[SOLVED] Server 2019 - SFC found corrupt files - DISM restorehealth: 0x800f0954

[steyrs]

Hi there,

Windows server 2019, 1809 (OS Build 17763.3650) - refuses to install updates
If I'm not mistaken this server was upgraded to Server 2019 - from Server 2012R2 not long ago.

Here's the out - when running sfc /scannow:

C:\>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files but was unable to fix some of them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag
And then trying the DISM command:

C:\>dism /online /cleanup-image /restorehealth

Deployment Image Servicing and Management tool
Version: 10.0.17763.3406

Image Version: 10.0.17763.3650

[===========================99.2%========================= ]
Error: 0x800f0954

DISM failed. No operation was performed.
For more information, review the log file.

The DISM log file can be found at C:\WINDOWS\Logs\DISM\dism.log

Attached files: cbs.zip, componentsscanner.txt, chkdsk-result.txt.

Thanks in advance!

 

[Gary R]

Looking over your logs, may take a while, back as soon as I've finished.

In the meantime ....

• Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
• Please copy this file to your desktop.
• Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
• Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
• The file will likely be too large to upload here, if so please upload to a file sharing service.
• Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

Please post me the link to the file

 

[steyrs]

Take your time Gary!

Can't zip the components file (file is in-use) - even after reboot.
Might try to boot to safe-mode and get it that way.

I will be back

 

[Gary R]

If you can't get it to zip, try the following ....

• Open Regedit (run as Administrator)
• In the left hand column click on HKey_Local_Machine to open it
• In its sub-key menu click on COMPONENTS to select it.
• Click on File and in the file menu click on Unload Hive.
• Allow any prompts and once the COMPONENTS hive is unloaded, exit out of Regedit.

Now try zipping your COMPONENTS hive.

 

[steyrs]

Hi Gary.

That did the trick (actually I had to first load it - and then unload it in registry - to pull it off).
Attached components.zip

 

[Gary R]

WARNING! The following fix is specific to the user's system in this thread only. No one else should follow these instructions, as it could damage your system.

• Download SFCFix.exe and save it to your desktop.
• Download the attachment SFCFix.zip and also save it on your desktop.
• Save any work you have open, and close all programs.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt
• Open the file, then copy and paste its content in your next reply.

Next ...

• Click Search button and type Command Prompt
• From the results, right click on the Command Prompt icon, and select Run as administrator
• A Command Window will open.
• Copy paste the command below into it, then press Enter
• Dism /Online /Cleanup-Image /RestoreHealth
• Once DISM has finished running ...
  • Please attach your ... C:\Windows\Logs\CBS\cbs.log ... to your next reply.
• If the file is too large, upload it to a file sharing service, and post me the link.
• Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

 

[steyrs]

Hi Gary.

Here are the contents of SFCFix.txt:

SFCFix version 3.0.2.1 by niemiro.
Start time: 2024-04-27 10:18:09.060
Microsoft Windows Server 10 Build 17763 - amd64
Using .zip script file at C:\Users\Administrator\Desktop\SFCFix.zip [0]


PowerCopy::
Successfully took permissions for file or folder C:\WINDOWS\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000470_31bf3856ad364e35_10.0.17763.1_none_d795e78abcaad466\KBDIBO.DLL
Successfully took permissions for file or folder C:\WINDOWS\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000046d_31bf3856ad364e35_10.0.17763.1_none_eea573aaadd7a631\KBDBASH.DLL
Successfully took permissions for file or folder C:\WINDOWS\WinSxS\Manifests\amd64_microsoft-windows-i..l-keyboard-0000046d_31bf3856ad364e35_10.0.17763.1_none_eea573aaadd7a631.manifest
Successfully took permissions for file or folder C:\WINDOWS\WinSxS\Manifests\amd64_microsoft-windows-i..l-keyboard-00000470_31bf3856ad364e35_10.0.17763.1_none_d795e78abcaad466.manifest

Successfully copied file C:\Users\Administrator\AppData\Local\niemiro\Archive\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000470_31bf3856ad364e35_10.0.17763.1_none_d795e78abcaad466\KBDIBO.DLL to C:\WINDOWS\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000470_31bf3856ad364e35_10.0.17763.1_none_d795e78abcaad466\KBDIBO.DLL.
Successfully copied file C:\Users\Administrator\AppData\Local\niemiro\Archive\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000046d_31bf3856ad364e35_10.0.17763.1_none_eea573aaadd7a631\KBDBASH.DLL to C:\WINDOWS\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000046d_31bf3856ad364e35_10.0.17763.1_none_eea573aaadd7a631\KBDBASH.DLL.
Successfully copied file C:\Users\Administrator\AppData\Local\niemiro\Archive\Manifests\amd64_microsoft-windows-i..l-keyboard-0000046d_31bf3856ad364e35_10.0.17763.1_none_eea573aaadd7a631.manifest to C:\WINDOWS\WinSxS\Manifests\amd64_microsoft-windows-i..l-keyboard-0000046d_31bf3856ad364e35_10.0.17763.1_none_eea573aaadd7a631.manifest.
Successfully copied file C:\Users\Administrator\AppData\Local\niemiro\Archive\Manifests\amd64_microsoft-windows-i..l-keyboard-00000470_31bf3856ad364e35_10.0.17763.1_none_d795e78abcaad466.manifest to C:\WINDOWS\WinSxS\Manifests\amd64_microsoft-windows-i..l-keyboard-00000470_31bf3856ad364e35_10.0.17763.1_none_d795e78abcaad466.manifest.

