[SOLVED] ERROR_INVALID_DATA in CBS.log preventing cumulative update on Windows Server 2022

P

porffor

Member
Joined
Feb 26, 2024
Posts
20
I have a Windows Server 2022 VM that fails on the cumulative update since November. I've tried basic things like resetting Windows Update Components and running sfc /scannow.

Here is an example of an error in CBS.log file:

2025-02-10 12:24:46, Info CBS Failed to add to transaction package: Microsoft-Windows-PowerShell-ISE-FOD-Package~31bf3856ad364e35~wow64~en-US~10.0.20348.1 [HRESULT = 0x8007000d - ERROR_INVALID_DATA]

Although there are some other ERROR_INVALID_DATA errors just before this one, that don't seem to relate to a specific package.

I'm also unable to complete the running of DISM with /RestoreHealth - I keep getting "Error: 0x800f081f. The source files could not be found."

The server doesn't have internet access, so I've downloaded the latest Server 2022 from MVLS.

I've tried mounting the ISO as a drive and running:

DISM /Online /Cleanup-Image /RestoreHealth /Source:Wim:E:\sources\install.wim:2 /LimitAccess [I've checked that 2 is the correct index]

I've tried extracting the ISO contents and pointing DISM to that folder
I've tried mounting the wim using DISM /Mount-Wim and DISM /Mount-Image and pointing DISM there
I've tried pointing DISM to the WinSxs of a different machine
I've tried running '/AnalyzeComponentStore' before the above command
I've rebooted a few times
Nothing works

Is there anything I can do to get DISM to work?

Or if not, all related files can be found in this Google Drive link.

Many thanks in advance.
 
Hi @porffor,

Welcome to Sysnative Forums!

If you haven't already, please review the posting instructions here, and attach the requested log files. Without log files, our helpers will not be able to assist, and this will slow down fixing your machine.

If logs have been already been provided, our team of volunteers will analyse the provided log files to build a fix for your system. Please be aware that this may take several days from your initial post, due to the high volume of threads that we receive.


- Sysnative Windows Update Team
 
Hi,

Download
67139f7e69a58-SFCFix-ico.PNG
SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.
  • Save any work you have open, and close all programs.
  • Download the attachment SFCFix.zip and save it to your desktop.
  • Drag the SFCFix.zip file over the SFCFix.exe executable and release it.
67139f52b3c1e-SFCFix-Zip-Eng.gif

  • SFCFix will launch, let it complete.
  • Once done, a file will appear on your desktop, called SFCFix.txt.
  • Post the logfile (SFCFix.txt) as attachment in your next reply.

Afterwards attempt to update. If it fails attach a new copy of the CBS logs.
 

Attachments

Hello, many thanks for your reply. After applying the fix, the install still fails unfortunately. I attach the SFCFix log file, and a fresh CBS.log. Thanks
 

Attachments

Rich (BB code): 
Failed to open registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components with error code ERROR_ACCESS_DENIED.

Rich (BB code): 
2025-02-27 08:58:34, Error                 CSI    00000009@2025/2/27:11:58:34.395 (F) onecore\base\wcp\componentstore\versionedindex.cpp(3239): Store corruption detected in function ComponentStore::CRawStoreLayout::CheckFamilyIndexForDeadWinnerComponent expression: (null)
  MissingWinningComponentKey on resource 'amd64_deployment-5e181a7a..fd00acb66fc62c7448f_31bf3856ad364e35_10.0.20348.3081_none_083cf89ae0681338'[gle=0x80004005]

The fix failed to complete, and now there are other issues. So please do the following.

Download
61f7aba7309a1-ComponentsScanner_Icon.png
ComponentsScanner and save it to your desktop.
  • Right-click ComponentsScanner.exe and select "Run as administrator", click Yes on the UAC (User Account Control) prompt which appears.
  • Follow the on-screen instructions.
  • Once complete, a report will be saved to your desktop called ComponentsScanner.txt.
  • Post the logfile ComponentsScanner.txt as attachment into your next reply.

Upload your COMPONENTS hive.
  • Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
  • Please copy this file to your desktop.
  • Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
  • Right-click on this file on your desktop and select Send To > Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
  • If the file is too large to upload here, upload the file to www.wetransfer.com and post the link in your next reply.
 
Rich (BB code): 
==== Critical Errors ====
Critical registry key "COMPONENTS\CanonicalData\Catalogs" exists but has no subkeys
Critical registry key "COMPONENTS\CanonicalData\Deployments" exists but has no subkeys
Critical registry key "COMPONENTS\DerivedData\Components" exists but has no subkeys
Critical registry key "COMPONENTS\Installers" does not exist or could not be loaded
Critical registry key "COMPONENTS\ccpinterface" does not exist or could not be loaded

Unfortunately, the current COMPONENTS hive is badly damaged, so please replace the current COMPONENTS hive with the one on your Google Drive or a more recent backup.

