SFC unable to repair Server 2019 Datacenter Terminal Server

New error message:
Code: 
PS C:\windows\system32> sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 59% complete.

Windows Resource Protection could not perform the requested operation.
 

Attachments

Rich (BB code): 
2022-02-18 15:37:11, Info                  CSI    00003c3c [SR] Verify complete
2022-02-18 15:37:11, Info                  CSI    00003c3d [SR] Verifying 100 components
2022-02-18 15:37:11, Info                  CSI    00003c3e [SR] Beginning Verify and Repair transaction
2022-02-18 15:37:11, Error                 CSI    00003c3f@2022/2/18:21:37:11.591 (F) onecore\base\wcp\componentstore\deltastore.cpp(3065): Error STATUS_INVALID_PARAMETER originated in function ComponentStore::CRawStoreLayout::DecompressFile expression: Parameter check failed
[gle=0x80004005]

It's a different error but will be very likely related to the same problem.

Step#1 - Capture Process Monitor Trace
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Please run DISM /Online /Cleanup-Image /RestoreHealth just like you have in the past.
3. Stop Process Monitor as soon as it fails. You can simply do this by clicking the square icon on the toolbar as shown below.
j8MhY5V.png

4. Select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
5. Zip up and provide the link to the LogFile.PML file as well as your CBS.log Examples of services to upload to are Dropbox or OneDrive or SendSpace.

Please also provide the latest copy of your COMPONENTS hive:

Retrieve Components Hive
1. Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
2. Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
3. Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
4. The file will likely be too large to upload here so please upload to a file sharing service. Examples of services to upload to are Dropbox or OneDrive or SendSpace and then just provide the link in your reply.
 
Thank you, could you please check if the following directory exists:

Rich (BB code): 
dir %systemroot%\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17763.2350_none_56f1682d9915d5e5



Would you mind getting another trace for me?

Step#1 - Capture Process Monitor Trace
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Please run sfc /scannow just like you have in the past.
3. Stop Process Monitor as soon as it fails. You can simply do this by clicking the square icon on the toolbar as shown below.
j8MhY5V.png

4. Select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
5. Zip up and provide the link to the LogFile.PML file as well as your CBS.log Examples of services to upload to are Dropbox or OneDrive or SendSpace.
 
Code: 
C:\windows\system32>dir %systemroot%\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17763.2350_none_56f1682d9915d5e5
 Volume in drive C is Windows
 Volume Serial Number is 887C-925B

 Directory of C:\windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17763.2350_none_56f1682d9915d5e5

12/29/2021  11:44 AM    <DIR>          .
12/29/2021  11:44 AM    <DIR>          ..
09/15/2018  12:09 AM                 9 amd64_installed
11/08/2021  11:47 PM         2,502,984 CbsCore.dll
09/15/2018  12:09 AM            51,000 CbsMsg.dll
11/08/2021  11:47 PM            83,272 cmiadapter.dll
11/08/2021  11:47 PM         2,584,400 cmiaisupport.dll
11/08/2021  11:47 PM           657,232 dpx.dll
11/08/2021  11:47 PM           371,528 drupdate.dll
11/08/2021  11:47 PM         1,213,768 drvstore.dll
11/08/2021  11:52 PM           147,784 EdgeAI.dll
09/15/2018  12:09 AM         1,247,506 GlobalInstallOrder.xml
09/15/2018  12:09 AM           516,408 msdelta.dll
09/15/2018  12:09 AM            55,096 mspatcha.dll
09/15/2018  12:09 AM           142,848 poqexec.exe
11/08/2021  11:47 PM           859,472 smiengine.dll
09/15/2018  12:09 AM            36,664 smipi.dll
11/08/2021  11:47 PM           466,248 TiFileFetcher.exe
11/08/2021  11:30 PM           231,936 TiWorker.exe
11/08/2021  11:47 PM           541,512 turbostack.dll
11/08/2021  11:47 PM         2,771,272 updateagent.dll
09/15/2018  12:09 AM             1,047 WcmTypes.xsd
11/08/2021  11:47 PM         3,758,928 wcp.dll
09/15/2018  12:09 AM           248,120 wdscore.dll
09/15/2018  12:09 AM            75,576 wrpint.dll
              23 File(s)     18,564,610 bytes
               2 Dir(s)  64,380,432,384 bytes free

C:\windows\system32>

Code: 
PS C:\windows\system32> sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 59% complete.

