Windows server 2019 Fail Updates

[Zenkuh]

Hey all,
I have an Update problem with my 2019 Datacenter server.
I tried to launch the SFCFix tool but it crashes every time I launch it.
You will find the requested logs concerning the machine that has the problem

thank you in advance for your help

 

[Gary R]

Looking over your logs, back soon.

 

[Gary R]

WARNING! The following fix is specific to the user's system in this thread only. No one else should follow these instructions, as it could damage your system.

• Download the attachment SFCFix.zip and save it on your desktop.
• Save any work you have open, and close all programs.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt
• Open the file, then copy and paste its content in your next reply.

Next ...

• Click Search button and type Command Prompt
• From the results, right click on the Command Prompt icon, and select Run as administrator
• A Command Window will open.
• Copy paste the command below into it, then press Enter
• Dism /Online /Cleanup-Image /RestoreHealth
• Once DISM has finished running ...
  • Please attach your ... C:\Windows\Logs\CBS\cbs.log ... to your next reply.
• If the file is too large, upload it to a file sharing service, and post me the link.
• Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

 

[Zenkuh]

Thank you for your prompt response,
Here is the contents of the file SFCFix.txt :

SFCFix version 3.0.2.1 by niemiro.
Start time: 2023-08-31 17:21:48.974
Microsoft Windows Server 10 Build 17763 - amd64
Using .zip script file at C:\Users\****\Desktop\SFCFix.zip [0]




PowerCopy::
Successfully took permissions for file or folder C:\Windows\WinSxS\amd64_dual_monitor.inf_31bf3856ad364e35_10.0.17763.771_none_3b0f36ae0adc9dce\monitor.sys

Successfully copied file C:\Users\a-nmullier\AppData\Local\niemiro\Archive\amd64_dual_monitor.inf_31bf3856ad364e35_10.0.17763.771_none_3b0f36ae0adc9dce\monitor.sys to C:\Windows\WinSxS\amd64_dual_monitor.inf_31bf3856ad364e35_10.0.17763.771_none_3b0f36ae0adc9dce\monitor.sys.

Successfully restored ownership for C:\Windows\WinSxS\amd64_dual_monitor.inf_31bf3856ad364e35_10.0.17763.771_none_3b0f36ae0adc9dce\monitor.sys
Successfully restored permissions on C:\Windows\WinSxS\amd64_dual_monitor.inf_31bf3856ad364e35_10.0.17763.771_none_3b0f36ae0adc9dce\monitor.sys
PowerCopy:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 1 datablocks.
Finish time: 2023-08-31 17:21:49.943
Script hash: 67C6trBJf9gShIVOKTApc6Y1odH05JXxWFUQcBKEStM=
----------------------EOF-----------------------

DISM command was 100% successful and I have attached the new CBS file

 

[Gary R]

Latest log showing no apparent errors, please try updating your computer.

If successful please let me know.

If not, please post me your latest CBS.log created after the update attempt.

 

[Zenkuh]

Hi,
I still have the problem of updating on the machine after a reboot :


I have attached the new CBS file

 

[Gary R]

Download FRST64 to your Desktop.

• Start FRST.
• Hit your Windows Key + R to open a Run window
• Type Notepad then click OK
• This will open an empty Notepad document
• Copy/Paste the following into it (Don't include the word Code: ) .....

Reg: Reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /v "dismHost.exe" /f
Reboot:

• Save it as fixlist.txt to the same location as FRST (must be in this location)
• NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
• Now press the Fix button once and wait.
• FRST will process fixlist.txt and reboot your computer.
• When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
• Please post me the log

Next ...

• Click Search button and type Command Prompt
• From the results, right click on the Command Prompt icon, and select Run as administrator
• A Command Window will open.
• Copy paste the command below into it, then press Enter
• Dism /Online /Cleanup-Image /RestoreHealth
• Once DISM has finished running ...
  • Please attach your ... C:\Windows\Logs\CBS\cbs.log ... to your next reply.
• If the file is too large, upload it to a file sharing service, and post me the link.
• Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Next ...

If DISM completes without error, please try updating your computer again.

If successful please let me know.

If not, please post me your latest CBS.log

.

 

[Zenkuh]

Same Problem and no errors for DISM again

 

[Gary R]

Sorry my mistake, the fix I gave you was to remove a value (which wasn't found) when it needed to be a key ...

• Start FRST.
• Hit your Windows Key + R to open a Run window
• Type Notepad then click OK
• This will open an empty Notepad document
• Copy/Paste the following into it (Don't include the word Code: ) .....

