Windows Server 2012 R2 DISM reports repaired corruption

[jat247]

Hi all,

I'm new here, and had initially started out with Windows Update not working at all with the error code 0x8024402F beginning this month for Microsoft's patch Tuesday. We believed this error to be due to a Network Device Firewall issue that started blocking Windows Update after I got advice from Bleeping Computer here: Bleeping Computer: Windows Server 2012 R2 - Windows Update Fails 8024402F (not WSUS)

After completing all the steps below (1 through 15) Windows Update *appears* to be working (it no longer shows an error upon checking for updates). However, whenever I run the "Dism /Online /Cleanup-Image /RestoreHealth" command it repeatedly reports "The restore operation completed successfully. The component store corruption was repaired. The operation completed successfully." (screenshot attached). Additionally if the "WindowsUpdateDiagnostic.diagcab is run, it also returns errors/issues it 'fixed' (screenshots attached). This still leaves me concerned about the actual underlying integrity/health of our System, despite what Windows Update looks like (right now at least). I'm hoping you all will be able to help me see what I might be missing. Bleeping Computer suggested the COMPONENTS hive might be corrupt and need repaired (and referred me here as they recognized your forum as a group of experts especially in this area/realm of expertise).

TLDR;

These are the steps I tried before seeking forum help at Bleeping Computer, as well as what I've done up until now:

    1.  Disabled ESET File Server Antivirus thinking it may have had an update that was conflicting with Windows Update
    2.  Completely uninstalled ESET File Server Antivirus Endpoint Protection thinking disabling it was not sufficient, and something might still be running and conflicting with Windows Update
    3.  Disabled the Windows Firewall with no luck at getting rid of the error, and as disabling Windows Firewall usually isn't recommended I re-enabled it again


    4.  Checked the Meraki MX64 Firewall for any changed settings (which I manage, so no settings were changed except the Static information for the new ISP, but checked just in case a security rule had been updated by Meraki's backend and was blocking access) - I did not find any issues, and for good measure whitelisted all the entries Microsoft listed for update servers in the Firewall even though it has never been an issue in the past. *UPDATE* I only whitelisted under Content Filtering initially, now they are whitelisted on Layer 3 of the Firewall! - the 8024402f error in Windows Update ceased after this step was revisited.
   
   
    5.  I also whitelisted all the Microsoft listed update servers (Trusted Zone) in Internet Explorer for good measure, even though this has not been an issue in the past.   
    6.  Changing windows update settings to manual instead of automatic since someone suggested this toggle sometimes helps.
    7.  I ran CMD as Administrator: SFC /SCANNOW and it initially said it found corruption and repaired it. Upon a re-run no integrity violations were found.
    8.  I ran CMD as Administrator: dism /online /cleanup-image /restorehealth and it said it had found and repaired issues (every time I run it, it says this but the same windows update error remains).
    9.  Using our Microsoft Installation CD for Windows Server 2012 R2 I ran CMD as Administrator: Dism /Online /Cleanup-Image /RestoreHealth /Source:wim:F:\sources\install.wim:2 /limitaccess (I used the index 2 by using "dism /get-wiminfo /wimfile:F:\sources\install.wim" command which stood for "Windows Server 2012 R2 ServerStandard" which is the version we use since we don't use standard core/data center core/data center)
    10.  I tried running a powershell script (as Administrator) as advised by Microsoft documentation for resetting Windows Update as an aggressive sort of last resort: https://gallery.technet.microsoft.com/scriptcenter/Reset-WindowsUpdateps1-e0c5eb78 (the script only threw 3 errors for the registry keys to delete in Step 7 of the script because they apparently didn't exist?) - Reference: https://docs.microsoft.com/en-us/windows/deployment/update/windows-update-resources
    11. I also manually found the latest KB updates for the server and manually downloaded and installed them with no issue (see attached image for a brief list of the KBs)
    12. I also ran CMD as Administrator with the following combination of commands which all completed and claimed to repair corruption except SFC: Dism.exe /online /Cleanup-Image /StartComponentCleanup&sfc/scannow&Dism /Online /Cleanup-Image /RestoreHealth&sfc/scannow&pause
    13. I also attempted using WindowsUpdateDiagnostic.diagcab which was also recommended. It finds different issues each time I run it (two sets, that alternate) and claims to repair them all but the error for windows updates still persists. See attached screenshots for the troubleshooter results.
    14. Checked SMART status of disks - all reported good (both fairly new replaced drives, less than 6 months old). Also ran chkdsk for good measure, found a few repairs to be made, but unsure that they were important/made any noticeable difference.
    15. System Date/Time is correct.

