Manually fixing CBS corruption.

naimc · Mar 28, 2023

I work company as a troubleshooter of last restore. ( ie if we can't fix something we wipe machines and just re-image them) Everyone month out of a about 1400 windows machines mostly surface devices Windows update fail to install because of Windows corruption. Because I am working in a corporate environment I cannot run sfcfix component scanner and on our machines .

I am stuck today trying to fix on machine and I am looking for guidance.

CBS log reports the following 15 as corrupted :

2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

amd64_windows-senseclient-service.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_cc3ce7c5c3d30c2d\MsSense.exe.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

wow64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.19041.2311_en-us_2d8f4a6642791461\wuapi.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

wow64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_d0121d4935721c68\wuapi.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

wow64_microsoft-windows-cdp-api_31bf3856ad364e35_10.0.19041.2311_none_5b2346365db87ddc\cdp.dll
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

amd64_microsoft-windows-u..tionuxexe.resources_31bf3856ad364e35_10.0.19041.2311_en-us_b93569bb66020aab\MusNotificationUx.exe.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

amd64_microsoft-windows-u..fyiconexe.resources_31bf3856ad364e35_10.0.19041.2311_en-us_c907e4d7e1ccfb25\MusNotifyIcon.exe.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

amd64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.19041.2311_en-us_233aa0140e185266\wuapi.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

amd64_microsoft-windows-u..ehandlers.resources_31bf3856ad364e35_10.0.19041.2311_en-us_de61e85968cd098f\MusUpdateHandlers.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

amd64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_c5bd72f701115a6d\wuapi.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

amd64_microsoft-windows-u..fyiconexe.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_6b8ab7bad4c6032c\MusNotifyIcon.exe.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

msil_system.management.automation_31bf3856ad364e35_10.0.19041.2364_none_3a019e0cdd2d8302\System.Management.Automation.dll
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

amd64_microsoft-windows-u..ehandlers.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_80e4bb3c5bc61196\MusUpdateHandlers.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

amd64_microsoft-windows-u..tionuxexe.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_5bb83c9e58fb12b2\MusNotificationUx.exe.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

amd64_microsoft-windows-updatepolicy.resources_31bf3856ad364e35_10.0.19041.2311_fr-fr_0ee4e2852df9502e\UpdatePolicy.dll.mui
2023-03-28 08:55:42, Info CBS (p) CSI Payload Corrupt

amd64_microsoft-windows-updatepolicy.resources_31bf3856ad364e35_10.0.19041.2311_en-us_6c620fa23b004827\UpdatePolicy.dll.mui

dism.exe /online /cleanup-image /restorehealth will fail to fix the corruption due to source not found errors .

given the build number 10.0.19041.2311 of the files I though I would be able to find them in the source which I though was : windows10.0-kb5022282-x64_fdb2ea85e921869f0abe1750ac7cee34876a760c.msu

Which I downloaded and manually extract the multiple levels of cab files till I reach the Cab_1_for_KB5022282_PSFX.cab which contains the 22355 sub "compontents" which contain the same folder name as the items I am missing from above. ( Using expand.exe f:* windows10.0-kb5022282-x64_fdb2ea85e921869f0abe1750ac7cee34876a760c.msu windows10.0-kb5022282-x64, for all the multiple layers of cabfiles inside the extracted folders.)
I then try to use dism to fix the corruption using the extracted cab as a source :
dism.exe /online /cleanup-image /restorehealth /Source:"c:\ProgramData\IS\Temp\kb5022282\SSU-19041.2300-x64cab\Windows10.0-KB5022282-x64cab\Cab_1_for_KB5022282_PSFXcab" /limitacces

I expect dism to use this as the source but its not working , I this generates the Error: 0x800f081f (The source files could not be found)

Any suggested to what my next steps should be ?

thank you

Naim

Maxstar · Mar 29, 2023

Hi and welcome to Sysnative,

naimc said:
(...) Everyone month out of a about 1400 windows machines mostly surface devices Windows update fail to install because of Windows corruption.

1. Are all the (1400) systems connected to the same network, and/or WSUS server?
2. How are the surface devices configured, and which policies are set?

naimc said:
Any suggested to what my next steps should be ?

1. Whitelist the tools - so you can run them and bypass the restrictions.
2. If this is not possible you'll need to replace the files manually - icacls

naimc · Mar 30, 2023

We replaced the users machine, I took a image of the device and made a VM out of it, scrubbed all the domain profiles and users data, put it in workgroup on an isolated network. I can now run some tools.
My goal is learn the "magic" only you guy's can do !

I was able to run ComponentsScanner, not pasting the raw log as no issues were found.
ComponentsScanner Version 1.5.1.0 by sysnative.com
Windows Version: Windows 10 22H2 x64 (10.0.19045.2486)
Start time: 2023-03-30T13:47:54
Hive scanned: %windir%\System32\config\COMPONENTS
Number of keys: 73448
Number of values: 228736

==== Critical Errors ====
None

==== Corrupt Key Names ====
None

==== Corrupt Value Names ====
None

==== Corrupt Value Data Type ====
None

==== Corrupt Value Data ====
None

==== Repair Log ====
No possible repairs

==== Warnings ====
None

I deleted the c:\windows\logs\cbs\cbs.log
ran dism.exe /online /cleanup-image /restorehealth
upload the resulting zipped and loaded the c:\windows\logs\cbs\cbs.log
On of the files that is corrupted is : msil_system.management.automation_31bf3856ad364e35_10.0.19041.2364_none_3a019e0cdd2d8302\System.Management.Automation.dll
that is core dependancy for powershell
Trying to launch powershell.exe results in :
Windows PowerShell terminated with the following error:
Could not load file or assembly 'System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The module was expected to contain an assembly manifest.

Maxstar · Mar 31, 2023

Hi,

Here's the package with replacement files.

Step 1. Download

SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

Save any work you have open, and close all programs.
Download the attachment SFCFix.zip and save it to your desktop.
Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt.
Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the following DISM command and post the result. If it fails attach a new copy of the CBS log.

Code:

DISM /online /cleanup-image /RestoreHealth

Search

Search

Manually fixing CBS corruption.

naimc

New member

Maxstar

Windows Update Moderator, Security Analyst

naimc

New member

Attachments

Maxstar

Windows Update Moderator, Security Analyst

Attachments