[SOLVED] Windows Server 2016

[Christoffer]

Hi,

We are trying to install Defender for Endpoint on our Windows Server 2016 RDP-servers (3).

On all of the servers we get "Please update Windows Defender Antivirus (KB4052623) to the latest version." in the installation process.

Ive tried to manuallt install the KB, and a different solution was to install Windows Defender Features under Add Roles and Features.

This worked on one of our RDP-servers, but the other two I have a lot of problems doing this.
When I try to install the feature I receive error 0x80073701.

Ive tried to run the Troubleshooter for Windows Update and it says "Repair Windows Update Database Corruption".
When I apply that fix, it gives me the that there is a "Potential Windows Update Database error detected" which it cant fix.

I go over to do a SFC /scannow.

Results:

---

C:\Windows\system32>sfc /scannow
Beginning system scan. This process will take some time.

Beginning verification phase of the system scan.
Verification 100% complete.

Windows Resources Protection did not find any integrity violations.

---

Then I do DISM command and I receive this:

---

C:\Windows\system32>DISM /Online /Cleanup-image /RestoreHealth /source:\Sources\install.wim:4 /limitaccess

Deployment Image Servicing and Management tool
Version: 10.0.14393.4169

Image version: 10.0.14393.7426

[====================100.0%====================]
Error: 0x800f081f

The source files could not be found.
Use the "Source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see Statistics Used by the Query Optimizer in Microsoft SQL Server 2008.

The DISM log file can be found at C:\Windows\Logs\DISM\dism.log

---

I dont know what else to do about this.

 

[Christoffer]

Hi,

Here are the attatched files I forgot to upload.

 

[PeterJ]

Hello and welcome,

Remove Update Manually

1. Right-Click the Start button and click Command Prompt (Admin) on the list.
2. When command prompt opens, copy and paste the following command into it, then press enter.
   wusa /uninstall /KB:4525236
   
3. Let me know if it says it was successful or if there are any errors.

 

[Christoffer]

Hello,

Thanks for the reply.

When I do the wusa /uninstall /KB:4525236, it returns "The update KB4525236 is not installed on this computer.".

 

[PeterJ]

FRST Registry Search

1. Click the Start button and in the search box, type CMD
2. When you see cmd.exe on the list, right-click on it and select Run as administrator.
3. When command prompt opens, copy and paste the following command into it, press enter afterwards.
   
   

   REG LOAD HKLM\COMPONENTS C:\Windows\System32\config\COMPONENTS

   
   Note: This loads your components hive which is what we want. Please keep the command prompt window open while you perform the remaining steps. You can minimize it if you wish but keep it open.
4. Download the Farbar Recovery Scan Tool and save it to your Desktop:
   64-bit: Downloading Farbar Recovery Scan Tool
   Note: Your antivirus program may report FRST incorrectly as an infection. If so, disable the real-time protection when downloading and running FRST.
5. Right-click on the file FRST64.exe and choose Run as administrator.
6. Copy and paste KB4525236 into the Search box and click the Search Registry button.
7. When the scan is complete, a message will display that 'SearchReg.txt' is saved in the same folder FRST was started from. Notepad will open this file also. Close Notepad and attach the file 'SearchReg.txt' to your next reply.
8. You may close any remaining open windows now.

 

[Christoffer]

Hi,

Here is the attatched searchreg.txt.

 

[PeterJ]

Step 1:
Warning: This script was written specifically for this user, for use on that particular machine. Do not run this script on another machine.

1. Download the attachment fixlist.txt and save it to your desktop.
2. Right-click on FRST64.exe and select "Run as administrator".
3. Press the Fix button.
4. The tool will now process fixlist.txt.
5. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
6. When finished, a log called Fixlog.txt will appear in the same directory the tool is run from.
7. Attach the logfile Fixlog.txt to your next reply.

Step 2:
Restart the machine.
Run the command sfc /scannow in an elevated commandprompt and report the result.
If it fails, copy the file C:\Windows\Logs\CBS\cbs.log to your desktop.
Zip the copied file and attach the zipped cbs.log to your next reply.

 

[Christoffer]

Hi,

That worked fine for this server.
Our last RDS-server have the same problem.

Ive attatched the CBS and componentscan for that one.

 

[PeterJ]

That worked fine for this server.

Great.

Our last RDS-server have the same problem.

Please create a new thread. Best to handle each machine separately to avoid any confusion.
I will mark this thread as solved.