DIRSD & Duplicate ownership errors in sfc scan

[tushartarkas]

Hello,

I've a Windows 2k16 server (datacenter) running as a VM in VMware vSphere infrastructure. I've my custom applications installed on it along with certain security agents. The Windows updates for all VMs in the infrastructure are centrally managed through another software.

I've a periodic check scheduled for my VMs to check for system files and windows component store. For doing the same, I use following set of commands.
1. sfc /scannow to check and correct system files
2. dism /online /cleanup-image /scanhealth to scan if there are any issues with component store
3. disk /online /cleanup-image /restorehealth to correct if any errors are detected

During last few cycles, the sfc command is failing with error corrupt files detected but could not correct it. For such servers, the scanhealth also returns specifying component is repairable however, the restorehealth fails complaining about could not find Source.

I'm attaching the cbs.log file with 1 recent run.

From the logs, I could find a lot of entries with either duplicate ownership for certain directories or no ownership at all. Searching through a lot of forums, these seem to be normal. I've followed suggestions in blogs for DIRSD and duplicate ownership. However, I still need help in ascerting the following.
1. Is this normal condition or there is any risk to the running server in terms of Windows Updates?
2. Should there be a periodic remediation performed to correct these? Are the commands mentioned above sufficient as remediation or there's more to get the restorehealth complete without error.

Any pointers in right direction will be helpful.

Regards,
Tushar

 

[Maxstar]

Hi,

The DIRSD warnings are nothing to be worry about, you will see them in almost every log and even on systems without any issues or fresh installed systems.

Step 1. Download

SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFix.zip and save it to your desktop.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the following DISM command and post the result. If it fails attach a new copy of the CBS log.

DISM /online /cleanup-image /RestoreHealth

 

[tushartarkas]

Thank you for the zip file.

Meanwhile, there are few updates on the system.
1. As mentioned earlier, we have a solution which manages all the Windows Updates centrally. The solution has an agent installed on our Windows machines.
2. We have removed the agent and rebooted the system.
3. We ran sfc /scannow after reboot which again reported errors which it could not fix.
4. We ran dism /online /cleanup-image /RestoreHealth command and it failed with error source not found.
5. The CBS logs do not show errors for permission issues.

Attached are the CBS & DISM log files from the latest run.

Hope these are helpful.

 

[Maxstar]

Please perform the fix in my previous post this will resolve the SFC issue! I am expecting DISM will fail with error 1734 (The array bounds are invalid) due to an issue with KB4586830.