[SOLVED] Windows Server 2016 Update don't working

[Shenziro]

Hello all,

i had a big problem with a Windows Server 2016.

The update installation won't work:

"Package KB5039214 failed to be changed to the Installed state. Status: 0x800f0922."

The Same issue I have in the Mai Update and can't fix it

SFC is clean
Run all DISM commands
Tried installing updates manually via different methods
Reset Update Components
Tried other user account

Could you please help me?

CBS Log is in the attachment

Thank you so much!

 

[Shenziro]

Oh sorry i have forgotten to add the SFCFix File

 

[Maxstar]

Hi,

Please provide the previous CbsPersist logs as well.

Upload a copy of the CBS folder

• Open Windows Explorer and browse to the C:\Windows\Logs folder.
• Right-click on the CBS folder and choose Send to > Compressed (zipped) folder.
• Now the message will appear, "Windows cannot create the Compressed (zipped) Folder here. Do you want it to be placed on the desktop instead?"
• Click on the Yes button here.

• Attach the file CBS.zip to your next reply. If the file is too large to attach, upload the CBS.zip file to www.wetransfer.com and post the link in your next reply.

 

[Shenziro]

Hello, Thank you very much for the answer, I'm on vacation for another 2 weeks. I'll get in touch again afterwards.

 

[Shenziro]

Hi,

my vacation is over, the desired folder is attached.

Thank you

 

[Maxstar]

Hi,

Hope you had a great holiday...

Which security software is installed on this server, also Sentinel One? If so disable all services or uninstall Sentinel One temporarily and attempt to update again. It is a known issue that certain software are causing such rollbacks.

 

[Shenziro]

Hi,

thank you, my holday was nice :)

On the Server is only used the Windows Defender. I can deactivate the windows defender and try agaian.

 

[Maxstar]

Let's check something else first.

• Open the start menu and type Task Scheduler and hit enter.
• Navigate to Task Scheduler Library > Microsoft > Windows > PI
• Take a screenshot of this window and post it into your next post.

 

[Shenziro]

 

[Maxstar]

Open an elevated command prompt and run the following commands and attach tasklist to your next post.

reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache" /s > "%userprofile%\desktop\tasklist.txt"
dir "%systemroot%\System32\Tasks\Microsoft\Windows\PI" /s >> "%userprofile%\desktop\tasklist.txt"

 

[Shenziro]

thanks for your help

 

[Maxstar]

This looks good.

Provide the profile information of this server.

• Click the Start button and in the search box, type Command Prompt
• When you see Command Prompt on the list, right-click on it and select Run as administrator.
  Copy and paste the following commands one at a time into the command prompt and press enter after each.
  

  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s > "%userprofile%\desktop\ProfileList.txt"
  reg query "HKEY_USERS" >> "%userprofile%\desktop\ProfileList.txt"

• These commands will collect the System and Application logs and create ProfileList.txt on your Desktop.
• Attach this file in your next reply.

 

[Shenziro]

thank you

 

[Maxstar]

I see a number of duplicate accounts? Are they remnants of an earlier migration?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-43060751-927425598-310601177-11235
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\maehrpet.admin

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-43060751-927425598-310601177-11236
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\maehrpet.admin2

 

[Shenziro]

I see a number of duplicate accounts? Are they remnants of an earlier migration?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-43060751-927425598-310601177-11235
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\maehrpet.admin

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-43060751-927425598-310601177-11236
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\maehrpet.admin2

Are those not the same accounts? the last block is 11235 and the other 11236



mahepet was an User a year ago, he has left the company

 

[Maxstar]

I mean .admin and .admin2 accounts, I'll see a number of them. So I would suggest to remove all the unused accounts from this server.

 

[Shenziro]

.admin whas the "normal" admin account, and admin2 the "domain" Admin Account

I can delete all unused Profiles

 

[Maxstar]

Okay, please be sure the SID is removed from the following key as well: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

 

[Shenziro]

Ok,

the Useraccounts wasn't create at the local machine, they was domain.users

So I Only need to delete the keys?

Right

 

[Maxstar]

That's right if they are just remnants in the registry.

You can run the following command to verify the local accounts and orphaned domain accounts.

wmic useraccount get name,sid >> "%userprofile%\desktop\ProfileList.txt"