none
Server 2008 R2 TrustedInstaller crashes

    Question

  • On a Windows Server 2008 R2 Standard we have a lot of application event log entries:

    #####

    Name der fehlerhaften Anwendung: TrustedInstaller.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc4b0
    Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5be02b
    Ausnahmecode: 0xc00000fd
    Fehleroffset: 0x0000000000053818
    ID des fehlerhaften Prozesses: 0xba4
    Startzeit der fehlerhaften Anwendung: 0x01cb3590542767b4
    Pfad der fehlerhaften Anwendung: C:\Windows\servicing\TrustedInstaller.exe
    Pfad des fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll
    Berichtskennung: 9a208f74-a183-11df-8d61-005056881660

    #####

    Fehlerbucket , Typ 0
    Ereignisname: APPCRASH
    Antwort: Nicht verfügbar
    CAB-Datei-ID: 0

    Problemsignatur:
    P1: TrustedInstaller.exe
    P2: 6.1.7600.16385
    P3: 4a5bc4b0
    P4: ntdll.dll
    P5: 6.1.7600.16385
    P6: 4a5be02b
    P7: c00000fd
    P8: 0000000000053818
    P9:
    P10:

    Angefügte Dateien:
    C:\Windows\Temp\WERF2E0.tmp.appcompat.txt
    C:\Windows\Temp\WERF310.tmp.WERInternalMetadata.xml
    C:\Windows\Temp\WERF311.tmp.hdmp
    C:\Windows\Temp\WERF40C.tmp.mdmp

    Diese Dateien befinden sich möglicherweise hier:
    C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_TrustedInstaller_7e765019b6254b3d4e6c9e56a66e5e6765d_cab_01bcf428

    Analysesymbol:
    Es wird erneut nach einer Lösung gesucht: 0
    Berichts-ID: 9a208f74-a183-11df-8d61-005056881660
    Berichtstatus: 4

    #####

    The produced WER file shows:

