Tutorial: Failure will not be ignored: A rollback will be initiated...

S

Sysnative Windows Update

Inactive
Joined
Oct 9, 2014
Posts
741
Hello everyone!

This error is very undocumented and I feel that it's high time we changed that.

I have uncovered many useful things about this dreadful error and wanted to share with you.


Okay, let's begin:

As you all know, this error is exceptionally rare and quite troublesome. It usually manifests in such a way that Windows Updates do install correctly, but fail on configuring. However, setupapi logs are useless in this case.

Code: 
2018-04-11 21:49:27, Error      [0x018008] CSI    0000003a (F) Failed  execution of queue item Installer: Generic Command (uninstall)  ({c145fd5d-1b9b-4738-9961-64034a3da28f}) with HRESULT  HRESULT_FROM_WIN32(14109).  Failure will not be ignored: A rollback will  be initiated after all the operations in the installer queue are  completed; installer is reliable (2)[gle=0x80004005]

There are a couple of errors I've come across up to now.


1. Access Denied (0x80004005)

Windows 10 - Rolling Back Updates

Code: 
2016-10-23 16:13:17, Info                  CSI    00000096 Begin executing advanced installer phase 24 index 563 (sequence 588)
    Old component: [l:171 ml:172]'[COLOR=#ff0000]Windows-Gaming-XboxLive-Storage-Service-Component[/COLOR], Culture=neutral, Version=10.0.14393.0, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS'
    New component: [l:173 ml:174]'Windows-Gaming-XboxLive-Storage-Service-Component, Culture=neutral, Version=10.0.14393.206, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS'
    Install mode: uninstall
    Smart installer: FALSE
    Installer ID: {386b5911-b69e-4d2d-a3ab-796d2ec6af38}
    Installer name: '[COLOR=#ff0000]Task Scheduler[/COLOR]'
2016-10-23 16:13:17, Info                  CSI    00000097 Performing 1 operations as follows:
  (0)  LockComponentPath: flags: 0 comp: {l:16 b:cf26ccfb3f2dd2019a0000004c001c08} pathid: {l:16 b:cf26ccfb3f2dd2019b0000004c001c08} path: [l:117]'\SystemRoot\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.14393.0_none_80da1857ca9fa70d' pid: 4c starttime: 131217091897439109
2016-10-23 16:13:17, Info                  CSI    00000098 Performing 1 operations as follows:
  (0)  LockComponentPath: flags: 0 comp: {l:16 b:cf26ccfb3f2dd2019c0000004c001c08} pathid: {l:16 b:cf26ccfb3f2dd2019d0000004c001c08} path: [l:119]'\SystemRoot\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.14393.206_none_8d69e9ef51b61cf1' pid: 4c starttime: 131217091897439109
2016-10-23 16:13:17, Error                 CSI    00000099 (F) Logged @2016/10/23:15:13:17.803 : [l:22 ml:23]'JobsHandler::Uninstall'
[gle=0x80004005]
2016-10-23 16:13:17, Error                 CSI    0000009a (F) Logged @2016/10/23:15:13:17.803 : [l:36 ml:37]'IsScheduleServiceRunning queries SCM'
[gle=0x80004005]
2016-10-23 16:13:17, Error                 CSI    0000009b (F) Logged @2016/10/23:15:13:17.803 : [l:37 ml:38]'IsScheduleServiceRunning returns true'
[gle=0x80004005]
2016-10-23 16:13:17, Error                 CSI    0000009c (F) Logged @2016/10/23:15:13:17.834 : [l:81 ml:82]'WmiCmiPlugin jobshandler.cpp(330): ITaskFolder::DeleteTask failed. HR=0x80070005.'

The key here is to interpret what is failing. In this case it was an Xbox Save Task:


Navigate to : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks
Search for Data xbl to find the correct task key GUID to remove. In this case it was XblGameSave Standby Task

Delete the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\XblGameSave\XblGameSaveTask

You get the idea.

Courtesy of zcomputerwiz



And now onto the REAL reason this thread was started:

2.

