Constant Rolling Back of Updates - Server 2008 x64

kaouk

kaouk

Member
Joined
Aug 5, 2016
Posts
15
Location
Wiltshire
Hello!

Long term reader of your forums but unfortunately your existing threads couldn't save me on this one :(

I've got a Windows Server 2008 x64 box (note; non R2) and it simply refuses to install updates. It installs fine, you reboot to apply them and it just rolls back saying failed to apply updates.

I've tried the following things:

Chkdsk /R
Run the Windows Update Repair Tool (Fixit50123)
Run the Windows Update Readiness Tool for 2008 x64
Ran SFC /scannow multiple times (each time says that "Windows Resource Protection could not perform the requested operation)

CBS folder is found here: https://dl.dropboxusercontent.com/u/8072232/CBS.zip

The SFCFix Tool doesn't work, it just auto finishes with the following info:

Code: 
SFCFix version 3.0.0.0 by niemiro.Start time: 2016-08-05 10:28:24.344
Microsoft Windows Server 2008 Service Pack 2 - amd64
Not using a script file.








AutoAnalysis::
SUMMARY: No corruptions were detected.
AutoAnalysis:: directive completed successfully.








Successfully processed all directives.
SFCFix version 3.0.0.0 by niemiro has completed.
Currently storing 0 datablocks.
Finish time: 2016-08-05 10:28:34.919
----------------------EOF-----------------------

Thanks in advance!

Kao
 
Hi kaouk,

Let's find out why SFC won't work.

SFC Scan

  1. Click on the Start
    Start%20Orb.jpg
    button and in the search box, type Command Prompt
  2. When you see Command Prompt on the list, right-click on it and select Run as administrator
  3. When command prompt opens, copy and paste the following commands into it, press enter after each

    sfc /scannow

    Wait for this to finish before you continue

    copy %windir%\logs\cbs\cbs.log %userprofile%\Desktop\cbs.txt
  4. This will create a file, cbs.txt on your Desktop. Please zip and attach this to your next post.
 
Code: 
2016-08-10 11:36:53, Info                  CSI    000002e6 Created NT transaction (seq 1) result 0x00000000, handle @0x714
2016-08-10 11:36:53, Error                 CSI    000002e7 (F) c0190005 [Error,Facility=FACILITY_TRANSACTION,Code=5] #5872410# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowSharingViolation|AllowTransactionalConflict|0x00000400), handle = {provider=NULL, handle=0}, da = (FILE_GENERIC_READ), oa = @0xf9dbd8->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[39]"\SystemRoot\WinSxS\Temp\PendingRenames\"; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0xf9dc60, as = (null), fa = (FILE_ATTRIBUTE_DIRECTORY), sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), cd = FILE_OPEN, co = (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|0x00004000), eab = NULL, eal = 0, disp = Invalid)
[gle=0xd0190005]
2016-08-10 11:36:53, Error                 CSI    000002e8@2016/8/10:10:36:53.614 (F) d:\longhorn\base\wcp\sil\merged\ntu\ntsystem.cpp(1849): Error c0190005 [Error,Facility=FACILITY_TRANSACTION,Code=5] originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile expression: (null)
[gle=0x80004005]
2016-08-10 11:36:55, Error                 CSI    000002e9 (F) c0190005 [Error,Facility=FACILITY_TRANSACTION,Code=5] #5872409# from Windows::Rtl::SystemImplementation::CSystemIsolationLayer_IRtlSystemIsolationLayerTearoff::OpenFilesystemDirectory(flags = (SharingViolationIsOk|TransactionalConflictIsOk|DeletePendingIsOk), da = (FILE_GENERIC_READ), dn = [ml:192{96},l:78{39}]"\SystemRoot\WinSxS\Temp\PendingRenames\", sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), oo = (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT), dir = NULL, disp = Invalid)
[gle=0xd0190005]
2016-08-10 11:36:55, Error                 CSI    000002ea (F) c0190005 [Error,Facility=FACILITY_TRANSACTION,Code=5] #5872408# from RtlRunPrimitiveOperationsFromCallbacksAgainstSil(...)[gle=0xd0190005]
2016-08-10 11:36:55, Error                 CSI    000002eb (F) c0190005 [Error,Facility=FACILITY_TRANSACTION,Code=5] #5872394# from ApplyTransactionPOQsToSil(...)[gle=0xd0190005]
2016-08-10 11:36:55, Error                 CSI    000002ec@2016/8/10:10:36:55.914 (F) d:\longhorn\base\wcp\componentstore\com\store_transaction.cpp(1121): Error c0190005 [Error,Facility=FACILITY_TRANSACTION,Code=5] originated in function ApplyTransactionPOQsToSil expression: (null)

Are you able to browse to C:\Windows\WinSxS\Temp\PendingRenames\ with Windows explorer or does this produce an error message?
 
Hi there,

I can navigate to that directory without any issues both in CMD and via Windows Explorer.

As a side note, the winsxs seems VERY large (more so than normal) at 17.1GB and has the "read-only" attribute applied also.
 
The WinSxS folder can be very large, that is normal.

