[SOLVED] SFC stopped at 74%. DISM error : 0x800f0954

Herve

Herve

Contributor
Joined
Apr 29, 2020
Posts
32
Location
France, Dinan
Hi all,
Same problem in another server, sfc has stopped at 74% in Windows Server 2019 Datacenter.
Thanks a lot for your help.

Step #2 - Run SFC Scan
Code: 
sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 74% complete.

Windows Resource Protection could not perform the requested operation.
Step #3 – DISM Scan
Code: 
Dism /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 10.0.17763.1697

Image Version: 10.0.17763.2928

[==========================100.0%==========================]
Error: 0x800f0954

DISM failed. No operation was performed.
For more information, review the log file.

The DISM log file can be found at C:\Windows\Logs\DISM\dism.log
Step #4 - Run SFCFix
Code: 
SFCFix version 3.0.2.1 by niemiro.
Start time: 2022-06-15 17:17:07.594
Microsoft Windows Server 10 Build 17763 - amd64
Not using a script file.




AutoAnalysis::
SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.



Failed to generate a complete zip file. Upload aborted.


SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2022-06-15 17:28:40.362
----------------------EOF-----------------------
Step #5 – Export/Upload CBS folder
CBS.log : CBS.zip
dism.log : dism.zip
 
Hello Herve,

I have looked at the reason for the DISM failure and below I have provided a fix for this:

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.


  1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
  2. Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
  3. Save any open documents and close all open windows.
  4. On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
  5. Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
  6. SFCFix will now process the script.
  7. Upon completion, a file should be created on your Desktop: SFCFix.txt.
  8. Attach this file into your next post for me to check please.
 

Attachments

Thanks for your answer.
Result of SFCFix
Code: 
SFCFix version 3.0.2.1 by niemiro.
Start time: 2022-06-22 15:59:30.481
Microsoft Windows Server 10 Build 17763 - amd64
Using .zip script file at C:\Users\salomon\Desktop\SFCFix.zip [0]




PowerCopy::
Successfully took permissions for file or folder C:\Windows\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml
Successfully took permissions for file or folder C:\Windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml

Successfully copied file C:\Users\salomon\AppData\Local\niemiro\Archive\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml to C:\Windows\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml.
Successfully copied file C:\Users\salomon\AppData\Local\niemiro\Archive\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml to C:\Windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml.

Successfully restored ownership for C:\Windows\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml
Successfully restored permissions on C:\Windows\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml
Successfully restored ownership for C:\Windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml
Successfully restored permissions on C:\Windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml
PowerCopy:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 2 datablocks.
Finish time: 2022-06-22 15:59:36.691
Script hash: fPbVX0GZRr1yknEVz4atZ8TCE+OogsCpUsUPiHAlAfU=
Result of sfc
Code: 
sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 74% complete.

Windows Resource Protection could not perform the requested operation.
New log : CBS2.zip
 
There is one more file being flagged:
Code: 
2022-06-22 17:07:52, Error                 CSI    00005df6 (F) c0000011 [Error,Facility=(system),Code=17 (0x0011)] #42907031# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysReadFile(h = 1b4 ('\Device\HarddiskVolume4\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpComputerStatus.cdxml'), evt = 0, apcr = NULL, apcc = NULL, iosb = @0xd13297baf0, data = {l:0 b:}, byteoffset = (null), key = (null))
[gle=0xd0000011]
2022-06-22 17:07:52, Error                 CSI    00005df7@2022/6/22:15:07:52.219 (F) onecore\base\wcp\sil\ntsystem.cpp(3610): Error c0000011 [Error,Facility=(system),Code=17 (0x0011)] originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysReadFile expression: (null)
[gle=0x80004005]

Earlier in the logs we can see that the file hashes for a number of these Windows defender files are incorrect.

