[SOLVED] Server 2019 fails Cumulative Update with 0x800705AA

[danrdj]

Hi Maxstar,

We're considering/scheduling the in-place OS upgrade (sticking with 2019).

Yes, I would think that \\TSCLIENT\SCARD\6 refers to a Remote Desktop client redirected device. This is a Terminal Server. I do know that I've attempted the patch installs with no TS users connected, though, if that helps.

The Handle output says "No matching handles found." Would I have to run the patch with procmon, grab the reg path from the Access Denied (I meant "INSUFFICIENT RESOURCES") message, and put that into Handle?

Thanks,
Dan

 

[danrdj]

I ran it again right after I saw the INSUFFICIENT RESOURCES

handle.exe -a -v "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect\Microsoft-Windows-ServerDatacenterEdition~31bf3856ad364e35~amd64~~0.0.0.0\Package_16_for_KB5027222~31bf3856ad364e35~amd64~~10.0.1.5" >> C:\Support\UserHandles.csv

and it appended the Chinese characters (attached).

Ummm.....

 

[Maxstar]

Hi,

Please attach a new copy of the Components Based Servicing hive.

Export CBS (Component Based Servicing) hive

• Click on the Start button and type regedit
• When you see regedit on the list, right-click on it and select Run as administrator.
• When regedit opens, using the left pane, navigate to the following registry key and select it by clicking on it once.
  

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing

• Once selected, click File > Export....
• Change the Save as type: to Registry Hive Files (*.*).
  
  
  
  
  
• Name this file ComponentBasedServicing (with no file extension) and save it to your Desktop.
• Right-click on the saved file and choose Send > Compressed (zipped) Folder.
• Attach the .ZIP file to your next post.
• If the file is too large to upload here, upload the file to www.wetransfer.com and post the link in your next reply.

 

[danrdj]

Sure, here!

 

[Maxstar]

Hi,

Warning: This command was written specifically for this system. Do not run it on another systems.

Please open an elevated command prompt, run the following command and post the result.

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect\Microsoft-Windows-ServerDatacenterEdition~31bf3856ad364e35~amd64~~0.0.0.0" /v "Package_16_for_KB5027222~31bf3856ad364e35~amd64~~10.0.1.5" /t REG_DWORD /d 0x2 /f

 

[danrdj]

ERROR: Access is denied

Edit: Then I gave SYSTEM full permissions to the key and ran it as SYSTEM, and got this:

ERROR: Insufficient system resources exist to complete the requested service.

 

[Maxstar]

This is really interesting, could you please run the following script with FRST to list the permissions for this key.

Download the

Farbar Recovery Scan Tool and save it to your Desktop:

Download the 64 bit version: - Farbar Recovery Scan Tool Link

• Download the attachment fixlist.txt and save it to your desktop.
• Right-click on FRST.exe and select "Run as administrator".
• Press the Fix button.
• If for some reason the tool needs a restart, please make sure you let the system restart normally.
• When finished, a log called Fixlog.txt will appear in the same directory the tool is run from.
• Post the logfile Fixlog.txt as attachment in your next reply.

Spoiler

permissions of "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect\Microsoft-Windows-ServerDatacenterEdition~31bf3856ad364e35~amd64~~0.0.0.0":

Owner: BUILTIN\Administrators

DACL(AI):

NT SERVICE\TrustedInstaller    ALLOW    All Access    (I)
NT SERVICE\TrustedInstaller    ALLOW    Generic All    (CI-I-OI)
NT AUTHORITY\SYSTEM    ALLOW    Read    (I)
NT AUTHORITY\SYSTEM    ALLOW    Generic Read    (CI-I-OI)
BUILTIN\Administrators    ALLOW    Read    (I)
BUILTIN\Administrators    ALLOW    Generic Read    (CI-I-OI)
BUILTIN\Users    ALLOW    Read    (I)
BUILTIN\Users    ALLOW    Generic Read    (CI-I-OI)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES    ALLOW    Read    (I)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES    ALLOW    Generic Read    (CI-I-OI)
S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681    ALLOW    Read    (I)
S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681    ALLOW    Generic Read    (CI-I-OI)

 

[danrdj]

Attached

 

[Maxstar]

Let's try the following script with SFCFix to add an value instead of using the command prompt.

