Windows 2012R2 updates are rolling back at 99%

sanglyb · May 30, 2023

Hi! We have broken updates on our 2012R2 server. Updates are installing without any issues, but after reboot they are rolling back every time, at 99%.
In setup logs there is an error 0x800f0922.
sfc /scannow and Dism /Online /Cleanup-Image /RestoreHealth didn't find corruptions.

In the cbs.log I've found such records:

Code:

    Old component: [l:0]""
    New component: [l:0]""
    Install mode: delta
    Installer ID: {d4486727-4d36-45a5-bc81-b8935aed1429}
    Installer name: [27]"Ngen Task Scheduler Tickler"
2023-05-30 20:05:04, Info                  CSI    000002b8@2023/5/30:13:05:04.594 Executing Process [76]"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exe  Update /Queue /Delay"
2023-05-30 20:05:04, Info                  CSI    000002b9@2023/5/30:13:05:04.656 Executing Process [78]"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe  Update /Queue /Delay"
2023-05-30 20:05:04, Info                  CSI    000002ba@2023/5/30:13:05:04.687 CSI Advanced installer perf trace:
CSIPERF:AIDONE;{d4486727-4d36-45a5-bc81-b8935aed1429};(null);99322us
2023-05-30 20:05:04, Info                  CSI    000002bb End executing advanced installer (sequence 0)
    Completion status: S_OK

2023-05-30 20:05:04, Info                  CSI    000002bc Begin executing advanced installer phase 50 (0x00000032) index 0 (sequence 0)
    Old component: [l:0]""
    New component: [l:0]""
    Install mode: uninstall
    Installer ID: {4006c604-9280-4d68-b731-2fe3d02e84bf}
    Installer name: [16]"Shortcut Tickler"
2023-05-30 20:05:04, Info                  CSI    000002bd@2023/5/30:13:05:04.687 CSI Advanced installer perf trace:
CSIPERF:AIDONE;{4006c604-9280-4d68-b731-2fe3d02e84bf};(null);89us
2023-05-30 20:05:04, Info                  CSI    000002be End executing advanced installer (sequence 0)
    Completion status: S_OK

2023-05-30 20:05:04, Info                  CBS    Progress: UI message updated. Operation type: Update. Stage: 1 out of 1. Percent progress: 99.
2023-05-30 20:05:04, Info                  CBS    Winlogon: TiCoreOnCreateSession has been called
2023-05-30 20:05:09, Error                 CBS    Startup: Failed to process advanced operation queue, startupPhase: 0.  A rollback transaction will be created. [HRESULT = 0x800f0922 - CBS_E_INSTALLERS_FAILED]
2023-05-30 20:05:09, Info                  CBS    Setting ExecuteState key to: CbsExecuteStateInitiateRollback | CbsExecuteStateFlagAdvancedInstallersFailed
2023-05-30 20:05:09, Info                  CBS    SetProgressMessage: progressMessageStage: -1, ExecuteState: CbsExecuteStateInitiateRollback | CbsExecuteStateFlagAdvancedInstallersFailed, SubStage: 0
2023-05-30 20:05:09, Info                  CBS    Progress: UI message updated. Operation type: Update. Stage: 1 out of 1. Rollback.
2023-05-30 20:05:09, Info                  CBS    Setting original failure status: 0x800f0922, last forward execute state: CbsExecuteStateResolvePending
2023-05-30 20:05:09, Info                  CBS    Attempting to remove poqexec from SetupExecute
2023-05-30 20:05:09, Info                  CBS    Removed poqexec from SetupExecute.
2023-05-30 20:05:09, Info                  CBS    Configured poqexec to not pend to SetupExecute.
2023-05-30 20:05:09, Info                  CBS    Startup: Changing logon timeout to a static timeout: 10800000
2023-05-30 20:05:09, Info                  CBS    Winlogon: TiCoreOnCreateSession has been called
2023-05-30 20:05:12, Info                  CSI    000002bf Rolling back transactions...

Is there something with .net?

I attached my cbs logs and componentscanner file.
Hope for your help, thx.

PeterJ · May 31, 2023

Hello,

Remove Update Manually

Click on the Start button and in the search box, type Command Prompt.
When you see Command Prompt on the list, right-click on it and select Run as administrator.
When command prompt opens, copy and paste the following command into it, then press enter.
wusa /uninstall /KB:5025288
Let me know if it says it was successful or if there are any errors.

sanglyb · May 31, 2023

PeterJ said:
Hello,

Remove Update Manually

Click on the Start button and in the search box, type Command Prompt.

When you see Command Prompt on the list, right-click on it and select Run as administrator.

When command prompt opens, copy and paste the following command into it, then press enter.
wusa /uninstall /KB:5025288

Let me know if it says it was successful or if there are any errors.

