[SOLVED] Access denied on components registry keys causing update to roll back

[tehvlb]

So i hve been trying to update my windows 2022 server, sfc /scannow and dism /scanhealth both pass, the update goes on but when it get to 97% processing it after windows reboots it rolls back every time.

I have been through the cbs log and the only things of note are these

CSI 00000674 (F) STATUS_ACCESS_DENIED #238733# from Windows::Rtl::SystemImplementation:irectRegistryProvider::SysQueryValueKey(flags = 1, key = 7ac ('\REGISTRY\MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-i..ndowsauthentication_31bf3856ad364e35_10.0.20348.143_none_24ab88afbfdb7553'), vn = [l:5 ml:6]'S256H', kvic = 2, kvi = 2, disp = 0)[gle=0xd0000022]

CSI 00000684 (F) STATUS_ACCESS_DENIED #238806# from Windows::Rtl::SystemImplementation:irectRegistryProvider::SysQueryValueKey(flags = 1, key = 6cc ('\REGISTRY\MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-iis-staticcontent_31bf3856ad364e35_10.0.20348.143_none_c6b8425061a044b3'), vn = [l:5 ml:6]'S256H', kvic = 2, kvi = 2, disp = 0)[gle=0xd0000022]

CSI 0000068c (F) STATUS_ACCESS_DENIED #238832# from Windows::Rtl::SystemImplementation:irectRegistryProvider::SysQueryValueKey(flags = 1, key = 4e0 ('\REGISTRY\MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-iis-httpredirect_31bf3856ad364e35_10.0.20348.143_none_233efb91b5346048'), vn = [l:5 ml:6]'S256H', kvic = 2, kvi = 2, disp = 0)[gle=0xd0000022]

CSI 00000694 (F) STATUS_ACCESS_DENIED #238858# from Windows::Rtl::SystemImplementation:irectRegistryProvider::SysQueryValueKey(flags = 1, key = 6cc ('\REGISTRY\MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-iis-httpprotocol_31bf3856ad364e35_10.0.20348.143_none_f5460a6a8257a1e6'), vn = [l:5 ml:6]'S256H', kvic = 2, kvi = 2, disp = 0)[gle=0xd0000022]

CSI 0000069c (F) STATUS_ACCESS_DENIED #238884# from Windows::Rtl::SystemImplementation:irectRegistryProvider::SysQueryValueKey(flags = 1, key = 4e0 ('\REGISTRY\MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-iis-directorybrowse_31bf3856ad364e35_10.0.20348.143_none_4e61beff67ef86f1'), vn = [l:5 ml:6]'S256H', kvic = 2, kvi = 2, disp = 0)[gle=0xd0000022]

CSI 000006a4 (F) STATUS_ACCESS_DENIED #238910# from Windows::Rtl::SystemImplementation:irectRegistryProvider::SysQueryValueKey(flags = 1, key = 6cc ('\REGISTRY\MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-iis-defaultdocument_31bf3856ad364e35_10.0.20348.143_none_a4a5eb3a399bc2e0'), vn = [l:5 ml:6]'S256H', kvic = 2, kvi = 2, disp = 0)[gle=0xd0000022]

CSI 000006ac (F) STATUS_ACCESS_DENIED #238936# from Windows::Rtl::SystemImplementation:irectRegistryProvider::SysQueryValueKey(flags = 1, key = 4e0 ('\REGISTRY\MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-i..tpcompressionstatic_31bf3856ad364e35_10.0.20348.143_none_014f1d4cb5aa0c1e'), vn = [l:5 ml:6]'S256H', kvic = 2, kvi = 2, disp = 0)[gle=0xd0000022]

CSI 000006b4 (F) STATUS_ACCESS_DENIED #238962# from Windows::Rtl::SystemImplementation:irectRegistryProvider::SysQueryValueKey(flags = 1, key = 6cc ('\REGISTRY\MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-i..pcompressiondynamic_31bf3856ad364e35_10.0.20348.143_none_4f744c459ac29cbf'), vn = [l:5 ml:6]'S256H', kvic = 2, kvi = 2, disp = 0)[gle=0xd0000022]

