none
Server 2012 Essentials - Failure configuring Windows updates. Reverting Changes (Status: 0x80070020)

    Question

  • Hello All,

    I have a Windows Server 2012 Essentials server running for a client. It is running on physical hardware (Dell T320). I have major problems applying security updates to this server.

    OS Version: Windows Server 2012 essentials
    OS Build: 6.2 9200

    I am able to install "normal" updates like silverlight and .NET rollups. But the important ones like the Security Monthly Quality Rollups fail after reboot. The updates always seem to install just fine, but when the server is rebooted to apply the update, it is always reverting with the following message: "Failure configuring Windows updates. Reverting changes."

    The following eventviewer events are available: 
    - A reboot is necessary before package KB4019216 can be changed to the Installed state.
    - Initiating changes for package KB4019216. Current state is Staged. Target state is Installed. Client id: WindowsUpdateAgent.
    - Package KB4019216 failed to be changed to the Installed state. Status: 0x80070020.

    What I have tried already:

    Things recommended from the Microsoft website (https://support.microsoft.com/en-us/help/2509997/you-can-t-install-updates-on-a-windows-based-computer)
    - Run Chkdsk /f on the C:\
    - Run the Windows Update troubleshooter (says it fixed things)
    - Download and manually install the update (from catalog website)
    - Restart Computer and try again
    - Run DISM.exe /Online /Cleanup-image /Restorehealth (says it fixed things)
    - Run SFC /scannow
    - Reset the Windows Update components (steps noted on method 7 on above website)
    - Delete any incorrect registry values (steps noted on method 8 on above website)

    Other things that I have tried:
    - Retry with different rollup update (e.g.: november rollup kb3197877)
    - Remove Antivirus Product
    - Deleted regkey {8c416c79-d49b-4f01-a467-e56d3aa8234c} as provided on this thread (https://social.technet.microsoft.com/Forums/office/en-US/70219bcb-36a8-466e-900b-cbf390db38d2/failure-configuring-windows-updates-reverting-changes-postreboot-status-0x800f0922?forum=winserver8gen)
    - Install the update using DISM.exe /Online /Add-Package /PackagePath:D:\temp\Windows8-RT-KB4019216-x64.cab
    - Set the BlockTimeIncrement registry key to value 2a30 (Hex) (HKLM\System\CurrentControlSet\Services\TrustedInstaller) as provided on Microsoft support article 3064434.

    Latest CBS log entries:

