80070246 - ERROR_ILLEGAL_CHARACTER when trying to run windows update on 2012 R2

xenomino · Aug 2, 2015

Dear all,

since a few weeks I have a problem installing new windows updates. Windows Update quits with the error 80070246. Investigating a little bit I also found out that either sfc nor dism is not working anymore:

Code:

C:\Windows\system32>dism /online /cleanup-image /RestoreHealth

Tool zur Imageverwaltung für die Bereitstellung
Version: 6.3.9600.17031

Abbildversion: 6.3.9600.17031

[==========================100.0%==========================]

Fehler: 582

Ein unzulässiges Zeichen wurde gefunden. Bei einem Mehrbyte-Zeichensatz schließt dies ein führendes Byte ohne nachfolgendes Byte ein. Beim Unicode-Zeichensatz sind dies die Zeichen 0xFFFF und 0xFFFE.

Die DISM-Protokolldatei befindet sich unter "C:\Windows\Logs\DISM\dism.log".

C:\Windows\system32>sfc /scannow

Systemsuche wird gestartet. Dieser Vorgang kann einige Zeit dauern.


Der Windows-Ressourcenschutz konnte den angeforderten Vorgang nicht ausführen.

The CBS.log is full of 80070246 - ERROR_ILLEGAL_CHARACTER errors. Then I tried using SFCFix, but it shows the same error as dism and then reports no errors were detected.

Code:

SFCFix version 2.4.5.0 by niemiro.
Start time: 2015-08-02 16:34:21.807
Microsoft Windows Server 2012 R2 Update 3 - amd64
Not using a script file.




AutoAnalysis::
SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.




Successfully processed all directives.
SFCFix version 2.4.5.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2015-08-02 16:34:54.307
----------------------EOF-----------------------

Then there is also a problem with the powershell commandlet Get-WindowsFeature showing the same error code:

Code:

PS C:\Users\Administrator> Get-WindowsFeature
Get-WindowsFeature : Fehler bei der Anforderung zum Auflisten der auf dem angegebenen Server verfügbaren Features.
Die Featureliste konnte nicht abgerufen werden.
Ein unzulässiges Zeichen wurde gefunden. Bei einem Mehrbyte-Zeichensatz schließt dies ein führendes Byte ohne
nachfolgendes Byte ein. Beim Unicode-Zeichensatz sind dies die Zeichen 0xFFFF und 0xFFFE. Fehler: 0x80070246
In Zeile:1 Zeichen:1
+ Get-WindowsFeature
+ ~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (@{Vhd=; Credent...Name=localhost}:PSObject) [Get-WindowsFeature], DeploymentProviderException
    + FullyQualifiedErrorId : Failure_Retrieving_Dism_Features,Microsoft.Windows.ServerManager.Commands.GetWindowsFeatureCommand

From reading through some of the posts here I think I have a corruption in my components hive. The machine is running on a ESX Server and recently had two crashes, now there are some *.blf and *.regtrans-ms files in the c:\windows\system32\config folder.

View attachment 14999

I would be glad if you could help me, its my DC incl. PIK and setting this up again would be a lot of work.

xenomino · Aug 2, 2015

I also did a chkdsk /r. No problems were found.

zcomputerwiz · Aug 3, 2015

Have you tested the RAM on your ESX host?

Follow these instructions to upload the components hive so I can inspect it for corruption:

SFCFix Script

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

[sfcfixdownload]Download SFCFix[/sfcfixdownload] (by niemiro) and save this to your Desktop.
Download the attached file, SFCFixScript.txt, and save this to your Desktop. Ensure that this file is named SFCFixScript.txt - do not rename it.
Save any open documents and close all open windows.
On your Desktop, you should see two files: SFCFix.exe and SFCFixScript.txt.
Drag the file SFCFixScript.txt onto the file SFCFix.exe and release it.
SFCFix will now process the script.
Upon completion, a log should be created on your Desktop: SFCFix.txt.
Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.

https://dl.dropboxusercontent.com/u...eric/Collect/COMPONENTS/SFCFixScript.txt?dl=1

LogBot · Aug 4, 2015

Logfile submission from xenomino

Logfile submission from xenomino.

