Case of the KB2919355 Installation Failure (Windows 8.1 Update)

We had already updated a Windows 8.1 x64 machine with KB2919442 and was starting to install Windows8.1-KB2919355-x64.msu.

Firstly it was hanging for ages at the “Installing” phase with no progress…

image

Well that is normal. What is going on here? Using ProcMon (http://live.sysinternals.com/ProcMon.exe) we used the target icon and dragged it over the “Download and Install Updates” Window to monitor activity.

image

However there was no file or registry activity going on.

So I cleared the current filter and used Tools | File Summary… I then looked at the most Active File by Path and clicked it, to display it in ProcMon filter. From this we could see that TiWorker.exe the “Windows Modules Installer Worker” was busy extracting update contents into the following folders:

  • C:\Windows\CbsTemp\
  • C:\Windows\SoftwareDistribution\Download\

For this update this phase can take quite a while due to large size of update file. You will not see any progress bar during the extraction phase.

Based on this info we reset our filter and set to filter on Process Name is TiWorker.exe

image

Once we started to see progress we would see files being written into C:\Windows\WinSxS\Temp\PendingRenames and other locations. (The PendingRenames files are files that need to be installed on reboot)

We also were able to notice with ProcMon that a log file was being written to at

C:\Windows\Logs\CBS\CBS.log

However after some time update failed with this helpful message:

Some updates were not installed

The following updates were not installed:

Update for Windows (KB2919355)

image

Checking the Windows System Event log, and looking at Source WindowsUpdateClient we found a slightly more helpful error message:

Installation Failure: Windows failed to install the following update with error 0x80070003: Update for Windows (KB2919355)

image

The error message 0x80070003 refers to “PATH NOT FOUND” So what was NOT FOUND?

We can find TIWORKER failures by searching our ProcMon log for LastError

In the detail view we can see the Data value has our error message – in decimal instead of HEX. We also see the package name that failed. We also see writing to CBS.log.

image

If we work backwards from that in our ProcMon log we quickly see a pile of PATH NOT FOUND errors:

image

If we checked the CBS.log (you will need to open Notepad or other log viewer as Administrator to open this file –> in some cases you may need to copy it into another folder before you can open it)

2014-04-03 13:55:16, Info CSI 00000e25 Delete of a missing registry value detected in the registry installer!!

Registry value name: “[l:0]“””

2014-04-03 13:55:17, Error CSI 00000e26 (F) STATUS_OBJECT_PATH_NOT_FOUND #8659314# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowSharingViolation), handle = {provider=NULL, handle=0, name= (“null”)}, da = (SYNCHRONIZE|FILE_READ_ATTRIBUTES), oa = @0x64b7a4d9a8->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[64]“\??\ D:\Users\Default\AppData\Local\Microsoft\Windows\WinX \Group2″; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0x64b7a4d988, as = (null), fa = 0, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), cd = FILE_OPEN, co = (FILE_SYNCHRONOUS_IO_NONALERT|0x00004000), eab = NULL, eal = 0, disp = Invalid)

[gle=0xd000003a]

2014-04-03 13:55:17, Error CSI 00000e27@2014/4/3:02:55:17.825 (F) base\wcp\sil\merged\ntu\ntsystem.cpp(2155): Error STATUS_OBJECT_PATH_NOT_FOUND originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile expression: (null)

[gle=0x80004005]

2014-04-03 13:55:17, Info CBS Added C:\windows\Logs\CBS\CBS.log to WER report.

2014-04-03 13:55:17, Info CBS Added C:\windows\Logs\CBS\CbsPersist_20140403023755.log to WER report.

2014-04-03 13:55:17, Info CBS Added C:\windows\Logs\CBS\CbsPersist_20140403022331.log to WER report.