    2017-05-16 21:14:27, Info                  CBS    TI: --- Initializing Trusted Installer ---
    2017-05-16 21:14:27, Info                  CBS    TI: Last boot time: 2017-05-16 20:50:33.491
    2017-05-16 21:14:27, Info                  CBS    Starting TrustedInstaller initialization.
    2017-05-16 21:14:27, Info                  CBS    Ending TrustedInstaller initialization.
    2017-05-16 21:14:27, Info                  CBS    Starting the TrustedInstaller main loop.
    2017-05-16 21:14:27, Info                  CBS    TrustedInstaller service starts successfully.
    2017-05-16 21:14:27, Info                  CBS    No startup processing required, TrustedInstaller service was not set as autostart
    2017-05-16 21:14:27, Info                  CBS    Startup processing thread terminated normally
    2017-05-16 21:14:27, Info                  CBS    Starting TiWorker initialization.
    2017-05-16 21:14:27, Info                  CBS    Ending TiWorker initialization.
    2017-05-16 21:14:27, Info                  CBS    Starting the TiWorker main loop.
    2017-05-16 21:14:27, Info                  CBS    TiWorker starts successfully.
    2017-05-16 21:14:27, Info                  CBS    Universal Time is: 2017-05-16 19:14:27.982
    2017-05-16 21:14:27, Info                  CBS    Loaded Servicing Stack v6.2.9200.21913 with Core: C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.21913_none_62fd475869f47e9b\cbscore.dll
    2017-05-16 21:14:27, Info                  CSI    00000001@2017/5/16:19:14:27.986 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7fa31256389 @0x7fa359298ca @0x7fa358e4de4 @0x7f7b115d1df @0x7f7b115d95c @0x7fa7d211b15)
    2017-05-16 21:14:27, Info                  CBS    Could not load SrClient DLL from path: SrClient.dll.  Continuing without system restore points.
    2017-05-16 21:14:27, Info                  CSI    00000002@2017/5/16:19:14:27.987 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7fa31256389 @0x7fa35986258 @0x7fa35947729 @0x7fa358e4f57 @0x7f7b115d1df @0x7f7b115d95c)
    2017-05-16 21:14:27, Info                  CBS    SQM: Initializing online with Windows opt-in: False
    2017-05-16 21:14:27, Info                  CBS    SQM: Cleaning up report files older than 10 days.
    2017-05-16 21:14:27, Info                  CBS    SQM: Requesting upload of all unsent reports.
    2017-05-16 21:14:27, Info                  CBS    SQM: Failed to start upload with file pattern: C:\Windows\servicing\sqm\*_std.sqm, flags: 0x2 [HRESULT = 0x80004005 - E_FAIL]
    2017-05-16 21:14:27, Info                  CBS    SQM: Failed to start standard sample upload. [HRESULT = 0x80004005 - E_FAIL]
    2017-05-16 21:14:27, Info                  CBS    SQM: Queued 0 file(s) for upload with pattern: C:\Windows\servicing\sqm\*_all.sqm, flags: 0x6
    2017-05-16 21:14:27, Info                  CBS    SQM: Warning: Failed to upload all unsent reports. [HRESULT = 0x80004005 - E_FAIL]
    2017-05-16 21:14:27, Info                  CBS    NonStart: Set pending store consistency check.
    2017-05-16 21:14:27, Info                  CBS    Session: 30592632_2741358023 initialized by client SPP.
    2017-05-16 21:14:28, Info                  CBS    Session: 30592632_2746309578 initialized by client SPP.
    2017-05-16 21:14:28, Info                  CBS    Session: 30592632_2746944392 initialized by client SPP.
    2017-05-16 21:14:28, Info                  CBS    Session: 30592632_2749932906 initialized by client SPP.
    2017-05-16 21:14:28, Info                  CBS    Session: 30592632_2750567720 initialized by client SPP.
    2017-05-16 21:14:29, Info                  CBS    Session: 30592632_2753546464 initialized by client SPP.
    2017-05-16 21:14:29, Info                  CBS    Session: 30592632_2754171513 initialized by client SPP.
    2017-05-16 21:14:29, Info                  CBS    Session: 30592632_2757140492 initialized by client SPP.
    2017-05-16 21:14:29, Info                  CBS    Session: 30592632_2757755775 initialized by client SPP.
    2017-05-16 21:14:29, Info                  CBS    Session: 30592632_2759699281 initialized by client SPP.
    2017-05-16 21:14:29, Info                  CBS    Session: 30592632_2760314564 initialized by client SPP.
    2017-05-16 21:14:30, Info                  CBS    Session: 30592632_2762189709 initialized by client SPP.
    2017-05-16 21:14:30, Info                  CBS    Session: 30592632_2762804992 initialized by client SPP.
    2017-05-16 21:16:30, Info                  CBS    Trusted Installer is shutting down because: SHUTDOWN_REASON_AUTOSTOP
    2017-05-16 21:16:30, Info                  CBS    TiWorker signaled for shutdown, going to exit.
    2017-05-16 21:16:30, Info                  CBS    Ending the TiWorker main loop.
    2017-05-16 21:16:30, Info                  CBS    Starting TiWorker finalization.
    2017-05-16 21:16:30, Info                  CBS    Ending the TrustedInstaller main loop.
    2017-05-16 21:16:30, Info                  CBS    Starting TrustedInstaller finalization.
    2017-05-16 21:16:30, Info                  CBS    Ending TrustedInstaller finalization.
    2017-05-16 21:16:30, Info                  CBS    Ending TiWorker finalization.

