Server 2019 fails nearly all CUs with 0x800f0922 or 0x80246007

[rhonda]

Hello,
I've run some of the cmds based on other posts I've read here. This is a 2019 standard vm that has been failing nearly all updates for the last year. It gets to 30% updated, reboots, gets to 90% and rolls back updates.
What I've tried:

DISM /Online /Cleanup-Image /RestoreHealth
(CBS log attached)

dir /s /a %systemroot%\WinSxS\msil_microsoft.identitys..r.service.resources_31bf3856ad364e35_10.0.17763.1432_ko-kr_99d60db3c722e4c6
C:\Users\Administrator>dir /s /a %systemroot%\WinSxS\msil_microsoft.identitys..r.service.resources_31bf3856ad364e35_10.0.17763.1432_ko-kr_99d60db3c722e4c6
Volume in drive C has no label.
Volume Serial Number is 747A-B6EE
File Not Found

certutil -hashfile %systemroot%\WinSxS\Manifests\msil_microsoft.identitys..r.service.resources_31bf3856ad364e35_10.0.17763.1432_ko-kr_99d60db3c722e4c6.manifest SHA256
bf3856ad364e35_10.0.17763.1432_ko-kr_99d60db3c722e4c6.manifest SHA256
CertUtil: -hashfile command FAILED: 0x80070002 (WIN32: 2 ERROR_FILE_NOT_FOUND)
CertUtil: The system cannot find the file specified.

Thanks in advance for your assistance,
Rhonda

 

[rhonda]

bump :)

 

[rhonda]

Uploading componentscanner files...

 

[rhonda]

Anyone available to assist?

 

[Maxstar]

Hi and welcome to Sysnative,

Please provide all the previous CBS logs as well.

Upload a copy of the CBS folder

• Open Windows Explorer and browse to the C:\Windows\Logs folder.
• Right-click on the CBS folder and choose Send to > Compressed (zipped) folder.
• Now the message will appear, "Windows cannot create the Compressed (zipped) Folder here. Do you want it to be placed on the desktop instead?"
• Click on the Yes button here.

• Attach the file CBS.zip to your next reply. If the file is too large to attach, upload the CBS.zip file to www.wetransfer.com and post the link in your next reply.

 

[rhonda]

Hello, thanks so much. I ran sfc /scannow a few days ago and reran DISM before running the attached.

 

[Maxstar]

Hi,

Open an elevated command prompt, run the following command and attach Services.txt to your next post.

WMIC SERVICE GET caption, name, startmode, state > "%userprofile%\desktop\services.txt"

 

[rhonda]

Thanks for the help - attached.

 

[Maxstar]

Hi,

Please open an elevated command prompt, run the following commands and copy paste the result in your next post.

sc qc http
sc config http start= auto

 

[rhonda]

C:\Users\Administrator>sc qc http
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: http
TYPE : 1 KERNEL_DRIVER
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : system32\drivers\HTTP.sys
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : HTTP Service
DEPENDENCIES : WinQuic
SERVICE_START_NAME :

C:\Users\Administrator>sc config http start= auto
[SC] ChangeServiceConfig SUCCESS

 

[Maxstar]

Great, please run the following commands and post the result.

sc start http
sc qc http
sc query http

 

[rhonda]

C:\Users\Administrator>sc start http
[SC] StartService FAILED 1009:

The configuration registry database is corrupt.


C:\Users\Administrator>sc qc http
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: http
TYPE : 1 KERNEL_DRIVER
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : system32\drivers\HTTP.sys
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : HTTP Service
DEPENDENCIES : WinQuic
SERVICE_START_NAME :

C:\Users\Administrator>sc query http

SERVICE_NAME: http
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1009 (0x3f1)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

 

[Maxstar]

Please run the following command and post the HTTP.txt file.

reg query HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo > "%userprofile%\Desktop\HTTP.txt"

Edit:
please run also the following command and post the result:

netsh show ssl cert

 

[rhonda]

C:\Users\Administrator>netsh show ssl cert
The following command was not found: show ssl cert.

 

[Maxstar]

Hmm, do you recognize the following entry under this key, which shouldn't be there?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443

If not detete that entry and run the following command again.

netsh http show sslcert

 

[rhonda]

Let me back it all up and I'll check on it. I will be away for a few hours but will update after that. I appreciate the help.

 

[Maxstar]

Update: I was able to reproduce this issue, but could your provide an export of this key to look at.

Export registry key as hive file.

• Open the Start menu of Windows and type CMD.
• When you see Command Prompt on the list, select the option Run as administrator.
• Copy and paste the following command into the command prompt and press enter.

reg save "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo" "%userprofile%\Desktop\SslBindingInfo.hiv"

• Once done, a file will appear on your desktop, called SslBindingInfo.hiv.
• ZIP this file and attach it to your next reply.

 

[rhonda]

Hello, so sorry about the lag. I'm hesitant to remove the 0.0.0.0:443 reg but attached is what you just requested. It looks to be empty.

 

[Maxstar]

Hi,

Yes this key is empty and seems to be the issue. So please run the following command, I expect you will see the message: The configuration registry database is corrupt or The handle is invalid.

netsh http show sslcert

See also this article about IIS / Certificate Mapping.