[SOLVED] Corrupted Windows Server 2016

ennvee · Feb 14, 2024

Hi all,

a couple of days ago our Windows Server 2016 would not start anymore but run into a BSOD ("Critical Process Died").

SFC /scannow found errors, but could not repair them. In the log files, over 1000 unique files were shown as corrupted.

We tried offline DSIM repair with an ISO from a Win PE which ran successfully but did not fix the problems.

As a last resort we copied the backups from Windows\System32\config\RegBack which finally allowed us to boot up the server.

Now, running "sfc /scannow" stops at 75% displaying "Windows Resource Protection could not perform the requested operation". DISM doesn't find an error, SFCFix shows no errors either. See logs attached.

What can we do? Thanks so much in advance for any help.

EDIT: Found the "Posting Instructions" and replaced the logfiles

Maxstar · Feb 19, 2024

Hi and welcome to Sysnative,

1. Open an elevated command prompt and run the following command. Attach Dirlist.txt to your next post.

Code:

dir /s /a %systemroot%\WinSxS\amd64_prnbrcl1.inf_31bf3856ad364e35_10.0.14393.0_none_3ed11940ff3514d4 > "%userprofile%\Desktop\Dirlist.txt"

2. Upload your COMPONENTS hive.

Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
Right-click on this file on your desktop and select Send To > Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
If the file is too large to upload here, upload the file to www.wetransfer.com and post the link in your next reply.

ennvee · Feb 19, 2024

Hi @Maxstar, thank you! Please see the file attached & behind the following link: COMPONENTS.zip

Maxstar · Feb 19, 2024

Hi,

Step 1. Download

SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

Save any work you have open, and close all programs.
Download the attachment SFCFix.zip and save it to your desktop.
Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the System File Checker and post the result. If it fails attach a new copy of the CBS log.

Code:

SFC /Scannow

ennvee · Feb 19, 2024

Thanks a lot, I will try this on wednesday afternoon (Server is in production environment...)

Maxstar · Feb 19, 2024

That's fine, I will see the result then.

ennvee · Feb 21, 2024

Hi @Maxstar, please see the log files attached. Unfortunately, Windows installed an Update on monday, which I failed to postpone. However, this time everything went well and the server is still bootable.

But sfc /scannow still stops at 75% ("Windows Resource Protection could not perform the requested operation").

Maxstar · Feb 21, 2024

Hi,

Here's the next fix to replace another component.

Step 1.
Warning: This fix was written specifically for this system. Do not run this fix on another system.

Save any work you have open, and close all programs.
Download the attachment SFCFix.zip and save it to your desktop.
Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the System File Checker and post the result. If it fails attach a new copy of the CBS log.

Code:

SFC /Scannow

ennvee · Feb 21, 2024

Thank you. Still 75%.

Logs attached!

Maxstar · Feb 21, 2024

Here's the next fix.

Step 1.
Warning: This fix was written specifically for this system. Do not run this fix on another system.

Save any work you have open, and close all programs.
Download the attachment SFCFix.zip and save it to your desktop.
Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the System File Checker and post the result. If it fails attach a new copy of the CBS log.

Code:

SFC /Scannow

ennvee · Feb 23, 2024

Thank you. Still 75%. I don't understand why SFC does not finish (with errors) but just stops...?!

Maxstar · Feb 23, 2024

Hi,

Please run SFC /Scannow again with Process Monitor running.

Step#1 - Capture Process Monitor Trace
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Run the System File Checker
3. Stop Process Monitor as soon as it fails. You can simply do this by clicking the square (CTRL +E) on the toolbar as shown below.

4. Select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
5. Zip up the LogFile.PML and upload it to WeTransfer - Send Large Files & Share Photos Online - Up to 2GB Free and provide the link.
6. Attach also a new copy of the CBS logs for the time stamps.

Upload a new copy of your COMPONENTS hive.

Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
Right-click on this file on your desktop and select Send To > Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
If the file is too large to upload here, upload the file to www.wetransfer.com and post the link in your next reply.

ennvee · Feb 24, 2024

Hi @Maxstar, thank you for your help. All files are uploaded here: CBS-20240224-1200.zip

Maxstar · Feb 24, 2024

Hi,

Step 1.
Warning: This fix was written specifically for this system. Do not run this fix on another system.

Save any work you have open, and close all programs.
Download the attachment SFCFix.zip and save it to your desktop.
Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the System File Checker again with Process Monitor running. If it fails attach a new copy of the CBS log and the *.PML trace file.

Code:

SFC /Scannow

ennvee · Feb 24, 2024

Sorry, still 75%...

Thank you for your patience and support!

Maxstar · Feb 24, 2024

ennvee said:
(...) a couple of days ago our Windows Server 2016 would not start anymore but run into a BSOD ("Critical Process Died").
As a last resort we copied the backups from Windows\System32\config\RegBack which finally allowed us to boot up the server.

The current COMPONENTS hive is out of sync. This means that a number of Components keys contain values (f! marks) with unexpected value data for the associated payload files into the WinSxS folder.

We can try to fix all the corruptions manually, but an in-place-upgrade with the Windows Server 2016 ISO would be a more suitable way to fix this server. Please let me know what you prefer.

In-place upgrade Server 2016

Mount the Windows Server ISO and run Setup.exe.
Use the option Download and install updates, drivers (recommended) and click Next.
In the next screen select the image you want to install.
Depending on your Windows Server version and license, you may see a screen prompting you to enter the licensing key.
Then accept the EULA. To perform a in-place upgrade, you need to check keep personal files and apps. Then click Next.
After clicking Next, an upgrade process will start checking for updates, when this is ready click install to start the in-place upgrade.

ennvee · Feb 24, 2024

I've never done an in place upgrade with an Windows 2016 server. What about all the apps and services, will they still work after this process? We have a couple of important things running, which we cannot re-install on our own.

Maxstar · Feb 24, 2024

Normally, an in-place-upgrade will not affect any apps, settings and/or services. However, if that is the case, the process will show a summary of possibly changes which will be made.

So what I would suggest is to make a full-image (snapshot) of this server first. Or clone this server in a test enviroment to perform the in-place-upgrade.

ennvee · Feb 27, 2024

Tahnk you. I will need a couple of days to prepare. I hope I can perform the in-place upgrade on wednesday or friday next week and will then report back here.

Maxstar · Feb 27, 2024

Please take your time...

[SOLVED] Corrupted Windows Server 2016

Member

Attachments

Windows Update Moderator, Security Analyst

Member

Attachments

Windows Update Moderator, Security Analyst

Attachments

Member

Windows Update Moderator, Security Analyst

Member

Attachments

Windows Update Moderator, Security Analyst

Attachments

Member

Attachments

Windows Update Moderator, Security Analyst

Attachments

Member

Attachments

Windows Update Moderator, Security Analyst

Member

Windows Update Moderator, Security Analyst

Attachments

Member

Attachments

Windows Update Moderator, Security Analyst

Member

Windows Update Moderator, Security Analyst

Member

Windows Update Moderator, Security Analyst