[SOLVED] Windows SXS Component Store Corruption

twalker · Dec 5, 2016

Hello,
I am hoping that you may be able to help me through aproblem I am facing.
About two weeks ago I tried to run an update on our Windows Server 2012 R2 with Exchange 2013. I got the Error code 80073712. Afterthis I then ran sfc/scannow and itcame up with Windows Resource Protectioncould not perform the requested operation. The next thing I tried was DISM. Here are the commands I ran and the results I was given:

DISM /Online/Cleanup-Image /CheckHealth: Thecomponent store is repairable. Theoperation completed successfully.

DISM /Online/Cleanup-Image /ScanHealth: Error:14098, the component store has been corrupted.

DISM /Online/Cleanup-Image /RestoreHealth: Error14098, the component store has been corrupted.

I then mounted the .iso image to the server and tried torepair from the disk using this command:

DISM /Online/Cleanup-Image /RestoreHealth /Source:F:\sources\install.wim: Error 14098, The component store has beencorrupted.

DISM /Online/Cleanup-Image /RestoreHealth /Source:F:\sources\install.wim /LimitAccess: Error 14098, The component store has beencorrupted.

Looking at the DISM and CBS logs, I noticed that somefolders in the registry under components are missing which are Derived Data,Installers, and ServicingStackVersions. This was determined by comparing to a Server that is does not have thisissue.

Is there anything I can do to fix this issue?

BrianDrab · Dec 12, 2016

Hi and welcome to Sysnative. Sorry for the delay. Do you still need assistance?

twalker · Dec 13, 2016

Yes I do. Any assistance you can provide me would be greatly appreciated.

BrianDrab · Dec 13, 2016

Please start with the following.

Step#2 - SFC Scan
1. Right-click on the Start

button and select Command Prompt (Admin)
2. When command prompt opens, Copy (Ctrl+C) and Paste (Right-click > Paste) the following command into it, then press Enter
sfc /scannow

3. Once it finishes, copy and paste the following into the command-prompt window and press Enter.
copy %windir%\logs\cbs\cbs.log "%userprofile%\Desktop\cbs.txt"

4. Once this has completed please go to your Desktop and you will find CBS.txt => Right-click on this file and choose Send To...Compressed (zipped folder). Please upload this zipped file CBS.zip to this thread

Please Note:: if the file is too big to upload to your next post please upload via a service such as Dropbox or One Drive or SendSpace and just provide the link.

twalker · Dec 13, 2016

Here you go. Let me know if you get this ok.

BrianDrab · Dec 13, 2016

Thanks. Got it. Please do the following.

Retrieve Components Hive
1. Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
2. Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
3. Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
4. The file will likely be too large to upload here so please upload to SendSpace and just provide the link here.

twalker · Dec 13, 2016

What I did was upload a restored file from Friday of last week which has the same amount of data in it. If this will not help you let me know. I did not want to restart our Exchange Server at the moment as it is in production. Also, I have some component files from backups that are about 4 times as large that I think still have the same problem with them. I do not think that any of our backups have a component file with the Derived key in them, but I can double check this. This also makes it hard to determine when this problem happened since our backups only go a month back.

Thanks

BrianDrab · Dec 13, 2016

Unfortunately your COMPONENTS hive is corrupt beyond repair. It's missing a ton of data that can't be reconstructed. At some point you will need to rebuild the server and re-install/configure Exchange. Sorry for the bad news.

twalker · Dec 13, 2016

This is pretty much what I thought but it was worth atry. Is this issue something that ismore common in Windows 8 or Server 2012? I may want to try a different operating system as I have never hadanything like this happen before in regards to Windows Updates. Also, what are some common reasons thatWindows Update would become this corrupted? The last update that was done on this server was KB3138615 which was supposed to contain improvements to the WindowsUpdate client. This is the only thingthat I can think of that could have botched it as we are extremely careful withthis server. Well if anything I learnedthat I need to run sfc/scannow on all server weekly so I never run into thissituation again.

I really appreciate having looking into this for me. Thank you very much for your help.

BrianDrab · Dec 13, 2016

This is pretty much what I thought but it was worth atry.Is this issue something that ismore common in Windows 8 or Server 2012?I may want to try a different operating system as I have never hadanything like this happen before in regards to Windows Updates.Also, what are some common reasons thatWindows Update would become this corrupted?The last update that was done on this server was KB3138615 which was supposed to contain improvements to the WindowsUpdate client.This is the only thingthat I can think of that could have botched it as we are extremely careful withthis server.Well if anything I learnedthat I need to run sfc/scannow on all server weekly so I never run into thissituation again.

This is actually very uncommon. There are many reasons this could happen but two of the main ones are bad RAM or bad Disk. I have two server racks full of 2012R2 with all combinations (i.e. Exchange, SQL Server, HyperV) and have never had the issue.

I really appreciate having looking into this for me. Thank you very much for your help.

No problem. Take care.

twalker · Dec 20, 2016

Would you mind taking a look at another one of my COMPONENTS hives that I restored from a backup? This one is roughly 56 MB whereas the one you looked at before was only 14 MB.

BrianDrab · Dec 20, 2016

Sure. Provide a link to it and I'll take a look.

twalker · Dec 23, 2016

Hi,

I am unable to upload the file, so I am going to have to setup a Dropbox in order to get it to you. I will try and this to you as soon as possible. Also, is there a way to clear the previous attachments that are still showing when I click on the attachments button?

Thanks

BrianDrab · Dec 23, 2016

I don't believe you can delete those. Unused ones get deleted within an hour. You can always upload your file to SendSpace as well and just provide the link.

twalker · Dec 27, 2016

Hello,

Here is the link to the file and let me know if it works. Also, the two prior uploads in the attachments are still there and have not deleted after about 2 weeks.

Download COMPONENTS 2.zip from Sendspace.com - send big files the easy way

Thanks

BrianDrab · Dec 27, 2016

Unfortunately this one is corrupt beyond repair as well. As far as the attachments, let me know which post numbers you want them to be removed from and I'll remove them.

Thanks.

twalker · Dec 27, 2016

OK, thank you for taking a look at it. I guess it is no big deal to delete any posts.

Thanks again.

Search

Search

[SOLVED] Windows SXS Component Store Corruption

twalker

Member

BrianDrab

Emeritus

twalker

Member

BrianDrab

Emeritus

twalker

Member

Attachments

BrianDrab

Emeritus

twalker

Member

Attachments

BrianDrab

Emeritus

twalker

Member

BrianDrab

Emeritus

twalker

Member

BrianDrab

Emeritus

twalker

Member

BrianDrab

Emeritus

twalker

Member

BrianDrab

Emeritus

twalker

Member