[SOLVED] Windows 2019 KB5037765 - Error 0x800f0922

R

revenant

Member
Joined
May 6, 2024
Posts
8
Attempted to install the May 2024 Cumulative Update KB5037765, but resulted in a rollback with Error 0x800f0922.
We've been having issues installing any updates past the Nov 2023 (KB5032196) cumulative update.


sfc /scannow - No Integrity Violations found.

Dism /Online /Cleanup-Image /RestoreHealth - Completed with no issue


Please find the attached ComponentsScanner.txt and CBS log files.


Much appreciated. Thank you!
 

Attachments

Last edited:
Hello all. Wanted to follow up on this one. Can anyone help? Thank you all for your time.
 
Hi and welcome to Sysnative,

Provide the profile information of this server.
  • Click the Start button and in the search box, type Command Prompt
  • When you see Command Prompt on the list, right-click on it and select Run as administrator.
    Copy and paste the following commands one at a time into the command prompt and press enter after each.
    Code: 
    reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s > "%userprofile%\desktop\ProfileList.txt"
reg query "HKEY_USERS" >> "%userprofile%\desktop\ProfileList.txt"
  • These commands will collect the System and Application logs and create ProfileList.txt on your Desktop.
  • Attach this file in your next reply.
 
Rich (BB code): 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3305319007-46350623-1003723052-1011
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\TRA-SSH

Hi,

Open an elevated command prompt and run the following command, attach the SID.txt to your next post.
Code: 
wmic useraccount get name,sid >> "%userprofile%\desktop\SID.txt"
 
Hi,

This looks good, please run the following command in an elevated prompt and attach services.txt to your next post.
Code: 
WMIC SERVICE GET caption, name, startmode, state > "%userprofile%\desktop\services.txt"
 
Is "C:\Users\TRA-SSH" used by Apache / IIS Admin? If so I would suggest to disable all the related services and then attempt to update again.
 
TRA-SSH is not actively used. IIS Admin and Apache are used, but we will disable temporarily and attempt an update. Will follow up once complete.

Thank you
 
Rich (BB code): 
2024-05-15 12:39:37, Info                  CSI    00000579 Performing HKCU for sid: S-1-5-21-3305319007-46350623-1003723052-1011
2024-05-15 12:39:37, Error                 CSI    0000057a (F) STATUS_OBJECT_NAME_NOT_FOUND #171974# from Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey(flg = (AllowAccessDenied), key = {provider=NULL, handle=0, name= ("null")}, da = (KEY_READ|KEY_WOW64_64KEY), oa = @0xee9c87b9f8->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[59]'\Registry\USER\S-1-5-21-3305319007-46350623-1003723052-1011'; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped disposition: 2626140120)[gle=0xd0000034]
2024-05-15 12:39:37, Error                 CSI    0000057b@2024/5/15:16:39:37.863 (F) onecore\base\wcp\sil\ntsystem.cpp(5348): Error STATUS_OBJECT_NAME_NOT_FOUND originated in function Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey expression: (null)
[gle=0x80004005]

Rich (BB code): 
TRA-SSH             S-1-5-21-3305319007-46350623-1003723052-1011
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3305319007-46350623-1003723052-1011

Ah, another option would be to remove this account completely as it seems to be the issue.
 
Hi Maxstar,

The attempted update rolled back with the services disabled. We will try removing the account. Will follow up after this attempt.
 
Amazing! Removal of that account allowed the update to go through successfully! Thank you, Maxstar!

It's strange how the Nov-23 update was fine but all updates after that failed due to one account.


Thank you so much for the help!

I've sent a donation to Sysnative. Keep up the great work!
 
You're welcome. Glad to hear the issue has been resolved and many thanks for your donation to Sysnative.. (y)
 
You must log in or register to reply here.
Back
Top