[SOLVED] Win 2012 Std - WU errors out with 8024A000

[SysEngineer]

I have a server (and maybe as many as 4) that absolutely will not update. I'm not sure all error out with the same 8024A000 but 3 of the 4 will run the "Check for Updates" process for hours and/or days and will eventually error out. I've spent all my time focused on a single server and the following logs and screenshots are from that single server.

All of the normal "stuff" to fix issues with Windows Update found on the internet has not netted any change.

 

[Sysnative Windows Update]

Hello and welcome!

Step#1 - Capture Process Monitor Trace
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Try updating the system just like you have in the past.
3. Stop Process Monitor as soon as it fails. You can simply do this by clicking the magnifying glass on the toolbar as shown below.

4. Select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
5. Zip up and provide the link to the LogFile.PML file as well as your CBS.log Examples of services to upload to are Dropbox or OneDrive or SendSpace.

 

[SysEngineer]

Sorry forgot the SFCFix.txt log. Wasn't sure from the posting instructions given if it was needed or not since sfc and dism commands did not report any corruption but went ahead and ran it anyway.

Also thank you @softwaremaniac I'll get those actions kicked off as soon as I get my day started.

 

[SysEngineer]

I kicked this process off at 8:20 a.m. CDT and it is currently still running.

 

[Sysnative Windows Update]

Can you stop ProcMon and try to run it again a few minutes (approximately) before failure?

 

[SysEngineer]

I can try but I don't think I'll have much success. The time to fail has been sporadic at best. Yesterday I witnessed it fail within 30 minutes but there have been times when it has literally run all weekend before finally failing.

 

[Sysnative Windows Update]

Yikes! Report back in an hour.

 

[SysEngineer]

I decided to start this process over. That decision was based on a rather sketchy recollection that when it failed within 30 minutes yesterday it was the first time I had checked for updates after a fresh reboot. So I rebooted the server and restarted procmon. That was kicked off at 10:10 CDT. IF this nets nothing I'll keep trying and once I am successful at getting a good capture of the process I'll create a download location and update this thread accordingly.

 

[Sysnative Windows Update]

Sounds good. I need the capture of the error, not the process as such.

 

[SysEngineer]

It finally failed. I have uploaded 2 zip files to Dropbox.

The first is logfile.zip and it contains the procmon output.
Logfile.zip

The second is the contents of the CBS directory.
cbs.zip

Honestly been a long while since I've used Dropbox so if those links don't work please let me know.

 

[Sysnative Windows Update]

Are you using McAffee or Norton AV security?

 

[SysEngineer]

Presently nothing. Normally, the server runs Symantec Endpoint Protection 14.x but I removed it last week as part of my troubleshooting. Unless someone came behind me and reinstalled it there should not be any installed.

 

[Sysnative Windows Update]

Let's check what's on the system:

Step#1 - FRST Scan

1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Right-click FRST64.exe and click Run as Administrator to run it as administrator. When the tool opens, click Yes to disclaimer.
3. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running (if not already checked).
4. Press Scan button.
5. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
6. Please attach the log back here.
7. Another log (Addition.txt - also located in the same directory as FRST64.exe) will be generated Please also attach that along with the FRST.txt in your reply.

 

[SysEngineer]

Here you go.

 

[Sysnative Windows Update]

Do any of the affected Servers have Desktop experience enabled? If yes, would it be possible to have it removed from one of the systems as a test? I've had a case before where it was the root cause of the issues.

 

[SysEngineer]

The system we've collected all the logs on so far has Desktop Experience installed. It is probably possible but I'd need to check with the system owner (external customer) before going down that path.

 

[Sysnative Windows Update]

Let's start by checking if all Servers have it enabled.

 

[SysEngineer]

Yes all four have Desktop Experience installed. If we're going to go down this path I'll need to find out from the customer if their 3rd party application is supported w/o the Desktop Experience before I can move forward with that path. Likely customer won't know w/o engaging the vendor of the 3rd party app so this might take some time to get approval to move forward. Just FYI.

 

[Sysnative Windows Update]

Okay, no problem. Like I said, we can try it on one Server with just a temporary uninstall to see if it works.

 

[SysEngineer]

Okay, I'll try to have that conversation with the customer tomorrow.