[SOLVED] Windows Server 2016 0x80073712

M

musashiro

Contributor
Joined
Aug 9, 2021
Posts
93
Cumulative updates have been failing since January

Code: 
SFC Scan - found corrupt files but was unable to fix some of them
DISM - file cannot be found
SFC Logs -

SFCFix version 3.0.2.1 by niemiro.
Start time: 2021-09-13 02:45:44.859
Microsoft Windows Server 10 Build 14393 - amd64
Not using a script file.




AutoAnalysis::
SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2021-09-13 03:58:28.802
----------------------EOF-----------------------


CBS Logs and component hive: CBS and COMPONENTS.zip


Corruptions found:
Code: 
Checking System Update Readiness.

(p)    CSI Manifest Corrupt            amd64_028f0735e1885ab222dc957d3ab1cc05_31bf3856ad364e35_10.0.14393.3383_none_e389f22b47032b94
(p)    CSI Manifest Corrupt            amd64_1a7b8ff6de04b3a5d74d7fb2905898dc_31bf3856ad364e35_10.0.14393.3383_none_dfc0efa720621dcc
(p)    CSI Manifest Corrupt            amd64_52824ba2715aef3eca2bc8761a69536f_31bf3856ad364e35_10.0.14393.3383_none_50b197a13760e08f
(p)    CSI Manifest Corrupt            amd64_microsoft-windows-f..r-health-perfhealth_31bf3856ad364e35_10.0.14393.2879_none_0308acfd48e4bb4c
(p)    CSI Manifest Corrupt            amd64_70415d12dce5eebc6de45d5ea7c8c222_31bf3856ad364e35_10.0.14393.3383_none_64334ed12ad7f3eb
(p)    CSI Manifest Corrupt            amd64_894b4ebcbb1eeed712e9e3a9cc55da46_31bf3856ad364e35_10.0.14393.2879_none_d9e5731184487240
(p)    CSI Manifest Corrupt            amd64_microsoft-windows-c..ana.pal.bin.cortana_31bf3856ad364e35_10.0.14393.3241_none_3de1b122c7b40198
(p)    CSI Payload Corrupt            amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_10.0.14393.3383_none_044e3fbfaee16c18\termsrv.dll
(p)    CSI Payload Corrupt            amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.14393.3241_none_c3577bac6520a2f8\DefaultSystemNotification.contrast-black_scale-150.png
(p)    CSI Payload Corrupt            amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.14393.0_none_1137c685b804c9a3\MSFT_MpThreatCatalog.cdxml
(p)    CSI Payload Corrupt            amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.14393.0_none_1137c685b804c9a3\Defender.psd1
(p)    CSI Payload Corrupt            amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.14393.0_none_1137c685b804c9a3\MSFT_MpWDOScan.cdxml
(p)    CSI Payload Corrupt            amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.14393.0_none_1137c685b804c9a3\MSFT_MpSignature.cdxml
(p)    CSI Payload Corrupt            amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.14393.0_none_1137c685b804c9a3\MSFT_MpThreat.cdxml
(p)    CSI Payload Corrupt            amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.14393.0_none_1137c685b804c9a3\MSFT_MpComputerStatus.cdxml
(p)    CSI Payload Corrupt            amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.14393.0_none_1137c685b804c9a3\MSFT_MpScan.cdxml
(p)    CSI Payload Corrupt            amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.14393.0_none_1137c685b804c9a3\MSFT_MpThreatDetection.cdxml
(p)    CSI Payload Corrupt            amd64_windows-defender-management-powershell_31bf3856ad364e35_10.0.14393.0_none_1137c685b804c9a3\MSFT_MpPreference.cdxml

Summary:
Operation: Detect only
Operation result: 0x0
Last Successful Step: CSI store detection completes.
Total Detected Corruption:    18
    CBS Manifest Corruption:    0
    CBS Metadata Corruption:    0
    CSI Manifest Corruption:    7
    CSI Metadata Corruption:    0
    CSI Payload Corruption:    11
Total Repaired Corruption:    0
    CBS Manifest Repaired:    0
    CSI Manifest Repaired:    0
    CSI Payload Repaired:    0
    CSI Store Metadata refreshed:    True
 
Hello musashiro,

Please follow the instructions below which should address the corruptions found and reported in your log.

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

  1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
  2. Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
  3. Save any open documents and close all open windows.
  4. On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
  5. Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
  6. SFCFix will now process the script.
  7. Upon completion, a file should be created on your Desktop: SFCFix.txt.
  8. Attach this file into your next post for me to analyse please.

You can run SFC /scannow from an administrator command prompt to check that the fix has worked. Please report the result and if there are any errors please upload the new CBS.logs.
 

Attachments

Hi Phil,

Can you explain how you got the manifest files? I'm sorry, I know I should just run the script but i want to understand the process since we have multiple servers with this issue. I've gotten as far as knowing which KB (KB4530689) the manifests came from but I cannot download it from Microsoft's catalog site.

If you cannot provide such guidance, I completely understand. I may run the fix at some point if I cannot find the source of the manifest/packages.
 
When an update is no longer provided in the Microsoft Catalogue you can often find it by searching the internet. In this case I found and extracted the manifest files from an update which was still being provided by DELL.
 
I downloaded and extracted the file from dell but i only found 2 of the manifest files.

Edit: did you use other KB's? would getting the manifest/files from a working machine with the same OS work? I checked the hash of the files you provided and while some of the files matched with the CBS logs, not all of them matched so I'm wondering
 
Last edited:
There were 5 cab files that needed to be expanded from that download in order to find all the files. I provided the files in their expanded form - hashes change depending upon whether the file is compressed or expanded. If there is a problem it will be shown in the CBS.log after you apply the fix because a hash value not matching will be picked up.

Finding files from Virtual Machines we have set up for the different versions of windows is the way we get most of the files.
 
Last edited:
Thank you. Can you help me find a working copy of this payload?

amd64_presentationcore_31bf3856ad364e35_10.0.14393.3411_none_21ce6bd4ea9fd580\PresentationCore.dll

I tried copying from other servers running the same OS but I think the version didn't match. I cant find a version 10.0.14393.3411
 
If you can send me a copy of your components hive from the server in question I can possibly find where it was deployed from.

Retrieve Components Hive
1. Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
2. Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
3. Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
4. The file will likely be too large to upload here so please upload to a file sharing service. Examples of services to upload to are Dropbox or OneDrive or SendSpace and then just provide the link in your reply.
 
Hi Phil,

I believe its from KB4534271 and I have extracted it but i'm not sure how to get the DLL.
 
Last edited by a moderator:
I used the same file. For some reason, the DLL inside Server 2016 ISO didn't work as well. I tried removing .net framework which allowed me to run DISM and SFC /Scannow without errors but as soon as I reinstall, the error is back. Windows update is working though so I am good.

Thank you so much for all the help, I learned a lot!
 
Are you happy for me to mark this as solved?
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top