Download

SFCFix and save it to your desktop.
Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFixScript.txt and save it to your desktop.
• Drag the SFCFixScript.txt file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

 

[danrdj]

Attached

 

[Maxstar]

Hi,

Unfortunately, this fix failed as well.

Retrieve SOFTWARE Hive
Note: The SOFTWARE hive has confidential and sensitive information in it so please send me a PM with a link to that particular hive so it's not in the public form.

• Please download the Freeware RegBak from here: Acelogix Software - Download products
  You will find it at the bottom of the page that the link brings you to.
• Go ahead and install this program and accept all the defaults. After the last install screen the program should open.
• Click the New Backup button. Accept the defaults and simply click Start.
• When it says Finished successfully, click the Close button.
• This will bring you back to the main screen of the program. You will see one entry in this list with the date that you did it. Right-click on this line-item and select Explore Backup...
• This will bring you into the folder where the backup was made. You should see a Users folder and a Windows folder along with a couple other files. Double-click on the Windows folder to open it. Then open the System32 folder and then config folder. You should see around 6 files in here, one of which is named SOFTWARE.
• Copy this file to your Desktop.
• Now right click on the file on your desktop and select Send to > Compressed (zipped) folder.
• Then please upload the zip file(s) to your favourite file sharing website (it will be too big to upload here). Examples of services to upload to are Dropbox or OneDrive or WeTransfer and then just provide the link in your reply.
• You can close any open windows you have as well as the RegBak program now.

 

[danrdj]

Thanks for the idea! I found that the SOFTWARE hive is 2097152KB (exactly 2GB) so it's maxed out.
I went looking for what was bloating it and found a number of these that were huge:

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider\Servers\XXX01\Monitors\Client Side Port\{xxxxx-xxxx-xxxx-xxxx-xxxxxxxxx}

I deleted them. Now trying the update again.
Should I plan to export SOFTWARE, rename the current one, and import it again so that the file isn't 2GB or is there a more graceful way to do that?

 

[Maxstar]

Hi,

You can replace the amended SOFTWARE hive with RegBak.

SOFTWARE Hive Replacement with RegBak
Warning: This fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good.

1. Close all open programs and save all your work. You will need to reboot the machine during this process.
2. Copy the amended SOFTWARE hive to where you previously saved a backup. It should be (C:\Windows\RegBak\PC-NAME\DATE\Windows\System32\Config)
3. 
4. Overwrite the one that is currently there when prompted.
5. Open RegBak by click Start and selecting Registry Backup and Restore. Highlight the backup in the list (it should be the one date today), and press Restore. Click Start. RegBak will reboot your computer to complete the restore process.

 

[danrdj]

These are the instructions I had seen for compacting the unused space in the hive:
Compress large registry hives - Windows Server

I made the changes to the live SOFTWARE hive, exported As Hive, made a regbak backup, copied the exported one into the backup, and restore only the SOFTWARE hive from backup (your instructions should point that out as default it restores everything), and let it reboot.

And...... Windows Update successful!
Thanks so much for the help!

 

[Maxstar]

Hi,

You're welcome and thanks for sharing that article about compressing "bloated" hive files. @x BlueRobot has already pointed out to me this could be the problem. That's why I asked for a copy of this hive through PM, so we could look into this further. However, you had already found the problem because of the 2 GB size limit of the registry hives.

your instructions should point that out as default it restores everything

I used an (older) canned, but you are right that this could be much clearer with a new screenshot as well, I will add this to a to-do list...