Impossible to upgrade DPM 2025 to DPM 2025 UR1

Question

Impossible to upgrade DPM 2025 to DPM 2025 UR1

M.E.ACG 11

Trying to update a DPM 2025 server to UR1 fails, regardless of the update being served by WSUS or downloaded by catalog. While having a look to the files contained in the package which I downloaded from catalog, I found an invalid signature was used to sign the patch file (dataprotectionmanager-kb5068307.msp):

User's image

Serial number is 330000048498e212e078a3315d000000000484.

I guess, UR1 will be re-released soon?

VPHAN 10,795 Reputation points Independent Advisor

2025-12-05T05:21:25.7933333+00:00

Hi, Have you tried my suggestions yet? Do you have any questions or need any further assistance? If the issue has been resolved, please click “accept the answer”, as this will help others with the same problem find more useful information. Thank you.

VP

2 answers

Your answer

VPHAN 10,795 Reputation points Independent Advisor

2025-12-05T05:21:25.7933333+00:00

Hi, Have you tried my suggestions yet? Do you have any questions or need any further assistance? If the issue has been resolved, please click “accept the answer”, as this will help others with the same problem find more useful information. Thank you.

VP

Answer 1

Hi M.E.ACG,

The signature validation failure you observed is the direct cause of the update failure. The 1st screenshot shows the critical error "This digital signature is not valid" for the signer "Microsoft Corporation," with a signing time stamped in the future (November 20, 2025). This future date, combined with the detailed cryptographic data in the 2ed image showing a valid certificate structure from the Microsoft Code Signing PCA 2011, points to a corrupted or improperly time-stamped signature within the .msp file itself. The system's certificate validation logic is rejecting the file because the authenticated attribute for the signing time is nonsensical, breaking the chain of trust.

To resolve this and install UR1, you must bypass the signature check for this specific file. The most direct method is to use the msiexec command with the parameter to disable signature validation. First, extract the .msp file from the downloaded update package or locate it in the WSUS content directory, typically under C:\WSUS\WsusContent. Then, open an elevated command prompt and execute the installation directly against the installed DPM product code. You will need to identify the exact GUID for your DPM 2019 installation, which can be found in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products. The command will resemble msiexec /p "C:\PathTo\dataprotectionmanager-kb5068307.msp" /qn /norestart DISABLE_PATCH_SIGNATURE_VALIDATION=1. This forces the installation of the patch regardless of the digital signature error.

Prior to this, ensure your system's date and time are correct and synchronised with a reliable source, as a significant time skew can contribute to validation issues. Also, verify that the root certificate "Microsoft Code Signing PCA 2011" is present and trusted in the local computer's certificate store under Cert:\LocalMachine\Root. While a re-release of UR1 with a correctly signed package is a possibility, this manual installation workaround is the immediate solution. Proceeding with this patch should not affect your ability to install future, correctly signed updates.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to ACCEPT ANSWER then. Should you have more questions, feel free to leave a message. Have a nice day!

M.E.ACG 11 Reputation points

2025-12-05T08:48:31.7766667+00:00

Hi VPHAN,

thanks a lot for your reply!

First of all, the two screenshots are from the same signature. Then I'm wondering why you think, that the 20th of November 2025 is a future date. However, I'm totally aware of the impacts of such a corrupt signature.

Unfortunately, your hint to apply the patch file with "DISABLE_PATCH_SIGNATURE_VALIDATION=1" doesn't allow me to apply the patch file. Omitting the silent-switch, just a generic error message is returned:
VPHAN 10,795 Reputation points Independent Advisor

2025-12-05T10:52:14.3733333+00:00

Sorry for the oversight. The error "This installation package could not be opened" from Windows Installer (msi.dll) means the .msp file is not just badly signed but is structurally corrupted and unrecognizable as a valid Windows Installer patch file. I've taken a look at the screenshots again, the file you have is completely unusable. The digital signature, valid or not, is attached to a corrupted container. This suggests the file was damaged during the download process from the Microsoft Update Catalog or, more likely, the source file on the Microsoft servers was corrupted before signing or during upload.

So we need to get an intact file. First, clear the WSUS cache on your DPM server and any downstream servers to force a fresh download. More directly, manually download the update package again from the Microsoft Update Catalog, but use a different method: instead of using the Microsoft Update Catalog website in your browser, use the Invoke-WebRequest cmdlet in PowerShell with the -UseBasicParsing parameter, or a dedicated download manager, to rule out browser related corruption. Verify the file hash after download; if Microsoft has published an SHA256 hash for KB5068307, compare it.

If a freshly downloaded file exhibits the same installer error, the issue is definitively with the package on Microsoft's side. In this case, you must wait for a re-release. There is no functional workaround for a corrupted .msp; it cannot be applied. Your initial guess is likely correct: UR1 will need to be re-released. For immediate progress, you may need to log a support case with Microsoft to bring formal attention to the corrupted package and request a direct source for a valid file.

Answer 2

M.E.ACG 11

It turned out, that the situation is totally different. Yes, the extracted files were corrupt but that seems to be caused when using the onboard extractor in Server 2025. Extracting the files with another 3rd party tool on the same machine results in intact files. After the extraction, I were able to install UR1 successfully.

VPHAN 10,795 Reputation points Independent Advisor

2025-12-08T14:22:03.14+00:00

thanks for your update. It seems you've just found a bug the new OS! :)

VP

Share via

Impossible to upgrade DPM 2025 to DPM 2025 UR1

2 answers

Your answer