[SOLVED] Error updating windows server 2019 0x800f0922

Ferespartan19

Ferespartan19

Member
Joined
Mar 7, 2024
Posts
15
I have been trying to analyze the failure about this server for some time, for months it has been failing in the cumulative security updates, can you help me detect it in the CBS log, and know how to solve it, I do not understand how to read the document if I filter for errors, but I don't know how to solve them
 

Attachments

Last edited by a moderator:
Hi and welcome to sysnative,

Provide the profile information of this server.
  • Click the Start button and in the search box, type Command Prompt
  • When you see Command Prompt on the list, right-click on it and select Run as administrator.
    Copy and paste the following commands one at a time into the command prompt and press enter after each.
    Code: 
    reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s > "%userprofile%\desktop\ProfileList.txt"
reg query "HKEY_USERS" /s >> "%userprofile%\desktop\ProfileList.txt"
  • These commands will collect the System and Application logs and create ProfileList.txt on your Desktop.
  • Attach this file in your next reply.
 
Rich (BB code): 
2024-03-06 18:47:46, Info                  CSI    000004a4 Performing HKCU for sid: S-1-5-21-1638102366-1377765060-1219578457-500
2024-03-06 18:47:46, Error                 CSI    000004a5 (F) STATUS_OBJECT_NAME_NOT_FOUND #145172# from Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey(flg = (AllowAccessDenied), key = {provider=NULL, handle=0, name= ("null")}, da = (KEY_READ|KEY_WOW64_64KEY), oa = @0x94f2c7c148->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[60]'\Registry\USER\S-1-5-21-1638102366-1377765060-1219578457-500'; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped disposition: 4073176872)[gle=0xd0000034]
2024-03-06 18:47:46, Error                 CSI    000004a6@2024/3/7:01:47:46.422 (F) onecore\base\wcp\sil\ntsystem.cpp(5348): Error STATUS_OBJECT_NAME_NOT_FOUND originated in function Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey expression: (null)
[gle=0x80004005]

Rich (BB code): 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1638102366-1377765060-1219578457-500
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\Administrator

Hi,

It seems there's a problem with the built-in administrator account, and maybe it is corrupted. Could you please try to login with this account.
 
Please attempt to update again using the local admin account and let me know the result. Please be sure all other users are logged off.
 
Okay im going to try it in pair of hours because the server is on production, so when i apply again the update, what files i need to attached?
 
If the update fails please provide the latest CBS logs.

Upload a copy of the CBS folder
  • Open Windows Explorer and browse to the C:\Windows\Logs folder.
  • Right-click on the CBS folder and choose Send to > Compressed (zipped) folder.
  • Now the message will appear, "Windows cannot create the Compressed (zipped) Folder here. Do you want it to be placed on the desktop instead?"
  • Click on the Yes button here.
653a64385d891-618e949e09fef-CBS-Folder.png

  • Attach the file CBS.zip to your next reply. If the file is too large to attach, upload the CBS.zip file to www.wetransfer.com and post the link in your next reply.
 
Hi,

Please attempt to update again with Process Monitor running.

Capture Process Monitor BootLog
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Select the Options....Enable Boot Logging option. A Enable Boot Logging dialog will come up. Just click OK.
3. Create a folder on your desktop named BootLog.
4. Attempt to install the update just like you have in the past. Let the machine reboot and revert just like it has in the past.
5. After the machine has rebooted and come back up to the desktop, open Process Monitor again. A message box will come up telling you that a log of boot-time activity was created and ask if you wish to save it. Click Yes and save to the BootLog folder on your desktop.
6. This may take some time as it converts the boot-time data. Allow it to finish.
7. Zip up the entire BootLog folder on your desktop and upload to a file sharing service like: WeTransfer - Send Large Files & Share Photos Online - Up to 2GB Free
8. Attach also a new copy of the CBS logs for the time stamps.
 
Hi,

Please run the following command in an elevated prompt and attach SID.txt to your next post.
Code: 
wmic useraccount get name,sid >> "%userprofile%\desktop\SIDt.txt"
 
Hi,

Please open and elevated prompt, run the following command and attach services.txt to your next post.
Code: 
WMIC SERVICE GET caption, name, startmode, state > "%userprofile%\desktop\services.txt"
 
Rich (BB code): 
Windows Agent Sensor Ctrl                                                           aella_ctrl                                Auto       Running

I suspect the above service (Stellar Data Recovery) might be the cause of the rollback? Can you disable all the third-party services and then attempt to update again?
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top