[SOLVED] Windows Server 2008 (not R2) 32 bit Windows update issues

A

aspick

Member
Joined
Jun 4, 2019
Posts
15
We have a server running Windows 2008 32 bit that we are struggling to run any of the latest Windows updates (for the past few months) including an important patch we need to apply (for the RDP Bluekeep vulnerability)

We've tried doing Windows updates, using our in house patching tool (Ivanti) and downloading the patches manually via the Windows Update Catalog links but every patch fails seemingly with the same error.

We've tried running checks in safe mode (cannot apply patches in this mode) and also clean boots but nothing seems to work. Ran sfc /scannow many times and also tried the SURT tool/patch.

We've cleared out c:\windows\logs\cbs and run sfc /scannow followed by sfcfix and I have attached the latest sfcfix log output here - any help to move us forward would be gratefully received :
------------------------------------------

SFCFix version 42.32768.0.0 by niemiro.
Start time: 2019-06-04 14:28:21.338
Microsoft Windows Server 2008 Service Pack 2 - x86
Not using a script file.


AutoAnalysis::
SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
CBS & SFC total detected corruption count: 52
CBS & SFC total unimportant corruption count: 0
CBS & SFC total fixed corruption count: 0
SURT total detected corruption count: 0
SURT total unimportant corruption count: 0
SURT total fixed corruption count: 0
AutoAnalysis:: directive completed successfully.


Successfully processed all directives.
SFCFix version 42.32768.0.0 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2019-06-04 14:29:30.350
----------------------EOF-----------------------
 
have run sfcfix again after now running SURT (KB947821 on this server OS)
=========================================
SFCFix version 42.32768.0.0 by niemiro.
Start time: 2019-06-04 15:59:46.500
Microsoft Windows Server 2008 Service Pack 2 - x86
Not using a script file.




AutoAnalysis::
SUMMARY: Some corruptions could not be fixed automatically. Seek advice from helper or sysnative.com.
CBS & SFC total detected corruption count: 52
CBS & SFC total unimportant corruption count: 0
CBS & SFC total fixed corruption count: 0
SURT total detected corruption count: 27
SURT total unimportant corruption count: 0
SURT total fixed corruption count: 0
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.
SFCFix version 42.32768.0.0 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2019-06-04 16:00:24.051
----------------------EOF-----------------------
 

Attachments

I believe I now have a better understanding of what is wrong with this server. The checksur.log highlights files (manifest xml files) that are corrupt. I can see if we try and view some of the corrupt files vs good ones in the c:\windows\winsxs\manifests directory.
One solution to this is to try and find good copies of these manifest files. Of course I needed to find other servers with the same architecture and version (Windows Server 2008 32 bit). We only had 3 others to choose from. I was able to find "3" good copies of the manifest files but there are still 23 corrupted files remaining.

So we've run the SURT tool again and produced a new CHECKSUR.LOG attached. We're getting there but slowly and until we can sort the remaining 23 corrupted files we will not be able to sort the problems overall.
 

Attachments

Can anyone help please?

Is there a way of getting hold of these specific XML files that are missing (and causing the patches to fail) ?
 
Please do the following:

Retrieve Components Hive
1. Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
2. Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
3. Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
4. The file will likely be too large to upload here so please upload to a file sharing service. Examples of services to upload to are Dropbox or OneDrive or SendSpace and then just provide the link in your reply.
 
Ok, sorry about delayed reply. It was a bit more difficult than we thought to get a copy of the file.

Am going to try and attach it here first...
 
It appears that the update containing the files has been pulled, as such, I would like to remove it from your system and go from there:

FRST Registry Search
1. Click your Start button and type in cmd. Press Enter.
2. Copy paste the following into the Command Prompt:

reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS

3. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 32-bit Version so please ensure you download that one.
4. Run FRST by Right-Clicking on the file and choosing Run as administrator.
5. Copy and paste KB4074736 into the Search box and click the Search Registry button.
6. When the scan is complete a notepad window will open with the results. Please attach this to your next reply. It is saved on your desktop named SearchReg.txt.
 
Thank you. I was correct. That update was improperly installed:

Step#1 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 32-bit Version so please ensure you download that one.
2. Download the attached fixlist.txt and save it to the Desktop.
Note. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
3. Run FRST by Right-Clicking on the file and choosing Run as administrator.
4. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
5. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.
 

Attachments

Ok, tried 1 update and that failed. Ran a Windows update and selected all (9) updates and they all failed.

CBS.ZIP with CBS.LOG attached.
 
SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.


  1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
  2. Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
  3. Save any open documents and close all open windows.
  4. On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
  5. Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
  6. SFCFix will now process the script.
  7. Upon completion, a file should be created on your Desktop: SFCFix.txt.
  8. Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.
 

Attachments

Ok, log file below:

Code: 
SFCFix version 3.0.1.0 by niemiro.
Start time: 2019-07-02 15:06:44.734
Microsoft Windows Server 2008 Service Pack 2 - x86
Using .zip script file at C:\Users\arcserve\Desktop\SFCFix.zip [0]




PowerCopy::
Successfully took permissions for file or folder C:\Windows\Temp\CheckSur\Winsxs\Manifests

Failed to find any content under directory "C:\Users\arcserve\AppData\Local\niemiro\Archive\winsxs" in line ""C:\Users\arcserve\AppData\Local\niemiro\Archive\winsxs" C:\Windows\winsxs [DIR]".
Failed to find any content under directory "C:\Users\arcserve\AppData\Local\niemiro\Archive\Packages" in line ""C:\Users\arcserve\AppData\Local\niemiro\Archive\Packages" C:\Windows\Temp\CheckSur\Servicing\Packages [DIR]".
Successfully copied file C:\Users\arcserve\AppData\Local\niemiro\Archive\Manifests\x86_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.0.6002.24282_none_8619638244eb4c04.manifest to C:\Windows\Temp\CheckSur\Winsxs\Manifests\x86_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.0.6002.24282_none_8619638244eb4c04.manifest.

Successfully restored ownership for C:\Windows\Temp\CheckSur\Winsxs\Manifests
Successfully restored permissions on C:\Windows\Temp\CheckSur\Winsxs\Manifests
PowerCopy:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.1.0 by niemiro has completed.
Currently storing 2 datablocks.
Finish time: 2019-07-02 15:06:45.986
Script hash: oksEBIcS5+5/ie2GfxZgCkod26TtcO15/YlGcqbaD5w=
----------------------EOF-----------------------
 
Ok, looks like your sfcfix may have sorted 1 of the 23 missing manifest files but updates are still failing. I have attached checksur.log after running the kb947821 fix.

also attach cbs.zip here (I tried to do a Windows update and picked 3 of the 8 updates that were still outstanding on this machine)
 

Attachments

You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top