I've freshly run "SFC /Scannow", as well as "Dism /Online /Cleanup-Image /RestoreHealth", and the "SFCFix" tool by niemiro as requested.

Attached is a screenshot of the SFC and DISM commands results. Also my CBS log folder (and for good measure, my DISM log folder, because this is where I see Warnings) is here (Google Drive, the logs are large): CBS & DISM Logs



Below are the requested SFCFix results:

SFCFix version 3.0.2.1 by niemiro.
Start time: 2020-06-20 14:56:30.081
Microsoft Windows Server 2012 R2 Update 3 - amd64
Not using a script file.




AutoAnalysis::
SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2020-06-20 14:57:23.819
----------------------EOF-----------------------

Any help with verifying the integrity/health of our system would be greatly appreciated. If there's anything else you need please don't hesitate to ask. Thank you so much!

 

[Sysnative Windows Update]

Hi!

I can confirm that the messages mean that your system is working as expected. No corrupt files. This is a message that DISM shows when everything is okay.

As for the Windows Update error, we can troubleshoot this if you wish.

 

[jat247]

Hi softwaremaniac, thanks for your response! So I have a few questions just to confirm:

1.  Just to confirm, are you saying it is normal for Windows DISM to continually report within CMD that "component store corruption was repaired"?
    Usually I only get a repair message if something on the system needed a repair, otherwise I simply get the following report:
    "The restore operation completed successfully. The operation completed successfully."

2.  Is it also typical for the Windows troubleshooting diagnostic tool to report repairs were necessary and performed for Windows Update? Specifically the following 3 repairs with 1 specific error code being listed:

       a.  "Windows Update Error 0x80070005 - Resetting Windows Update data store"

       b.  "Repair Windows Update services and dependencies"

       c.  "Service registration is missing or corrupt - Reset service registration"

3.  Are the following info/warnings within the DISM.log file indicative of any real issue to be concerned about?

       a.  Info   DISM   DISM Provider Store: PID=944 TID=7160 Loading Provider from location

                C:\Users\ADMINI~1\AppData\Local\Temp\9ED54077-3E77-481D-B7A1-FC8D6C5D3C42\PEProvider.dll - CDISMProviderStore::Internal_GetProvider

           Warning   DISM   DISM Provider Store: PID=944 TID=7160 Failed to Load the provider:

                C:\Users\ADMINI~1\AppData\Local\Temp\9ED54077-3E77-481D-B7A1-FC8D6C5D3C42\PEProvider.dll. - CDISMProviderStore::Internal_GetProvider(hr:0x8007007e)

       b.  Info   DISM   DISM Provider Store: PID=944 TID=7160 Loading Provider from location

                C:\Users\ADMINI~1\AppData\Local\Temp\9ED54077-3E77-481D-B7A1-FC8D6C5D3C42\IBSProvider.dll - CDISMProviderStore::Internal_GetProvider

           Warning   DISM   DISM Provider Store: PID=944 TID=7160 Failed to Load the provider:

                C:\Users\ADMINI~1\AppData\Local\Temp\9ED54077-3E77-481D-B7A1-FC8D6C5D3C42\IBSProvider.dll. - CDISMProviderStore::Internal_GetProvider(hr:0x8007007e)

       c.  Info   DISM   DISM Provider Store: PID=944 TID=7160 Loading Provider from location

                C:\Users\ADMINI~1\AppData\Local\Temp\9ED54077-3E77-481D-B7A1-FC8D6C5D3C42\Wow64provider.dll - CDISMProviderStore::Internal_GetProvider

           Warning   DISM   DISM Provider Store: PID=944 TID=7160 Failed to get the IDismObject Interface - CDISMProviderStore::Internal_LoadProvider(hr:0x80004002)

           Warning   DISM   DISM Provider Store: PID=944 TID=7160 Failed to Load the provider:

