[SOLVED] Windows 2016 Server will not install major cumulative upgrades, last try was KB5019964

Bitstacker · Apr 6, 2023

Hello all,

I am a bit clueless now how to proceed. I found that our Server 2016 which runs Exchange 2016 as well did not install the last major cumulative updates since November.
It started with not installing KB5019964. All cumulative updates did not install afterwards.

The tools to remove malicious software do install and since it is a virtualized machine also some drivers for vmware installed recently.
Also the latest Cumulative Exchange update 22 (KB5019758) installed without a problem.

So the following updates recently did not install:

2023-03 Cumulative Update for Windows Server 2016 for x64-based Systems (KB5023697)
2023-02 Kumulatives Update für .NET Framework 4.8 für Windows Server 2016 für x64 (KB5022503)
2023-02 Cumulative Update for Windows Server 2016 for x64-based Systems (KB5022838)
2023-01 Cumulative Update for Windows Server 2016 for x64-based Systems (KB5022289)
2022-12 Kumulatives Update für .NET Framework 4.8 für Windows Server 2016 für x64 (KB5020873)
2022-12 Cumulative Update for Windows Server 2016 for x64-based Systems (KB5021235)

So what did I try then:

I've downloaded and tried to install KB5019964 as standalone package but that did not work.

Then I tried the following:

Code:

dism /online /cleanup-image /restorehealth

and afterwards

Code:

sfc /scannow

Having finished that I used Windows Update to install pending updates again but it did not succeed.

As posted in this thread asked by user @LiquidTension for another case

Code:

dism /online /cleanup-image /restorehealth
copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\CBS.txt"
del %0

I have created a CBS.txt

Maybe someone has an idea where to look to get it working again.

My use and some knowledge of Windows goes back to the times of Windows 3.1, Windows NT and MSC Compiler version 5.0, but I am not a professional software developer or administrator.

Kind regards,
Bernd

PS: Once the server booted and system time was faulty. With Windows Updates History Viewer from Nirsoft I got the following lines:

Code:

Title    Description    KB Number    Install Date    Update Operation    Operation Result    Information URL    Support URL    Uninstall Notes    Category    Client Application ID    Service ID    Update ID    Revision Number    Unmapped Result Code    Server Selection    hResult   
Sicherheitsupdate für Windows (KB5019964)    Title    Description    KB Number    Install Date    Update Operation    Operation Result    Information URL    Support URL    Uninstall Notes    Category    Client Application ID    Service ID    Update ID    Revision Number    Unmapped Result Code    Server Selection    hResult   
Sicherheitsupdate für Windows (KB5019964)    Fix for KB5019964    KB5019964    30.12.1899 01:00:00    Install    Not Started    https://support.microsoft.com/help/5019964    http://support.microsoft.com    This software update can be removed by selecting View installed updates in the Programs and Features Control Panel.    Windows    wusa    00000000-0000-0000-0000-000000000000    00000000-0000-0000-0000-000000000000    0    0    Default    0x00000000   
... thousands of equal lines deleted


Sicherheitsupdate für Windows (KB5019964)    Fix for KB5019964    KB5019964    26.11.2022 19:18:33    Install    Failed    https://support.microsoft.com/help/5019964    http://support.microsoft.com    This software update can be removed by selecting View installed updates in the Programs and Features Control Panel.    Windows    wusa    1f263141-b7b2-4b3e-9e10-60b317d732dd    9077aefb-5cee-4531-a78d-f7032acd1269    501    0    Others    0x800f0922

Bitstacker · Apr 6, 2023

Additionally I've run the Components Scanner with the attached results.

Bitstacker · Apr 6, 2023

And furthermore I've created a ZIP file from the c:\windows\logs directory.

Maxstar · Apr 10, 2023

Hi and welcome to Sysnative,

Open an elevated command prompt, run the following command and attach ProfileList.txt to your next post.

Code:

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s > "%userprofile%\desktop\ProfileList.txt"

Open Windows Explorer and browse to the C:\Windows\INF folder.
Right-click on the file setupapi.dev.log and choose Send to > Compressed (zipped) folder.
Now the message will appear, "Windows cannot create the Compressed (zipped) Folder here. Do you want it to be placed on the desktop instead?"
Click on the Yes button here.

Attach the file setupapi.dev.zip in your next reply.

Bitstacker · Apr 11, 2023

Dear Maxstar,

thank you for your help. I've created a ProfileList.txt and attached it here as well as the zipped setupapi.dev.log.

Maxstar · Apr 11, 2023

Hi,

Click the Start button and in the search box, type Command Prompt
When you see Command Prompt on the list, right-click on it and select Run as administrator.
Copy and paste the following command line and press Enter.

Code:

reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" "%userprofile%\desktop\RegExp.txt"

When finished, a logfile called RegExp.txt is saved on your desktop.
Post the logfile as attachment in your next reply.

Bitstacker · Apr 11, 2023

Here you are ...

Maxstar · Apr 11, 2023

Please perform the following steps to re-register this server in WSUS.

Download the

Farbar Recovery Scan Tool and save it to your Desktop:

Download the 64 bit version: - Farbar Recovery Scan Tool Link

Warning: This script was written specifically for this system. Do not run this script on another system.