    Version=1
    EventType=APPCRASH
    EventTime=129256373665202129
    ReportType=2
    Consent=1
    ReportIdentifier=eae80229-a1ef-11df-8d61-005056881660
    IntegratorReportIdentifier=eae80228-a1ef-11df-8d61-005056881660
    Response.type=4
    Sig[0].Name=Anwendungsname
    Sig[0].Value=TrustedInstaller.exe
    Sig[1].Name=Anwendungsversion
    Sig[1].Value=6.1.7600.16385
    Sig[2].Name=Anwendungszeitstempel
    Sig[2].Value=4a5bc4b0
    Sig[3].Name=Fehlermodulname
    Sig[3].Value=ntdll.dll
    Sig[4].Name=Fehlermodulversion
    Sig[4].Value=6.1.7600.16385
    Sig[5].Name=Fehlermodulzeitstempel
    Sig[5].Value=4a5be02b
    Sig[6].Name=Ausnahmecode
    Sig[6].Value=c00000fd
    Sig[7].Name=Ausnahmeoffset
    Sig[7].Value=000000000005382a
    DynamicSig[1].Name=Betriebsystemversion
    DynamicSig[1].Value=6.1.7600.2.0.0.272.7
    DynamicSig[2].Name=Gebietsschema-ID
    DynamicSig[2].Value=1031
    DynamicSig[22].Name=Zusatzinformation 1
    DynamicSig[22].Value=4442
    DynamicSig[23].Name=Zusatzinformation 2
    DynamicSig[23].Value=44428deb81a5171b205d3708bc5f7420
    DynamicSig[24].Name=Zusatzinformation 3
    DynamicSig[24].Value=98f3
    DynamicSig[25].Name=Zusatzinformation 4
    DynamicSig[25].Value=98f3ccf98f2acea17cb36d0443099743
    UI[2]=C:\Windows\servicing\TrustedInstaller.exe
    UI[5]=Online nach einer Lösung suchen (empfohlen)
    UI[6]=Später nach einer Lösung suchen (empfohlen)
    UI[7]=Schließen
    UI[8]=Windows Modules Installer wurde beendet und geschlossen.
    UI[9]=Die Anwendung wird aufgrund eines Problems nicht mehr richtig ausgeführt. Sie erhalten Nachricht, wenn eine Lösung verfügbar ist.
    UI[10]=S&chließen
    LoadedModule[0]=C:\Windows\servicing\TrustedInstaller.exe
    LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll
    LoadedModule[2]=C:\Windows\system32\kernel32.dll
    LoadedModule[3]=C:\Windows\system32\KERNELBASE.dll
    LoadedModule[4]=C:\Windows\system32\ADVAPI32.dll
    LoadedModule[5]=C:\Windows\system32\msvcrt.dll
    LoadedModule[6]=C:\Windows\SYSTEM32\sechost.dll
    LoadedModule[7]=C:\Windows\system32\RPCRT4.dll
    LoadedModule[8]=C:\Windows\system32\ole32.dll
    LoadedModule[9]=C:\Windows\system32\GDI32.dll
    LoadedModule[10]=C:\Windows\system32\USER32.dll
    LoadedModule[11]=C:\Windows\system32\LPK.dll
    LoadedModule[12]=C:\Windows\system32\USP10.dll
    LoadedModule[13]=C:\Windows\system32\IMM32.DLL
    LoadedModule[14]=C:\Windows\system32\MSCTF.dll
    LoadedModule[15]=C:\Windows\system32\wdscore.dll
    LoadedModule[16]=C:\Windows\system32\OLEAUT32.dll
    LoadedModule[17]=C:\Windows\system32\SHELL32.dll
    LoadedModule[18]=C:\Windows\system32\SHLWAPI.dll
    LoadedModule[19]=C:\Windows\system32\dbghelp.dll
    LoadedModule[20]=C:\Windows\system32\CRYPTBASE.dll
    LoadedModule[21]=C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\cbscore.dll
    LoadedModule[22]=C:\Windows\system32\VERSION.dll
    LoadedModule[23]=C:\Windows\system32\CRYPT32.dll
    LoadedModule[24]=C:\Windows\system32\MSASN1.dll
    LoadedModule[25]=C:\Windows\system32\WINTRUST.dll
    LoadedModule[26]=C:\Windows\system32\USERENV.dll
    LoadedModule[27]=C:\Windows\system32\profapi.dll
    LoadedModule[28]=C:\Windows\system32\Ktmw32.dll
    LoadedModule[29]=C:\Windows\system32\dpx.dll
    LoadedModule[30]=C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\wcp.dll
    LoadedModule[31]=C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\DrUpdate.dll
    LoadedModule[32]=C:\Windows\system32\SETUPAPI.dll
    LoadedModule[33]=C:\Windows\system32\CFGMGR32.dll
    LoadedModule[34]=C:\Windows\system32\DEVOBJ.dll
    LoadedModule[35]=C:\Windows\system32\MPR.dll
    LoadedModule[36]=C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\wrpint.dll
    LoadedModule[37]=C:\Windows\system32\SxsStore.dll
    LoadedModule[38]=C:\Windows\system32\sqmapi.dll
    LoadedModule[39]=C:\Windows\system32\CRYPTSP.dll
    LoadedModule[40]=C:\Windows\system32\rsaenh.dll
    LoadedModule[41]=C:\Windows\system32\RpcRtRemote.dll
    LoadedModule[42]=C:\Windows\system32\CLBCatQ.DLL
    LoadedModule[43]=C:\Windows\servicing\CbsApi.dll
    FriendlyEventName=Nicht mehr funktionsfähig
    ConsentKey=APPCRASH
    AppName=Windows Modules Installer
    AppPath=C:\Windows\servicing\TrustedInstaller.exe