Hello.
It is talking, that update is not found on the computer.

PeterJ · May 31, 2023

Don't quote my message into yours. Its not needed.

FRST Registry Search

Click the Start button and choose Control Panel.
In the upper right corner ensure the View by: is set to Category.
Select the Programs group.
Click the Turn Windows features on or off link. This will bring up the Server Manager dialog.
Note: This loads your components hive which is what we want. Please keep this dialog open while you perform the remaining steps. You can minimize it if you wish but keep it open.
Download the Farbar Recovery Scan Tool and save it to your Desktop:
64-bit: Downloading Farbar Recovery Scan Tool
Note: Your antivirus program may report FRST incorrectly as an infection. If so, disable the real-time protection when downloading and running FRST.
Right-click on the file FRST64.exe and choose Run as administrator.
Copy and paste KB5025288 into the Search box and click the Search Registry button.
When the scan is complete, a message will display that 'SearchReg.txt' is saved in the same folder FRST was started from. Notepad will open this file also. Close Notepad and attach the file 'SearchReg.txt' to your next reply.
You may close any remaining open windows now.

sanglyb · Jun 1, 2023

Hi, here is requested file.

PeterJ · Jun 1, 2023

Step 1:
Warning: This script was written specifically for this user, for use on that particular machine. Do not run this script on another machine.

Download the attachment and extract it.
Open the extracted folder, double-click the file regfix.reg.
When prompted allow to change the registry settings.
Report the result.

Step 2:
Restart the machine.
Check Windows Update again but do install any updates yet.
Provide a screenshot of the available important updates first.
Attach a copy of the file C:\Windows\Logs\CBS\cbs.log to your next reply.

sanglyb · Jun 1, 2023

Thank you.
Is second step mandatory? I mean, updates on that server are controlled by SCCM, and it might be hard to change all deployments, to disallow automatic installation. For now updates are totally disabled by client settings, I'm trying to install them manually, using DISM.exe /Online /Add-Package /PackagePath:c:\Updates\04upd\Windows8.1-KB5025285-x64.cab

PeterJ · Jun 1, 2023

I'm trying to install them manually, using DISM.exe /Online /Add-Package /PackagePath:c:\Updates\04upd\Windows8.1-KB5025285-x64.cab

Are there earlier updates that fail ?

sanglyb · Jun 1, 2023

Yes, I've tried to install different updates, all of them failed with the same symptoms.

PeterJ · Jun 1, 2023

Please provide a list of the failing updates.

sanglyb · Jun 1, 2023

Actually, there are many of those. The problem is old enough. I can say that every cumulative update failed to install on that server since 2020 or 2021. Updates were disabled on that server for several months.

PeterJ · Jun 1, 2023

Okay.
Lets start with the one below. Do not install any other updates.

Install Update with DISM

Download the update MSU here: https://catalog.s.download.windowsu..._7076478c55f0da1cf0dd69d9d98151f74dc17528.msu
Copy the MSU file to a convenient location (such as C:\temp).
Click on the Start button and in the search box, type Command Prompt
When you see Command Prompt on the list, right-click on it and select Run as administrator
When command prompt opens, copy and paste the following commands into it, press enter after each

cd C:\temp
replace C:\temp with your path if different

expand windows8.1-kb4054522-x64_7076478c55f0da1cf0dd69d9d98151f74dc17528.msu -f:* C:\temp

DISM.exe /Online /Add-Package /PackagePath:C:\temp\windows8.1-kb4054522-x64.cab
You should receive the message:
The operation completed successfully.
Make sure to allow the computer to restart if prompted.
If you receive any other message:
Post a screenshot of the Commandprompt window.
Zip and attach the file C:\Windows\Logs\CBS\CBS.log

sanglyb · Jun 2, 2023

It was installed without any errors.

PeterJ · Jun 2, 2023

Install Update with DISM

Download the update MSU here: https://catalog.s.download.windowsu..._2718920716ec19174fcfa4a43ab5bbe40a27a732.msu
Copy the MSU file to a convenient location (such as C:\temp).
Click on the Start button and in the search box, type Command Prompt
When you see Command Prompt on the list, right-click on it and select Run as administrator
When command prompt opens, copy and paste the following commands into it, press enter after each

cd C:\temp
replace C:\temp with your path if different

expand windows8.1-kb4338824-x64_2718920716ec19174fcfa4a43ab5bbe40a27a732.msu -f:* C:\temp

DISM.exe /Online /Add-Package /PackagePath:C:\temp\windows8.1-kb4338824-x64.cab
You should receive the message:
The operation completed successfully.
Make sure to allow the computer to restart if prompted.
If you receive any other message:
Post a screenshot of the Commandprompt window.
Zip and attach the file C:\Windows\Logs\CBS\CBS.log

sanglyb · Jun 2, 2023

I think, I've found the earliest update, that fails - KB4284878. Tried to install it, and system rolledback after reboot. CBS logs are in the attachment.

