KB installation and SFC fails

C

CAOS

Active member
Joined
Aug 2, 2023
Posts
25
My file server runs Windows 2016 Standard, OS build 14393.5989, en-us, and gets patched once a month. Last week, Windows Update successfully installed KB5028169, but regretted this badly during the reboot and claimed that the installation had failed. Troubleshooting started.
It took me several days to finally make dism /online /cleanup-image /restorehealth to complete successfully, but after having manually imported a missing kb using dism, it now runs without detecting errors.
SFC /Scannow still fails, it counts up to 44% and then reports that "Windows Resource Protection could not perform the requestion operation", even when booted in safe mode and Webroot set to not perform any scanning.

Windows Update still behaves the same. I've downloaded the KB and tried to install offline, but the result is the same.
I've reset the Windows Update components, made sure the services run, sacrificed a one-legged chicken in a crossroad at midnight, but the installation still fails.
I tried to do an inplace repair, but the only (evaluation) iso that I can download from MS isn't considered the correct type by neither setup.exe, nor DISM. I fail to understand why, both version, type and language are correct.

I've found that the vast majority of Internet sites dealing with these kind of issues only have vague ideas about the subject and most frequently just quote each others suggestions. My last hope now is that someone on this site can interpret the attached log files and find out what's missing. The SFCfix.exe alone didn't, it considered the system healthy.
 

Attachments

I might add that the event log reports that the error related to the failed KB installation is "Package KB5028169 failed to be changed to the installed state. Status: 0x80070057.
The previous line in the Setup event log was that the update was successfully installed.
 
I've uploaded a ProcMon log traced during a sfc /scannow, and the correspondig CBS.log, as I've seen others in my situation have supplied that.
 

Attachments

Hi and welcome to Sysnative,

Upload your COMPONENTS hive.
  • Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
  • Please copy this file to your desktop.
  • Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
  • Right-click on this file on your desktop and select Send To > Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
  • If the file is too large to upload here, upload the file to www.wetransfer.com and post the link in your next reply.
 
Hi,

Step 1. Download
56f31e53c97da-SFCFix.PNG
SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.
  • Save any work you have open, and close all programs.
  • Download the attachment SFCFix.zip and save it to your desktop.
  • Drag the SFCFix.zip file over the SFCFix.exe executable and release it.
6190d993a26f3-SFCFix-Zip-Eng.gif

  • SFCFix will launch, let it complete.
  • Once done, a file will appear on your desktop, called SFCFix.txt.
  • Post the logfile (SFCFix.txt) as attachment in your next reply.


Step 2. Run the System File Checker and post the result. If it fails attach a new copy of the CBS log.
Code: 
SFC /Scannow
 

Attachments

Hi,

Unfortunately, the SFC /scannow still aborts after 44%. I've included the SFCfix report, the output of the sfc /scannow command and the cbs.log file in the attached file.
Thanks for your assistance!
 

Attachments

Hi,

Please run SFC /Scannow again with Process Monitor running and attach the *.PML trace in your next reply.

Step#1 - Capture Process Monitor Trace
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Run SFC /Scannow just like you have in the past.
3. Stop Process Monitor as soon as it fails. You can simply do this by clicking the square (CTRL +E) on the toolbar as shown below.



4. Select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
5. Zip up the LogFile.PML and upload it to WeTransfer - Send Large Files & Share Photos Online - Up to 2GB Free and provide the link.
 
Hi again,

Please find the requested file attached to this message. You will find that it only includes the time between 40% up to 44% of sfc (that's where it aborts). To keep the file size down, I've only included process TiWorker.exe

Kind regards
 

Attachments

Step 1.
Warning: This fix was written specifically for this system. Do not run this fix on another system.
  • Save any work you have open, and close all programs.
  • Download the attachment SFCFix.zip and save it to your desktop.
  • Drag the SFCFix.zip file over the SFCFix.exe executable and release it.
6190d993a26f3-SFCFix-Zip-Eng.gif

  • SFCFix will launch, let it complete.
  • Once done, a file will appear on your desktop, called SFCFix.txt.
  • Post the logfile (SFCFix.txt) as attachment in your next reply.


Step 2. Run the System File Checker with Process Monitor running and attach the *.PML trace.
Code: 
SFC /Scannow
 

Attachments

Please find the requested log file attached to this message. Btw, SFC still failed at 44% and I couldn't see any changes in the error message in the cbs.log file either.
Kind regards
 

Attachments

Step 1.
Warning: This fix was written specifically for this system. Do not run this fix on another system.
  • Save any work you have open, and close all programs.
  • Download the attachment SFCFix.zip and save it to your desktop.
  • Drag the SFCFix.zip file over the SFCFix.exe executable and release it.
6190d993a26f3-SFCFix-Zip-Eng.gif

  • SFCFix will launch, let it complete.
  • Once done, a file will appear on your desktop, called SFCFix.txt.
  • Post the logfile (SFCFix.txt) as attachment in your next reply.


Step 2. Run the System File Checker with Process Monitor running and attach the *.PML trace.
Code: 
SFC /Scannow
 

Attachments

Please find the new log file attached to this message. Still no cigar... :-/
 

Attachments

Please run the following commands and copy and paste the result in your next post.
Code: 
certutil -hashfile %systemroot%\WinSxS\amd64_microsoft-windows-font-fms_31bf3856ad364e35_10.0.14393.2457_none_bd7385c50ef8c1c5\fms.dll SHA256
 
Last edited:
C:\WINDOWS\system32> certutil -hashfile %systemroot%\WinSxS\amd64_microsoft-windows-font-fms_31bf3856ad364e35_10.0.14393.2457_none_bd7385c50ef8c1c5\fms.dll SHA256
SHA256 hash of file C:\WINDOWS\WinSxS\amd64_microsoft-windows-font-fms_31bf3856ad364e35_10.0.14393.2457_none_bd7385c50ef8c1c5\fms.dll:
eec624a325e27c549050bd8d918fe2700d4a49daf1ee0a7d9dbdee496647de8c
CertUtil: -hashfile command completed successfully.
 
Please do the same for the RTM component.
Code: 
certutil -hashfile %systemroot%\WinSxS\amd64_microsoft-windows-font-fms_31bf3856ad364e35_10.0.14393.0_none_75472118cb02d82d\fms.dll SHA256
 
C:\WINDOWS\system32>certutil -hashfile %systemroot%\WinSxS\amd64_microsoft-windows-font-fms_31bf3856ad364e35_10.0.14393.0_none_75472118cb02d82d\fms.dll SHA256
SHA256 hash of file C:\WINDOWS\WinSxS\amd64_microsoft-windows-font-fms_31bf3856ad364e35_10.0.14393.0_none_75472118cb02d82d\fms.dll:
cc2422840f61f4e4b285e272af3909a33c8a6e5e6f8ad7582cb8fd77f6c2b5d7
CertUtil: -hashfile command completed successfully.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top