    Every try, I get the same result. Installation seems to go fine, but when rebooting the message "Failure configuring Windows updates. Reverting changes." Is shown. After that, the system is rebooted again and the system comes up without the updates installed.

    The latest update I could successfully install was KB4019113 (Security and Quality Rollup .NET)
    I am pulling out my hear (if i had any ;)). I think the problem started after the November 2016 rollup (KB3197877), because the Oktober rollup before that (kb3185332, is not applicable anymore to my system when I try installing it.

    I downloaded all rollups after the Oktober Rollup (kb3197877, kb3205409, kb4012217, kb4015551, kb4019216), all these rollups succeed installation but fail after reboot with the rollback error.  

    No security updates for Windows have been installed after 23-10-2016. This system is now running behind on security, and it is the company’s only server. Please advise!









    • Edited by TechKr Wednesday, May 17, 2017 6:07 AM
    Tuesday, May 16, 2017 7:38 PM

Answers

  • Okay.. I went on-site to further troubleshoot the problem, and FINALLY got the issue solved!

    Here is what I did;

    First of all, I removed all the attached USB devices like harddrives and UPS. Then installed the latest chipset drivers from manufacturers website and updated the firmwares (probably has nothing to do with the issue, but because I was on-site I could do this and I thought it never hurts to have everything updated).

    First attempt applying update:
    - Removed all the pending.xml.<string> files from Windows\WinSxS folder
    - Applied kb4019218 (preview update at this time, but I wanted to try the latest), at this time only the pending.xml file was in the WinSxS folder
    - Rebooted the server... Update fails and is reverting, so no difference from kb4019216...

    Second attempt applying update:
    -
    Booted into safe mode with networking
    - Tried to apply kb4019218 to the server using the MSU. Got an error that this method (WUSA) was not available in safe mode
    - Unpacked the .msu file and applied the update with DISM.exe /Online /Add-Package /PackagePath:<path_to_cab>, this process applied the patch successfully and a reboot was needed
    - Rebooted again into safe mode, applying update fails, reverting.... (system reboots automatically)
    - Rebooted again into safe mode, still the message apprears reverting update... Gave me the creeps (system looping?) but after waiting a minute I could login again.

    Third attempt applying update:
    - I was still booted into safe mode with networking
    - Again applied the kb4019218 update with DISM.exe /Online /Add-Package /PackagePath:<path_to_cab>, this process applied the patch successfully and a reboot was needed
    - Rebooted into NORMAL mode this time....
    - YAY! The update process applied the patch successfully.

    After that, I applied all other patches that were available from Windows Update. All went well. So, problem solved (for now). Now I must wait until the next Monthly Security Rollup arrives, to see if from now on I can normally apply the patch. 

    Not sure what the main issue was, but solved for now!

    Thank you Larry and Eve for your time and thinking along. I was about to give up and you really helped me solving the problem.







    • Marked as answer by TechKr Friday, May 19, 2017 11:13 AM
    • Edited by TechKr Friday, May 19, 2017 12:24 PM
    Friday, May 19, 2017 11:12 AM

All replies

  • Hi,

    Good list of troubleshooting.  I did not see the system readiness tool in your list, nor (although I did not check all your references) see where you had emptied the software distribution folder.

    https://www.microsoft.com/en-us/download/details.aspx?id=1400

    Another thing I see is the line: "ould not load SrClient DLL from path: SrClient.dll."

    Have you eliminated that as an area of concern?

    I'm going to add this against my better judgment.  The pending.xml file might "have issues".  Before doing anything with that, please read the below and add you own research:

    https://blogs.technet.microsoft.com/joscon/2011/03/11/why-you-dont-want-to-edit-your-pending-xml-to-resolve-0xc0000034-issues/


    Larry Struckmeyer [MVP]-- --If your question is answered please mark the response as the answer so that others can benefit.

    Wednesday, May 17, 2017 7:36 PM
  • Hi Larry,

    Thanks for your response.
    I did empty the Software Distribution folder. I followed all the steps mentioned on this MS support site: https://support.microsoft.com/en-us/help/971058/how-do-i-reset-windows-update-components It resets everything that has something to do with Windows Update.

