Roll back after attempting to install WMF 4 or 5 on Windows SBS 2011 Std

[phantom]

Hi

We're busy decommissioning our EOL SBS 2011 server, and we need to migrate the exchange to MS 365. To get Azure ADConnect to install we need a newer PowerShell version, which means installing Windows Management Framework. I initially attempted to install WMF 4, the initial setup goes through, but after a reboot, the server rolls back the update and reboots twice. Then I attempted WMF 5 and the same thing happens.

I have run SFC and SURT and didn't find any corruption.
I also extracted the contents of the WMF 4 and 5 and installed the cabs individually, which produced the same results the updates install, but after rebooting, the server has to roll back the update.

Non-standard changes that were made to the server previously:

The server has had WSUS disabled, with the services and the database dismounted etc. so I'm not sure if that could be causing the update to roll back or not.

I also used IISCrypto to disable TLS 1.0 and 1.1 (can't remember if we used the Best Practices or the PCI 3.2 template or a tweaked version of one or the other)

I'd appreciate if a team member can assist in troubleshooting this issue and getting the WMF to install.

CBS and SFCFix: https://wetransfer.com/downloads/4ae7abffd3c89fb291982e3f29b08f3a20211203083407/89e3f81ed7f2988096f512e7a05c21e220211203083424/e82cd5

 

[phantom]

Starting looking through the CBS log and found the below entry while searching for "rollback"

2021-11-30 17:43:30, Info                  CSI    00000153 Begin executing advanced installer phase 38 (0x00000026) index 261 (0x0000000000000105) (sequence 300)
    Old component: [ml:364{182},l:362{181}]"Microsoft-Windows-SLC-Component-ExtendedSecurityUpdatesAI, Culture=neutral, Version=6.1.7601.24544, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS"
    New component: [ml:364{182},l:362{181}]"Microsoft-Windows-SLC-Component-ExtendedSecurityUpdatesAI, Culture=neutral, Version=6.1.7601.24548, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS"
    Install mode: install
    Installer ID: {4e9a75dd-0792-460c-a238-3f4130c39369}
    Installer name: [38]"Extended Security Updates AI installer"
2021-11-30 17:43:30, Info                  CSI    00000154 Performing 1 operations; 1 are not lock/unlock and follow:
  LockComponentPath (10): flags: 0 comp: {l:16 b:3456430601e6d701aa00000020040805} pathid: {l:16 b:3456430601e6d701ab00000020040805} path: [l:238{119}]"\SystemRoot\WinSxS\amd64_microsoft-windows-s..edsecurityupdatesai_31bf3856ad364e35_6.1.7601.24544_none_c6daa7a039160638" pid: 420 starttime: 132827593944172737 (0x01d7e5fe316988c1)
2021-11-30 17:43:30, Info                  CSI    00000155 Performing 1 operations; 1 are not lock/unlock and follow:
  LockComponentPath (10): flags: 0 comp: {l:16 b:55a4430601e6d701ac00000020040805} pathid: {l:16 b:55a4430601e6d701ad00000020040805} path: [l:238{119}]"\SystemRoot\WinSxS\amd64_microsoft-windows-s..edsecurityupdatesai_31bf3856ad364e35_6.1.7601.24548_none_c6dea8c839126b94" pid: 420 starttime: 132827593944172737 (0x01d7e5fe316988c1)
2021-11-30 17:43:30, Info                  CSI    00000001 ESU: Product = 9.
2021-11-30 17:43:30, Info                  CSI    00000002 ESU: Is IMDS check needed:FALSE
2021-11-30 17:43:30, Info                  CSI    00000003 ESU: Pre IMDS checks failed, Not Eligible:HRESULT_FROM_WIN32(1605)
2021-11-30 17:43:30, Info                  CSI    00000156@2021/11/30:15:43:30.518 CSI Advanced installer perf trace:
CSIPERF:AIDONE;{4e9a75dd-0792-460c-a238-3f4130c39369};Microsoft-Windows-SLC-Component-ExtendedSecurityUpdatesAI, Version = 6.1.7601.24548, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral;368071
2021-11-30 17:43:30, Info                  CSI    00000157 Performing 1 operations; 1 are not lock/unlock and follow:
  LockComponentPath (10): flags: 0 comp: {l:16 b:5f15460601e6d701ae00000020040805} pathid: {l:16 b:5f15460601e6d701af00000020040805} path: [l:234{117}]"\SystemRoot\WinSxS\x86_microsoft.windows.s..ation.badcomponents_31bf3856ad364e35_6.1.7600.16385_none_3868158f24725705" pid: 420 starttime: 132827593944172737 (0x01d7e5fe316988c1)
2021-11-30 17:43:30, Error      [0x01803d] CSI    00000158 (F) Failed execution of queue item Installer: Extended Security Updates AI installer ({4e9a75dd-0792-460c-a238-3f4130c39369}) with HRESULT HRESULT_FROM_WIN32(1605).  Failure will not be ignored: A rollback will be initiated after all the operations in the installer queue are completed; installer is reliable (2)[gle=0x80004005]
2021-11-30 17:44:23, Info                  CBS    Failed to submit the Windows Error Report. [HRESULT = 0x800700a1 - ERROR_BAD_PATHNAME]
2021-11-30 17:44:23, Info                  CSI    00000159 Creating NT transaction (seq 1), objectname [6]"(null)"
2021-11-30 17:44:23, Info                  CSI    0000015a Created NT transaction (seq 1) result 0x00000000, handle @0x354
2021-11-30 17:44:27, Info                  CSI    0000015b@2021/11/30:15:44:27.891 CSI perf trace:
CSIPERF:TXCOMMIT;2202760
2021-11-30 17:44:27, Info                  CSI    0000015c End executing advanced installer (sequence 300)
    Completion status: HRESULT_FROM_WIN32(ERROR_ADVANCED_INSTALLER_FAILED)

Is the update failing because of the lack of an ESU license? Is it then not possible to install the newer PowerShell and install the Azure ADConnect without an ESU license?