Code:

2023-06-02 15:05:04, Info                  CSI    0000002d Begin executing advanced installer phase 34 (0x00000022) index 20 (0x0000000000000014) (sequence 55)
    Old component: [ml:308{154},l:306{153}]"Microsoft-Windows-WebServices, Culture=neutral, Version=6.3.9600.17415, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS"
    New component: [ml:308{154},l:306{153}]"Microsoft-Windows-WebServices, Culture=neutral, Version=6.3.9600.19028, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS"
    Install mode: install
    Installer ID: {1b265fd2-721c-4e59-ad55-9d102a5d1d7f}
    Installer name: [12]"SppInstaller"
2023-06-02 15:05:04, Info                  CSI    0000002e@2023/6/2:08:05:04.264 CSI Advanced installer perf trace:
CSIPERF:AIDONE;{1b265fd2-721c-4e59-ad55-9d102a5d1d7f};Microsoft-Windows-WebServices, Version = 6.3.9600.19028, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral;7982us
2023-06-02 15:05:04, Info                  CSI    0000002f End executing advanced installer (sequence 55)
    Completion status: S_OK

2023-06-02 15:05:04, Info                  CSI    00000030 Begin executing advanced installer phase 38 (0x00000026) index 21 (0x0000000000000015) (sequence 60)
    Old component: [ml:308{154},l:306{153}]"Microsoft-Windows-System-Events, Culture=neutral, Version=6.3.9600.19000, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=x86, versionScope=NonSxS"
    New component: [ml:308{154},l:306{153}]"Microsoft-Windows-System-Events, Culture=neutral, Version=6.3.9600.19035, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=x86, versionScope=NonSxS"
    Install mode: install
    Installer ID: {3bb9fd2b-351e-4b9c-b1fc-ed0758805998}
    Installer name: [6]"Events"
2023-06-02 15:05:04, Info                  CBS    Progress: UI message updated. Operation type: Update. Stage: 1 out of 1. Percent progress: 76.
2023-06-02 15:05:04, Info                  CBS    Winlogon: TiCoreOnCreateSession has been called
2023-06-02 15:05:05, Error                 CSI    00000001 (F) Logged @2023/6/2:08:05:04.358 : [ml:272{136},l:270{135}]"events installer: online=1, install=1, component=x86_Microsoft-Windows-System-Events_31bf3856ad364e35_6.3.9600.19035_neutral_release__."
[gle=0x80004005]
2023-06-02 15:05:05, Error                 CSI    00000002 (F) Logged @2023/6/2:08:05:05.155 : [ml:144{72},l:142{71}]"WmiCmiPlugin (-1): InstrumentationManifestAssert failed. HR=0x80070057."
[gle=0x80004005]
2023-06-02 15:05:05, Error                 CSI    00000003 (F) Logged @2023/6/2:08:05:05.155 : [ml:166{83},l:164{82}]"WmiCmiPlugin eventloghandler.cpp(192): ProcessEventsInstall failed. HR=0x80070057."
[gle=0x80004005]
2023-06-02 15:05:05, Error                 CSI    00000004 (F) Logged @2023/6/2:08:05:05.155 : [ml:170{85},l:168{84}]"WmiCmiPlugin eventloghandler.cpp(212): EventLogHandlerInstall failed. HR=0x80070057."
[gle=0x80004005]
2023-06-02 15:05:05, Error                 CSI    00000005@2023/6/2:08:05:05.170 (F) CMIADAPTER: Inner Error Message from AI HRESULT = E_INVALIDARG

Code:

2023-06-02 15:06:33, Info                  CSI    00000040 Begin executing advanced installer phase 40 (0x00000028) index 24 (0x0000000000000018) (sequence 65)
    Old component: [ml:336{168},l:334{167}]"Microsoft-Windows-BootEnvironment-OS-Loader, Culture=neutral, Version=6.3.9600.19000, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS"
    New component: [ml:336{168},l:334{167}]"Microsoft-Windows-BootEnvironment-OS-Loader, Culture=neutral, Version=6.3.9600.19035, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS"
    Install mode: install
    Installer ID: {084acfba-714f-4d8a-a69a-fe4e9c8ce62d}
    Installer name: [23]"CSI FveUpdate installer"
2023-06-02 15:06:33, Info                  CSI    00000008 Install called with flags 0 in phase 40 (0x00000028)

2023-06-02 15:06:33, Info                  CSI    00000009 Install called with command \u4700\u5278\u7ffa

2023-06-02 15:06:33, Info                  CSI    0000000a BitLockerUpdate: Running.