Code: 
2022-06-22 17:07:48, Info                  CSI    00005da3 Hashes for file member [l:27]'MSFT_MpComputerStatus.cdxml' do not match.
 Expected: {l:32 ml:4096 b:250a58b9ec6c327e7d165cecbdbae0b1fdca203cd342dba12616527b47a44486}.
 Actual: {l:32 b:cbfca6cb14b5a84f5bd30cbc9b05f008f4916e54a33a513fcedf8bff90002f5d}.
2022-06-22 17:07:48, Info                  CSI    00005da4 [SR] Cannot repair member file [l:27]'MSFT_MpComputerStatus.cdxml' of Windows-Defender-Management-Powershell, version 10.0.17763.831, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2022-06-22 17:07:48, Info                  CSI    00005da5 Hashes for file member [l:19]'MSFT_MpThreat.cdxml' do not match.
 Expected: {l:32 ml:4096 b:ae595236832a3884d2aa3f913454ac6ff4c735f55e819c7f391c94b653281f92}.
 Actual: {l:32 b:dd2decdbc6ec0357ddbd952ad3c29c0a05fc7368badb377648bb8f0964eedeec}.
2022-06-22 17:07:48, Info                  CSI    00005da6 [SR] Cannot repair member file [l:19]'MSFT_MpThreat.cdxml' of Windows-Defender-Management-Powershell, version 10.0.17763.831, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2022-06-22 17:07:48, Info                  CSI    00005da7 Hashes for file member [l:26]'MSFT_MpThreatCatalog.cdxml' do not match.
 Expected: {l:32 ml:4096 b:106d459542c3ec7dd9b7e545d74a4a98f0ad74c7db6a1333cfcd9168e2a3c076}.
 Actual: {l:32 b:ff8bbde3d74745abc4b8bef6278c46bd9bba05c2e61f0eb033787443cde80f44}.
2022-06-22 17:07:48, Info                  CSI    00005da8 [SR] Cannot repair member file [l:26]'MSFT_MpThreatCatalog.cdxml' of Windows-Defender-Management-Powershell, version 10.0.17763.831, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2022-06-22 17:07:48, Info                  CSI    00005da9 Hashes for file member [l:28]'MSFT_MpThreatDetection.cdxml' do not match.
 Expected: {l:32 ml:4096 b:a19bf000eb950ddd8438c30562c0fa6f3c0848432f55a219ef3d79b302aa6cf1}.
 Actual: {l:32 b:3c082a55cd0e2d835764bb55c35292277b3c3a7a909543123a9b75bddf7ef20f}.
2022-06-22 17:07:48, Info                  CSI    00005daa [SR] Cannot repair member file [l:28]'MSFT_MpThreatDetection.cdxml' of Windows-Defender-Management-Powershell, version 10.0.17763.831, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2022-06-22 17:07:48, Info                  CSI    00005dab Hashes for file member [l:23]'MSFT_MpPreference.cdxml' do not match.
 Expected: {l:32 ml:4096 b:8bbe2742d4284d6a9578cada99243b282e6be6df9a6f796d19e6e72eafa1e382}.
 Actual: {l:32 b:dd557986b51074f3e4b7d5c0923903bf10ba919a1235605f5cba8a49b05ef07d}.
2022-06-22 17:07:48, Info                  CSI    00005dac [SR] Cannot repair member file [l:23]'MSFT_MpPreference.cdxml' of Windows-Defender-Management-Powershell, version 10.0.17763.831, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2022-06-22 17:07:48, Info                  CSI    00005dad Hashes for file member [l:17]'MSFT_MpScan.cdxml' do not match.
 Expected: {l:32 ml:4096 b:a27630566684ee79af41ac68dc70bbdbffc968b2489aa16be0d0fa0e0eccf0c8}.
 Actual: {l:32 b:52a143a0bcb954c7ec8b35044ef9284055c75e7e2fe316cbaa120d665c06b1a7}.
2022-06-22 17:07:48, Info                  CSI    00005dae [SR] Cannot repair member file [l:17]'MSFT_MpScan.cdxml' of Windows-Defender-Management-Powershell, version 10.0.17763.831, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2022-06-22 17:07:48, Info                  CSI    00005daf Hashes for file member [l:20]'MSFT_MpWDOScan.cdxml' do not match.
 Expected: {l:32 ml:4096 b:80ddeca09c6c85cde406bd9352c24cb6ca58ab17062159713f0591c46fa7b9fd}.
 Actual: {l:32 b:064d8c62e1d613524ab6f414d4906ba77d8eefc4ba2bae3ac796b3332b1681ec}.
2022-06-22 17:07:48, Info                  CSI    00005db0 [SR] Cannot repair member file [l:20]'MSFT_MpWDOScan.cdxml' of Windows-Defender-Management-Powershell, version 10.0.17763.831, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2022-06-22 17:07:48, Info                  CSI    00005db1 Hashes for file member [l:22]'MSFT_MpSignature.cdxml' do not match.
 Expected: {l:32 ml:4096 b:dbb84a0489a5dfeecb4e850412aabb72e725e5f89319d9e158a8baa9be6470da}.
 Actual: {l:32 b:956a869d006ef2b477e146835befea9e9da6af260506389e79ce8a669906f0b3}.
2022-06-22 17:07:48, Info                  CSI    00005db2 [SR] Cannot repair member file [l:22]'MSFT_MpSignature.cdxml' of Windows-Defender-Management-Powershell, version 10.0.17763.831, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2022-06-22 17:07:48, Info                  CSI    00005db3 Hashes for file member [l:13]'Defender.psd1' do not match.
 Expected: {l:32 ml:4096 b:1b1971fcbdc0abc871748d7409c696bb509c4ede12b0c748af0af96e629961b7}.
 Actual: {l:32 b:b096112fba4e3abcde87ad6dfc843c7e2d74fb469125a00404e12fbe5f054ecb}.