    #####

    The System Update Readiness Tool runs for hours but never finishes. The logfile in C:\Windows\Logs\CBS shows:

    2010-08-06 20:50:28, Info                  CBS    TrustedInstaller terminated unexpectedly with pending operations the last time around; will skip core startup processing.
    2010-08-06 20:50:28, Info                  CBS    Starting TrustedInstaller initialization.
    2010-08-06 20:50:28, Info                  CBS    Loaded Servicing Stack v6.1.7600.16385 with Core: C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\cbscore.dll
    2010-08-06 20:50:28, Info                  CSI    00000001@2010/8/6:18:50:28.488 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7fee81ae9a1 @0x7fef1128755 @0x7fef10f2ac7 @0xff3de94c @0xff3dd769 @0xff3ddaff)
    2010-08-06 20:50:28, Info                  CBS    Could not load SrClient DLL from path: SrClient.dll.  Continuing without system restore points.
    2010-08-06 20:50:28, Info                  CSI    00000002@2010/8/6:18:50:28.488 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7fee81ae9a1 @0x7fef117500e @0x7fef1141504 @0x7fef10f2b9d @0xff3de94c @0xff3dd769)
    2010-08-06 20:50:28, Info                  CSI    00000003@2010/8/6:18:50:28.488 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x7fee81ae9a1 @0x7fef1048728 @0x7fef1048856 @0xff3de444 @0xff3dd7ae @0xff3ddaff)
    2010-08-06 20:50:28, Info                  CBS    Ending TrustedInstaller initialization.
    2010-08-06 20:50:28, Info                  CBS    Starting the TrustedInstaller main loop.
    2010-08-06 20:50:28, Info                  CBS    TrustedInstaller service starts successfully.
    2010-08-06 20:50:28, Info                  CBS    SQM: Initializing online with Windows opt-in: False
    2010-08-06 20:50:28, Info                  CBS    SQM: Cleaning up report files older than 10 days.
    2010-08-06 20:50:28, Info                  CBS    SQM: Requesting upload of all unsent reports.
    2010-08-06 20:50:28, Info                  CBS    SQM: Failed to start upload with file pattern: C:\Windows\servicing\sqm\*_std.sqm, flags: 0x2 [HRESULT = 0x80004005 - E_FAIL]
    2010-08-06 20:50:28, Info                  CBS    SQM: Failed to start standard sample upload. [HRESULT = 0x80004005 - E_FAIL]
    2010-08-06 20:50:28, Info                  CBS    SQM: Queued 0 file(s) for upload with pattern: C:\Windows\servicing\sqm\*_all.sqm, flags: 0x6
    2010-08-06 20:50:28, Info                  CBS    SQM: Warning: Failed to upload all unsent reports. [HRESULT = 0x80004005 - E_FAIL]
    2010-08-06 20:50:28, Info                  CBS    No startup processing required, TrustedInstaller service was not set as autostart, or else a reboot is still pending.
    2010-08-06 20:50:28, Info                  CBS    NonStart: Checking to ensure startup processing was not required.
    2010-08-06 20:50:28, Info                  CSI    00000004 IAdvancedInstallerAwareStore_ResolvePendingTransactions (call 1) (flags = 00000004, progress = NULL, phase = 0, pdwDisposition = @0x175fbd0
    2010-08-06 20:50:28, Info                  CSI    00000005 Creating NT transaction (seq 1), objectname [6]"(null)"
    2010-08-06 20:50:28, Info                  CSI    00000006 Created NT transaction (seq 1) result 0x00000000, handle @0x1c8
    2010-08-06 20:50:28, Info                  CSI    00000007@2010/8/6:18:50:28.488 CSI perf trace:
    CSIPERF:TXCOMMIT;555
    2010-08-06 20:50:28, Info                  CBS    NonStart: Success, startup processing not required as expected.
    2010-08-06 20:50:28, Info                  CBS    Startup processing thread terminated normally
    2010-08-06 20:50:28, Info                  CSI    00000008 CSI Store 1939584 (0x00000000001d9880) initialized
    2010-08-06 20:50:28, Info                  CBS    Session: 30094744_1023548145 initialized by client WindowsServerRoleDetector.