Reg: Reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dismHost.exe" /f
Reboot:

• Save it as fixlist.txt to the same location as FRST (must be in this location)
• NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
• Now press the Fix button once and wait.
• FRST will process fixlist.txt and reboot your computer.
• When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
• Please post me the log

 

[Zenkuh]

Last result :

Résultats de correction de Farbar Recovery Scan Tool (x64) Version: 28-08-2023
Exécuté par a-nmullier (01-09-2023 14:05:32) Run:2
Exécuté depuis C:\Users\XXXXX\Desktop
Profils chargés: XXXXX
Mode d'amorçage: Normal
==============================================

fixlist contenu:
*****************
Reg: Reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dismHost.exe" /f
Reboot:
*****************


========= Reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dismHost.exe" /f =========

Erreurÿ: Erreurÿ: le systŠme n'a pas trouv‚ la cl‚ ou la valeur de Registre sp‚cifi‚e.


========= Fin de Reg: =========



Le système a dû redémarrer.

==== Fin de Fixlog 14:05:32 ====

 

[Gary R]

Strange, the error code 0x80070002 you got earlier ... see post #6 ... is usually caused by the key we've just tried to remove (which your machine says is not present).

Not seeing a great deal in your latest log, but there's a couple of things in it I need to discuss with my colleagues.

That may take a while, but I'll get back to you as soon as I can.

 

[Gary R]

Do you have any recent backups of your Server ???

 

[Zenkuh]

Yes the backups are made every evening.
On the other hand, I cannot say from when the problem occurred on the machine

 

[Gary R]

That's OK, your last log suggests you have a problem with your Servicing Stack, and that's usually down to a Registry and/or file corruption on your live server. We will probably have to patch these corruptions (when we've found them) and the best source for any replacements would be from a backup.

So, if you know when you were last able to successfully update (even a vague one), then if we source what we need from a backup made before then, then there's a fair chance that it will have what we need. If not, then we just try an earlier backup, and rinse and repeat as necessary until we find what we need.

Anyway, before we start trying to source anything, we first need to know what we're going to need, so can you please do the following for me ...

• Start FRST.
• Hit your Windows Key + R to open a Run window
• Type Notepad then click OK
• This will open an empty Notepad document
• Copy/Paste the following into it (Don't include the word Code: ) .....

StartBatch:
dir /s /a %systemroot%\servicing\version
dir /s /a %systemroot%\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35*.*
EndBatch:
CMD: reg query "HKEY_CLASSES_ROOT\CLSID\{0823B6F8-F499-4d5e-B885-EA9CB4F43B24}" /s
CMD: reg query "HKEY_CLASSES_ROOT\CLSID\{75207391-23F2-4396-85F0-8FDB879ED0ED}" /s
CMD: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0823B6F8-F499-4d5e-B885-EA9CB4F43B24}" /s
CMD: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4d5e-B885-EA9CB4F43B24}" /s
CMD: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Version" /s
CMD: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_none_4a207b402ad93a1c\10.0" /s
CMD: reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
CMD: reg query "HKEY_LOCAL_MACHINE\COMPONENTS\ServicingStackVersions" /s

• Save it as fixlist.txt to the same location as FRST (must be in this location)
• NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
• Now press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
• Please post me the log

Just so you know. I'm going to be out for much of today, so it may be late this afternoon (my time GMT+1) before I get a chance to look over your return log.

 

[Zenkuh]

Ok great, I will look at this time to find an uncorrupted version.

So, I did what was necessary to have the logs.
No problems and many thanks again for your help and perserverance !

 

[Gary R]

This is a relatively new fault to me, so I need to consult with my colleagues on the results found in your Fixlog, and how best to resolve things.

May take a while, but I will get back to you as soon as I can.

 

[Gary R]

Export CBS Hive

• Click on the Start button and in the search box, type regedit
  • When you see regedit on the list, right-click on it and select Run as administrator
• When regedit opens, using the left pane, navigate to the following registry key and select it by clicking on it once.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing

• Once selected, click File > Export....
  • Change the Save as type: to Registry Hive Files (.)
  • Name this file ComponentBasedServicing (with no file extension) and save it to your Desktop.
• Right-click on the saved file and choose Send To -> Compressed (zipped) Folder.
• Attach the .ZIP file to your next post.
• If the file is too large to upload here, please upload to a file sharing service.
• Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

 

[Zenkuh]

Here it is !

 

[Gary R]

Thanks. From the size of the file, it looks like there's going to be a whole mass of missing keys and values, but I'll know better once I've had chance to have a proper look at it.

 

[Gary R]

1. Are you able to explore the previous backups and extract files from them without restoring the complete server?

2. If so ....

• Navigate to C:\Windows\System32\Config and locate the SOFTWARE file.
• Please copy this file to your desktop.
• Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
• Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named SOFTWARE.ZIP on your desktop.
• Please upload to a file sharing service.
• Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Please note ...

The SOFTWARE hive has confidential and sensitive information in it so please send me a PM with a link to that particular hive so it's not in the public form.