    Today I also removed the last 20 installed security updates, hoping that this would "flip the bit" in the right direction. Removing them went well, but unfortunately it makes no difference installing the Security Quality rollups.

    I am not sure what to do with the URL you provided me with though (except to be cautious editing pending.xml). Could you be more specific?

    On one of the MS support sites I found that I could try to rename the c:\windows\winsxs\pending.xml file and then try again. I do not have that specific file in that location. There are a lot of files that are named pending.xml<string>, e.g. pending.xml.01d1c9fed900f346 in that directory, but no pending.xml.

    On every try, when booting the update process does not ever pass the 15% before failing and reverting back.

    If you need another log from me (like more CBS logging, there is a lot!), I can upload and share it.

    I looked at the message "Could not load SrClient DLL from path: SrClient.dll", but because it says it will continue processing without a system restore point I would think that is not an obstruction.


    Edit: I now see the pending.xml when a patch is installed (before rebooting). Not sure what to do with it though...
    • Edited by TechKr Wednesday, May 17, 2017 9:05 PM
    • Marked as answer by TechKr Wednesday, May 17, 2017 9:07 PM
    • Unmarked as answer by TechKr Wednesday, May 17, 2017 9:08 PM
    Wednesday, May 17, 2017 8:59 PM
  • I think I would create a new backup, (and or an image) making sure you had the system state and the system drive... not so worried about exchange, wsus or user data although that never hurts, then clean out all pending.xml references and reboot and let us know the result.

    Stop the windows update service(s) in Admin Tools, Services then follow item 10 in 250997.


    Larry Struckmeyer [MVP]-- --If your question is answered please mark the response as the answer so that others can benefit.


    Wednesday, May 17, 2017 9:16 PM
  • Last night the backup ran, this morning I took ownership of all the pending.xml.<string> files and moved them to another location. Because it is a production system, I will try and reboot the machine tonight.

    Only the current pending.xml file is now located in the C:\Windows\WinSxS directory, which was generated by the update process when installing the latest rollup and holds the pending operations that must be done during the reboot.
    Thursday, May 18, 2017 6:17 AM
  • Last night the backup ran, this morning I took ownership of all the pending.xml.<string> files and moved them to another location. Because it is a production system, I will try and reboot the machine tonight.

    Only the current pending.xml file is now located in the C:\Windows\WinSxS directory, which was generated by the update process when installing the latest rollup and holds the pending operations that must be done during the reboot.
    Thursday, May 18, 2017 6:18 AM
  • Hi,

    According to your description, my understanding is that security updates failed to be installed with error "Failure configuring Windows updates. Reverting changes”.

    Try to run system built-in Windows Update Troubleshooter again and confirm the result:
    Control Panel – Troubleshooting - System and Security - Windows Update.

    Besides, please follow below steps to check/confirm system files again. Open cmd and type:
    1. sfc /scannow
    2. DISM.exe /Online /Cleanup-image /Scanhealth 
    3. DISM.exe /Online /Cleanup-image /Restorehealth

    Note:
    Based on your description, I know some operations have been done by yourself before. Please follow above steps to have an confirmation again.

    Besides, please try to download one of the KBs(which is failed to be installed) from Microsoft website to your server locally, then, re-start the server in Safe Mode with Networking. Then, manually install the update and check the result.

    If the problem persists, please provide below information( please upload files to OneDrive - https://onedrive.live.com/. Share it and provide me the access link):
    1. Run “msinfo32” and provide me the system information.
    2. CBS log of this failure installation.
    3. KB number which is failed to be installed. 

    Best Regards,
    Eve Wang

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, May 18, 2017 6:41 AM
    Moderator
  • Hi Eve,

    Thanks for your reply. Is there a way to privately send you the link with the logs and information?

    I performed the SFC and DISM commands two days ago, because it is a system in production and the DISM command also breaks things like Anywhere Access web.config files (it resets file locations with %placeholders%) in WSE2012, I would rather not directly run it again so soon after the last try.

