Windows server 2019 Fail Updates

Zenkuh · Aug 31, 2023

Hey all,
I have an Update problem with my 2019 Datacenter server.
I tried to launch the SFCFix tool but it crashes every time I launch it.
You will find the requested logs concerning the machine that has the problem

thank you in advance for your help

Gary R · Aug 31, 2023

Looking over your logs, back soon.

Gary R · Aug 31, 2023

WARNING! The following fix is specific to the user's system in this thread only. No one else should follow these instructions, as it could damage your system.

Download the attachment SFCFix.zip and save it on your desktop.
Save any work you have open, and close all programs.
Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

SFCFix will launch, let it complete.
Once done, a file will appear on your desktop, called SFCFix.txt
Open the file, then copy and paste its content in your next reply.

Next ...

Click Search button and type Command Prompt
From the results, right click on the Command Prompt icon, and select Run as administrator
A Command Window will open.
Copy paste the command below into it, then press Enter
Dism /Online /Cleanup-Image /RestoreHealth
Once DISM has finished running ...
- Please attach your ... C:\Windows\Logs\CBS\cbs.log ... to your next reply.
If the file is too large, upload it to a file sharing service, and post me the link.
Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Zenkuh · Aug 31, 2023

Thank you for your prompt response,
Here is the contents of the file SFCFix.txt :

SFCFix version 3.0.2.1 by niemiro.
Start time: 2023-08-31 17:21:48.974
Microsoft Windows Server 10 Build 17763 - amd64
Using .zip script file at C:\Users\****\Desktop\SFCFix.zip [0]

PowerCopy::
Successfully took permissions for file or folder C:\Windows\WinSxS\amd64_dual_monitor.inf_31bf3856ad364e35_10.0.17763.771_none_3b0f36ae0adc9dce\monitor.sys

Successfully copied file C:\Users\a-nmullier\AppData\Local\niemiro\Archive\amd64_dual_monitor.inf_31bf3856ad364e35_10.0.17763.771_none_3b0f36ae0adc9dce\monitor.sys to C:\Windows\WinSxS\amd64_dual_monitor.inf_31bf3856ad364e35_10.0.17763.771_none_3b0f36ae0adc9dce\monitor.sys.

Successfully restored ownership for C:\Windows\WinSxS\amd64_dual_monitor.inf_31bf3856ad364e35_10.0.17763.771_none_3b0f36ae0adc9dce\monitor.sys
Successfully restored permissions on C:\Windows\WinSxS\amd64_dual_monitor.inf_31bf3856ad364e35_10.0.17763.771_none_3b0f36ae0adc9dce\monitor.sys
PowerCopy:: directive completed successfully.

Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2023-08-31 17:21:49.943
Script hash: 67C6trBJf9gShIVOKTApc6Y1odH05JXxWFUQcBKEStM=
----------------------EOF-----------------------

DISM command was 100% successful and I have attached the new CBS file

Gary R · Aug 31, 2023

Latest log showing no apparent errors, please try updating your computer.

If successful please let me know.

If not, please post me your latest CBS.log created after the update attempt.

Zenkuh · Sep 1, 2023

Hi,
I still have the problem of updating on the machine after a reboot :

I have attached the new CBS file

Gary R · Sep 1, 2023

Download FRST64 to your Desktop.

Start FRST.
Hit your Windows Key + R to open a Run window
Type Notepad then click OK
This will open an empty Notepad document
Copy/Paste the following into it (Don't include the word Code: ) .....

Code:

Reg: Reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /v "dismHost.exe" /f
Reboot:

Save it as fixlist.txt to the same location as FRST (must be in this location)
NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
Now press the Fix button once and wait.
FRST will process fixlist.txt and reboot your computer.
When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
Please post me the log

Next ...

Click Search button and type Command Prompt
From the results, right click on the Command Prompt icon, and select Run as administrator
A Command Window will open.
Copy paste the command below into it, then press Enter
Dism /Online /Cleanup-Image /RestoreHealth
Once DISM has finished running ...
- Please attach your ... C:\Windows\Logs\CBS\cbs.log ... to your next reply.
If the file is too large, upload it to a file sharing service, and post me the link.
Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Next ...

If DISM completes without error, please try updating your computer again.

If successful please let me know.

If not, please post me your latest CBS.log

.

Zenkuh · Sep 1, 2023

Same Problem and no errors for DISM again

Gary R · Sep 1, 2023

Sorry my mistake, the fix I gave you was to remove a value (which wasn't found) when it needed to be a key ...

Start FRST.
Hit your Windows Key + R to open a Run window
Type Notepad then click OK
This will open an empty Notepad document
Copy/Paste the following into it (Don't include the word Code: ) .....

Code:

Reg: Reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dismHost.exe" /f
Reboot:

Save it as fixlist.txt to the same location as FRST (must be in this location)
NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
Now press the Fix button once and wait.
FRST will process fixlist.txt and reboot your computer.
When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
Please post me the log

Zenkuh · Sep 1, 2023

Last result :

Résultats de correction de Farbar Recovery Scan Tool (x64) Version: 28-08-2023
Exécuté par a-nmullier (01-09-2023 14:05:32) Run:2
Exécuté depuis C:\Users\XXXXX\Desktop
Profils chargés: XXXXX
Mode d'amorçage: Normal
==============================================

fixlist contenu:
*****************
Reg: Reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dismHost.exe" /f
Reboot:
*****************

========= Reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dismHost.exe" /f =========

Erreurÿ: Erreurÿ: le systŠme n'a pas trouv‚ la cl‚ ou la valeur de Registre sp‚cifi‚e.