Win 7-64 Always Reverts and Backs Out After Quarterly Update Attempt.

Code: 
2018-04-12 17:36:45, Info                  CSI    000000ab Begin executing advanced installer phase 38 (0x00000026) index 81 (0x0000000000000051) (sequence 120)
    Old component: [ml:328{164},l:326{163}]"[COLOR=#0000ff][B]Microsoft-Windows-Printing-Spooler-Core[/B][/COLOR], Culture=neutral, Version=6.1.7601.17514, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS"
    New component: [ml:328{164},l:326{163}]"[COLOR=#0000ff][B]Microsoft-Windows-Printing-Spooler-Core[/B][/COLOR], Culture=neutral, Version=6.1.7601.24000, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS"
    Install mode: install
    Installer ID: {3bb9fd2b-351e-4b9c-b1fc-ed0758805998}
    Installer name: [6]"[COLOR=#0000ff][B]Events[/B][/COLOR]"
2018-04-12 17:36:45, Error                 CSI    00000001 (F) Logged @2018/4/12:21:36:45.119 : [ml:292{146},l:290{145}]"events installer: online=1, install=1, component=amd64_Microsoft-Windows-Printing-Spooler-Core_31bf3856ad364e35_6.1.7601.24000_neutral_release__."
[gle=0x80004005]
2018-04-12 17:36:45, Error                 CSI    00000002 (F) Logged @2018/4/12:21:36:45.181 : [ml:144{72},l:142{71}]"WmiCmiPlugin (-1): InstrumentationManifestAssert failed. HR=0x80070057."
[gle=0x80004005]
2018-04-12 17:36:45, Error                 CSI    00000003 (F) Logged @2018/4/12:21:36:45.181 : [ml:166{83},l:164{82}]"WmiCmiPlugin eventloghandler.cpp(192): ProcessEventsInstall failed. HR=0x80070057."
[gle=0x80004005]
2018-04-12 17:36:45, Error                 CSI    00000004 (F) Logged @2018/4/12:21:36:45.181 : [ml:170{85},l:168{84}]"WmiCmiPlugin eventloghandler.cpp(212): EventLogHandlerInstall failed. HR=0x80070057."
[gle=0x80004005]
2018-04-12 17:36:45, Error                 CSI    00000005@2018/4/12:21:36:45.181 (F) CMIADAPTER: Inner Error Message from AI HRESULT = E_INVALIDARG
 [
[29]"The parameter is incorrect.

"
]
[gle=0x80004005]
2018-04-12 17:36:45, Error                 CSI    00000006@2018/4/12:21:36:45.181 (F) CMIADAPTER: AI failed. HRESULT = E_INVALIDARG
    Element:
    [134129]"<events xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events" xmlns:xs="http://www.w3.org/2001/XMLSchema">

  <provider guid="{747EF6FD-E535-4d16-B510-42C90F6873A1}" message="$(string.eventProviderPrintSpooler)" messageFileName="%SystemRoot%\system32\ntprint.dll" name="Microsoft-Windows-PrintService" resourceFileName="%SystemRoot%\system32\ntprint.dll" symbol="SPOOLER_ETW_CONTROL_GUID">

    <channels>

      <channel chid="Admin" enabled="true" isolation="Application" message="$(string.AdminChannel)" name="Microsoft-Windows-PrintService/Admin" symbol="SPOOLER_CHANNEL_ADMIN" type="Admin" />

      <channel chid="Operational" enabled="false" isolation="Application" message="$(string.OperationalChannel)" name="Microsoft-Windows-PrintService/Operational" symbol="SPOOLER_CHANNEL_OPERATIONAL" type="Operational" />

      <channel chid="Debug" enabled="false" isolation="Application" message="$(string.DebugChannel)" name="Microsoft-Windows-PrintService/Debug" symbol="SPOOLER_CHANNEL_DEBUG" type="Debug" />