    Is it possible for you to look at the logs?

    I have to go on-site to try the installation in Safe Mode. I will schedule this as soon as possible.

    KB numbers that fail to install:

    kb3185332 --> Seems to be the last rollup that installed correctly, can not find confirmation on the system that it did, but retrying to install this update gave the message "not applicable". Yesterday I removed this update with DISM, no reboot was needed. Sounds odd to me.

    Every rollup after kb3185332 failed for sure:

    kb3197877
    kb3205409
    kb4012217
    kb4015551
    kb4019216
    kb4019218


    • Edited by TechKr Thursday, May 18, 2017 10:32 AM
    Thursday, May 18, 2017 10:31 AM
  • Hi,

    Not this will cure the current problem, and please carry on with Eve if you choose to, but I suggest you do not allow any server to download and install updates and then wait for a convenient time to reboot.  Better for the system and for your peace of mind to download and WAIT for you to install, then reboot immediately.  That way you can choose what updates to apply, and I would always be at least two weeks behind after checking with www.patchmanagment.org.


    Larry Struckmeyer [MVP]-- --If your question is answered please mark the response as the answer so that others can benefit.

    Thursday, May 18, 2017 11:57 AM
  • Very true, with my other clients I always do it like this. Mostly on weekends installation and reboot. What I am doing now is pure troubleshooting.

    Tonight I will reboot the server with the pending.xml.<string> files removed. Will post back and I like to hear your thoughts also!
    Thursday, May 18, 2017 12:39 PM
  • Okay.. I went on-site to further troubleshoot the problem, and FINALLY got the issue solved!

    Here is what I did;

    First of all, I removed all the attached USB devices like harddrives and UPS. Then installed the latest chipset drivers from manufacturers website and updated the firmwares (probably has nothing to do with the issue, but because I was on-site I could do this and I thought it never hurts to have everything updated).

    First attempt applying update:
    - Removed all the pending.xml.<string> files from Windows\WinSxS folder
    - Applied kb4019218 (preview update at this time, but I wanted to try the latest), at this time only the pending.xml file was in the WinSxS folder
    - Rebooted the server... Update fails and is reverting, so no difference from kb4019216...

    Second attempt applying update:
    -
    Booted into safe mode with networking
    - Tried to apply kb4019218 to the server using the MSU. Got an error that this method (WUSA) was not available in safe mode
    - Unpacked the .msu file and applied the update with DISM.exe /Online /Add-Package /PackagePath:<path_to_cab>, this process applied the patch successfully and a reboot was needed
    - Rebooted again into safe mode, applying update fails, reverting.... (system reboots automatically)
    - Rebooted again into safe mode, still the message apprears reverting update... Gave me the creeps (system looping?) but after waiting a minute I could login again.

    Third attempt applying update:
    - I was still booted into safe mode with networking
    - Again applied the kb4019218 update with DISM.exe /Online /Add-Package /PackagePath:<path_to_cab>, this process applied the patch successfully and a reboot was needed
    - Rebooted into NORMAL mode this time....
    - YAY! The update process applied the patch successfully.

    After that, I applied all other patches that were available from Windows Update. All went well. So, problem solved (for now). Now I must wait until the next Monthly Security Rollup arrives, to see if from now on I can normally apply the patch. 

    Not sure what the main issue was, but solved for now!

    Thank you Larry and Eve for your time and thinking along. I was about to give up and you really helped me solving the problem.







    • Marked as answer by TechKr Friday, May 19, 2017 11:13 AM
    • Edited by TechKr Friday, May 19, 2017 12:24 PM
    Friday, May 19, 2017 11:12 AM
  • Hi,

    I am glad to hear that your issue was successfully resolved. Also, thank you for taking the time to have an update about the detail steps. It might be helpful for other people who has the similar problem.

    If there is anything else we can do for you, please feel free to post in the forum.

    Best Regards,
    Eve Wang

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, May 22, 2017 2:22 AM
    Moderator