2014-04-03 13:55:17, Info CBS Not able to add pending.xml to Windows Error Report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]

2014-04-03 13:55:17, Info CBS Not able to add pending.xml.bad to Windows Error Report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]

2014-04-03 13:55:17, Info CBS Not able to add SCM.EVM to Windows Error Report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]

2014-04-03 13:55:19, Error CSI 00000e28 (F) STATUS_OBJECT_PATH_NOT_FOUND #8659313# from Windows::Rtl::SystemImplementation::CSystemIsolationLayer_IRtlSystemIsolationLayerTearoff::OpenFilesystemDirectory(flags = 0, da = (FILE_ALL_ACCESS), dn = [ml:520{260},l:128{64}]“\??\D:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2″, sa = (FILE_SHARE_READ|FILE_SHARE_DELETE), oo = (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT), dir = NULL, disp = Invalid)

[gle=0xd000003a]

2014-04-03 13:55:19, Error CSI 00000e29 (F) STATUS_OBJECT_PATH_NOT_FOUND #8124892# from PrimitiveInstaller::CCoordinator::FinalizeChanges(…)[gle=0xd000003a]

2014-04-03 13:55:19, Info CSI 00000402 SMI Primitive Installer [done]

2014-04-03 13:55:19, Error CSI 00000e2a (F) STATUS_OBJECT_PATH_NOT_FOUND #6494085# from CCSDirectTransaction::PerformChangeAnalysis(…)[gle=0xd000003a]

2014-04-03 13:55:19, Error CSI 00000e2b (F) STATUS_OBJECT_PATH_NOT_FOUND #6494084# from CCSDirectTransaction::PrepareForCommit(…)[gle=0xd000003a]

2014-04-03 13:55:19, Error CSI 00000e2c (F) STATUS_OBJECT_PATH_NOT_FOUND #6494083# from CCSDirectTransaction::GenerateComponentChangeList(…)[gle=0xd000003a]

2014-04-03 13:55:19, Error CSI 00000e2d (F) STATUS_OBJECT_PATH_NOT_FOUND #6494082# from Windows::COM::CPendingTransaction::ExtractInformationFromRtlTransaction(…)[gle=0xd000003a]

2014-04-03 13:55:19, Error CSI 00000e2e (F) HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) #1764404# from Windows::COM::CPendingTransaction::IStorePendingTransaction_Analyze(…)[gle=0x80070003]

2014-04-03 13:55:20, Error CSI 00000e2f (F) HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) #1626198# from Windows::ServicingAPI::CCSITransaction::ICSITransaction_Commit(Flags = 47 (0x0000002f), pSink = NULL, disp = 0, coldpatching = FALSE)[gle=0x80070003]

2014-04-03 13:55:20, Error CSI 00000e30 (F) HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) #1626197# 313613458 us from

 

So why was D:\Users\Default folder missing?

This is because the User Profiles has been redirected using a registry key, instead of unattend.xml – Refer to “Relocation of the Users directory and the ProgramData directory to a drive other than the drive that contains the Windows directory” at http://support.microsoft.com/kb/949977 

To summarize this KB article:

  • Using ProfilesDirectory to redirect folders to a drive other than the system volume blocks upgrades.
  • Using ProfilesDirectory to point to a directory that is not the system volume will block SKU upgrades and upgrades to future versions of Windows.
  • Microsoft recommends that you do not change the location of the user profile directories or program data folders.
  • Note If you use the unattend settings to set up the operating systems that are listed in this article, we will provide commercially reasonable efforts to support your scenario.

