Windows Serve 2016 Cumulative Update "we couldn't complete the update undoing changes"

fduffy · Apr 24, 2020

Hi, I have a Windows 2016 standard server I am unable to install updates on. After rebooting get message "we couldn't complete the update undoing changes"
To try and correct the issue I have done the following
- SFC / scannow
- SFCFix
- Rename "SoftwareDistribution" and "System32\catroot2"
- Clean Boot (Only Microsoft services enabled)

But I am still having the issue. Was hapening on March cumulative update so waitied and tried April cumulative update same issue.

I have attached the windows update log and the SFcFix output

Any advice would be much appreciated.

Thanks

Sysnative Windows Update · Apr 24, 2020

Hi!

Please boot to Clean Boot mode and update from there:

https://support.microsoft.com/en-us/help/929135/how-to-perform-a-clean-boot-in-windows

If that does not work, please provide FRST logs.

Step#1 - FRST Scan

1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Right-click FRST64.exe and click Run as Administrator to run it as administrator. When the tool opens, click Yes to disclaimer.
3. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running (if not already checked).
4. Press Scan button.
5. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
6. Please attach the log back here.
7. Another log (Addition.txt - also located in the same directory as FRST64.exe) will be generated Please also attach that along with the FRST.txt in your reply.

fduffy · Apr 25, 2020

Morning, Tried the below.

- Clean Boot (Only Microsoft services enabled)
- Download the update from Windows Catalog and run
- Having the same issue.
- Run FRST Scan

Logs attached.

Sysnative Windows Update · Apr 25, 2020

Hi!

Okay, I see two potential issues for now.

Trend Micro and IIS.

Please try fully removing (not disabling) Trend Micro. If that does not work, disable the IIS role (with TM still uninstalled) and retry updates. If it still fails, attach CBS.log as well.

fduffy · Apr 26, 2020

Hi,

- Uninstalled Trend Micro restarted server
- Installed update same issue
- Disabled IIS with Trend Micro still uninstalled
- Installed update same issue

Pls find attached windows update log + link for CBS logs

https://wetransfer.com/downloads/c7f8ff4e58a7856eb13f39c1c159a4b020200426104432/a1ee7f53755c503df051ffae4474dc6320200426104432/dfb3dc

Sysnative Windows Update · Apr 26, 2020

Hi!

Thank you. I see the issue.

Code:

2020-04-25 19:27:38, Info                  CBS    Attempting to remove poqexec from SetupExecute
2020-04-25 19:27:38, Info                  CBS    Removed poqexec from SetupExecute.
2020-04-25 19:27:38, Info                  CBS    Doqe: Enabling Device installs
2020-04-25 19:27:38, Info                  CBS    Clearing HangDetect value
2020-04-25 19:27:38, Info                  CBS    Saved last global progress. Current: 1, Limit: 1, ExecuteState: CbsExecuteStateFailed
2020-04-25 19:27:38, Info                  CBS    Doqe: Unlocking driver updates, Count 224
2020-04-25 19:27:38, Info                  CBS    WER: Generating failure report for package: Package_for_RollupFix~31bf3856ad364e35~amd64~~14393.3659.1.8, status: 0x800106d9, failure source: AI, start state: Staged, target state: Installed, client id: WindowsUpdateAgent
2020-04-25 19:27:38, Info                  CBS    Not able to query DisableWerReporting flag.  Assuming not set... [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2020-04-25 19:27:38, Info                  CBS    Added C:\Windows\Logs\CBS\CBS.log to WER report.
2020-04-25 19:27:38, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20200425165336.log to WER report.
2020-04-25 19:27:38, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20200425055754.log to WER report.
2020-04-25 19:27:38, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20200425040451.log to WER report.
2020-04-25 19:27:38, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20200425025553.log to WER report.
2020-04-25 19:27:38, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20200425004457.log to WER report.
2020-04-25 19:27:38, Info                  CBS    Not able to add %windir%\winsxs\pending.xml to WER report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2020-04-25 19:27:38, Info                  CBS    Not able to add %windir%\winsxs\pending.xml.bad to WER report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2020-04-25 19:27:38, Info                  CBS    Reporting package change completion for package: Package_for_RollupFix~31bf3856ad364e35~amd64~~14393.3659.1.8, current: Staged, original: Staged, target: Installed, status: 0x800106d9, failure source: AI, failure details: "Network Drivers    800106d9    31    Delta     NONE    ", client id: WindowsUpdateAgent, initiated offline: False, execution sequence: 347, first merged sequence: 347, pending decision: Unknown, primitive execution context: Shutdown Flight: False
2020-04-25 19:27:38, Info                  CBS    The store corruption status report is incomplete. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2020-04-25 19:27:38, Info                  CBS    Unable to gather perf datapoints because there are no active sessions.

It's the network drivers, which points in the direction of Hyper-V or the actual network adapter, but I'd start by exploring the network adapters and checking them for issues. Disable Hyper-V temporarily if enabled and attach C:\Windows\Inf\setupapi.dev.log to gather more info on the issue.

fduffy · Apr 26, 2020

Hi, This is a virtual machine running on ESX. Hyper-V is not enabled on the box. I have attached the C:\Windows\Inf\setupapi.dev.log.

Thanks.

Sysnative Windows Update · Apr 26, 2020

Thank you.

I see NpCap

Code:

Network Binding:
=============
Ethernet0: Npcap Packet Driver (NPCAP) -> INSECURE_NPCAP (enabled)
Ethernet0: Npcap Packet Driver (NPF) -> INSECURE_NPF (enabled)

Code:

Npcap 0.9983 (HKLM-x32\...\NpcapInst) (Version: 0.9983 - Nmap Project)

Is it possible to remove it temporarily?

fduffy · Apr 26, 2020

Hi, I have removed Npcap both NPF & NPCAP

Do you want me to restart the server and try instaling update. Or do I need to resatrt?

Thanks.

Sysnative Windows Update · Apr 26, 2020

Yes, a reboot would be good prior to the install.

fduffy · Apr 26, 2020

Hi, After removing Npcap both NPF & NPCAP. Then restarting server. Having same issue.

Pls find attached windows update log, setupapi.dev.log & link for CBS logs

CBS.7z

Sysnative Windows Update · Aug 25, 2020

Hi, this seems to have fallen through the cracks. My apologies. Are you still in need of assistance?

Search

Search

Windows Serve 2016 Cumulative Update "we couldn't complete the update undoing changes"

fduffy

Member

Attachments

Sysnative Windows Update

Inactive

fduffy

Member

Attachments

Sysnative Windows Update

Inactive

fduffy

Member

Attachments

Sysnative Windows Update

Inactive

fduffy

Member

Attachments

Sysnative Windows Update

Inactive

fduffy

Member

Sysnative Windows Update

Inactive

fduffy

Member

Attachments

Sysnative Windows Update

Inactive