The logfiles are available at: https://www.sysnative.com/niemiro/fileDistribution/2015-08/6330.zip

xenomino · Aug 4, 2015

thanks for helping me

I did an extanded check of the ESX host but couldn't find any problems. After consolidating all snapshots on the affected VM no crashes happened again. So I hope the root course is fixed.

But now to the remaining problems. I ran the SFCFixScript:

Code:

SFCFix version 2.4.5.0 by niemiro.
Start time: 2015-08-04 19:10:39.010
Microsoft Windows Server 2012 R2 Update 3 - amd64
Using .txt script file at C:\Users\Administrator\Desktop\SFCFixScript.txt [0]




Collect:: directive completed successfully.




Successfully processed all directives.
SFCFix version 2.4.5.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2015-08-04 19:11:27.620
----------------------EOF-----------------------

zcomputerwiz · Aug 4, 2015

Do you have any backups or restore points of that machine from before June 21st ?

xenomino · Aug 4, 2015

No, Updates gets overwritten, I recognized the error too late and I removed the snapshot because it was causing the crashes. But the VM is cloned from a template, I have the original copy back from December (untouched since cloning) as well as a other instance from the same source, but this one already got the July updates.

zcomputerwiz · Aug 4, 2015

That's unfortunate. The components hive is corrupted and cannot be repaired, the only way around it would be to use a recent backup from that machine.

Browse to C:\Windows\System32\Config\, right click on Components then click properties.
Click the Previous Versions tab.

What is the earliest version of the file available (if any)?

xenomino · Aug 4, 2015

No other versions of the Components file are available. Is there no way to find the corrupted parts in the hive?

zcomputerwiz · Aug 5, 2015

I tried something, but I'm not sure it will work.

Be sure to BACK UP or even better CLONE your existing VM, I'll get back to you.

zcomputerwiz · Aug 5, 2015

OK, let's try replacing the components hive.

Here is the modified hive: https://www.sendspace.com/file/u85tch

Download it the desktop on your server and extract it, then open an elevated command prompt.
Rename the existing COMPONENTS registry hive using the following:

ren %systemroot%\system32\config\components components.bad

Next, copy the modified hive from your desktop to the config folder;

copy %userprofile%\desktop\components %systemroot%\system32\config\

Let me know if that works or if you get an access denied message.

If the copy works, reboot then run DISM again and upload the logs.

xenomino · Aug 8, 2015

Sorry for the delay, got my first child so I'm in the hospital most of the time.

I cloud replace the COMPONENTS file and the server started. DISM completed with the message the the components store was repaired. SFC also completed but no problems were found.

Code:

C:\Windows\system32>dism /online /cleanup-image /restorehealth

Tool zur Imageverwaltung für die Bereitstellung
Version: 6.3.9600.17031

Abbildversion: 6.3.9600.17031

[==========================100.0%==========================]
Der Wiederherstellungsvorgang wurde abgeschlossen. Die Beschädigung des Komponentenspeichers wurde repariert.
Der Vorgang wurde erfolgreich beendet.

C:\Windows\system32>sfc /scannow

Systemsuche wird gestartet. Dieser Vorgang kann einige Zeit dauern.

Überprüfungsphase der Systemsuche wird gestartet.
Überprüfung 100 % abgeschlossen.

Der Windows-Ressourcenschutz hat keine Integritätsverletzungen gefunden.

Attached please find the DISM and CBS logs.
View attachment 15274

Windows Update and Get-WindowsFeature are also working again.

Thanks so much! You saved me really a lot of time.

Can you tell me which tool do you use to find and correct such corruptions?

zcomputerwiz · Aug 8, 2015

I used a linux utility called hivexsh to get the hive in a state that Windows regedit could load it and then one of Tom's (one of the admins here) registry tools to find some corruption I knew how to repair.

Search

Search

80070246 - ERROR_ILLEGAL_CHARACTER when trying to run windows update on 2012 R2

xenomino

Member

xenomino

Member

zcomputerwiz

Windows Update Expert

LogBot

Well-known member

xenomino

Member

zcomputerwiz

Windows Update Expert

xenomino

Member

zcomputerwiz

Windows Update Expert

xenomino

Member

zcomputerwiz

Windows Update Expert

zcomputerwiz

Windows Update Expert

xenomino

Member

zcomputerwiz

Windows Update Expert