Manually fixing CBS corruption.

[naimc]

I work company as a troubleshooter of last restore. ( ie if we can't fix something we wipe machines and just re-image them) Everyone month out of a about 1400 windows machines mostly surface devices Windows update fail to install because of Windows corruption. Because I am working in a corporate environment I cannot run sfcfix component scanner and on our machines .

I am stuck today trying to fix on machine and I am looking for guidance.

CBS log reports the following 15 as corrupted :

2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt amd64_windows-senseclient-service.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_cc3ce7c5c3d30c2d\MsSense.exe.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt wow64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.19041.2311_en-us_2d8f4a6642791461\wuapi.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt wow64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_d0121d4935721c68\wuapi.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt wow64_microsoft-windows-cdp-api_31bf3856ad364e35_10.0.19041.2311_none_5b2346365db87ddc\cdp.dll
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt amd64_microsoft-windows-u..tionuxexe.resources_31bf3856ad364e35_10.0.19041.2311_en-us_b93569bb66020aab\MusNotificationUx.exe.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt amd64_microsoft-windows-u..fyiconexe.resources_31bf3856ad364e35_10.0.19041.2311_en-us_c907e4d7e1ccfb25\MusNotifyIcon.exe.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt amd64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.19041.2311_en-us_233aa0140e185266\wuapi.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt amd64_microsoft-windows-u..ehandlers.resources_31bf3856ad364e35_10.0.19041.2311_en-us_de61e85968cd098f\MusUpdateHandlers.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt amd64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_c5bd72f701115a6d\wuapi.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt amd64_microsoft-windows-u..fyiconexe.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_6b8ab7bad4c6032c\MusNotifyIcon.exe.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt msil_system.management.automation_31bf3856ad364e35_10.0.19041.2364_none_3a019e0cdd2d8302\System.Management.Automation.dll
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt amd64_microsoft-windows-u..ehandlers.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_80e4bb3c5bc61196\MusUpdateHandlers.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt amd64_microsoft-windows-u..tionuxexe.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_5bb83c9e58fb12b2\MusNotificationUx.exe.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt amd64_microsoft-windows-updatepolicy.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_0ee4e2852df9502e\UpdatePolicy.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt amd64_microsoft-windows-updatepolicy.resources_31bf3856ad364e35_10.0.19041.2311_en-us_6c620fa23b004827\UpdatePolicy.dll.mui

dism.exe /online /cleanup-image /restorehealth will fail to fix the corruption due to source not found errors .

given the build number 10.0.19041.2311 of the files I though I would be able to find them in the source which I though was : windows10.0-kb5022282-x64_fdb2ea85e921869f0abe1750ac7cee34876a760c.msu

Which I downloaded and manually extract the multiple levels of cab files till I reach the Cab_1_for_KB5022282_PSFX.cab which contains the 22355 sub "compontents" which contain the same folder name as the items I am missing from above. ( Using expand.exe f:* windows10.0-kb5022282-x64_fdb2ea85e921869f0abe1750ac7cee34876a760c.msu windows10.0-kb5022282-x64, for all the multiple layers of cabfiles inside the extracted folders.)
I then try to use dism to fix the corruption using the extracted cab as a source :
dism.exe /online /cleanup-image /restorehealth /Source:"c:\ProgramData\IS\Temp\kb5022282\SSU-19041.2300-x64cab\Windows10.0-KB5022282-x64cab\Cab_1_for_KB5022282_PSFXcab" /limitacces

I expect dism to use this as the source but its not working , I this generates the Error: 0x800f081f (The source files could not be found)

Any suggested to what my next steps should be ?

thank you

Naim

 

[Maxstar]

Hi and welcome to Sysnative,

(...) Everyone month out of a about 1400 windows machines mostly surface devices Windows update fail to install because of Windows corruption.

1. Are all the (1400) systems connected to the same network, and/or WSUS server?
2. How are the surface devices configured, and which policies are set?

Any suggested to what my next steps should be ?

1. Whitelist the tools - so you can run them and bypass the restrictions.
2. If this is not possible you'll need to replace the files manually - icacls

 

[naimc]

We replaced the users machine, I took a image of the device and made a VM out of it, scrubbed all the domain profiles and users data, put it in workgroup on an isolated network. I can now run some tools.
My goal is learn the "magic" only you guy's can do !

I was able to run ComponentsScanner, not pasting the raw log as no issues were found.
ComponentsScanner Version 1.5.1.0 by sysnative.com
Windows Version: Windows 10 22H2 x64 (10.0.19045.2486)
Start time: 2023-03-30T13:47:54
Hive scanned: %windir%\System32\config\COMPONENTS
Number of keys: 73448
Number of values: 228736

==== Critical Errors ====
None

==== Corrupt Key Names ====
None

==== Corrupt Value Names ====
None

==== Corrupt Value Data Type ====
None

==== Corrupt Value Data ====
None

==== Repair Log ====
No possible repairs

==== Warnings ====
None

I deleted the c:\windows\logs\cbs\cbs.log
ran dism.exe /online /cleanup-image /restorehealth
upload the resulting zipped and loaded the c:\windows\logs\cbs\cbs.log
On of the files that is corrupted is : msil_system.management.automation_31bf3856ad364e35_10.0.19041.2364_none_3a019e0cdd2d8302\System.Management.Automation.dll
that is core dependancy for powershell
Trying to launch powershell.exe results in :
Windows PowerShell terminated with the following error:
Could not load file or assembly 'System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The module was expected to contain an assembly manifest.

 

[Maxstar]

Hi,

Here's the package with replacement files.

Step 1. Download

SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFix.zip and save it to your desktop.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the following DISM command and post the result. If it fails attach a new copy of the CBS log.

DISM /online /cleanup-image /RestoreHealth