Windows Resource Protection could not perform the requested operation.
PS C:\windows\system32>

Logfile.zip
 
I don't appear to have the appropriate permissions to access the file you shared?
 
Thank you, unfortunately the logs didn't reveal too much other than the error appears to be getting thrown by the servicing stack. However, I've had a look at the differences between my component and yours, you appear to be missing a value and one of f! marks has a different value as well.

Rich (BB code): 
C:\Users\Administrator>reg query HKEY_LOCAL_MACHINE\Cmers\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202

HKEY_LOCAL_MACHINE\Cmers\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202
    S256H    REG_BINARY    DCE3671F39E82A07EFC403ED69E0A2A0D7B0A5A108EC74660B1AB9C36C4A73D3
    identity    REG_BINARY    4D6963726F736F66742D57696E646F77732D5465726D696E616C53657276696365732D4C6963656E73655365727665722D4C5257495A444C4C2C2043756C747572653D6E65757472616C2C2056657273696F6E3D31302E302E31373736332E312C205075626C69634B6579546F6B656E3D333162663338353661643336346533352C2050726F636573736F724172636869746563747572653D616D6436342C2076657273696F6E53636F70653D4E6F6E537853
    c!microsoft-w..-deployment_31bf3856ad364e35_10.0.17763.1_0451cbc0b3f2604d    REG_BINARY
    c!microsoft-w..-deployment_31bf3856ad364e35_10.0.17763.1_023323de9d9bb855    REG_BINARY
    f!lrwizdll.dll    REG_DWORD    0x1
    f!lserver_pkconfig.xml_4b3e5be4962e6a22    REG_DWORD    0x21


C:\Users\Administrator>reg query HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202

HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202
    S256H    REG_BINARY    DCE3671F39E82A07EFC403ED69E0A2A0D7B0A5A108EC74660B1AB9C36C4A73D3
    identity    REG_BINARY    4D6963726F736F66742D57696E646F77732D5465726D696E616C53657276696365732D4C6963656E73655365727665722D4C5257495A444C4C2C2043756C747572653D6E65757472616C2C2056657273696F6E3D31302E302E31373736332E312C205075626C69634B6579546F6B656E3D333162663338353661643336346533352C2050726F636573736F724172636869746563747572653D616D6436342C2076657273696F6E53636F70653D4E6F6E537853
    c!microsoft-w..-deployment_31bf3856ad364e35_10.0.17763.1_0451cbc0b3f2604d    REG_BINARY
    c!microsoft-w..-deployment_31bf3856ad364e35_10.0.17763.1_023323de9d9bb855    REG_BINARY
    f!lrwizdll.dll    REG_DWORD    0x21
    f!lserver_pkconfig.xml_4b3e5be4962e6a22    REG_DWORD    0x21
    CF    REG_DWORD    0x200



Step#1 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Download the attached fixlist.txt and save it to the Desktop.
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
3. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
4. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
5. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.

Step #2 - SFCFix Script
Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.
  1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
  2. Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
  3. Save any open documents and close all open windows.
  4. On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
  5. Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
  6. SFCFix will now process the script.
  7. Upon completion, a file should be created on your Desktop: SFCFix.txt.
  8. Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.
 

Attachments

Code: 
Fix result of Farbar Recovery Scan Tool (x64) Version: 24-02-2022
Ran by adm-david (26-02-2022 09:04:36) Run:2
Running from C:\Users\adm-david\Desktop
Loaded Profiles: adm-david & MSSQL$MICROSOFT##WID
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
Reg: reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
Reg: reg add HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202 /v f!lrwizdll.dll /t REG_DWORD /d 0x21 /f
Reg: reg add HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202 /v CF /t REG_DWORD /d 0x200 /f
*****************

Error: (0) Failed to create a restore point.

========= reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS =========

The operation completed successfully.



========= End of Reg: =========


========= reg add HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202 /v f!lrwizdll.dll /t REG_DWORD /d 0x21 /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg add HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202 /v CF /t REG_DWORD /d 0x200 /f =========

The operation completed successfully.



========= End of Reg: =========


==== End of Fixlog 09:04:38 ====

Code: 
SFCFix version 3.0.2.1 by niemiro.
Start time: 2022-02-26 09:05:19.859
Microsoft Windows Server 10 Build 17763 - amd64
Using .zip script file at C:\Users\adm-david\Desktop\SFCFix.zip [0]




PowerCopy::
Successfully took permissions for file or folder C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll
Successfully took permissions for file or folder C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml

Successfully copied file C:\Users\adm-david\AppData\Local\niemiro\Archive\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll to C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll.
WARNING: File C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml was not backed up as that would replace the current backup.
Successfully copied file C:\Users\adm-david\AppData\Local\niemiro\Archive\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml to C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml.