Download the attachment fixlist.txt and save it to your desktop.
Right-click on FRST.exe and select "Run as administrator".
Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally.
When finished, a log called Fixlog.txt will appear in the same directory the tool is run from.
Post the logfile Fixlog.txt as attachment in your next reply.

Bitstacker · Apr 11, 2023

Here ist the Fixlog.txt

Maxstar · Apr 11, 2023

Please open an elevated command prompt, run the following command and copy and paste the result.

Code:

reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f

Bitstacker · Apr 11, 2023

Code:

C:\Windows\system32>reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f
Der Vorgang wurde erfolgreich beendet.


C:\Windows\system32>

meaning "Successfully completed"

Maxstar · Apr 11, 2023

Please reboot the server and attempt to update. If it fails attach a new copy of the CBS log(s).

Bitstacker · Apr 12, 2023

Ok, I've rebooted the server and startet Settings and windows Update again. The first try was unsuccessful but it looked as if the server searched for something not being present. So I asked it to search for updates again:

Code:

2023-03 Cumulative Update for Windows Server 2016 for x64-based Systems (KB5023697)

is now being downloaded, it is then installed, the computer reboots, it takes some significant amount of time then it failed again:

Ok, as above I've created a new cbs.log with

Code:

dism /online /cleanup-image /restorehealth
copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\CBS.txt"
del %0

Shall I also run again sfc /scannow?

Maxstar · Apr 12, 2023

Hi,

Please attach a copy of the CBS folder with all the previous CBS logs.

Upload a copy of the CBS folder

Open Windows Explorer and browse to the C:\Windows\Logs folder.
Right-click on the CBS folder and choose Send to > Compressed (zipped) folder.
Now the message will appear, "Windows cannot create the Compressed (zipped) Folder here. Do you want it to be placed on the desktop instead?"
Click on the Yes button here.

Attach the file CBS.zip to your next reply.

Open an elevated command prompt, run the following command and attach Services.txt to your next post.

Code:

WMIC SERVICE GET caption, name, startmode, state > "%userprofile%\desktop\services.txt"

Bitstacker · Apr 12, 2023

Sorry for the delay, I was out for delivery ...

Bitstacker · Apr 12, 2023

Let me know if you need more information or if anything is missing

Maxstar · Apr 12, 2023

It seems this problem depends on user profiles and/or on network services which do not get "shutdown" before the update process could complete

Could you let me know where the following users are in use for, especially the second (service) account?

Code:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-161320918-29243318-3193960280-1111
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\sa

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-161320918-29243318-3193960280-17115
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\ESTServiceUser

Code:

2023-04-11 16:51:04, Info                  CSI    000002d8 Performing 1 operations as follows:
  (0)  LockComponentPath: flags: 0 comp: {l:16 b:4aa92a0a856cd901220300007c05ac05} pathid: {l:16 b:e6cf2a0a856cd901230300007c05ac05} path: [l:115]'\SystemRoot\WinSxS\x86_microsoft.windows.s..ation.badcomponents_31bf3856ad364e35_10.0.14393.0_none_09e78f632173f4c5' pid: 57c starttime: 133256977107541291
2023-04-11 16:51:04, Error      [0x01805b] CSI    000002d9 (F) Failed execution of queue item Installer: Network Drivers ({a111f280-5923-47c0-9a68-d0bafb577901}) with HRESULT 800106d9 [Error,Facility=(0001),Code=1753 (0x06d9)].  Failure will be ignored: The failure was encountered during rollback; installer is reliable[gle=0x80004005]

I would suggest to look at all the Exchange services first, and this "ESTServiceUser" (Exchange Server Toolbox).

1. Disable all the Exchange services temporarily and try to update again.
2. Or set all the related network services of Exchange to Automatic (Delayed Start).
3. Also take a look at the following IIS service and the startup type Auto or Auto (Delayed).

Code:

IIS-Verwaltungsdienst                                             IISADMIN                                  Auto       Running

Bitstacker · Apr 12, 2023

Thank you for your ideas what to do next. I appreciate your help very much. It might be a good idea to talk to JAM Software the originator of this Exchange Server Toolbox if they encountered any problems with updating. Then I will try to disable the mentioned services and see if after e fresh reboot the updates will be successful.

Maxstar · Apr 12, 2023

You're welcome. Let me know the result when you have contacted JAM Software.

Bitstacker · Apr 13, 2023

I've called JAM. They do not know about any related problems. They will send me an email explaining which services need to be disabled. I will then get a quiet minute to perform the outlined steps from above. I will let you know about the forthcomings.

[SOLVED] Windows 2016 Server will not install major cumulative upgrades, last try was KB5019964

Member

Attachments

Member

Attachments

Member

Attachments

Moderator, Windows Update Expert, Security Analyst

Member

Attachments

Moderator, Windows Update Expert, Security Analyst

Member

Attachments

Moderator, Windows Update Expert, Security Analyst

Attachments

Member

Attachments

Moderator, Windows Update Expert, Security Analyst

Member

Moderator, Windows Update Expert, Security Analyst

Member

Attachments

Moderator, Windows Update Expert, Security Analyst

Member

Attachments

Member

Moderator, Windows Update Expert, Security Analyst

Member

Moderator, Windows Update Expert, Security Analyst

Member