Server 2008 R2 - KB4519976 causing it to boot into system recovery

pacore · Oct 17, 2019

Hi guys,

We have a particular 2008 R2 server that has been having issues with the monthly security updates for the last couple of months. The patch applies - the server restarts and goes straight to the system recovery screen. The latest culprit is KB4519976

If I use DISM to remove the pending updates - the server boots and all is well. I'd prefer not to stop the monthly security updates going to all our 2008 R2 servers as the others seem to update without a problem.

I'm out of ideas :) I've attached the sfcfix.txt. Appreciate your assistance.

Thanks

Sysnative Windows Update · Oct 17, 2019

Hello and welcome!

Step#1 - FRST Scan

1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Right-click FRST64.exe and click Run as Administrator to run it as administrator. When the tool opens, click Yes to disclaimer.
3. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running (if not already checked).
4. Press Scan button.
5. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
6. Please attach the log back here.
7. Another log (Addition.txt - also located in the same directory as FRST64.exe) will be generated Please also attach that along with the FRST.txt in your reply.

pacore · Oct 17, 2019

Thanks for the prompt reply!

Logs are attached.

Sysnative Windows Update · Oct 17, 2019

Are there minidumps in the C:\Windows\Minidump folder?

If yes, copy them to the desktop and zip/attach them.

pacore · Oct 17, 2019

Nothing there - doesn't even have a minidump folder

Sysnative Windows Update · Oct 17, 2019

Can you temporarily remove the System Center Endpoint Protection and retry?

pacore · Oct 17, 2019

Not really it's a production server. Other 2008 R2 servers with SCEP do not have the issue.

Sysnative Windows Update · Oct 18, 2019

Have yiz tried downloading the standalone installer and installing it like that?

pacore · Oct 18, 2019

Yes - have downloaded the KB from the MS Catalog and ran it. No different unfortunately.

Sysnative Windows Update · Oct 18, 2019

Farbar Service Scanner
1. Download Farbar Service Scanner from here, and move it to the Desktop
2. Right-click on FSS.exe > Run as Administrator
3. Checkmark everything, and click Scan

4. Once it finishes, Notepad will open FSS.txt on your Desktop. Copy and paste everything in it in your next reply

pacore · Oct 18, 2019

No dice unfortunately - the AV we use here has quarantined it

Sysnative Windows Update · Oct 18, 2019

Disable the AV then while you run it.

pacore · Oct 18, 2019

Here you go

Sysnative Windows Update · Oct 18, 2019

Any external devices attached to the Server?

pacore · Oct 20, 2019

No external devices - just a standard physical server with internal storage (albeit an older model)

Sysnative Windows Update · Oct 20, 2019

Is each Server customized in terms of software or are they (fairly) identical?

pacore · Oct 20, 2019

Yeah base OS isn't customised (especially for these 2008 R2 boxes). We've got about 15 2008 R2 servers and this one is the only troublemaker. Probably 6 of them are on the exact same hardware. The rest are virtualised.

Sysnative Windows Update · Oct 20, 2019

Can I get FRST logs from a good Server, just to see if I spot any differences?

pacore · Oct 20, 2019

Here you go

Sysnative Windows Update · Oct 21, 2019

Thanks for the info. Please do the following.

1. Click your Start button and type cmd in the search box. Right-click on cmd from the search results and select Run as administrator. Answer Yes if the UAC prompt comes up.
2. Copy/Paste the following in to the command-prompt window and hit enter.
wmic qfe list brief /format:texttablewsys > "%USERPROFILE%\desktop\hotfix.txt"

3. This will create a file on your desktop named hotfix.txt. Please attach this to your next reply.

Server 2008 R2 - KB4519976 causing it to boot into system recovery

Member

Attachments

Inactive

Member

Attachments

Inactive

Member

Inactive

Member

Inactive

Member

Inactive

Member

Inactive

Member

Attachments

Inactive

Member

Inactive

Member

Inactive

Member

Attachments

Inactive