Server 2019 Failing to Update

[bcaliagi]

Hey all, been struggling with Windows update on my Server 2019 EC2 instance.

dism /online /cleanup-image /restorehealth fails at 91.2% with 0xd0000034 error
sfc /scannow seems to report all okay

Best I've been able to track down to is windows defender files.

Any help would be greatly appreciated.

 

[Maxstar]

Hi and welcome to Sysnative,

Step 1. Download

SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFix.zip and save it to your desktop.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the following DISM command and post the result. If it fails attach a new copy of the CBS log.

DISM /online /cleanup-image /RestoreHealth

 

[bcaliagi]

Thank you for the response and I apologize for the delayed response, I've been on and off trying to fix this in my spare time. SFCFix resovled the DSIM issues and its now reporting no errors, however windows is still failing to update.

Current CBS log seems to possibly be NetStetupAI.dll causing issues, appears to be rolling back after failing to install.

 

[Maxstar]

Hi,

Open an elevated prompt and run the following commands and copy and paste the result in your next post.

sc query NetSetupSvc
sc qc NetSetupSvc

 

[bcaliagi]

Can do, results are as follows:

C:\Users\Administrator>sc query NetSetupSvc

SERVICE_NAME: NetSetupSvc
        TYPE               : 30  WIN32
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

C:\Users\Administrator>sc qc NetSetupSvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: NetSetupSvc
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Windows\System32\svchost.exe -k netsvcs -p
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Network Setup Service
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : LocalSystem

C:\Users\Administrator>

 

[Maxstar]

Please run the following command in an elevated prompt and post the result.

sc config NetSetupSvc start= auto

Afterwards reboot the server and attempt to update again, if it fails attach a new copy of the CBS logs.

 

[bcaliagi]

Latest logs, update was run on the 16th, seems to be the same issue still happening

 

[Maxstar]

Which Security Software is installed on this server? SentinelOne / Malwarebytes?

 

[bcaliagi]

We are using CrowdStrike Falcon.

 

[Maxstar]

Please do the following first to check the "NetSetupSvc" service.

Export registry key as hive file.

• Open the Start menu of Windows and type CMD.
• When you see Command Prompt on the list, select the option Run as administrator.
• Copy and paste the following command into the command prompt and press enter.

reg save "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" "%userprofile%\Desktop\Services.hiv"

• Once done, a file will appear on your desktop, called Services.hiv.
• ZIP this file and attach it to your next reply.

 

[bcaliagi]

Yep, here is the file

 

[Maxstar]

The "NetSetupSvc" service looks good, so perhaps CrowdStrike Falcon is causing this issue. I'ts a well-known issue that third-party security software is the cause of such rollbacks.

So please disable or remove CrowdStrike Falcon and attempt to update again.

 

[bcaliagi]

Sounds good, I'll give that a try once I can, thanks!