Hello sysnative team,
"I need help"
I've been working on resolving consistent failures with the 2024-09 Cumulative Update for Windows Server 2022. The updates fail with error codes 0x80073701 and 0x800F081F. I followed the forum posting instructions here and attached the resulting CBS log here. I went through the motions on 2024-09-24, so the timestamps are from yesterday. No further activity has been conducted on the machine since.
Server Configuration:
OS: Windows Server 2022
Version 21H2 (Build 20348.502)
Disk Space: 57 GB available
RAM: 32 GB
Windows Defender: Real-Time Protection Enabled (I tried disabling it during troubleshooting as a shot in the dark with no success)
No third-party AV programs
Please let me know if there's any more information needed on the system, or additional logs needed.
"Let me try first"
Okay, now this section is a bit unrelated sorry, but I greatly appreciate your time in reading through it:
I've tried troubleshooting this myself:
I finally came across this forum which is an absolute gold mine (I just want to say, reading through posts and seeing all you do, you all rock).
I noticed a lot of the troubleshooting on these follows a pattern, which I tried to replicate:
- Troubleshooting 0x800f081f / 0x800f0982 Error
- How to fix Windows Update errors using DISM (DISM.log) or the System Update Readiness Tool / SURT (CheckSUR.log)
I even tried looking through other people's CBS logs in posts before me, then the SCFix.zip archive that analysts would give back. My goal was to try and figure out what the analyst saw in the log that led to them providing those specific packages, and try to do it myself.
Honestly, though, I was still struggling. I saw many lines in the CBS.log referencing:
- "Not able to find top owner for package"
- "Failed to pin deployment while resolving Update" (this seemed to me to be the problematic package, but I'm not sure)
But I realized I'm not exactly sure what these mean. Even after I post this, I'll still be digging through the Servicing directories and CBS logs to see what I can discover, but I won't be making any changes on the system.
"All of this to say..."
I want to learn.
I think what you guys do is amazing. I'm a newer security analyst, and I never knew just Windows Updates could get so complex yet for some strange reason, I absolutely love it.
When I finally found this forum, I was astonished, and loved reading the amazing work everyone has done here.
I want to understand your methodologies, and really dive into how Windows Updates work so I can both help myself and others in the future. I often find issues with Windows Updates come up and barely anyone around knows how to approach them.
I found this post about a kind of academy you all run in your spare time, and was wondering if that's still a thing? The post is from 2019, but if it is still relevant, I would love to participate.
Thank you sincerely for your time.
Also, I've never been on a forum before! This is my very first post like... anywhere! Just thought that was fun to share.
"I need help"
I've been working on resolving consistent failures with the 2024-09 Cumulative Update for Windows Server 2022. The updates fail with error codes 0x80073701 and 0x800F081F. I followed the forum posting instructions here and attached the resulting CBS log here. I went through the motions on 2024-09-24, so the timestamps are from yesterday. No further activity has been conducted on the machine since.
Server Configuration:
OS: Windows Server 2022
Version 21H2 (Build 20348.502)
Disk Space: 57 GB available
RAM: 32 GB
Windows Defender: Real-Time Protection Enabled (I tried disabling it during troubleshooting as a shot in the dark with no success)
No third-party AV programs
Please let me know if there's any more information needed on the system, or additional logs needed.
"Let me try first"
Okay, now this section is a bit unrelated sorry, but I greatly appreciate your time in reading through it:
I've tried troubleshooting this myself:
- Disabled Windows Defender Real-Time Protection – issue persists.
- Verified Disk Space – sufficient space available.
- Ran the Windows Update Troubleshooter – no resolution.
- Ran `sfc /scannow` - issue persists, no errors reported.
- Used `dism /online /cleanup-image /restorehealth` – issue persists, no issues reported.
- Attempted Clean Boot > update – issue persists.
I finally came across this forum which is an absolute gold mine (I just want to say, reading through posts and seeing all you do, you all rock).
I noticed a lot of the troubleshooting on these follows a pattern, which I tried to replicate:
- Review CBS and Components logs for errors, missing packages or manifests, COMPONENTS hive corruption.
- Sometimes a procmon capture is requested, guessing monitoring what TiWorker or wuauserv are doing? Not sure.
- Identify the bad artifacts
- Source fresh copies of artifacts from a new VM running the same OS
- Use SFCFix.exe to copy the fresh files into their appropriate destinations, or repair registry components (\manifests, \WinSxS)
- Based on logs I've seen, it looks like it just takes ownership of the destination parent directory (or hive path) > imports the changes > reverts the ownership changes
- Try to update
- If still failure, rinse and repeat the above until resolution
- Troubleshooting 0x800f081f / 0x800f0982 Error
- How to fix Windows Update errors using DISM (DISM.log) or the System Update Readiness Tool / SURT (CheckSUR.log)
I even tried looking through other people's CBS logs in posts before me, then the SCFix.zip archive that analysts would give back. My goal was to try and figure out what the analyst saw in the log that led to them providing those specific packages, and try to do it myself.
Honestly, though, I was still struggling. I saw many lines in the CBS.log referencing:
- "Not able to find top owner for package"
- "Failed to pin deployment while resolving Update" (this seemed to me to be the problematic package, but I'm not sure)
But I realized I'm not exactly sure what these mean. Even after I post this, I'll still be digging through the Servicing directories and CBS logs to see what I can discover, but I won't be making any changes on the system.
"All of this to say..."
I want to learn.
I think what you guys do is amazing. I'm a newer security analyst, and I never knew just Windows Updates could get so complex yet for some strange reason, I absolutely love it.
When I finally found this forum, I was astonished, and loved reading the amazing work everyone has done here.
I want to understand your methodologies, and really dive into how Windows Updates work so I can both help myself and others in the future. I often find issues with Windows Updates come up and barely anyone around knows how to approach them.
I found this post about a kind of academy you all run in your spare time, and was wondering if that's still a thing? The post is from 2019, but if it is still relevant, I would love to participate.
Thank you sincerely for your time.
Also, I've never been on a forum before! This is my very first post like... anywhere! Just thought that was fun to share.
Last edited: