Unable to complete removal of Windows Defender, CBS.log shows ERROR_SXS_ASSEMBLY_MISSING KB4519979

[r0bot85]

I am attempting to remove Windows Defender as part of an Avira AV deployment and keep having errors. According to the CBS logs the issue is

0000000f (F) HRESULT_FROM_WIN32(ERROR_SXS_ASSEMBLY_MISSING) #143245# from Windows::ServicingAPI::CCSITransaction::ICSITransaction_PinDeployment(Flags = 0, a = a3d874599429ecb6a05e964bc86e8ace, version 10.0.14393.2999, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35}, cb = (null), s = (null), rid = 'Package_6312_for_KB4519979~31bf3856ad364e35~amd64~~10.0.1.7.4519979-12068_neutral', rah = '2', manpath = (null), catpath = (null), ed = 0, disp = 0)[gle=0x80073701]

I have solved these problems before by manually installing the .CAB file from the KB article via the DISM.exe /Online /Add-Package /PackagePath command, however I cannot locate KB4519979 to download from the Windows Catalog or anywhere else.

 

[r0bot85]

Running the SFC /SCANNOW returns these results



Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files but was unable to fix some
of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not
supported in offline servicing scenarios.

 

[r0bot85]

PS C:\Windows\system32> Dism /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 10.0.14393.4169

Image Version: 10.0.14393.4169

[==========================100.0%==========================]
Error: 0x800f081f

The source files could not be found.
Use the "Source" option to specify the location of the files that are required to restore the feature. For more informat
ion on specifying a source location, see Configure a Windows Repair Source.

The DISM log file can be found at C:\Windows\Logs\DISM\dism.log

 

[r0bot85]

Tool results and CBS log attached

 

[Maxstar]

Hi and welcome to Sysnative,

Step 1. Download

SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFix.zip and save it to your desktop.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the following DISM command and post the result. If it fails attach a new copy of the CBS log.

DISM /online /cleanup-image /RestoreHealth

Step 3. Follow these instructions to remove an update.

• Open the Start menu of Windows and type the command CMD
• When you see Command Prompt on the list, right-click on it and select Run as administrator.
• When command prompt opens, copy and paste the following command into it, then press enter.

wusa /uninstall /KB:4519979

• Let me know if it says it was successful or you get the message: The update KB4519979 is not installed on this computer.

 

[r0bot85]

Maxstar,

Thank you for your help on this issue. I have ran through the steps you outlined. Here are the results:



SFCFix:

“Stage 1 of 6 failed on server”. Stages 2-6 completed to 100%. There we some errors about folder/file permissions after stage 6 but they went so fast I couldn’t record them. Result file is attached.



DISM /online /cleanup-image /RestoreHealth:



Deployment Image Servicing and Management tool

Version: 10.0.14393.4169



Image Version: 10.0.14393.4169



[==========================100.0%==========================] The restore operation completed successfully.



wusa /uninstall /KB:4519979:



The update KB4519979 is not installed on this computer.

 

[r0bot85]

Attempting to remove the Windows Defender component still fails:

Uninstall-WindowsFeature -Name Windows-Defender



Uninstall-WindowsFeature : The request to add or remove features on the
specified server failed.
Removal of one or more roles, role services, or features failed.
The referenced assembly could not be found. Error: 0x80073701
At line:1 char:1
+ Uninstall-WindowsFeature -Name Windows-Defender
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (@{Vhd=; Credent...Name=localh
ost}SObject) [Uninstall-WindowsFeature], Exception
+ FullyQualifiedErrorId : DISMAPI_Error__Failed_Disabling_Updates,Microsof
t.Windows.ServerManager.Commands.RemoveWindowsFeatureCommand

Success Restart Needed Exit Code Feature Result
------- -------------- --------- --------------
False No Failed {}




Attached is the new fresh and clean CBS log

 

[Maxstar]

Hi,

Download the

Farbar Recovery Scan Tool and save it to your Desktop:

Download the 64 bit version: - Farbar Recovery Scan Tool Link

• Open the startmenu and type the command cmd.
• After you find the Command Prompt, right click on it and select Run as Administrator.
• Copy and paste the following into the Command Prompt and press enter.

reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS

Right-click on the file FRST64.exe and choose Run as administrator.

• Copy and paste the following (code) into the Search box and click the Search Registry button.

KB4519979

• When the scan is complete, a message will display that SearchReg.txt is saved in the same folder FRST was started from.
• Post the logfile SearchReg.txt as attachment in your next reply.