Windows Server 2016 Standard 64-bit - unable to update since 2022/09

[Maxstar]

Right-click on the file

FRST64.exe and choose Run as administrator.

• Copy and paste the following (code) into the Search box and click the Search Files button.

package_1096_for_kb5012596~31bf3856ad364e35~amd64~~10.0.1.7.*

• When the scan is complete, a message will display that 'Search.txt' is saved in the same folder FRST was started from. Notepad will open this file also.
• Post the logfile Search.txt as attachment in your next reply.

 

[Jose Eduardo]

took a while

 

[Maxstar]

C:\Windows\CbsTemp\31092084_881458187\Package_1096_for_KB5012596~31bf3856ad364e35~amd64~~10.0.1.7.cat
[2024-03-03 14:23][2022-04-03 02:14] 000010183 _____ () 166BD82495E77A2AE871F6BEDF6A6584 [File is digitally signed]

C:\Windows\CbsTemp\31092084_881458187\Package_1096_for_KB5012596~31bf3856ad364e35~amd64~~10.0.1.7.mum
[2024-03-03 14:23][2022-04-03 01:52] 000002781 _____ () 2BAE0EC9A5D9F2A12EE262AAADBA91E5 [File not signed]

C:\Windows\CbsTemp\31092061_3811237569\Package_1096_for_KB5012596~31bf3856ad364e35~amd64~~10.0.1.7.cat
[2024-03-03 11:37][2022-04-03 02:14] 000010183 _____ () 166BD82495E77A2AE871F6BEDF6A6584 [File is digitally signed]

C:\Windows\CbsTemp\31092061_3811237569\Package_1096_for_KB5012596~31bf3856ad364e35~amd64~~10.0.1.7.mum
[2024-03-03 11:37][2022-04-03 01:52] 000002781 _____ () 2BAE0EC9A5D9F2A12EE262AAADBA91E5 [File not signed]

Let's clean-up some %TMP% folders first, the following fix will trigger a reboot. So please reboot the server after running this fix.

Start the

Farbar Recovery Scan Tool again.

Warning: This script was written specifically for this system. Do not run this script on another system.

• Download the attachment fixlist.txt and save it to your desktop.
• Right-click on FRST.exe and select "Run as administrator".
• Press the Fix button.
• If for some reason the tool needs a restart, please make sure you let the system restart normally.
• When finished, a log called Fixlog.txt will appear in the same directory the tool is run from.
• Post the logfile Fixlog.txt as attachment in your next reply.

 

[Jose Eduardo]

Fix log

 

[Maxstar]

Please try to install KB5012596 with DISM again as described in post #60 with Process Monitor running.

Capture Process Monitor Trace
1. Download and run Process Monitor. Leave this running while you perform the next steps.
2. Try to install the update with DISM.
3. Stop Process Monitor as soon as it fails. You can simply do this by clicking the square (CTRL +E) on the toolbar as shown below.



4. Select the File menu...Save... and save the file to your desktop. This is likely the default location. The name (unless changed) will be LogFile.PML. This is fine.
5. Zip up the LogFile.PML and upload it to WeTransfer - Send Large Files & Share Photos Online - Up to 2GB Free and provide the link.
6. Attach also a new copy of the CBS logs.

 

[Jose Eduardo]

wetransfer Logfile.zip

 

[Jose Eduardo]

Logfile.zip

 

[Maxstar]

Hi,

Open an elevated command prompt, run the following commands and post the result.

sc query RpcSs
sc qc RpcSs

 

[Jose Eduardo]

 

[Maxstar]

Just a question to be sure, is the Windows Firewall service running at the moment?

 

[Jose Eduardo]

 

[Maxstar]

3/3/2024 6:55:55 PM    SearchIndexer.exe    FileSystemControl    C:    SUCCESS    Control: FSCTL_QUERY_USN_JOURNAL
3/3/2024 6:55:55 PM    TiWorker.exe    QueryRemoteProtocolInformation    C:\Windows\CbsTemp\31092114_1101857062\Package_1096_for_KB5012596~31bf3856ad364e35~amd64~~10.0.1.7.cat    INVALID PARAMETER    
3/3/2024 6:55:55 PM    SearchIndexer.exe    FileSystemControl    C:    SUCCESS    Control: FSCTL_READ_USN_JOURNAL

Let's try something else, when we look at the excerpt above the DISM process is interrupted bij Windows Search indexer as it seems?

Please disable the Windows Search indexer with the following commands.

sc stop WSearch
sc config WSearch start= disabled

Then try to install KB5012596 with DISM again as described in post #60 with Process Monitor running.

 

[Jose Eduardo]

exit

 

[Maxstar]

DFS Namespace                                                     Dfs                                       Auto       Running 
DFS Replication                                                   DFSR                                      Auto       Running

The following services are also running and could also be the issue, see also this document of Microsoft.

I would suggest to disable both services as well and then try to update again using DISM.

sc stop Dfs 
sc config Dfs start= disabled
sc stop DFSR
sc config DFSR start= disabled

 

[Jose Eduardo]

No Luck. Same result and error.

 

[Maxstar]

Hmm, please run the following command again to look at the current service list.

WMIC SERVICE GET caption, name, startmode, state > "%userprofile%\desktop\services.txt"

 

[Jose Eduardo]

services

 

[Maxstar]

Please run the following commands in an elevated prompt.

sc start BITS
sc query BITS

When running attempt to update the normal way to see what happens, perhaps the new CBS logs will reveal some more info this time?

 

[Jose Eduardo]

It's been running since your last post and jumped to 9% imediately but then it didn't grew more that the 9% just like last time. BITS was running but it stops after a while.
I think that letting it run overnight will do any diference. This is really really weird. Altgough it's running the "update" I'm sending you the CBS file anyway.

 

[Maxstar]

This is really really weird.

This is absolutely an very odd issue, let's take a look at the event viewer logs.

Upload the Event Viewer logs.

• Click the Start button and in the search box, type Command Prompt
• When you see Command Prompt on the list, right-click on it and select Run as administrator.
  Copy and paste the following commands one at a time into the command prompt and press enter after each.
  

  wevtutil epl SYSTEM "%userprofile%\Desktop\System.evt"
  wevtutil epl APPLICATION "%userprofile%\Desktop\Application.evt"
  PowerShell Compress-Archive -Path "%userprofile%\Desktop\*.evt" -DestinationPath "%UserProfile%\Desktop\EventLogs.zip"

• These commands will collect the System and Application logs and create EventsLogs.zip on your Desktop.
• Attach this file in your next reply.