Step 1. Replace Components Hive Manually

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

  1. Navigate to C:\Windows\System32\config
  2. Right-click on the current COMPONENTS file and select rename. Rename it to COMPONENTS.bad.
    Note: If you get an error that the file is in use, reboot your computer and then try again.
  3. Download the COMPONENTS hive from your Google Drive or a more recent backup and paste it into C:\Windows\System32\config

Step 2. Afterwards reboot the server and run
61f7aba7309a1-ComponentsScanner_Icon.png
ComponentsScanner again.
  • Right-click ComponentsScanner.exe and select "Run as administrator", click Yes on the UAC (User Account Control) prompt which appears.
  • Follow the on-screen instructions.
  • Once complete, a report will be saved to your desktop called ComponentsScanner.txt.
  • Post the logfile ComponentsScanner.txt as attachment into your next reply.
 
Wow. Yes I can see that the COMPONENTS file that I sent previously is 53 MB but the one currently on the system is only 7 MB! I'm currently making enquiries about getting this server rebooted. I'll report back asap. Thank you.
 
Great, let me know the result. And please note that the COMPONENTS hive is not a boot-critical hive like the SYSTEM hive, so when the COMPONENTS hive is still corrupted you can always reboot the system.
 
Thank you! That's working now!

It was a bit tricky renaming the COMPONENTS file. I'll share my experience here in case it helps others:

I rebooted the server because System was holding on to the file. But when it was coming back up I was unable to get to the file quickly enough before whichever service it is locked the file again. So in the end, the only way I could do it to connect remotely via \\server\c$ the moment I saw the pings coming back up. I was able to do it quicker that way compared with logging in to the machine.

Anyway, after the replacing the file and rebooting, the file came down to 43 MB. I then ran ComponentScanner again, and it came out clean this time.

Then after that, I retried the update install and it worked this time! Many thanks for your help. I'll send some dollars your way.

There are a couple of things I would like to understand. Was there anything I could've done to get DISM to work? Or is it the case that it was the CBS corruption itself that was causing DISM to fail, rather than being unable to find files, and that "The source files could not be found." is misleading?

Secondly, regarding the fix, I guess I was barking up the wrong tree with the 'PowerShell-ISE-FOD-Package' component. Could you explain how you knew that the "credential-picker" component is that one that was breaking the install?
 
Hi,

Glad to hear the issue has been resolved and many thanks for your donation to Sysnative, that's much appreciated... (y)

The latest CbsPersist log you have posted didn't show any missing files after running dism, only the following issue which refered to a corrupt entry into the COMPONENTS hive.

Rich (BB code): 
2025-02-10 12:24:40, Error                 CSI    000000d5 (F) Hydration failed with error NTSTATUS_FROM_WIN32(ERROR_INVALID_DATA) . Delta Type: Reverse Delta , IntegrityState Valid: false , RetrievedChecksum: 469189531 , ComputedChecksum: 2174886843[gle=0x80004005]
2025-02-10 12:24:40, Error                 CSI    000000d6 (F) Hydration failed for component Microsoft-Windows-Security-Credential-Picker, version 10.0.20348.2849, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35} on file Windows.Security.Credentials.UI.CredentialPicker.dll with NTSTATUS -1073283059. Matching Component = Microsoft-Windows-Security-Credential-Picker, version 10.0.20348.2461, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}. FileHasForwardReverseDeltas  = true, GenerateReverseDelta = true[gle=0x80004005]
2025-02-10 12:24:40, Error                 CSI    000000d7@2025/2/10:15:24:40.840 (F) Attempting to mark store corrupt with category [l:18 ml:19]'CorruptPayloadFile'[gle=0x80004005]
2025-02-10 12:24:40, Info                  CSI    000000d8 PossibleCorruption: Component: Microsoft-Windows-Security-Credential-Picker, version 10.0.20348.2461, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}, file: Windows.Security.Credentials.UI.CredentialPicker.dll

porffor said:
Was there anything I could've done to get DISM to work
Click to expand...
Yes, when you notice such issues you can follow this tutorial on how to replace the missing /corrupt files.
 
I did look though the tutorial before originally posting in fact, but I couldn't find enough similarities between the errors in my log and the ones in the tutorial, so I wasn't sure if the fix was the same. Thanks, I'll have another look through it next time.

Sorry one last thing, regarding the following reg key in your fix file:

[HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\wow64_microsoft-windows-s..y-credential-picker_31bf3856ad364e35_10.0.20348.2461_none_634c82c6a2424d43]

Is this a pointer to somewhere else? And since components/packages are listed in a few different keys (ComponentDetect, PackageDetect, PackageIndex, Packages), how did you know which one needed to be replaced?

Thank you
 
That's quite difficult to explain in just a couple of sentences, but if you are interested in such issues and how to deal with them you can sign up for our Windows Update Academy.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top