Windows Server 2012 - Will Not Patch - error 0x800F0920

[ignorantbliss]

I've inherited a Windows Server 2012 server running Exchange 2013 that will not patch regular Windows Updates, and hasn't, for months - likely a year at this point. I've gotten all the missing Servicing Stack Updates to successfully install, but none of the monthly cumulative/generic OS patches.

Error 0x800F0920 every time I try and install updates currently. It "installs" them, and a single patch takes 3-6 reboots as it configures windows updates 1-3 times, then another 1-3 times rebooting backing out/rolling back after the error.

CBS logs are too large to attach so I've put them on DropBox.
CBS.zip


I ran sfc /scannow

Windows Resource Protection found corrupt files and successfully repaired
them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For
example C:\Windows\Logs\CBS\CBS.log. Note that logging is currently not
supported in offline servicing scenarios.

I ran dism /online /cleanup-image /restorehealth

C:\Windows\system32>Dism /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 6.2.9200.16384

Image Version: 6.2.9200.16384

[==========================100.0%==========================]
The restore operation completed successfully. The component store corruption wa
repaired.
The operation completed successfully.

Ran SFCFix...

SFCFix version 3.0.2.1 by niemiro.
Start time: 2020-09-17 10:12:35.314
Microsoft Windows Server 2012 - amd64
Not using a script file.




AutoAnalysis::
SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.



Failed to generate a complete zip file. Upload aborted.


SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2020-09-17 10:21:41.489
----------------------EOF-----------------------

Tried installing updates again, same error.

So then I ran all of that again to then capture the latest logs this morning for upload for this thread.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

C:\Windows\system32>Dism /Online /Cleanup-Image /RestoreHealth

Deployment Image Servicing and Management tool
Version: 6.2.9200.16384

Image Version: 6.2.9200.16384

[==========================100.0%==========================]
The restore operation completed successfully. The component store corruption was
repaired.
The operation completed successfully.

SFCFix version 3.0.2.1 by niemiro.
Start time: 2020-09-21 09:08:50.987
Microsoft Windows Server 2012 - amd64
Not using a script file.




AutoAnalysis::
SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2020-09-21 09:09:20.459
----------------------EOF-----------------------

I need assistance trying to resolve this, please!

 

[Sysnative Windows Update]

Hi!

If IIS or Hyper-V role is enabled, try disabling them and retrying the update again. This error is specific for a role/feature causing the issue.

 

[ignorantbliss]

Hey softwaremaniac, IIS is installed, configured, and required - unfortunately this is an Exchange Server. I cannot disable IIS without completely taking down the entire Exchange environment. Hyper-V is not installed or running. But I definitely cannot disable/remove any of the IIS roles.

 

[ignorantbliss]

Apparently the Engineer before me battled updates for MONTHS before giving up and just leaving it for someone else to inherit. That said, I have fixed my problem. I didn't have to disable anything, or uninstall anything.

I had to modify a registry setting that allowed the TrustedInstaller more time to do its work.

HKLM\SYSTEM\CurrentControlSet\Services\TrustedInstaller

Inside that key is a REG_DWORD named "BlockTimeIncrement" and it's default value is Decimal 900 - so 15 minutes. And it apparently kept timing out. If you change that value to something higher, I changed it to 10800 (hex is 2a30) which is 3 hours, and within about 25 minutes the server patched, rebooted, and came back up successfully.

It is now fully up to date and working fine. Just a heads up for anyone with similar issues.