Failed Windows Server 2016 Update

J

Jaw302

Member
Joined
May 18, 2024
Posts
9
Hello,

I have a Windows Server 2016 Hyper-V virtual machine that fails updating 2024-05 Cumulative Update for Windows Server 2016 for x64-based Systems (KB5037763).
I have:
cleared the SoftwareDistribution directory
Ran:
sfc /scannow
DISM.exe /Online /Cleanup-image /Scanhealth
DISM.exe /Online /Cleanup-image /Checkhealth
DISM.exe /Online /Cleanup-image /Restorehealth
Dism.exe /Online /Cleanup-Image /StartComponentCleanup /ResetBase

Nothing seems to work.
I am about to just spin up a new VM and transfer everything over.

I cleared the CBS Log directory and ran sfc /scannow, DISM.exe /Online /Cleanup-image /Restorehealth, and ComponentsScanner.exe.

The Output logs are attached.

Any help you can give would be much appreciated.

Thank you.
 

Attachments

Hi and welcome to Sysnative,

Are you able to restore the deleted CBS logs, this because the attach CBS.zip file is empty.
 
Sorry about that Maxstar. There were quite a few CBSpersist logs in the logs directory also, which I included here.
Hope these help.

Thanks.
 

Attachments

SentinelOne. I have this same EDR protection on all my other VMs as well and only this Server VM and one other is having this problem.
 
Hi,

In this case, SentinelOne was also causing the rollback, so I would suggest to disable SentinelOne and the attempt to update again.
 
Hi,

Have you also disabled all the related Sentinel services?

Upload a copy of the CBS folder
  • Open Windows Explorer and browse to the C:\Windows\Logs folder.
  • Right-click on the CBS folder and choose Send to > Compressed (zipped) folder.
  • Now the message will appear, "Windows cannot create the Compressed (zipped) Folder here. Do you want it to be placed on the desktop instead?"
  • Click on the Yes button here.
653a64385d891-618e949e09fef-CBS-Folder.png

  • Attach the file CBS.zip to your next reply. If the file is too large to attach, upload the CBS.zip file to www.wetransfer.com and post the link in your next reply.
 
I disabled SentinelOne completely before attempting Windows update.

Attached is the CBS Loog.
 

Attachments

Hi,

Provide the profile information of this server.
  • Click the Start button and in the search box, type Command Prompt
  • When you see Command Prompt on the list, right-click on it and select Run as administrator.
    Copy and paste the following commands one at a time into the command prompt and press enter after each.
    Code: 
    reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s > "%userprofile%\desktop\ProfileList.txt"
reg query "HKEY_USERS" >> "%userprofile%\desktop\ProfileList.txt"
  • These commands will collect the System and Application logs and create ProfileList.txt on your Desktop.
  • Attach this file in your next reply.
 
Please run also the following command in an elevated prompt and attach SID.txt.
Code: 
wmic useraccount get name,sid >> "%userprofile%\desktop\SID.txt"
 
Rich (BB code): 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1737121134-1685929827-622671684-2784
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\jjoyce

Is the account above still in use, this because the update is started from the administrator.EAGLE as it seems and the jjoyce account was not loaded under HKEY_USERS...
 
The jjoyce is my domain account. jjoyce is not a local account on the server. I am logged in as administrator.eagle when performing the updates.
 
Rich (BB code): 
2024-06-02 11:49:06, Info                  CSI    000008db Failed unloading hive file: \??\C:\Users\jjoyce\NTUSER.DAT, key: \Registry\User\S-1-5-21-1737121134-1685929827-622671684-2784, with flags: 0, NTSTATUS: 0
2024-06-02 11:49:06, Error                 CBS    Startup: Failed to process advanced operation queue, startupPhase: 0.  A rollback transaction will be created. [HRESULT = 0x800f0922 - CBS_E_INSTALLERS_FAILED]

Please log-in with the administrator account only, an be sure the jjoyce account is logged off before attempting to update again.
 
Maxstar,

I rebooted and logged in as administrator before updating last time. There was no jjoyce logged in.
I just delete the jjoyce user profile from the server.

jjoyce no longer exists in the ProfileList.

I will attempt the update again next time I have a window, unless you want me to do something else first.

Thanks
 
Great, please let me know the result and if it failed again or not.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top