                C:\Users\ADMINI~1\AppData\Local\Temp\9ED54077-3E77-481D-B7A1-FC8D6C5D3C42\Wow64provider.dll. - CDISMProviderStore::Internal_GetProvider(hr:0x80004002)

       d.  Info   DISM   DISM Provider Store: PID=944 TID=7160 Loading Provider from location

                C:\Users\ADMINI~1\AppData\Local\Temp\9ED54077-3E77-481D-B7A1-FC8D6C5D3C42\EmbeddedProvider.dll - CDISMProviderStore::Internal_GetProvider

           Warning   DISM   DISM Provider Store: PID=944 TID=7160 Failed to Load the provider:

                C:\Users\ADMINI~1\AppData\Local\Temp\9ED54077-3E77-481D-B7A1-FC8D6C5D3C42\EmbeddedProvider.dll. - CDISMProviderStore::Internal_GetProvider(hr:0x8007007e)

Thanks!

 

[Sysnative Windows Update]

1. Yes. If there were errors, DISM would throw and error code.
2. Yes, Windows Troubleshooter is useless and never fixes anything.
3. DISM.log is unimportant. The only place where real issues are logged is the CBS.log

If you wish, run DISM again with the RestoreHealth parameter and I will check the CBS.log after that to confirm.

 

[jat247]

Awesome, good to know!

Then I may have worried for nothing after doing my initial troubleshooting and repairs with Bleeping Computer. I'll post the latest CBS.log file for review just in case, but I didn't see any "Error" entries listed, just "Info". Please find it attached. Thanks again!

 

[Sysnative Windows Update]

Looks good. Does the update still fail?

 

[jat247]

Great, thanks for taking a look!

Windows Update currently doesn't fail or return an error code when I click Check For Updates - However, I believe Windows Update is failing to see that the following (I believe to be applicable) KB is available for download and install: KB4567521 (a fix to the update KB4561666). Because of this I'm concerned Windows Update is not pulling updates it should when it checks for updates.

When Windows Update was failing with an error (which it no longer is) I manually downloaded and installed KB4562253, and KB4561666 (installed on 06/12/2020).

Attached are the following:

1. Screenshot of what my Windows Update on the Server currently reports. (the optional install is Microsoft Silverlight...)
   • 
2. I got the information for the two KB I manually installed on 06/12/2020 (on the left under "In this release", Screenshot attached for reference) here: KB4562253 & KB4561666
   • 
3. I got the information for KB4567521 that was released after the KB4561666 I manually installed (which is supposed to be a cumulative update resolution/fix for KB4561666) here: KB4567521 Documentation and Microsoft Update Catalog Listing - Server 2012 R2(Screenshot included for reference)
   • 
4. Screenshot of all Currently Installed Updates on the Server (two are the manual KB installations I did, and two show a June installation date but are listed as a May update from 2017 and another from May 2020 which is odd and I don't know why those would be listed as recent installs in June unless the "Installed On" column data is not reliable.
   • 

So my questions are:

1. Why might Windows Update not be detecting KB4567521 which seems to be an applicable update? Is it because I manually installed the update it is meant to fix, or might there be another reason?
2. Should I try to manually install the KB4567521?
3. Why would KB3172729 from 05/31/2017 as well as a KB4557900 from 05/08/2020 be listed as installed in June of 2020? I definitely did not do this manually. Could this be a result of a repair DISM ran on the Server?
4. Is there a way to permanently hide the "Optional Windows Update" Microsoft Silverlight?

***UPDATE***
I just realized that the KB4567521 update Windows Update was not finding is apparently by design from Microsoft for some reason. Reading the "Resolution" section of the KB documentation it specifically states at the very bottom "Note KB4567521 is not available from Windows Update and will not install automatically."

 

[Sysnative Windows Update]

Hi!

2. You can try if you've been affected by the printing issue.
3. No, this is not due to DISM. Some updates stay dormant until manually executed or are considered optional.
4. Silverlight is specific and causes issues with hiding itself. This is most likely a bug in Win8.1.

 

[jat247]

Thanks softwaremanic! I guess all is in good working order on our Server now then. That update for the printing issue installed without any issue and Windows Update is no longer throwing any error. I appreciate your help and analysis of the logs, and hope you have a great rest of your week!

 

[Sysnative Windows Update]

Thank you. The same to you!