     

    Saturday, August 07, 2010 8:13 AM

Answers

  • After copying the following files from a good server into the directory C:\Windows\servicing\Packages , the System Update Readiness Tool does not find any errors:

    Package_for_KB979482_RTM~31bf3856ad364e35~amd64~~6.1.1.1.cat
    Package_for_KB979482_RTM~31bf3856ad364e35~amd64~~6.1.1.1.mum
    Package_for_KB979482~31bf3856ad364e35~amd64~~6.1.1.1.cat
    Package_for_KB979482~31bf3856ad364e35~amd64~~6.1.1.1.mum

     

    As far as I can see the server is back in a good state. The application log did not show any TrustedInstaller crashes.

     

    Thanks for your help.

    • Marked as answer by Stefan-P Monday, August 09, 2010 10:05 PM
    Monday, August 09, 2010 10:04 PM

All replies

  • I'd start out by verifying the protected OS files to see if I could get
    the system to a state where the SUR tool runs,
     
    sfc /scannow
     

    -- Mike Burr
    Saturday, August 07, 2010 12:44 PM
  • Having exact the same problem as Stefan-P -> sfx /scannow finishes with no errors.

     

    Saturday, August 07, 2010 4:13 PM
  • Meanwhile I found somewhat of a useful thread here:
    http://social.technet.microsoft.com/Forums/de-DE/windows_Serverde/thread/5ef600ff-ebbd-42e1-a535-2b33ffd1b46f (in German)
    It describes exactly the same problem an links to this article:
    http://technet.microsoft.com/en-us/library/ee619779%28WS.10%29.aspx

    Furthermore I found this one:
    http://www.itsolutionskb.com/2009/04/roles-error-when-viewing-roles-in-windows-server-2008-server-manager/

    Unfortunately there is no %windir%\logs\cbs\checksur.log, since System Update Readiness Tool runs forever, but never installs/finishes.

    The side effects are as that Server-Manager does not show any Roles or Features anymore:

    Protokollname: Microsoft-Windows-ServerManager/Operational
    Quelle:        Microsoft-Windows-ServerManager
    Datum:         09.06.2010 20:23:33
    Ereignis-ID:   1601
    Aufgabenkategorie:Keine
    Ebene:         Fehler
    Schlüsselwörter:
    Benutzer:      NETPARTY\Administrator
    Computer:      dc1.domain.local
    Beschreibung:
    Der Status des Systems konnte nicht ermittelt werden. Es wurde eine unerwartete Ausnahme gefunden:
    System.Runtime.InteropServices.COMException (0x800706BE): Der Remoteprozeduraufruf ist fehlgeschlagen. (Ausnahme von HRESULT: 0x800706BE)
       bei System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
       bei Microsoft.Windows.ServerManager.ComponentInstaller.CreateSessionAndPackage(IntPtr& session, IntPtr& package)
       bei Microsoft.Windows.ServerManager.ComponentInstaller.InitializeUpdateInfo()
       bei Microsoft.Windows.ServerManager.ComponentInstaller.Initialize()
       bei Microsoft.Windows.ServerManager.Common.Provider.RefreshDiscovery()
       bei Microsoft.Windows.ServerManager.LocalResult.PerformDiscovery()
       bei Microsoft.Windows.ServerManager.ServerManagerModel.CreateLocalResult(RefreshType refreshType)
       bei Microsoft.Windows.ServerManager.ServerManagerModel.InternalRefreshModelResult(Object state)

    Right now, I cannot install no msu-package and Windows Update does not work either (standing while downloading with 0%).

    This is a Hyper-V-Host with nothing else installed than the Hyper-V-Role (no Domain-Membership).

