2008 R2 - won't update, SFC fails, probably eats babies too.

OK. I'm going to have you navigate to the following key to see if an error comes up.

Code: 
COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-i..l-keyboard-0001080c_31bf3856ad364e35_none_1036028c71d2d28b\f256!kbdbene.dll

Navigate to Registry Key
1. Click your Start button and type regedit in the search box
2. Click on the REGEDIT program that shows in the search results
3. Answer Yes at the User Account Control message if it comes up.
4. Navigate to HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-i..l-keyboard-0001080c_31bf3856ad364e35_none_1036028c71d2d28b
Capture.JPG

5. Let me know if you get any errors when you get to this key. I suspect you will.
 
I can get to the key itself, but there are two keys within it, f256!kbdbene.dll and v!6.1.7600.16385. If I click on f256!kbdbene.dll, I receive a message that it can't be opened, an error is preventing it from being opened, system cannot find the file specified. v!6.1.7600.16385 can be accessed without error.
 
Yup. That's our issue. Knowing this is a DC makes it a little more difficult.

Can you right click on the parent key (amd64_microsoft-windows-i..l-keyboard-0001080c_31bf3856ad364e35_none_1036028c71d2d28b) and delete the entire key? Does it let you?
 
Nope, it declined to with a somewhat unhelpful 'error while deleting key'. The other subkey vanished, it was apparently successfully deleted, but the f256!kbdbene.dll subkey remains.
 
OK, I have a plan. Let's get another more current copy of your COMPONENTS hive.

Retrieve Components Hive
Note: Please follow the steps exactly as it will be slightly different than the first time this was done.

  • Ensure you delete the COMPONENTS.zip and COMPONENTS files from your desktop (if they exist).
  • Open RegBack again.
  • Click the New Backup button.
  • Click the link that says "Click here to view details of the hives in the backup"
  • Ensure that only "System (recommended)" is checked at the top of the screen and only the C:\Windows\System32\config\COMPONENTS hive is checked at the bottom of the screen and click OK.
  • Click Start.
  • When it says Finished successfully, click the Close button.
  • This will bring you back to the main screen of the program. You will see a couple entries in this list. Right-click on this most recent line-item and select Explore Backup...
  • This will bring you into the folder where the backup was made. You should see a Users folder and a Windows folder along with a couple other files. Double-click on the Windows folder to open it. Then open the System32 folder and then config folder.
  • Copy the COMPONENTS file to your Desktop.
  • Now right click on the COMPONENTS file that is on your desktop and select Send to > Compressed (zipped) folder.
  • Then please upload the zip file (COMPONENTS.zip) to your favourite file sharing website (it will be too big to upload here). Examples of services to upload to are Dropbox or One Drive or SendSpace and then just provide the link in your reply.
  • You can close any open windows you have as well as the RegBack program now.
 
OK, let's do the following. This will have to be done when you are able to reboot the server. Please follow exactly step by step and stop if you receive any unexpected messages or errors. Thank you. Let me know when complete.

Replace Components Hive
1. Download componentsnew.zip to your desktop.
2. Right-click on componentsnew.zip and select Extract All...
3. Ensure "Show extracted files when complete" is checked and click the Extract button.
4. The componentsnew folder will open and you will see the components file inside it.
5. Right-click on the components file and select copy.
6. Open Registry Backup and Restore (regback) again.
7. Right-click on the most recent backup and select Explore Backup...
8. This will bring you into the folder where the backup was made. You should see a Windows folder along with a couple other files. Double-click on the Windows folder to open it. Then open the System32 folder and then config folder. You should see an existing file named COMPONENTS.
9. Right-click in a blank area of this window and select paste. You will be prompted that "There is already a file with the same name in this location". Click Copy and Replace.
10. You may receive another dialog asking for confirmation. Click the Continue button if you do.
11. You may close this window now. It will bring you back to the Regsitry Backup and Restore window showing your backups.
12. Ensure that the most recent backup is still selected and click the Restore... button.
13. Click the Advanced Options link at the bottom of the screen.
14. Change the Restoration Mode to Copy Files. You will receive a warning about changing this setting. Answer Yes to continue.
15. Click the OK button on this screen.
16. Click the Start button. You will be prompted asking if you are sure. Answer Yes.
17. Once complete you will see it say Finished. Then you can click the Cancel button on the Registry Restore screen.
18. Close any remaining open windows and programs and reboot the server.
 
The new registry is in, the server rebooted properly, and it's now trying to install a pile of updates. I'm afraid to jynx it, but I think we might be in the clear now.
 
It's downloaded and installed updates up to current day! It took a lot of running the updates, a lot of reboots, and at least one full system image backup from being terrified that one of the updates might break something after so much work, but everything looks normal. There's one holdout that's failing to install, but it's just a .net update for a browser vulnerability, so not a priority for a server.
 
Great news. It's up to you if you would like to troubleshoot the issue with the last update or not or leave along. Let me know.
 
I hate to spend more time on this thing, especially for such an unimportant update. But I just know that whatever's breaking that update is inevitably going to come back to bite us for something more important down the road. The update that's failing is KB2840631, and it's doing so with error 0x80073712.
 
I agree. Just didn't want to push if you weren't interested. Please manually download and install this update and then attempt to install. When it fails please send me the following two logs.

c:\windows\logs\cbs\cbs.log
c:\windows\windowsupdate.log
 
We really need to get that memory test run when you get a chance.

Also, does this server get its updates from a WSUS server? Is this server the WSUS server?

Lastly, please do the following again.

System Update Readiness Tool (SUR)
 1. Download and run the following file. Or use the one you already downloaded.
2. When it asks you if you wish to install, please answer yes. Note: It could take 15 minutes or more to run. Please don't cancel.
3. You will get an Installation Complete screen when it's done running.
4. Please attach the log from the following location. C:\Windows\Logs\CBS\CheckSUR.log
Please Note:: if the file is too big to upload to your next post please upload via a service such as Dropbox or One Drive or SendSpace and just provide the link.
 
It is the WSUS server and in the past updated itself. With the whole update breaking issue that of course ended, and after the repairs I had it get the updates direct from microsoft to be sure it had uncorrupted copies. Now that it's back up to date, its default behavior is to update itself through WSUS. (In case you're wondering why it's bothering to download updates that it then serves to itself, there's a second 2008 R2 server handling application databases that it's also updating.)

CheckSUR come out completely clean this time:


=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2016-02-08 22:36

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store

Summary:
Seconds executed: 586
No errors detected
 
Understood. Would you be willing to do a WSUS /Reset from the command-line? This will clean up the corrupted copies that are currently downloaded and get fresh copies.
 
The command's in, but WSUS being WSUS it will of course take an indeterminate but likely obnoxious length of time to complete. Processing now, though.
 
I know. We use it here. Times out all the time when doing a full update and takes many days or longer to re-download all the content. We have a 100Mb fiber but it doesn't matter. The bottlneck is the opposite end. Thankfully we only had to do this three times in the last 17 years.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top