Successfully restored ownership for C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll
Successfully restored permissions on C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll
Successfully restored ownership for C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml
Successfully restored permissions on C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml
PowerCopy:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 3 datablocks.
Finish time: 2022-02-26 09:05:20.266
Script hash: gw/dH+8KB4wdv/OG1tKRVrnfO0/VPOQPTzhxL5BXzAA=
----------------------EOF-----------------------
 
Could you please run SFC and then provide the CBS log if it fails? From my understanding, the CF value is used to determine if a component has compressed files associated to it. I've amended the registry to indicate that both files are compressed and have replaced your copy with the files from my VM which I know is updating successfully and has had no issues.
 
Code: 
PS C:\windows\system32> sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files but was unable to fix some of them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.
PS C:\windows\system32>
 

Attachments

Could you please provide the latest copy of your COMPONENTS hive using the following:

Retrieve Components Hive
1. Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
2. Please copy this file to your desktop.
Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
3. Right-click on this file on your desktop and select Send To...Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
4. The file will likely be too large to upload here so please upload to a file sharing service. Examples of services to upload to are Dropbox or OneDrive or SendSpace and then just provide the link in your reply.

Could you please zip up and attach the following folders:

Rich (BB code): 
%systemroot%\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202
%systemroot%\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4

Rich (BB code): 
%systemroot%\WinSxS\Manifests\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202.manifest
%systemroot%\WinSxS\Manifests\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4.manifest
 
Last edited:

Attachments

Thanks and thank you for your patience, I'll take a look into those files.
 
Let's reset the values of the key we changed earlier, back to how they were originally. Please run FRST64 as you did before with the attached script.
 

