Windows Updates Not Installing

[Maxstar]

Here's the next fix.

Warning: This fix was written specifically for this system. Do not run this fix on another system.

• Save any work you have open, and close all programs.
• Download the attachment SFCFix.zip and save it to your desktop.
• Drag the SFCFix.zip file over the SFCFix.exe executable and release it.

• SFCFix will launch, let it complete.
• Once done, a file will appear on your desktop, called SFCFix.txt.
• Post the logfile (SFCFix.txt) as attachment in your next reply.

Afterwards attempt to update. If it fails attach a new copy of the CBS logs.

 

[Sonics]

Now it looks like we are back to the original error. Here are the logs. Thanks

 

[Maxstar]

(...)We are using Defender for Endpoint on our E5 tenant.

Are you able able to disconnect this system from Defender Endpoint?

 

[Sonics]

Thanks Maxstar. I will have to work with team and evaluate doing that work or migrating the services to a new server. Thanks for all your help. I have another server that has some different errors and will start a new thread on that one. We have had more issues with Server 2022 than anything in past.

 

[Maxstar]

Hi,

You're welcome and let me know the outcome after reaching out the team.

 

[Sonics]

Will do. To clarify. Do you need the server completely detached from the E5 tenant? Or are you looking to disable the local AV? The reason I ask is the server is attached to Azure ARC and Cloud protection with SQL server monitoring. Thanks

 

[Maxstar]

(...) the server is attached to Azure ARC and Cloud protection with SQL server monitoring

Aha, this possibly clarifies some things and maybe the access denied issues! But what do you mean exactly by the E5 tentant? Is that an bridged server with the cloud protection?

 

[Sonics]

Yeah sorry. Referring to the Microsoft 365 tenant of which the server in question is onboarded to and protected by. One thing I haven't done is look at the Defender timeline and see if Defender is logging any helpful information at the time of the updates. I can also look at any ASR rules that may be flagged at that time. Unlikely but worth looking at. Thanks

 

[Maxstar]

KB5049983 cannot be installed and shows an [0x80070005 - E_ACCESSDENIED] error:

2025-01-18 09:34:24, Error                 CSI    00000645 (F) HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED) #3389740# from Windows::ServicingAPI::CCSITransaction::ICSITransaction2_AddComponents(Flags = 4, a = @0x26086ea9b20, mp = @0x26086eaa320, disp = 0)[gle=0x80070005]
2025-01-18 09:34:24, Info                  CBS    Failed to add one or more component [HRESULT = 0x80070005 - E_ACCESSDENIED]

2025-01-18 09:34:25, Info                  CBS    Exec: Processing complete.  Session: 31156686_1835747791, Package: Package_for_RollupFix~31bf3856ad364e35~amd64~~20348.3091.1.9, Identifier: KB5049983 [HRESULT = 0x80070005 - E_ACCESSDENIED]
2025-01-18 09:34:25, Info                  CBS    Removing the pending hard reserve adjustment for Client: UpdateAgentLCU, Session: 31156686_1835747791
2025-01-18 09:34:26, Error                 CBS    Failed to perform operation.  [HRESULT = 0x80070005 - E_ACCESSDENIED]

I don't think Windows Defender is the issue, but other policies / permissions / restrictions in this case.

 

[Sonics]

Would it be worth running another process monitor? I think when we ran the first one the error was different than 80070005. We fixed the other errors with your fixes. Is there a way to find out what access is being denied to? Is it OS related or WINSXS? THanks

 

[Maxstar]

Would it be worth running another process monitor?

I would then try to update again the normal way, and post the new CBS logs.