[SOLVED] server 2019 rollback everytime it's patched

[lennertholmbergkarnov]

Hi..

We've been having a problem with one of our servers for a few months now, which we try to patch every month.
Every time we do the patches are rolled back.

We have a short maintenance window for this server, so we have not been able to retry that many times.

We just tried updating the latest CU ( 2024-03 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5035849) ) with the same result.

We have patched the system using our patch management system From manageengine, but subsequently tried using the built-in windows update with the same result.

We have run sfc /scannow and Dism /Online /Cleanup-Image /RestoreHealth every month after failed updates, always without finding any problems.
We also tried windows update cleanup and the WU troubleshooter.

I have today ran the same, and your component Scanner and I've attached the required files, CBS.zip, componentscanner and cmd outputs.
I hope you can help

 

[Maxstar]

2024-03-13 20:29:09, Info                  CSI    000000b6 Loading user account SID S-1-5-21-3030903430-2029731480-1927092453-1182
2024-03-13 20:29:14, Error                 CSI    000000b7@2024/3/13:19:29:14.346 (F) internal\onecorebase\inc\auto_hive.h(235): Error STATUS_SHARING_VIOLATION originated in function Windows::Rtl::AutoHive::Load expression: Status
[gle=0x80004005]

Hi and welcome to Sysnative,

Provide the profile information of this server.

• Click the Start button and in the search box, type Command Prompt
• When you see Command Prompt on the list, right-click on it and select Run as administrator.
  Copy and paste the following commands one at a time into the command prompt and press enter after each.
  

  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s > "%userprofile%\desktop\ProfileList.txt"
  reg query "HKEY_USERS" >> "%userprofile%\desktop\ProfileList.txt"

• These commands will collect the System and Application logs and create ProfileList.txt on your Desktop.
• Attach this file in your next reply.

 

[lennertholmbergkarnov]

Thanks for the reply..
Here are the reg exports as requested

 

[Maxstar]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3030903430-2029731480-1927092453-1182
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\C4Service

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3030903430-2029731480-1927092453-3223
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\C4Service

Hi,

The accounts above are the issue, so I would suggest to check both SID's to see which is the correct profile and which can be removed.

 

[lennertholmbergkarnov]

Hi Maxstar.. thanks a bunch ..

It's the one marked in red.. Is it enough to remove the Profilelist key and it's values ?

 

[Maxstar]

I suspected that that SID would be the issue, you can remove this profile with the following command in an elevated prompt.

reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3030903430-2029731480-1927092453-1182" /f

 

[lennertholmbergkarnov]

Removing the SIDand rebooting, finally mad ethe cumulative update install..

Thanks a bunch .. there are still 3 dotnet updates, that will not install (no rollbacks though). Should I open a new thread for that or continue in this ?

 

[Maxstar]

Hi,

Great, glad to hear the update installed without any issues this time. Fot the .NET issue please attach the latest CBS logs.

 

[lennertholmbergkarnov]

I started a new thread as they might be unrelated .. new therad here: server 2019 DotNet updates won't install

 

[Maxstar]

Okay, I will mark this thread as solved then..