Here is a new fix for repairing all of them:

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.


  1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
  2. Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
  3. Save any open documents and close all open windows.
  4. On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
  5. Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
  6. SFCFix will now process the script.
  7. Upon completion, a file should be created on your Desktop: SFCFix.txt.
  8. Attach this file into your next post for me to check please.
 

Attachments

Thanks for your explanation.
Result of SFCFix
Code: 
SFCFix version 3.0.2.1 by niemiro.
Start time: 2022-06-22 19:35:15.105
Microsoft Windows Server 10 Build 17763 - amd64
Using .zip script file at C:\Temp\SFCFix.zip [0]




PowerCopy::
Successfully took permissions for file or folder C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\Defender.psd1
Successfully took permissions for file or folder C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpComputerStatus.cdxml
Successfully took permissions for file or folder C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpPreference.cdxml
Successfully took permissions for file or folder C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpScan.cdxml
Successfully took permissions for file or folder C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpSignature.cdxml
Successfully took permissions for file or folder C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreat.cdxml
Successfully took permissions for file or folder C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreatCatalog.cdxml
Successfully took permissions for file or folder C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreatDetection.cdxml
Successfully took permissions for file or folder C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpWDOScan.cdxml

Successfully copied file C:\Users\salomon\AppData\Local\niemiro\Archive\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\Defender.psd1 to C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\Defender.psd1.
Successfully copied file C:\Users\salomon\AppData\Local\niemiro\Archive\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpComputerStatus.cdxml to C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpComputerStatus.cdxml.
Successfully copied file C:\Users\salomon\AppData\Local\niemiro\Archive\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpPreference.cdxml to C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpPreference.cdxml.
Successfully copied file C:\Users\salomon\AppData\Local\niemiro\Archive\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpScan.cdxml to C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpScan.cdxml.
Successfully copied file C:\Users\salomon\AppData\Local\niemiro\Archive\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpSignature.cdxml to C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpSignature.cdxml.
Successfully copied file C:\Users\salomon\AppData\Local\niemiro\Archive\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreat.cdxml to C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreat.cdxml.
Successfully copied file C:\Users\salomon\AppData\Local\niemiro\Archive\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreatCatalog.cdxml to C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreatCatalog.cdxml.
Successfully copied file C:\Users\salomon\AppData\Local\niemiro\Archive\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreatDetection.cdxml to C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreatDetection.cdxml.
Successfully copied file C:\Users\salomon\AppData\Local\niemiro\Archive\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpWDOScan.cdxml to C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpWDOScan.cdxml.

Successfully restored ownership for C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\Defender.psd1
Successfully restored permissions on C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\Defender.psd1
Successfully restored ownership for C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpComputerStatus.cdxml
Successfully restored permissions on C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpComputerStatus.cdxml
Successfully restored ownership for C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpPreference.cdxml
Successfully restored permissions on C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpPreference.cdxml
Successfully restored ownership for C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpScan.cdxml
Successfully restored permissions on C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpScan.cdxml
Successfully restored ownership for C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpSignature.cdxml
Successfully restored permissions on C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpSignature.cdxml
Successfully restored ownership for C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreat.cdxml
Successfully restored permissions on C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreat.cdxml
Successfully restored ownership for C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreatCatalog.cdxml
Successfully restored permissions on C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreatCatalog.cdxml
Successfully restored ownership for C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreatDetection.cdxml
Successfully restored permissions on C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpThreatDetection.cdxml
Successfully restored ownership for C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpWDOScan.cdxml
Successfully restored permissions on C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpWDOScan.cdxml
PowerCopy:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 11 datablocks.
Finish time: 2022-06-22 19:35:22.212
Script hash: ZEBOw5e9ElGD+cTsZXVaBxFyr/askaibIPUN2v7QPzw=
Result of sfc
Code: 
sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 74% complete.

Windows Resource Protection could not perform the requested operation.
New log : CBS3.zip
 
The only error showing now is one which is a pain to put right because there is virtually no information given in the logs other than that there is a parameter error.