    I checked the logs: Trsuted Installer Error first appeared after installing KB915597 (Windows Defender Update).
    But it obviously got even worse after Update KB982381 could not be installed with Error 800706BE.

    Any help would be very nice - please excuse my poor English.

    Saturday, August 07, 2010 8:11 PM
  • Hi Stefan,

     

    Since you’ve tried sfc /scannow and System Update Readiness tool with no success, in this case, I suggest performing an in-place upgrade if your server is not a DC.

     

    To perform an in-place upgrade of Windows Server 2008 R2, follow these steps:

    1.       Insert the Windows Server 2008 R2 installation CD/DVD, then double click to run the Setup from CD/DVD.

    2.       Choose the language and click Install Now.

    3.       Accept the License Agreement and Choose Upgrade.

    4.       Select the same edition of Windows Server 2008 R2 that is installed on server.

    (Please make sure you have enough space in your System drive.)

     

    Regards,

    Karen Ji


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ” This posting is provided "AS IS" with no warranties, and confers no rights.
    Monday, August 09, 2010 5:01 AM
  • The "sfc" command did not find anything:

    C:\>sfc /scannow
     
    Systemsuche wird gestartet. Dieser Vorgang kann einige Zeit dauern.
     
    Überprüfungsphase der Systemsuche wird gestartet.
    Überprüfung 100 % abgeschlossen.

    Der Windows-Ressourcenschutz hat keine Integritätsverletzungen gefunden.

    I checked "ntdll.dll" on a server with no update errors:

    24.03.2010 08:59     1.736.608 ntdll.dll

    Server with TrustedInstaller crashes:

    14.07.2009 03:43     1.736.792 ntdll.dll

    After installing Hotfix Windows6.1-KB980846-x64.msu the "ntdll.dll" shows version 6.1.7600.16559.

    After a reboot I was able to run the System Update Readiness Tool and it produced the following CheckSUR.log:

     

    =================================
    Checking System Update Readiness.
    Binary Version 6.1.7600.20667
    Package Version 8.0
    2010-08-09 12:10

    Checking Windows Servicing Packages

    Checking Package Manifests and Catalogs
    (f)    CBS MUM Corrupt    0x00000000    servicing\Packages\Package_for_KB979482_RTM~31bf3856ad364e35~amd64~~6.1.1.1.mum        Expected file name Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.mum does not match the actual file name

    Checking Package Watchlist

    Checking Component Watchlist

    Checking Packages

    Checking Component Store

    Summary:
    Seconds executed: 611
     Found 1 errors
      CBS MUM Corrupt Total count: 1

    Unavailable repair files:
        servicing\packages\Package_for_KB979482_RTM~31bf3856ad364e35~amd64~~6.1.1.1.mum
        servicing\packages\Package_for_KB979482_RTM~31bf3856ad364e35~amd64~~6.1.1.1.cat

    (w)    Unable to get system disk properties    0x0000045D    IOCTL_STORAGE_QUERY_PROPERTY    Disk Cache

     

    #####

     

    So I think it is possible to solve this problem without doing an inplace repair installation.

     

    Monday, August 09, 2010 10:31 AM
  • After copying the following files from a good server into the directory C:\Windows\servicing\Packages , the System Update Readiness Tool does not find any errors:

    Package_for_KB979482_RTM~31bf3856ad364e35~amd64~~6.1.1.1.cat
    Package_for_KB979482_RTM~31bf3856ad364e35~amd64~~6.1.1.1.mum
    Package_for_KB979482~31bf3856ad364e35~amd64~~6.1.1.1.cat
    Package_for_KB979482~31bf3856ad364e35~amd64~~6.1.1.1.mum

     

    As far as I can see the server is back in a good state. The application log did not show any TrustedInstaller crashes.

     

    Thanks for your help.

    • Marked as answer by Stefan-P Monday, August 09, 2010 10:05 PM
    Monday, August 09, 2010 10:04 PM