server 2022 update error 0x800f0905

Status
Not open for further replies.
Thanks. Let's hope this one shines a light on the cause of your problem.

Looking things over now, may take a while.
 
I need to see your whole CBS folder, so can you please do the following for me ....

  • Open Windows Explorer and browse to the ... C:\Windows\Logs\CBS ... folder.
  • Right click on it, and select ... Send to > Compressed (zipped) folder
  • A message will appear stating, "Windows cannot create the Compressed (zipped) Folder here. Do you want it to be placed on the desktop instead?"
    • Answer Y to create a folder CBS.zip on your Desktop.
  • Please attach it to your next post.
    • If the file is too large, please upload it to a file sharing service and provide the link to it in your next reply.
    • Examples of services to upload to are WeTransfer and TransferKit and SendFileOnline
 
Thanks.

Something strange is going on, and I'm going to have to consult on it, so it could be a while before I get back to you.


Just to explain .....


Your ProcMon log starts at 16:50 on 4th Oct and finishes at 16:53

Code: 
16:50:37.3145939    ProxySrv.exe    TCP TCPCopy    VBG-Milestone.vanberkelgroep.eu:51566 -> 192.168.31.216:rtsp    SUCCESS    Length: 1382, seqnum: 0, connid: 0




16:53:12.1280364    wuauclt.exe    QueryOpen    C:\$WinREAgent\Scratch\Mount\Windows\WinSxS\amd64_microsoft-windows-winbio.resources_31bf3856ad364e35_10.0.20348.1_en-us_2549c165b4479302



However, the CBS.log you posted started at 2023-10-04 17:22:15 and finished at 2023-10-04 18:06:41

This in itself is not particularly unusual, since CBS logs are added to all the time, and when they reach a certain size are archived as "persist" logs and a new one is started, which is why I asked to see the whole CBS folder.

Problem we have is that the log which should contain the information recorded during your ProcMon scan ... CbsPersist_20231004152215.log ..... contains ....

Code: 
2023-10-04 16:36:38, Info                  CBS    Ending the TrustedInstaller main loop.
2023-10-04 16:36:38, Info                  CBS    Starting TrustedInstaller finalization.
2023-10-04 16:36:38, Info                  CBS    Lock: Lock removed: WinlogonNotifyLock, level: 8, total lock:6
2023-10-04 16:36:38, Info                  CBS    Ending TrustedInstaller finalization.


2023-10-04 17:04:37, Info                  CBS    TI: --- Initializing Trusted Installer ---
2023-10-04 17:04:37, Info                  CBS    TI: Last boot time: 2023-10-04 10:20:24.621
2023-10-04 17:04:37, Info                  CBS    Starting TrustedInstaller initialization.
2023-10-04 17:04:37, Info                  CBS    Lock: New lock added: CCbsPublicSessionClassFactory, level: 30, total lock:4

.... so again there are no entries in CBS at the time you ran ProcMon ..... and as far as I'm aware, there should be.
 
Last edited:
There is something going wrong with procmon then because I ran it at a different time and for at least 10 minutes I'll have a look at it to see if I can tell what is happening.
 
OK thanks. I look forward to hearing back from you.
 
Procmon slows down to a crawl at around 300.000 events. So after clearing the log until the last part of the windows update and letting it run for around 20 minutes longer after that I was able to capture the time when I got the update error. Here are the new files:
https://files.vanberkelbedrijven.nl/file/VanBerkelFileshare/CBS (3).zip
https://files.vanberkelbedrijven.nl/file/VanBerkelFileshare/Logfile3.PML

Note that this procmon log doesn't include the beginning of the windows update only the end.
 
No problem, it's not usually the beginning that concerns us, it's seeing what's going on at the point of failure that often gives us the clues we need to resolve things.

Downloading your latest logs now, will get back to you as soon as I've looked them over, and come to any conclusions. I may be a while, dependant on what I find.
 
Still the same disparity between your ProcMon log and your CBS.log I'm afraid. Your ProcMon logs also show that wermngr.exe (windows error reporting manager) was not running, which is almost certainly related to why there are no CBS entries being recorded at the time of the update failure (and ProcMon scan).

We believe this may be due to the 3rd party applications that were running at the time of the scan, particularly the Xprotect recording software.

Is it possible for you to run a ProcMon scan whilst updating, at a time when the server is not in use, and you can disable as many 3rd party applications as possibe (especially Xprotect) ?
 
It's been 5 days since I last posted, and I haven't received a reply from you.

Do you still need help with your problem ?

If I don't hear back from you in the next 24 hours I will presume not, and will close this topic.
 
Yes I still need help. But I need to plan a maintanance window where I can stop te recording server while running procmon. So that is why is taking a bit longer.
 
It would have helped if you had let me know that, that way I would not have had to make (false) assumptions.

There are very few trained helpers here, so if I'm helping you then I can't be helping others, so when/if there are delays I don't know about, it means that my time is not being used productively, and I'm not helping as many people as I could have been.
 
Due to lack of activity, this topic is now closed.

If you still need help, please start a new topic and wait for a new helper.
 
Status
Not open for further replies.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top