CSI 000006bc (F) STATUS_ACCESS_DENIED #238988# from Windows::Rtl::SystemImplementation:irectRegistryProvider::SysQueryValueKey(flags = 1, key = 4e0 ('\REGISTRY\MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-i..pressionbinaries-gc_31bf3856ad364e35_10.0.20348.143_none_19537603e412928e'), vn = [l:5 ml:6]'S256H', kvic = 2, kvi = 2, disp = 0)[gle=0xd0000022]

CSI 000006c4 (F) STATUS_ACCESS_DENIED #239014# from Windows::Rtl::SystemImplementation:irectRegistryProvider::SysQueryValueKey(flags = 1, key = 6cc ('\REGISTRY\MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-iis-httpcache_31bf3856ad364e35_10.0.20348.143_none_4854e14261053f18'), vn = [l:5 ml:6]'S256H', kvic = 2, kvi = 2, disp = 0)[gle=0xd0000022]

CSI 000006cc (F) STATUS_ACCESS_DENIED #239040# from Windows::Rtl::SystemImplementation:irectRegistryProvider::SysQueryValueKey(flags = 1, key = 4e0 ('\REGISTRY\MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-iis-caching_31bf3856ad364e35_10.0.20348.143_none_2c84eb8606926f03'), vn = [l:5 ml:6]'S256H', kvic = 2, kvi = 2, disp = 0)[gle=0xd0000022]

CSI 000006d4 (F) STATUS_ACCESS_DENIED #239066# from Windows::Rtl::SystemImplementation:irectRegistryProvider::SysQueryValueKey(flags = 1, key = 6cc ('\REGISTRY\MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-iis-cachingbase_31bf3856ad364e35_10.0.20348.143_none_555a1987815201c2'), vn = [l:5 ml:6]'S256H', kvic = 2, kvi = 2, disp = 0)[gle=0xd0000022]

CSI 000006dc (F) STATUS_ACCESS_DENIED #239092# from Windows::Rtl::SystemImplementation:irectRegistryProvider::SysQueryValueKey(flags = 1, key = 4e0 ('\REGISTRY\MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-iis-httplogging_31bf3856ad364e35_10.0.20348.143_none_8073e1f4729d1b87'), vn = [l:5 ml:6]'S256H', kvic = 2, kvi = 2, disp = 0)[gle=0xd0000022]



The list goes on

I have loaded the components hive and tracked down the keys and the permissions on them are consistnt with the permissions on the other keys surrounding it.

any ideas?

 

[tehvlb]

bump

 

[tehvlb]

anyone able to help?

this is now affecting more of our servers

 

[Maxstar]

Hi,

Please follow the Windows Update Forum Posting Instructions and provide the requested files in your next post

 

[tehvlb]

Hi,

Please follow the Windows Update Forum Posting Instructions and provide the requested files in your next post

Thanks Maxstar, files attached

Components scanner clean, SFC clean, Dism clean the only thing that provides errors is the "cbs-accessdenied.log" this is the log of when it tries to install the update but roll back because of access denied on the reg keys mentioned in first post.

thank you for your time and help

 

[Maxstar]

Hi,

Which (third party) security software is installed on this server? Malwarebytes?

 

[tehvlb]

Hi,

Which (third party) security software is installed on this server? Malwarebytes?

Yes MalwareBytes

 

[Maxstar]

Please uninstall Malwarebytes first and reboot the server. Then attempt to update again.

 

[tehvlb]

Please uninstall Malwarebytes first and reboot the server. Then attempt to update again.

will do that now

 

[tehvlb]

thats it removed and trying updates again

 

[Maxstar]

Great, let me know the result! If it fails attach a new copy of the CBS logs.

 

[tehvlb]

Great, let me know the result! If it fails attach a new copy of the CBS logs.

Thanks that worked a treat, MWB must have been locking the regitry.

Thank you Maxstar

 

[Maxstar]

Hi,

You're welcome. Glad to hear the update installed without any issue after uninstalling Malwarebytes...
I will mark this thread as solved.