Code: 
2022-06-22 19:58:13, Error                 CSI    00005ddc@2022/6/22:17:58:13.868 (F) onecore\base\wcp\componentstore\deltastore.cpp(3065): Error STATUS_INVALID_PARAMETER originated in function ComponentStore::CRawStoreLayout::DecompressFile expression: Parameter check failed

I can see that you have worked on a similar problem in your previous thread. You will need to repeat the same method to provide me with the Process Monitor trace while you are doing the SFC scan so that I can find out which component is causing the failure. Let me know if you are OK with doing this and refer back to your previous thread if needed. Thanks!
 
I appreciate your explanations. I understand the difficulty to find the failure with the PM trace (very huge log).
Would you like to get the PM trace with a filter on the process called tiworker.exe or the full PM trace ?
 
The tiworker filter should provide the information I need.
 
Thank you.

It looks like there is a corrupted registry entry associated with the file:
C:\Windows\WinSxS\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5\MSFT_MpComputerStatus.cdxml

Please do the following to extract the relevant entry:

  1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
  2. Download the attached file, SFCFixScript.txt, and save this to your Desktop. Ensure that this file is named SFCFixScript.txt - do not rename it.
  3. Save any open documents and close all open windows.
  4. On your Desktop, you should see two files: SFCFix.exe and SFCFixScript.txt.
  5. Drag the file SFCFixScript.txt onto the file SFCFix.exe and release it.
  6. SFCFix will now process the script.
  7. Upon completion, a log should be created on your Desktop: SFCFix.txt.
  8. Attach this file into your next post for me to check please.
 

Attachments

Here is the result of the SFCfix :
Code: 
SFCFix version 3.0.2.1 by niemiro.
Start time: 2022-06-23 14:04:22.049
Microsoft Windows Server 10 Build 17763 - amd64
Using .txt script file at C:\Temp\SFCFixScript.txt [0]




RegistryExport::
Successfully exported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5.



Datablocks:
RegistryExport:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 11 datablocks.
Finish time: 2022-06-23 14:04:22.252
Script hash: JmTn3h/9suHRG43efI1s/XqYMrqcCk0/z0Iw3DmzmKo=
SFC command :
Code: 
sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 74% complete.

Windows Resource Protection could not perform the requested operation.
This is the new log : CBS5.zip
 
It looks like something went wrong, the script should have output all the registry key values into the SFCFix.txt file, unless all the entries are missing!
[Note: I did not need you to run the SFC scan at this stage]

Maybe it will be easier if you provide me with your COMPONENTS hive:

Retrieve Components Hive
1. Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
2. Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
3. Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
4. The file will likely be too large to upload here so please upload to a file sharing service. Examples of services to upload to are Dropbox or OneDrive or WeTransfer and then just provide the link in your reply.
 
Thank you - I can see the problem - the f! mark values are all incorrect.

  1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
  2. Download the attached file, SFCFixScript.txt, and save this to your Desktop. Ensure that this file is named SFCFixScript.txt - do not rename it.
  3. Save any open documents and close all open windows.
  4. On your Desktop, you should see two files: SFCFix.exe and SFCFixScript.txt.
  5. Drag the file SFCFixScript.txt onto the file SFCFix.exe and release it.
  6. SFCFix will now process the script.
  7. Upon completion, a log should be created on your Desktop: SFCFix.txt.
  8. Attach this file into your next post for me to check please.
 

Attachments

SFCfix :
Code: 
SFCFix version 3.0.2.1 by niemiro.
Start time: 2022-06-23 16:03:48.332
Microsoft Windows Server 10 Build 17763 - amd64
Using .txt script file at C:\Temp\SFCFixScript.txt [0]




RegistryScript::
Successfully took ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5.

Successfully imported registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5.

Successfully restored ownership and permissions for registry key HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.17763.831_none_5892c02f26f780e5.
RegistryScript:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 12 datablocks.
Finish time: 2022-06-23 16:03:49.819
Script hash: BQIlVm7LIkpWkYruLK/vkSBmRMzn3cUYu1r95Ol72Zw=
SFC result :
Code: 
sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.
DISM result :
Code: 
Dism /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 10.0.17763.1697

Image Version: 10.0.17763.2928

[==========================100.0%==========================] The restore operation completed successfully.
The operation completed successfully.

Nice ! Everything is good ! Thank you for your precious time. (y)
 
You are welcome!

Out of interest I think this is the third server we have helped you with? Do you have many others and are they all likely to be affected by this problem? There have been similarities in all three threads.
 
No, there were only these servers affected by this problem. Recently I have run the sfc command on every Windows servers.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top