    </channels>

    <keywords>

      <keyword mask="0x1" message="$(string.SPOOLER_KEYWORD_LOCALSPL.KeywordMessage)" name="SPOOLER_KEYWORD_LOCALSPL" symbol="SPOOLER_KEYWORD_LOCALSPL" />

      <keyword mask="0x2" message="$(string.SPOOLER_KEYWORD_WIN32SPL.KeywordMessage)" name="SPOOLER_KEYWORD_WIN32SPL" symbol="SPOOLER_KEYWORD_WIN32SPL" />

      <keyword mask="0x20" message="$(string.SPOOLER_KEYWORD_PRINTER.KeywordMessage)" name="SPOOLER_KEYWORD_PRINTER" symbol="SPOOLER_KEYWORD_PRINTER" />

      <keyword mask="0x40" message="$(string.SPOOLER_KEYWORD_JOB.KeywordMessage)" name="SPOOLER_KEYWORD_JOB" symbol="SPOOLER_KEYWORD_JOB" />

      <keyword mask="0x80" message="$(string.SPOOLER_KEYWORD_CONNECTION.KeywordMessage)" name="SPOOLER_KEYWORD_CONNECTION" symbol="SPOOLER_KEYWORD_CONNECTION" />

      <keyword mask="0x100" message="$(s[gle=0x80004005]

Upon inspecting the CBS.log we can see that the error code has changed and it now says: HR=0x80070057.

Microsoft-Windows-Printing-Spooler-Core

Hey, isn't Print Spooler a service under services.msc? Yes it is. But don't ya all get excited, disabling it does absolutely nothing to help us.

However, is there a place in the Windows Registry where we could check if there's something going on? Yes, there is.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService

How I ended up there? If you look at the log:

Code: 
  Installer name: [6]"[B]Events[/B]"
2018-04-12 17:36:45, Error                 CSI    00000001 (F) Logged  @2018/4/12:21:36:45.119 : [ml:292{146},l:290{145}]"events installer:  online=1, install=1,  component=amd64_Microsoft-Windows-Printing-Spooler-Core_31bf3856ad364e35_6.1.7601.24000_neutral_release__."
[gle=0x80004005]


Code: 
<provider guid="{747EF6FD-E535-4d16-B510-42C90F6873A1}"  message="$(string.eventProviderPrintSpooler)"  messageFileName="%SystemRoot%\system32\ntprint.dll"  name="[B][COLOR=#0000ff]Microsoft-Windows-PrintService[/COLOR][/B]"  resourceFileName="%SystemRoot%\system32\ntprint.dll"  symbol="SPOOLER_ETW_CONTROL_GUID">

I wonder what's in there? So I go ahead and export the whole EventLog and see the two subkeys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Admin

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Operational
Don't we know that from before? Yes, we do:
Code: 
<channel chid="Admin" enabled="true" isolation="Application"  message="$(string.AdminChannel)"  name="Microsoft-Windows-PrintService/Admin"  symbol="SPOOLER_CHANNEL_ADMIN" type="Admin" />

      <channel chid="Operational" enabled="false"  isolation="Application" message="$(string.OperationalChannel)"  name="Microsoft-Windows-PrintService/Operational"  symbol="SPOOLER_CHANNEL_OPERATIONAL" type="Operational" />


More on channels available here: Defining Channels (Windows)

As far as I have understood the updates attempt to migrate this event log from the old location in the Event Viewer (root of Application and Services Logs) to it's proper location of Application and Services Logs > Microsoft > Windows > PrintService > Operational. but errors out at these keys and initiates a rollback which results in a failure to configure Windows Updates.

The key here is to delete the two offensive keys:


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Admin

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-PrintService/Operational

Voila, updates work again!


But softwaremaniac, I don't have the keys you mentioned, what to do?

3.

Fear not, there's another place to check in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\<eventlogprovider>

The same key should exist under: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\<guid>

zcomputerwiz covered Channels and Publishers here, so I won't prolong it any more: Missing channels under the channelreferances (sic) registry key

Thank you for your kind attention! I hope I have helped at least one person with this tutorial.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top