2023-06-02 15:06:33, Info                  CSI    0000000b BitLockerUpdate: Service request is for winload.exe/winresume.exe.

2023-06-02 15:06:33, Info                  CSI    0000000c BitLockerUpdate: BitLocker Drive Encryption module was not found on the system.

2023-06-02 15:06:33, Info                  CSI    0000000d BitLockerUpdate: No servicing was performed on the OS volume.

2023-06-02 15:06:33, Info                  CSI    0000000e BitLockerUpdate: Done.

2023-06-02 15:06:33, Info                  CSI    00000041@2023/6/2:08:06:33.241 CSI Advanced installer perf trace:
CSIPERF:AIDONE;{084acfba-714f-4d8a-a69a-fe4e9c8ce62d};Microsoft-Windows-BootEnvironment-OS-Loader, Version = 6.3.9600.19035, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral;238us
2023-06-02 15:06:33, Info                  CSI    00000042 End executing advanced installer (sequence 65)
    Completion status: S_OK

2023-06-02 15:06:33, Error                 CBS    Startup: Failed to process advanced operation queue, startupPhase: 0.  A rollback transaction will be created. [HRESULT = 0x800f0922 - CBS_E_INSTALLERS_FAILED]
2023-06-02 15:06:33, Info                  CBS    Setting ExecuteState key to: CbsExecuteStateInitiateRollback | CbsExecuteStateFlagAdvancedInstallersFailed
2023-06-02 15:06:33, Info                  CBS    SetProgressMessage: progressMessageStage: -1, ExecuteState: CbsExecuteStateInitiateRollback | CbsExecuteStateFlagAdvancedInstallersFailed, SubStage: 0
2023-06-02 15:06:33, Info                  CBS    Progress: UI message updated. Operation type: Update. Stage: 1 out of 1. Rollback.
2023-06-02 15:06:33, Info                  CBS    Setting original failure status: 0x800f0922, last forward execute state: CbsExecuteStateResolvePending
2023-06-02 15:06:33, Info                  CBS    Attempting to remove poqexec from SetupExecute
2023-06-02 15:06:33, Info                  CBS    Removed poqexec from SetupExecute.
2023-06-02 15:06:33, Info                  CBS    Configured poqexec to not pend to SetupExecute.

PeterJ · Jun 2, 2023

Remove Update Manually

Click on the Start button and in the search box, type Command Prompt.
When you see Command Prompt on the list, right-click on it and select Run as administrator.
When command prompt opens, copy and paste the following command into it, then press enter.
wusa /uninstall /KB:4103715
Let me know if it says it was successful or if there are any errors.

sanglyb · Jun 2, 2023

utility told that this update is required for computer and cannot be uninstalled

PeterJ · Jun 2, 2023

Step 1:
Was the installation for the update in message #14 successful ?

Step 2:
Warning: This script was written specifically for this user, for use on that particular machine. Do not run this script on another machine.

Download the Farbar Recovery Scan Tool and save it to your Desktop:
64-bit: Downloading Farbar Recovery Scan Tool
Note: Your antivirus program may report FRST incorrectly as an infection. If so, disable the real-time protection when downloading and running FRST.
Download the attachment fixlist.txt and save it to your desktop.
Right-click on FRST64.exe and select "Run as administrator".
Press the Fix button.
The tool will now process fixlist.txt.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished, a log called Fixlog.txt will appear in the same directory the tool is run from.
Attach the logfile Fixlog.txt to your next reply.

sanglyb · Jun 5, 2023

Hello.

Was the installation for the update in message #14 successful ?

No, it is also rolling back.

The fixlog file is in the attachement.

PeterJ · Jun 5, 2023

Step 1:
Warning: This script was written specifically for this user, for use on that particular machine. Do not run this script on another machine.

Download the attachment and extract it.
Open the extracted folder, double-click the file regfix.reg.
When prompted allow to change the registry settings.
Report the result.

Step 2:
Restart the machine.
Perform the instructions in message #14 again and report the result.

Windows 2012R2 updates are rolling back at 99%

Well-known member

Attachments

Moderator, Windows Update Expert, Security Analyst

Well-known member

Moderator, Windows Update Expert, Security Analyst

Well-known member

Attachments

Moderator, Windows Update Expert, Security Analyst

Attachments

Well-known member

Moderator, Windows Update Expert, Security Analyst

Well-known member

Moderator, Windows Update Expert, Security Analyst

Well-known member

Moderator, Windows Update Expert, Security Analyst

Well-known member

Moderator, Windows Update Expert, Security Analyst

Well-known member

Attachments

Moderator, Windows Update Expert, Security Analyst

Well-known member

Moderator, Windows Update Expert, Security Analyst

Attachments

Well-known member

Attachments

Moderator, Windows Update Expert, Security Analyst

Attachments