[SOLVED] Windows 10 21H2 - cumulative update fails to install\catroot2 issue?

S

SpadeM

Well-known member
Joined
Nov 25, 2014
Posts
56
Hello,

I have a client with a strange problem. It fails to install the latest cumulative update, it goes through the whole process quite fast, says update is installed requires reboot, client reboots but after that nothing changes, the windows version stays the same at 19044.1466. Of course, the update gets offered again after the reboot the process repeats itself.

I tried with an offline msu from the catalog.microsoft.com site but same deal. When I did the default troubleshoot i noticed that the only errors I saw were in the catroot2 folder.

Any help is apreciated.
 

Attachments

Hello.

I will be assisting you regarding your computer's issues. Since I'm still in training in Windows Update, my fixes have to be approved first by a qualified Update Expert, so there may be a slight delay in my replies. Look at it as a good thing though, since you will have two people looking at your problem. :-)

I am currently reviewing your logs, and will be back as soon as I am ready.
 
Hi, SpadeM.

The only significant error I can see, is shown below:

2022-04-28 13:51:45, Info CBS Client aborted the install. [HRESULT = 0x800f0821 - CBS_E_ABORT]
2022-04-28 13:51:45, Info CBS Repr: Canceled by client [HRESULT = 0x800f0821 - CBS_E_ABORT]
2022-04-28 13:51:45, Info CBS Repr: CBS Store check completes
2022-04-28 13:51:45, Info CSI 00000036 StoreCorruptionRepair transaction begun. WcpVersion: [l:38]'10.0.19041.1525 (WinBuild.160101.0800)'.
2022-04-28 13:51:45, Info CSI 00000037@2022/4/28:11:51:45.456 Starting corruption detection (InnerFlags=2)
2022-04-28 13:51:45, Info CBS FLOW: Entering stage: CheckCsi
2022-04-28 13:51:45, Info CBS Client aborted the install. [HRESULT = 0x800f0821 - CBS_E_ABORT]
2022-04-28 13:51:45, Info CBS Repr: Canceled by client [HRESULT = 0x800f0821 - CBS_E_ABORT]
2022-04-28 13:51:45, Info CSI 00000038 Direct SIL provider: Number of files opened: 4.
2022-04-28 13:51:45, Error CSI 00000039 (F) STATUS_SUCCESS #3917860# from CCSDirect::EnumStoreCorruptions(...)[gle=0x10000000]
2022-04-28 13:51:45, Info CSI 0000003a@2022/4/28:11:51:45.518 Corruption detection complete. numCorruptions = 0, Disp = 2.
2022-04-28 13:51:45, Info CBS Failed to check CSI store. [HRESULT = 0x800f0821 - CBS_E_ABORT]
Click to expand...

I would like you to do the following:

Run Deployment Image Servicing and Management (DISM)
  • Click on the Start button and in the search box, type Command Prompt
  • When you see Command Prompt on the list, right-click on it and select Run as administrator
  • Enter the command below and press on Enter;
Code: 
DISM /Online /Cleanup-Image /RestoreHealth
  • Let the scan run until the end (100%). Depending on your system, it can take some time.
  • Let the command to run, and when finished, attach the newest CBS log for me to check.
 
Hi,

The logs I zipped up which reflect that error were takes after running dism /online /cleanup-image /restorehealth but i'll run it again and attach a new export to this post, give me a few minutes.
 

Attachments

Thank you, SpadeM.

We have check your logs and it seems that something is happening during the reboot process.


1. Capture Process Monitor BootLog

1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Select the Options....Enable Boot Logging option. A Enable Boot Logging dialog will come up. Just click OK.
3. Create a folder on your desktop named BootLog.
4. Attempt to install the update just like you have in the past. Let the machine reboot and revert just like it has in the past.
5. After the machine has rebooted and come back up to the desktop, open Process Monitor again. A message box will come up telling you that a log of boot-time activity was created and ask if you wish to save it. Click Yes and save to the BootLog folder on your desktop.
6. This may take some time as it converts the boot-time data. Allow it to finish.
7. Zip up the entire BootLog folder on your desktop and upload to a file sharing service of your choice for my review. Examples of services to upload to are Dropbox or OneDrive or SendSpace


2. Attach the rollback logs

Follow the path C\$WINDOWS.~BT\Sources\Rollback and attach the log(s).
 
Unfortunately, DR M isn't able to continue with your thread at the moment, so I'll take over and attempt to help you. Could you please provide the KB number of the update you're attempting to install?
 
At the moment, KB5011831 ... I've tried originally with KB5012599 but it's the same issue so it's KB agnostic basically. KB5012599 is\was offered via automatic update using SCCM and KB5011831 as a manual install from catalog.microsoft.com.
 
