[SOLVED] updates failing terminal server 2019

[mcfreiz]

for the past 2 months the cumulative updates have failed.
Beginning verification phase of system scan.
Verification 75% complete.
Windows Resource Protection could not perform the requested operation.

DISM /Online /Cleanup-Image /RestoreHealth completes successfully
componentscanner is taking a while, i'll upload those logs in a little bit

 

[mcfreiz]

component scanner didnt find anything

 

[Maxstar]

Hi and welcome to Sysnative,

Step 1. Download

SFCFix and save it to your desktop.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFix.zip and save it to your desktop.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Step 2. Run the System File Checker and post the result. If it fails attach a new copy of the CBS log.

SFC /Scannow

 

[mcfreiz]

sfc completed successfully but the windows update KB5028168 still fails with error 0x80070020

 

[Maxstar]

2023-08-02 19:23:18, Error                 CSI    0000012c@2023/8/2:23:23:18.630 (F) internal\onecorebase\inc\auto_hive.h(235): Error STATUS_SHARING_VIOLATION originated in function Windows::Rtl::AutoHive::Load expression: Status
[gle=0x80004005]

Hi,

This error 0x80070020 and the rollback issue is caused by a specific profile. Could you please attempt to update again with Process Monitor running.

Capture Process Monitor BootLog
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Select the Options....Enable Boot Logging option. A Enable Boot Logging dialog will come up. Just click OK.
3. Create a folder on your desktop named BootLog.
4. Attempt to install the update just like you have in the past. Let the machine reboot and revert just like it has in the past.
5. After the machine has rebooted and come back up to the desktop, open Process Monitor again. A message box will come up telling you that a log of boot-time activity was created and ask if you wish to save it. Click Yes and save to the BootLog folder on your desktop.
6. This may take some time as it converts the boot-time data. Allow it to finish.
7. Zip up the entire BootLog folder on your desktop and upload to a file sharing service like: WeTransfer - Send Large Files & Share Photos Online - Up to 2GB Free

 

[mcfreiz]

bootlog uploaded to BootLog.zip

 

[Maxstar]

Hi,

It seems the following processes could be the issue in here, I would suggest to start with uninstalling the Sophos protection software and disabling the ZoHo desktop control software and then attempt to update again.

"C:\Program Files\Sophos\Endpoint Defense\SSPService.exe"
"C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin\dcinventory.exe"

2:12:10.5656510 AM    SSPService.exe    3268    RegOpenKey    HKU\S-1-5-21-3593959059-320285414-333860865-16361    NAME NOT FOUND    Desired Access: Read
2:12:59.1613040 AM    dcinventory.exe    5008    RegLoadKey    HKU\S-1-5-21-3593959059-320285414-333860865-16361    SUCCESS    Hive Path: C:\Users\jdavis\NTUSER.DAT
2:12:59.3285884 AM    TiWorker.exe    1872    RegOpenKey    HKU\S-1-5-21-3593959059-320285414-333860865-16361\    NAME NOT FOUND    Desired Access: Read
2:12:59.3286546 AM    TiWorker.exe    1872    RegLoadKey    HKU\S-1-5-21-3593959059-320285414-333860865-16361    SHARING VIOLATION    Hive Path: C:\Users\jdavis\NTUSER.DAT

 

[mcfreiz]

i uninstalled UEMS and Sophos, reran all the sfc and dism and its working now, thanks

 

[Maxstar]

Hi,

You're welcome. Glad to hear everything is up and running again...