[SOLVED] SFC reporting hash mismatch for tls_branding_config.xml Windows Server 2022 Datacenter

[Tanque]

Hi very sorry to bother,

Im currently using Windows Server 2022 Datacenter in an Azure VM. I recently uninstalled Licensed Remote-Desktop-Services and now I cant use the standard RDP.
When running sfc /scannow I get the attached log. But when i run "DISM /online /cleanup-image /RestoreHealth" i dont see any issues currently, however, I'm unable to RDP into the server.

I saw a few Windows Server 2022 threads but they all seem to include different sized attachments so I didn't know which one would apply to me.

 

[Windows Update Bot]

Hi @Tanque,

Welcome to Sysnative Forums!

If you haven't already, please review the posting instructions here, and attach the requested log files. Without log files, our helpers will not be able to assist, and this will slow down fixing your machine.

If logs have been already been provided, our team of volunteers will analyse the provided log files to build a fix for your system. Please be aware that this may take several days from your initial post, due to the high volume of threads that we receive.


- Sysnative Windows Update Team

 

[Tanque]

attached is the most updated cbs log.

Also jsut as a side note, im having to access the server via azure serial console, so i cant use any gui components.

 

[Maxstar]

2025-01-16 06:30:19, Info                  CSI    0000020b [SR] Cannot repair member file [l:23]'tls_branding_config.xml' of Microsoft-Windows-TerminalServices-LicenseServer-TlsBrand, version 10.0.20348.2849, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2025-01-16 06:30:19, Info                  CSI    0000020c Hashes for file member [l:23]'tls_branding_config.xml' do not match.
 Expected: {l:32 ml:33 b:045852938e96aa28197993a6efc401407d94185aff8c13172ad3252ff711ba45}.
 Actual: {l:32 b:49c898176d9ad8669bb1761a62e4fddb9da3b98f8cc3a311db7ac374bc4d2c37}.

Hi and welcome to Sysnative,

Warning: This fix was written specifically for this system. Do not run this fix on another system.

1. Download the attachement: amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.20348.2849_none_f6d5f2aab5f717fd.zip
2. Unpack this file and replace the tls_branding_config.xml file, maybe you'll need to ammend the following commands a bit for the azure serial console.

icacls "%systemroot%\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.20348.2849_none_f6d5f2aab5f717fd" /save "%userprofile%\desktop\perms.acl" /t
takeown /f "%systemroot%\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.20348.2849_none_f6d5f2aab5f717fd" /r
icacls "%systemroot%\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.20348.2849_none_f6d5f2aab5f717fd" /grant administrators:(F) /t

Copy the tls_branding_config.xml file into the "amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.20348.2849_none_f6d5f2aab5f717fd" folder.

icacls "%systemroot%\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.20348.2849_none_f6d5f2aab5f717fd" /setowner "NT SERVICE\TrustedInstaller" /t
icacls "%systemroot%\WinSxS" /restore "%userprofile%\desktop\perms.acl" /t

 

[Tanque]

Thank you very much. This fixed everything

 

[Maxstar]

You're welcome. Glad to hear the issue has been resolved...