[SOLVED] Server 2016 Std | unable to install CUs after 2022-02 CU | error 0x800F0922

[Max01]

Hello,

i have 10 domain controller (2 physical and 8 virtual). These domain controllers were on a very old state "2019-05 Cumulative Update" or "2019-12 Cumulative Update". I wanted to update these domain controllers to the current state "2023-05 Cumulative Update".

The server seems to install the Update then need a reboot and after a reboot and some time i get the massage undoing changes and in the EventViewer i get error 0x800F0922 no matter if I tried to install the update from WSUS or manually downloaded from MS Update Catalog. Then I tried to install previous Cumulative Update 2023-04, 2022-08, 2022-06, 2022-04 and I always got the error 0x800F0922 in EventViewer. After that I went forward instead of backward and was able to install 2019-12, 2021-08 and 2022-02 successfully.

Starting with 2022-02, I get the 0x800F0922 error message again for all future Cumulative Updates (i.e. 2022-03, 2022-04, ...).


I have tried some things I found as solutions on the web.
- install newst SSU
- ren C:\Windows\SoftwareDistribution & ren C:\Windows\System32\catroot2
- empty %temp% and C:\Windows\Temp
- DISM /Online /Cleanup-Image /RestoreHealth & SFC /ScanNow
- manual install Edge Browser (read in web)
- installation via sconfig
- disabled Antivires & Firewall


It looks to me like with the 2022-03 version (KB5011495) there must be a prerequisite that I don't have or an other installed update cause this error. I can't find any sign of an error in EventViewer except the error 0x800F0922.
It would be realy great if you can check my Logs.
Now that I have all domain controllers all up to 2022-02, I can test many things at the same time.

For the WindowsUpdate.log here my timestemps:
13:17 -> Update started
13:49 -> Update installed and need a reboot to complete -> reboot
13:59 -> Undoing changes


Max

 

[Max01]

I did some other trys and found in the CBS.log the following:

2023-05-26 09:50:04, Error                 CSI    0000026f (F) Error E_INVALIDARG from InstrumentationManifestAssert at  line 4294967295, online=TRUE
[gle=0x80004005]
2023-05-26 09:50:04, Error                 CSI    00000270 (F) Error E_INVALIDARG in eventsXml: <events><provider guid="{3663a992-84be-40ea-bba9-90c7ed544222}" message="$(string.eventProviderName)" messageFileName="%SystemRoot%\system32\efscore.dll" name="Microsoft-Windows-EFS" resourceFileName="%SystemRoot%\system32\efscore.dll" symbol="EFS_PUBLISHER"><channels xmlns="http://schemas.microsoft.com/win/2004/08/events">

          <channel chid="Microsoft-Windows-EFS/Debug" isolation="Application" name="Microsoft-Windows-EFS/Debug" symbol="EFS_DEBUG" type="Debug"></channel>

          <importChannel chid="Application" name="Application"></importChannel>

        </channels></provider></events>
[gle=0x80004005]
2023-05-26 09:50:04, Info                  CSI    00000271@2023/5/26:07:50:04.233 CSI Advanced installer perf trace:
CSIPERF:AIDONE;{3bb9fd2b-351e-4b9c-b1fc-ed0758805998};(null);12396080us
2023-05-26 09:50:04, Info                  CSI    00000272 End executing advanced installer (sequence 0)
    Completion status: E_INVALIDARG

2023-05-26 09:50:04, Info                  CSI    00000273 Performing 1 operations as follows:
  (0)  LockComponentPath: flags: 0 comp: {l:16 b:ff4db1aea68fd901f402000054068c06} pathid: {l:16 b:ff4db1aea68fd901f502000054068c06} path: [l:115]'\SystemRoot\WinSxS\x86_microsoft.windows.s..ation.badcomponents_31bf3856ad364e35_10.0.14393.0_none_09e78f632173f4c5' pid: 654 starttime: 133295609673237675
2023-05-26 09:50:04, Error      [0x01802b] CSI    00000274 (F) Failed execution of queue item Installer: Events ({3bb9fd2b-351e-4b9c-b1fc-ed0758805998}) with HRESULT E_INVALIDARG.  Failure will not be ignored: A rollback will be initiated after all the operations in the installer queue are completed; installer is reliable[gle=0x80004005]

Then i compare the registry for "{3663a992-84be-40ea-bba9-90c7ed544222}" with a healthy DC from another envirement and find out, that i missing many registry entries.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\Microsoft-Windows-EFS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{3663a992-84be-40ea-bba9-90c7ed544222}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-Application\{3663a992-84be-40ea-bba9-90c7ed544222}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\Microsoft-Windows-EFS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\WMI\Autologger\EventLog-Application\{3663a992-84be-40ea-bba9-90c7ed544222}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\EventLog\Application\Microsoft-Windows-EFS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application\{3663a992-84be-40ea-bba9-90c7ed544222}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\Microsoft-Windows-EFS

i have only this one:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-EFS/Debug

So i then exported the registry entries from the healthy DC and imported then on one of my DC´s, restarted the server and tried it aigan but the error in the CBS.log is still the same and the registry entries are were deleted.

 

[Max01]

I have found the issue.
This registry key was to much
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-EFS/Debug
After deliting it, the update could be installed.

Thanks anyway.

 

[Maxstar]

Hi,

Glad you have managed to resolve this issue, and thanks for sharing the solution - do you still have a copy of the deleted key to look at?

 

[Max01]

Hi Maxstar,

it is not necessary to look at the backup, because the were no values in it. It was just this single Key.

 

[Maxstar]

Hi,

That's interesting, thanks for letting me know so I can test some things to reproduce this issue..