Attachments

Rich (BB code): 
2022-02-27 12:44:17, Info                  CSI    00006688 Hashes for file member [l:23]'tls_branding_config.xml' do not match.
 Expected: {l:32 ml:4096 b:c3b2a8c679b89829b173cd05bdfa46acb1b28a6d4da26fcf0295387a385a9262}.
 Actual: {l:32 b:8e6adaf781147f87780c1dd37e63b529f4a49482d541a7f417fe46458f395047}.
2022-02-27 12:44:17, Info                  CSI    00006689 [SR] Cannot repair member file [l:23]'tls_branding_config.xml' of Microsoft-Windows-TerminalServices-LicenseServer-TlsBrand, version 10.0.17763.1075, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2022-02-27 12:44:17, Info                  CSI    0000668a Hashes for file member [l:12]'lrwizdll.dll' do not match.
 Expected: {l:32 ml:4096 b:4014fdccec80d54b7cb64f7835693577a15631c2b4e61d6f15e804503a06a18c}.
 Actual: {l:32 b:bcecfe62e7a1459b166414a3cdd877f9ad186058eecc8c375fcb5695597da203}.
2022-02-27 12:44:17, Info                  CSI    0000668b Hashes for file member [l:12]'lrwizdll.dll' do not match.
 Expected: {l:32 ml:4096 b:4014fdccec80d54b7cb64f7835693577a15631c2b4e61d6f15e804503a06a18c}.
 Actual: {l:32 b:bcecfe62e7a1459b166414a3cdd877f9ad186058eecc8c375fcb5695597da203}.
2022-02-27 12:44:17, Info                  CSI    0000668c [SR] Could not reproject corrupted file \??\C:\windows\System32\\lrwizdll.dll; source file in store is also corrupted
2022-02-27 12:44:17, Info                  CSI    0000668d Hashes for file member [l:20]'LServer_PKConfig.xml' do not match.
 Expected: {l:32 ml:4096 b:a68ced28a12c6d3a25c153e76217f1830e2d94b9c71e4f9b2ebb2b01335af2b6}.
 Actual: {l:32 b:c5645f3fc7ee69092e01ba0405a9306c43ccadbe42977c7f4fda7b5e7e1ae2f4}.
2022-02-27 12:44:17, Info                  CSI    0000668e Hashes for file member [l:20]'LServer_PKConfig.xml' do not match.
 Expected: {l:32 ml:4096 b:a68ced28a12c6d3a25c153e76217f1830e2d94b9c71e4f9b2ebb2b01335af2b6}.
 Actual: {l:32 b:c5645f3fc7ee69092e01ba0405a9306c43ccadbe42977c7f4fda7b5e7e1ae2f4}.
2022-02-27 12:44:17, Info                  CSI    0000668f [SR] Could not reproject corrupted file \??\C:\windows\System32\\LServer_PKConfig.xml; source file in store is also corrupted
2022-02-27 12:44:17, Info                  CSI    00006690@2022/2/27:18:44:17.515 Primitive installers committed for repair
2022-02-27 12:44:17, Info                  CSI    00006691@2022/2/27:18:44:17.515 Primitive installers committed for repair
2022-02-27 12:44:17, Info                  CSI    00006692 Hashes for file member [l:23]'tls_branding_config.xml' do not match.
 Expected: {l:32 ml:4096 b:c3b2a8c679b89829b173cd05bdfa46acb1b28a6d4da26fcf0295387a385a9262}.
 Actual: {l:32 b:8e6adaf781147f87780c1dd37e63b529f4a49482d541a7f417fe46458f395047}.
2022-02-27 12:44:17, Info                  CSI    00006693 [SR] Cannot repair member file [l:23]'tls_branding_config.xml' of Microsoft-Windows-TerminalServices-LicenseServer-TlsBrand, version 10.0.17763.1075, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35} in the store, hash mismatch
2022-02-27 12:44:17, Info                  CSI    00006694 [SR] This component was referenced by [l:80]'Package_2579_for_KB5010351~31bf3856ad364e35~amd64~~10.0.1.7.5010351-4796_neutral'
2022-02-27 12:44:17, Info                  CSI    00006695 [SR] This component was referenced by [l:80]'Package_4171_for_KB5010351~31bf3856ad364e35~amd64~~10.0.1.7.5010351-7685_neutral'
2022-02-27 12:44:17, Info                  CSI    00006696 [SR] This component was referenced by [l:80]'Package_5009_for_KB5010351~31bf3856ad364e35~amd64~~10.0.1.7.5010351-9117_neutral'
2022-02-27 12:44:17, Info                  CSI    00006697 Hashes for file member [l:23]'tls_branding_config.xml' do not match.
 Expected: {l:32 ml:4096 b:c3b2a8c679b89829b173cd05bdfa46acb1b28a6d4da26fcf0295387a385a9262}.
 Actual: {l:32 b:8e6adaf781147f87780c1dd37e63b529f4a49482d541a7f417fe46458f395047}.
2022-02-27 12:44:17, Info                  CSI    00006698 Hashes for file member [l:23]'tls_branding_config.xml' do not match.
 Expected: {l:32 ml:4096 b:c3b2a8c679b89829b173cd05bdfa46acb1b28a6d4da26fcf0295387a385a9262}.
 Actual: {l:32 b:8e6adaf781147f87780c1dd37e63b529f4a49482d541a7f417fe46458f395047}.

For verification, here's the SHA256 hashes of the files attached:

Rich (BB code): 
SHA256 hash of LServer_PKConfig.xml:
a68ced28a12c6d3a25c153e76217f1830e2d94b9c71e4f9b2ebb2b01335af2b6
CertUtil: -hashfile command completed successfully.

SHA256 hash of lrwizdll.dll:
4014fdccec80d54b7cb64f7835693577a15631c2b4e61d6f15e804503a06a18c

SHA256 hash of tls_branding_config.xml:
c3b2a8c679b89829b173cd05bdfa46acb1b28a6d4da26fcf0295387a385a9262
CertUtil: -hashfile command completed successfully.

Please run the SFCFix with the attached file and then run SFC /scannow as you have before. Afterwards, run the following commands in a command prompt window and then post the output of each:

Rich (BB code): 
certutil -hashfile "%systemroot%\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml" SHA256

certutil -hashfile "%systemroot%\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll" SHA256

certutil -hashfile "%systemroot%\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml" SHA256

You should get the same output as shown above. Please attach the CBS log too.
 

Attachments

Code: 
Fix result of Farbar Recovery Scan Tool (x64) Version: 27-02-2022
Ran by adm-david (04-03-2022 13:40:00) Run:3
Running from C:\Users\adm-david\Desktop
Loaded Profiles: adm-david & PCoelh & adm-sujil & MSSQL$MICROSOFT##WID
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
Reg: reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
Reg: reg add HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202 /v f!lrwizdll.dll /t REG_DWORD /d 0x1 /f
Reg: reg add HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202 /v f!lserver_pkconfig.xml_4b3e5be4962e6a22 /t REG_DWORD /d 0x1 /f
DeleteValue: HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202|CF
*****************

Error: (0) Failed to create a restore point.

========= reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS =========

The operation completed successfully.



========= End of Reg: =========


========= reg add HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202 /v f!lrwizdll.dll /t REG_DWORD /d 0x1 /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg add HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202 /v f!lserver_pkconfig.xml_4b3e5be4962e6a22 /t REG_DWORD /d 0x1 /f =========

The operation completed successfully.



========= End of Reg: =========

"HKLM\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\\CF" => removed successfully

==== End of Fixlog 13:40:01 ====

Code: 
SFCFix version 3.0.2.1 by niemiro.
Start time: 2022-03-04 13:41:16.385
Microsoft Windows Server 10 Build 17763 - amd64
Using .zip script file at C:\Users\adm-david\Desktop\SFCFix.zip [0]




PowerCopy::
Successfully took permissions for file or folder C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml
Successfully took permissions for file or folder C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll
Successfully took permissions for file or folder C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml

WARNING: File C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml was not backed up as that would replace the current backup.
Successfully copied file C:\Users\adm-david\AppData\Local\niemiro\Archive\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml to C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml.
WARNING: File C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll was not backed up as that would replace the current backup.
Successfully copied file C:\Users\adm-david\AppData\Local\niemiro\Archive\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll to C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll.
WARNING: File C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml was not backed up as that would replace the current backup.
Successfully copied file C:\Users\adm-david\AppData\Local\niemiro\Archive\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml to C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml.

Successfully restored ownership for C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml
Successfully restored permissions on C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml
Successfully restored ownership for C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll
Successfully restored permissions on C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll
Successfully restored ownership for C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml
Successfully restored permissions on C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml
PowerCopy:: directive completed successfully.




Successfully processed all directives.
SFCFix version 3.0.2.1 by niemiro has completed.
Currently storing 3 datablocks.
Finish time: 2022-03-04 13:41:16.869
Script hash: QAl+BdjPvO+nB0lUQMuGJbYFOA0nFtHzwcENwva5gC4=
----------------------EOF-----------------------

Code: 
PS C:\windows\system32> sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.
PS C:\windows\system32>

Code: 
C:\windows\system32>certutil -hashfile "%systemroot%\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml" SHA256
SHA256 hash of C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\LServer_PKConfig.xml:
a68ced28a12c6d3a25c153e76217f1830e2d94b9c71e4f9b2ebb2b01335af2b6
CertUtil: -hashfile command completed successfully.

C:\windows\system32>certutil -hashfile "%systemroot%\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll" SHA256
SHA256 hash of C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-lrwizdll_31bf3856ad364e35_10.0.17763.1_none_f5101f628983b202\lrwizdll.dll:
4014fdccec80d54b7cb64f7835693577a15631c2b4e61d6f15e804503a06a18c
CertUtil: -hashfile command completed successfully.

C:\windows\system32>certutil -hashfile "%systemroot%\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml" SHA256
SHA256 hash of C:\windows\WinSxS\amd64_microsoft-windows-t..enseserver-tlsbrand_31bf3856ad364e35_10.0.17763.1075_none_9c481b71554a77d4\tls_branding_config.xml:
c3b2a8c679b89829b173cd05bdfa46acb1b28a6d4da26fcf0295387a385a9262
CertUtil: -hashfile command completed successfully.
 

Attachments

And after a reboot:
Code: 
PS C:\windows\system32> sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files but was unable to fix some of them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.
 

Attachments

SFCFixScript.txt
Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.
  1. Download SFCFix.exe (by niemiro) and save this to your Desktop.
  2. Download the attached file, SFCFixScript.txt, and save this to your Desktop. Ensure that this file is named SFCFixScript.txt - do not rename it.
  3. Save any open documents and close all open windows.
  4. On your Desktop, you should see two files: SFCFix.exe and SFCFixScript.txt.
  5. Drag the file SFCFixScript.txt onto the file SFCFix.exe and release it.
  6. SFCFix will now process the script.
  7. Upon completion, a log should be created on your Desktop: SFCFix.txt.
  8. Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this into your next post for me to analyse please - put [CODE][/CODE] tags around the log to break up the text.[/list]
 

Attachments

You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top