Successfully restored ownership for C:\WINDOWS\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000470_31bf3856ad364e35_10.0.17763.1_none_d795e78abcaad466\KBDIBO.DLL
Successfully restored permissions on C:\WINDOWS\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000470_31bf3856ad364e35_10.0.17763.1_none_d795e78abcaad466\KBDIBO.DLL
Successfully restored ownership for C:\WINDOWS\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000046d_31bf3856ad364e35_10.0.17763.1_none_eea573aaadd7a631\KBDBASH.DLL
Successfully restored permissions on C:\WINDOWS\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000046d_31bf3856ad364e35_10.0.17763.1_none_eea573aaadd7a631\KBDBASH.DLL
Successfully restored ownership for C:\WINDOWS\WinSxS\Manifests\amd64_microsoft-windows-i..l-keyboard-0000046d_31bf3856ad364e35_10.0.17763.1_none_eea573aaadd7a631.manifest
Successfully restored permissions on C:\WINDOWS\WinSxS\Manifests\amd64_microsoft-windows-i..l-keyboard-0000046d_31bf3856ad364e35_10.0.17763.1_none_eea573aaadd7a631.manifest
Successfully restored ownership for C:\WINDOWS\WinSxS\Manifests\amd64_microsoft-windows-i..l-keyboard-00000470_31bf3856ad364e35_10.0.17763.1_none_d795e78abcaad466.manifest
Successfully restored permissions on C:\WINDOWS\WinSxS\Manifests\amd64_microsoft-windows-i..l-keyboard-00000470_31bf3856ad364e35_10.0.17763.1_none_d795e78abcaad466.manifest
PowerCopy:: directive completed successfully.


Successfully processed all directives.

Failed to generate a complete zip file. Upload aborted.

SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 4 datablocks.
Finish time: 2024-04-27 10:21:27.014
Script hash: l9Ks/JWh81c4+i+K9ndP6RKWSozF37TAxu3QZspFHNg=
----------------------EOF-----------------------

CBS.log attached

 

[Gary R]

Latest log is not flagging anything, so please try updating.

If successful please let me know.

If not, please post the CBS.log created after your update attempt.

 

[steyrs]

Unfortunately Windows update fails.
A restart of the server doesn't make any difference.



CBS.log attached

 

[Gary R]

Need to consult with my colleagues, your latest CBS.log is not telling me a lot (or at least it's not entirely clear what it is telling me).

May be a while before I get back to you, but I'll be as quick as I can.

 

[steyrs]

Take all the time you need Gary!

Really appreciate your help!

 

[Gary R]

Please can you do the following ....

• Run the command SFC /SCANNOW in an elevated command prompt and report the result.

Next ...

Once the SFC scan has finished ...

• Open Windows Explorer and browse to the ... C:\Windows\Logs\CBS ... folder.
• Right click on it, and select ... Send to > Compressed (zipped) folder
• A message will appear stating, "Windows cannot create the Compressed (zipped) Folder here. Do you want it to be placed on the desktop instead?"
  • Answer Y to create a folder CBS.zip on your Desktop.
• Please attach it to your next post.
  • If the file is too large, please upload it to a file sharing service and provide the link to it in your next reply.
  • Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline

 

[steyrs]

Sure thing Gary.

SFC scannow result and CBS attached.

 

[Gary R]

Sorry for the long wait, latest log didn't show what I'd expected, so have been consulting to see what (if anything) I'd missed.

Please try updating your computer again.

When it fails (as I expect it will), please post me the CBS.log created after the update attempt.

Also, please do the following ....

• Open a search and type Powershell
• Right click on the Powershell icon and select (Run as Administrator) to open a Powershell window.
• At the prompt type ... Get-WindowsUpdateLog ... and then hit return.
• Windows will collect details of your updates and when finished create a logfile ... WindowsUpdate.log ... on your Desktop.
• Please post me that log

 

[steyrs]

No worries Gary!

Updating attempted.
Failed as expected.

CBS.log and Windowsupdate.log attached.

 

[Gary R]

Is this server connected to a WSUS server and which proxy-settings are set?

What protective programs do you have installed (AV, Firewall) ?

 

[steyrs]

Yes the server gets the updates from our SCCM (ConfigMgr, MECM) setup - port 8530.
(even if I seek online - via Microsoft update - the server bogs down)

Windows Defender and Windows Firewall

I could try to download a single update - and update by hand?

 

[Gary R]

I could try to download a single update - and update by hand?

OK, give that a try, and let me know how things go.

 

[steyrs]

Chose latest cumulative patch for april 2024 - KB5036896
Installation completed - seems to be OK.

Attached cbs.log

 

[Gary R]

Export registry key as hive file.

• Open the Start menu of Windows and type CMD.
• When you see Command Prompt on the list, select the option Run as administrator.
• Copy and paste the following command into the command prompt and press enter.

reg save "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" "%userprofile%\Desktop\Services.hiv"

• Once done, a file will appear on your desktop, called Services.hiv.
• ZIP this file and attach it to your next reply.

Next ...

Please run the following command as well in an elevated prompt and attach services.txt to your next post.

WMIC SERVICE GET caption, name, startmode, state > "%userprofile%\desktop\services.txt"