Server 2008 R2 - KB4519976 causing it to boot into system recovery

[pacore]

Hi guys,

We have a particular 2008 R2 server that has been having issues with the monthly security updates for the last couple of months. The patch applies - the server restarts and goes straight to the system recovery screen. The latest culprit is KB4519976

If I use DISM to remove the pending updates - the server boots and all is well. I'd prefer not to stop the monthly security updates going to all our 2008 R2 servers as the others seem to update without a problem.

I'm out of ideas :) I've attached the sfcfix.txt. Appreciate your assistance.

Thanks

 

[Sysnative Windows Update]

Hello and welcome!

Step#1 - FRST Scan

1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Right-click FRST64.exe and click Run as Administrator to run it as administrator. When the tool opens, click Yes to disclaimer.
3. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running (if not already checked).
4. Press Scan button.
5. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
6. Please attach the log back here.
7. Another log (Addition.txt - also located in the same directory as FRST64.exe) will be generated Please also attach that along with the FRST.txt in your reply.

 

[pacore]

Thanks for the prompt reply!

Logs are attached.

 

[Sysnative Windows Update]

Are there minidumps in the C:\Windows\Minidump folder?

If yes, copy them to the desktop and zip/attach them.

 

[pacore]

Nothing there - doesn't even have a minidump folder

 

[Sysnative Windows Update]

Can you temporarily remove the System Center Endpoint Protection and retry?

 

[pacore]

Not really it's a production server. Other 2008 R2 servers with SCEP do not have the issue.

 

[Sysnative Windows Update]

Have yiz tried downloading the standalone installer and installing it like that?

 

[pacore]

Yes - have downloaded the KB from the MS Catalog and ran it. No different unfortunately.

 

[Sysnative Windows Update]

Farbar Service Scanner
1. Download Farbar Service Scanner from here, and move it to the Desktop
2. Right-click on FSS.exe > Run as Administrator
3. Checkmark everything, and click Scan

4. Once it finishes, Notepad will open FSS.txt on your Desktop. Copy and paste everything in it in your next reply

 

[pacore]

No dice unfortunately - the AV we use here has quarantined it

 

[Sysnative Windows Update]

Disable the AV then while you run it.

 

[pacore]

Here you go

 

[Sysnative Windows Update]

Any external devices attached to the Server?

 

[pacore]

No external devices - just a standard physical server with internal storage (albeit an older model)

 

[Sysnative Windows Update]

Is each Server customized in terms of software or are they (fairly) identical?

 

[pacore]

Yeah base OS isn't customised (especially for these 2008 R2 boxes). We've got about 15 2008 R2 servers and this one is the only troublemaker. Probably 6 of them are on the exact same hardware. The rest are virtualised.

 

[Sysnative Windows Update]

Can I get FRST logs from a good Server, just to see if I spot any differences?

 

[pacore]

Here you go

 

[Sysnative Windows Update]

Thanks for the info. Please do the following.

1. Click your Start button and type cmd in the search box. Right-click on cmd from the search results and select Run as administrator. Answer Yes if the UAC prompt comes up.
2. Copy/Paste the following in to the command-prompt window and hit enter.
wmic qfe list brief /format:texttablewsys > "%USERPROFILE%\desktop\hotfix.txt"

3. This will create a file on your desktop named hotfix.txt. Please attach this to your next reply.