Let's focus on the update which has been offered to you, could you please perform a FRST registry search using the following instructions:

FRST Registry Search
1. Click your Start button and type in cmd.
2.After you find the Command Prompt, right click on it and select Run as Administrator.
3. Copy and paste the following into the Command Prompt:
reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
4. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
5. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
6. Copy and paste KB5012599 into the Search box and click the Search Registry button.
7. When the scan is complete a notepad window will open with the results. Please attach this to your next reply. It is saved on your desktop named SearchReg.txt.
 
Could you please repeat the above but with KB5009543, since the cumulative update appears to install quite quickly, I'm wondering if the current one is installed correctly.
 
Okay, that is very odd, looks like the cumulative update for 19044.1466 isn't actually installed at all? Could you please run the following FRST script to remove that one registry subkey.

FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Download the attached fixlist.txt and save it to the Desktop.
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
2. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
3. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
4. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.

Could you also please provide the CBS hive using the following instructions:

Export CBS hive
  • Click on the Start button and in the search box, type regedit
  • When you see regedit on the list, right-click on it and select Run as administrator.
  • When regedit opens, using the left pane, navigate to the following registry key and select it by clicking on it once.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
  • Once selected, click File > Export....
  • Change the Save as type: to Registry Hive Files (.).
  • Name this file ComponentBasedServicing (with no file extension) and save it to your Desktop.
  • Right-click on the saved file and choose Send To -> Compressed (zipped) Folder.
  • Attach the .ZIP file to your next post.
  • If the file is too large to upload here, upload to Dropbox or OneDrive or WeTransfer and just provide the link here.

Please ensure that the subkey is exported as a registry hive file.
 

Attachments

Thanks, could you please try and install the cumulative update which has been offered to you again?
 
Done ... asked for a reboot, did so, rebooted in 10 seconds or less and back into Windows, version 19044.1466. The "new" thing now is that the update shows up as failed when I check it's state under sccm.
 
Something is certainly missing and I suspect it's because you aren't truly on the build number which the operating systems claims to be.

Rich (BB code): 
2022-05-13 15:17:42, Info                  CSI    0000001f StoreCorruptionRepair transaction begun. WcpVersion: [l:38]'10.0.19041.1525 (WinBuild.160101.0800)'.
2022-05-13 15:17:42, Info                  CSI    00000020@2022/5/13:13:17:42.953 Starting corruption detection (InnerFlags=2)
2022-05-13 15:17:42, Info                  CBS    FLOW: Entering stage: CheckCsi 
2022-05-13 15:19:19, Info                  CBS    Client aborted the install. [HRESULT = 0x800f0821 - CBS_E_ABORT]
2022-05-13 15:19:19, Info                  CBS    Repr: Canceled by client [HRESULT = 0x800f0821 - CBS_E_ABORT]
2022-05-13 15:19:19, Info                  CSI    00000021 Direct SIL provider: Number of files opened: 102636.
2022-05-13 15:19:19, Error                 CSI    00000022 (F) STATUS_SUCCESS #3916410# from CCSDirect::EnumStoreCorruptions(...)[gle=0x10000000]
2022-05-13 15:19:19, Info                  CSI    00000023@2022/5/13:13:19:19.437 Corruption detection complete. numCorruptions = 0, Disp = 2.
2022-05-13 15:19:19, Info                  CBS    Failed to check CSI store. [HRESULT = 0x800f0821 - CBS_E_ABORT]

Install Update with DISM

  1. Download the update MSU here: windows10.0-kb5009543-x64_c7b660efcaaa2dd1d55fe91c5cea3d9b209a15cd.msu
  2. Copy the .msu file to a convenient location (such as %userprofile%\Desktop).
  3. Click on the Start button and in the search box, type Command Prompt
  4. When you see Command Prompt on the list, right-click on it and select Run as administrator
  5. When command prompt opens, copy and paste the following commands into it, press enter after each

    cd %userprofile%\Desktop
    replace %userprofile%\Desktop with your path if different

    expand windows10.0-kb5009543-x64_c7b660efcaaa2dd1d55fe91c5cea3d9b209a15cd.msu -f:* %userprofile%\Desktop

    DISM /Online /Add-Package /PackagePath:%userprofile%\Desktop\windows10.0-kb5009543-x64.cab
  6. You should receive the message:
    The operation completed successfully.
    Make sure to allow the computer to restart if prompted.
  7. If you receive any other message:
    Post a screenshot of the Command Prompt window.
    Zip and attach the file %systemroot%\Logs\CBS\CBS.log
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top