Questions regarding CF registry value in COMPONENTS hive

[temnimura]

Hi Sysnative team!

I thank you for your forums, the knowledge you can get from studying through these posts are amazing.

Recently had a issue with a host that was unable to run sfc scan, it was through process monitor failing on a component for iis:
amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.14393.5246_none_869efef40f6b71e6

With this warning in CBS:
Error STATUS_INVALID_PARAMETER originated in function ComponentStore::CRawStoreLayout:ecompressFile expression: Parameter check failed

Managed to resolve the issue, but i'm struggling to grasp what these CF values are supposed to mean.

I have checked multiple hosts as a reference, and the value can variate greatly. The values i see is eiter: 10, 40, 80, 280. Not sure if there are more possible numbers.

10 to me seems to indicate installed (superseeded?), 40 not installed (possibly), on working iis installs the most recent component can have either 80 or 280. But no idea on what the difference is supposed to be.

There doesn't seem to be any official documentation from Microsoft that i am able to find on this, and i was wondering if you maybe had some insights to share on the possible values and what they all indicate?

Thanks in advance for your help!

 

[Windows Update Bot]

Hi @temnimura,

Welcome to Sysnative Forums!

If you haven't already, please review the posting instructions here, and attach the requested log files. Without log files, our helpers will not be able to assist, and this will slow down fixing your machine.

If logs have been already been provided, our team of volunteers will analyse the provided log files to build a fix for your system. Please be aware that this may take several days from your initial post, due to the high volume of threads that we receive.


- Sysnative Windows Update Team

 

[Maxstar]

Hi and welcome to Sysnative,

There doesn't seem to be any official documentation from Microsoft that i am able to find on this...

That's right and it seems the CF value represents a "ClosureFlag" after using compression methods for payload files. However, this is not really an essential value and the DWORD data has nothing to do with installed, staged, superseded updates etc.