Windows Serve 2016 Cumulative Update "we couldn't complete the update undoing changes"

fduffy

Member
Apr 24, 2020
6
Hi, I have a Windows 2016 standard server I am unable to install updates on. After rebooting get message "we couldn't complete the update undoing changes"
To try and correct the issue I have done the following
- SFC / scannow
- SFCFix
- Rename "SoftwareDistribution" and "System32\catroot2"
- Clean Boot (Only Microsoft services enabled)

But I am still having the issue. Was hapening on March cumulative update so waitied and tried April cumulative update same issue.

I have attached the windows update log and the SFcFix output

Any advice would be much appreciated.

Thanks
 

Attachments

Hi!

Please boot to Clean Boot mode and update from there:

https://support.microsoft.com/en-us/help/929135/how-to-perform-a-clean-boot-in-windows

If that does not work, please provide FRST logs.

Step#1 - FRST Scan

1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Right-click FRST64.exe and click Run as Administrator to run it as administrator. When the tool opens, click Yes to disclaimer.
3. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running (if not already checked).
4. Press Scan button.
5. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
6. Please attach the log back here.
7. Another log (Addition.txt - also located in the same directory as FRST64.exe) will be generated Please also attach that along with the FRST.txt in your reply.
 
Last edited:
Morning, Tried the below.

- Clean Boot (Only Microsoft services enabled)
- Download the update from Windows Catalog and run
- Having the same issue.
- Run FRST Scan

Logs attached.
 

Attachments

Hi!

Okay, I see two potential issues for now.

Trend Micro and IIS.

Please try fully removing (not disabling) Trend Micro. If that does not work, disable the IIS role (with TM still uninstalled) and retry updates. If it still fails, attach CBS.log as well.
 
Hi!

Thank you. I see the issue.

Code:
2020-04-25 19:27:38, Info                  CBS    Attempting to remove poqexec from SetupExecute
2020-04-25 19:27:38, Info                  CBS    Removed poqexec from SetupExecute.
2020-04-25 19:27:38, Info                  CBS    Doqe: Enabling Device installs
2020-04-25 19:27:38, Info                  CBS    Clearing HangDetect value
2020-04-25 19:27:38, Info                  CBS    Saved last global progress. Current: 1, Limit: 1, ExecuteState: CbsExecuteStateFailed
2020-04-25 19:27:38, Info                  CBS    Doqe: Unlocking driver updates, Count 224
2020-04-25 19:27:38, Info                  CBS    WER: Generating failure report for package: Package_for_RollupFix~31bf3856ad364e35~amd64~~14393.3659.1.8, status: 0x800106d9, failure source: AI, start state: Staged, target state: Installed, client id: WindowsUpdateAgent
2020-04-25 19:27:38, Info                  CBS    Not able to query DisableWerReporting flag.  Assuming not set... [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2020-04-25 19:27:38, Info                  CBS    Added C:\Windows\Logs\CBS\CBS.log to WER report.
2020-04-25 19:27:38, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20200425165336.log to WER report.
2020-04-25 19:27:38, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20200425055754.log to WER report.
2020-04-25 19:27:38, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20200425040451.log to WER report.
2020-04-25 19:27:38, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20200425025553.log to WER report.
2020-04-25 19:27:38, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20200425004457.log to WER report.
2020-04-25 19:27:38, Info                  CBS    Not able to add %windir%\winsxs\pending.xml to WER report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2020-04-25 19:27:38, Info                  CBS    Not able to add %windir%\winsxs\pending.xml.bad to WER report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2020-04-25 19:27:38, Info                  CBS    Reporting package change completion for package: Package_for_RollupFix~31bf3856ad364e35~amd64~~14393.3659.1.8, current: Staged, original: Staged, target: Installed, status: 0x800106d9, failure source: AI, failure details: "Network Drivers    800106d9    31    Delta     NONE    ", client id: WindowsUpdateAgent, initiated offline: False, execution sequence: 347, first merged sequence: 347, pending decision: Unknown, primitive execution context: Shutdown Flight: False
2020-04-25 19:27:38, Info                  CBS    The store corruption status report is incomplete. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2020-04-25 19:27:38, Info                  CBS    Unable to gather perf datapoints because there are no active sessions.

It's the network drivers, which points in the direction of Hyper-V or the actual network adapter, but I'd start by exploring the network adapters and checking them for issues. Disable Hyper-V temporarily if enabled and attach C:\Windows\Inf\setupapi.dev.log to gather more info on the issue.
 
Hi, This is a virtual machine running on ESX. Hyper-V is not enabled on the box. I have attached the C:\Windows\Inf\setupapi.dev.log.

Thanks.
 

Attachments

Thank you.

I see NpCap

Code:
Network Binding:
=============
Ethernet0: Npcap Packet Driver (NPCAP) -> INSECURE_NPCAP (enabled)
Ethernet0: Npcap Packet Driver (NPF) -> INSECURE_NPF (enabled)

Code:
Npcap 0.9983 (HKLM-x32\...\NpcapInst) (Version: 0.9983 - Nmap Project)

Is it possible to remove it temporarily?
 
Hi, I have removed Npcap both NPF & NPCAP

Do you want me to restart the server and try instaling update. Or do I need to resatrt?

Thanks.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top