert: this would later prove to be true).

Finally with some weekend time to spare and limited distractions, I sat down to take a look at the issue in detail. I found a machine to test against. This machine was consistently failing IE10 deployments over and over with the same error message above. I started to think about how I was going to approach resolving this issue. I decided that it would make sense to treat this like any other windows update issue and use the Microsoft System Update Readiness tool (Download Here). This tool has been helpful for me in the past fixing corrupted damaged system files or orphaned updates. It’s also been helpful in providing more detailed information and getting to the next step of troubleshooting. After installing the tool and running on the affected workstation, I took a shot in the dark and tried installing IE10 again. No luck. So now if you’re familiar with this tool, you’d know that there is a log that it produces upon completion of the installation, in C:\Windows\Logs\CBS\CheckSur.log (%SystemRoot%\Logs\CBS\CheckSur.log). Upon opening this file, I found several entries regarding expired components, particularly this entry:

CSI Catalog Expired    0x800B0101    winsxs\Catalogs\5ecdd16d7678267e96a8c15964d5ca11bcf7f6f5cd1bd7bf28103ffbea31d9c1.cat    ccb3aa159d2..53a473e1121_31bf3856ad364e35_6.1.7601.22044_eb09bf772e4bea12

So with another shot in the dark (what the hell at this point right?), I performed a google search on that error. Somewhere within that search I came across KB2749655 which deals with a Microsoft known issue “involving specific digital certificates that were generated by Microsoft without proper timestamp attributes. These digital certificates were later used to sign some Microsoft core components and software binaries. This could cause compatibility issues between affected binaries and Microsoft Windows.” Sounds about right. Reading on further, “This issue is caused by a missing timestamp Enhanced Key Usage (EKU) extension during certificate generation and signing of Microsoft core components and software. Some certificates used for two months of 2012 did not contain an X.509 timestamp Enhanced Key Usage (EKU) extension.” These excerpts were taken from the technet article pertaining to KB2749655 if you want to read more here.

Now after applying the patch for this particular KB, http://support.microsoft.com/kb/2749655, rebooting and installing Internet Explorer 10. Voila! Installation went in as normal. This was another nice Sunday victory (two Sunday wins in a row now!).

Here’s the TL;DR for those of who want a quick answer:

• Download KB2749655 and install.
• Reboot
• Retry installation of IE10.

Would love to hear if this solution works for anyone else.

Enjoy the rest of the weekend. Time for a car wash.

Nick