========= Fin de Reg: =========

Le système a dû redémarrer.

==== Fin de Fixlog 14:05:32 ====

Gary R · Sep 1, 2023

Strange, the error code 0x80070002 you got earlier ... see post #6 ... is usually caused by the key we've just tried to remove (which your machine says is not present).

Not seeing a great deal in your latest log, but there's a couple of things in it I need to discuss with my colleagues.

That may take a while, but I'll get back to you as soon as I can.

Gary R · Sep 1, 2023

Do you have any recent backups of your Server ???

Zenkuh · Sep 4, 2023

Yes the backups are made every evening.
On the other hand, I cannot say from when the problem occurred on the machine

Gary R · Sep 4, 2023

That's OK, your last log suggests you have a problem with your Servicing Stack, and that's usually down to a Registry and/or file corruption on your live server. We will probably have to patch these corruptions (when we've found them) and the best source for any replacements would be from a backup.

So, if you know when you were last able to successfully update (even a vague one), then if we source what we need from a backup made before then, then there's a fair chance that it will have what we need. If not, then we just try an earlier backup, and rinse and repeat as necessary until we find what we need.

Anyway, before we start trying to source anything, we first need to know what we're going to need, so can you please do the following for me ...

Start FRST.
Hit your Windows Key + R to open a Run window
Type Notepad then click OK
This will open an empty Notepad document
Copy/Paste the following into it (Don't include the word Code: ) .....

Code:

StartBatch:
dir /s /a %systemroot%\servicing\version
dir /s /a %systemroot%\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35*.*
EndBatch:
CMD: reg query "HKEY_CLASSES_ROOT\CLSID\{0823B6F8-F499-4d5e-B885-EA9CB4F43B24}" /s
CMD: reg query "HKEY_CLASSES_ROOT\CLSID\{75207391-23F2-4396-85F0-8FDB879ED0ED}" /s
CMD: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0823B6F8-F499-4d5e-B885-EA9CB4F43B24}" /s
CMD: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4d5e-B885-EA9CB4F43B24}" /s
CMD: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Version" /s
CMD: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_none_4a207b402ad93a1c\10.0" /s
CMD: reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
CMD: reg query "HKEY_LOCAL_MACHINE\COMPONENTS\ServicingStackVersions" /s

Save it as fixlist.txt to the same location as FRST (must be in this location)
NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
Now press the Fix button once and wait.
FRST will process fixlist.txt
When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
Please post me the log

Just so you know. I'm going to be out for much of today, so it may be late this afternoon (my time GMT+1) before I get a chance to look over your return log.

Zenkuh · Sep 4, 2023

Ok great, I will look at this time to find an uncorrupted version.

So, I did what was necessary to have the logs.
No problems and many thanks again for your help and perserverance !

Gary R · Sep 4, 2023

This is a relatively new fault to me, so I need to consult with my colleagues on the results found in your Fixlog, and how best to resolve things.

May take a while, but I will get back to you as soon as I can.

Gary R · Sep 4, 2023

Export CBS Hive

Click on the Start button and in the search box, type regedit
- When you see regedit on the list, right-click on it and select Run as administrator
When regedit opens, using the left pane, navigate to the following registry key and select it by clicking on it once.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing

Once selected, click File > Export....
- Change the Save as type: to Registry Hive Files (.)
- Name this file ComponentBasedServicing (with no file extension) and save it to your Desktop.
Right-click on the saved file and choose Send To -> Compressed (zipped) Folder.
Attach the .ZIP file to your next post.
If the file is too large to upload here, please upload to a file sharing service.
Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Zenkuh · Sep 4, 2023

Here it is !

Gary R · Sep 4, 2023

Thanks. From the size of the file, it looks like there's going to be a whole mass of missing keys and values, but I'll know better once I've had chance to have a proper look at it.

Gary R · Sep 4, 2023

1. Are you able to explore the previous backups and extract files from them without restoring the complete server?

2. If so ....

Navigate to C:\Windows\System32\Config and locate the SOFTWARE file.
Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named SOFTWARE.ZIP on your desktop.
Please upload to a file sharing service.
Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Please note ...

The SOFTWARE hive has confidential and sensitive information in it so please send me a PM with a link to that particular hive so it's not in the public form.

Windows server 2019 Fail Updates

Member

Attachments

Forum Moderator, Security Analyst, Windows Update Analyst

Forum Moderator, Security Analyst, Windows Update Analyst

Attachments

Member

Attachments

Forum Moderator, Security Analyst, Windows Update Analyst

Member

Attachments

Forum Moderator, Security Analyst, Windows Update Analyst

Member

Attachments

Forum Moderator, Security Analyst, Windows Update Analyst

Member

Forum Moderator, Security Analyst, Windows Update Analyst

Forum Moderator, Security Analyst, Windows Update Analyst

Member

Forum Moderator, Security Analyst, Windows Update Analyst

Member

Attachments

Forum Moderator, Security Analyst, Windows Update Analyst

Forum Moderator, Security Analyst, Windows Update Analyst

Member

Attachments

Forum Moderator, Security Analyst, Windows Update Analyst

Forum Moderator, Security Analyst, Windows Update Analyst