Let's see if we can take permissions on the PendingRenames folder and copy files to it.

Modify File/Folder Permissions

  1. Navigate to the PendingRenames folder, right-click on it and select Properties
  2. Under the Security tab, click Advanced.
  3. Under the Owner tab, click Edit.
  4. Click "Other Users and Groups".
  5. Click Advanced.
  6. Click "Find Now".
  7. Scroll down and double click on Everyone.
  8. Click OK THREE times.
  9. Click on the Permissions tab.
  10. Under type Deny, single click on any entries and click Remove. (N.B.: There may not be any Deny entries, in which case just ignore this step. Just remove any that do exist)
  11. Click OK.
  12. Click Edit (now on the standard file Property window under the Security tab).
  13. Click Add.
  14. Click Advanced.
  15. Click "Find Now".
  16. Scroll down and double click on Everyone.
  17. Click OK.
  18. Single click on Everyone and then tick the "Full Control" box under Allow.
  19. Click OK TWO times.

Once this process has completed, try copying a text file into the folder. If this is successful, delete the text file from the PendingRenames folder.
 
Hey zcomputerwiz,

Thanks for the response. I've changed the permissions on that folder and confirmed I can copy a new text file into the directory but unfortunately SFC /scannow still doesn't run.

Please see the latest CBS log attached.

Cheers,

Kao
 

Attachments

I'd like to take a look at the event logs.

Event Log Collection

  • Download VEW by Vino Rosso here: VEW.EXE
  • Right click the file and select Run as administrator and click Continue or Allow at the User Account Control Prompt.
  • Click the check boxes next to Application and System located under Select log to query on the upper left.
  • Under Select type to list on the right click the boxes next to Error, Warning and Critical (not XP).
  • Under Number or date of events select Number of events and type 20 in the box next to 1 to 20 and click Run.
  • Once it finishes it will display a log file in notepad.
  • Copy and paste its entire contents into your next reply.
 
Hi zcomputerwiz,

This is a very active server that constantly logs to the system and application logs. Is there anything you're looking for in particular as otherwise you'll only get 20 events of application specific gibberish.
 
I'm looking for services failing to start, disk or filesystem errors or warnings etc.
 
zcomputerwiz said:
I'm looking for services failing to start, disk or filesystem errors or warnings etc.
Click to expand...

There's none, all error messages in event viewer are expected ones from the application services running on the server. This is the first thing I checked. There's nothing happening around the time you do a SFC either, just says it's starting trusted installer and then nothing.

zcomputerwiz said:
How much free space on the drive Windows is installed on?
Click to expand...

20GB
 
I'd like to see what's in that folder (if anything).

Command Prompt

Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.

  1. Click on the Start
    Start%20Orb.jpg
    button and in the search box, type Command Prompt
  2. When you see Command Prompt on the list, right-click on it and select Run as administrator
  3. When command prompt opens, copy and paste the following commands into it, press enter after each

    C:

    cd %SystemRoot%\WinSxS\Temp\PendingRenames\

    dir > %userprofile%\desktop\dircontents.txt

  4. Please attach dircontents.txt (on your Desktop) with your reply.
 
Please zip the entire PendingRenames directory and upload it to a file sharing service such as OneDrive, DropBox, SendSpace, etc. and include the link with your reply.
 
Ok, make sure you have a good backup of this server before continuing.

Please delete only the contents of the PendingRenames folder (not the folder itself) and then restart the machine.

Let me know the result.
 
Hi,

I deleted all the files under the Pending Renames folder as requested and re-ran the sfc /scannow command. It failed with the same error "Windows Resource Protection could not perform the requested operation".

I've attached the CBS logs again.

Thanks for your help so far.
 

Attachments

Let's try deleting and recreating the folder.

Step#1 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Download View attachment fixlist.txt and save it to the Desktop.
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
3. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
4. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
5. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Zip this file and please post the resulting zip file.

Step#2 - SFCFix Script
Warning: this fix is specific to the user in this thread. No one else should follow these instructions as it may cause more harm than good. If you are after assistance, please start a thread of your own.
  1. Download SFCFix.exe (by niemiro) and save this to your Desktop. If you still have this on your desktop from downloading previously, you don't need to re-download.
  2. Download the file below, SFCFix.zip, and save this to your Desktop. Ensure that this file is named SFCFix.zip - do not rename it.
  3. Save any open documents and close all open windows.
  4. On your Desktop, you should see two files: SFCFix.exe and SFCFix.zip.
  5. Drag the file SFCFix.zip onto the file SFCFix.exe and release it.
  6. SFCFix will now process the script.
  7. Upon completion, a file should be created on your Desktop: SFCFix.txt.
  8. Copy (Ctrl+C) and Paste (Ctrl+V) the contents of this file into your next post for me to analyse please

View attachment SFCFix.zip

Step#3 - Another FRST fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Download fixlist.txt and save it to the Desktop.
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
2. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
3. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
4. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.
Items for your next post
1. Fixlog.zip
2. SFCFix.txt
3. Fixlog.txt
 
You must log in or register to reply here.
Back
Top