So to fix the machine we ran:

robocopy C:\Users\Default\ D:\Users\Default\ *.* /s

To prevent these type of issues in the future however it is best to keep ProfilesDirectory on the system volume (i.e. C:\ ) This issue may not have occurred if the unattend settings had been used to put the profile on D:\

After creating a copy of default profile under D:\Users\Default we re-ran Windows8.1-KB2919355-x64.msu and updated installed without an issue

image

Some other issues with this Windows update error message are also covered under these KB articles:

Windows Update error “0x80070002″ or “0x80070003″

http://support.microsoft.com/kb/910336

Error message when you try to install updates by using the Windows Update or Microsoft Update Web site: “0x80070003″

http://support.microsoft.com/kb/956705/id-id

About chentiangemalc

specializes in end-user computing technologies. disclaimer 1) use at your own risk. test any solution in your environment. if you do not understand the impact/consequences of what you're doing please stop, and ask advice from somebody who does. 2) views are my own at the time of posting and do not necessarily represent my current view or the view of my employer and family members/relatives. 3) over the years Microsoft/Citrix/VMWare have given me a few free shirts, pens, paper notebooks/etc. despite these gifts i will try to remain unbiased.
This entry was posted in ProcMon, SysInternals, Troubleshooting, Windows 8, Windows 8.1. Bookmark the permalink.

29 Responses to Case of the KB2919355 Installation Failure (Windows 8.1 Update)

  1. Wow, what a nice job You’ve done. Cudos for that. Although my error was that I deleted a “System Tools” folder from the start menu. But this guide helped me anyway.

    • PacMani says:

      I also deleted that folder. Can you tell me where to put it back?

      • PacMani says:

        Got it! I needed to apply the fix here AND restore the System Tools folder (after the first fix I got 0x80070002 instead of 0x80070003). Just added an empty folder back to “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools”

    • anirudh says:

      Thanks ! I never knew system tools would affect updates ! this solved my problems

  2. PacMani says:

    Interesting how Microsoft messed up here. It is pretty common to move the personal folders to another volume. This will probably fix it, trying now.

  3. Montmorency says:

    Same problem with “System Tools” in my case. I relocated my “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools” one level deeper to “…\Programs\Accessories\System Tools”. Since “System Tools” was missing from its original location, the update was failing. After I created an empty “System Tools” directory in the original location, the update installed without any problems. This is actually rather preposterous that such an “innocent” change breaks such an important update. Windows Updater should be able to work around such issues by itself.

  4. Sean C. says:

    Same ‘System Tools’ problem for me as well; blog entry from Andrey:

    http://atarasevich.blogspot.com/2014/04/error-0x80070002-when-installing-new.html

  5. junk says:

    Guys I had diffrent cause, but the same result… KB2919355 failed with error 0x80070002
    – In C:\Windows\Logs\CBS\CBS.log was error about
    “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools”
    – So I have executed
    mkdir “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools”
    – And next installation worked!

  6. John says:

    same problem here… but… I can’t create an empty “System Tools” folder. I tried to trick the system and made a “System Tool” and then changing the name to System ToolS. Look what happened: https://onedrive.live.com/redir?resid=567154B9725C9A3!4360&authkey=!AICuAslm1ptjTjM&v=3&ithint=photo%2c.PNG

    I think Windows 8 team really screwed the OS. They are completely out of control.

    • Netpilot says:

      “I think Windows 8 team really screwed the OS. They are completely out of control.”
      That’s an understatement and I’m an MS fan. I read somewhere that Windows 8.1 Update was never tested outside of Microsoft. I have a feeling they won’t make that mistake again.

    • I think in your case issue is not System Tools is missing but it is Administrative Tools. Trying running cmd as admin and use mkdir “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools”

      • Patrick says:

        I have that same error, can’t create a System Tools folder and I DO have an Administrative Tools folder, complete with items in it, still no go.

      • arne says:

        how do you set yourself as admin

      • arne says:

        figured it out. My cmd prompt says windows32 but it should say 64 I believe

  7. Netpilot says:

    My 0×80070003 error was caused by a missing
    C:\Users\Default\AppData\Local\Microsoft\Windows\WinX subfolder.
    This guide helped me find the problem. Nice work.

    TL;DR: Several months ago I renamed the WinX subfolder to WinX.jic in all users’ subfolders. (Long story – I thought they were put there by the WinX DVD program.)
    When I figured out that doing so broke my Windows 8 Win-X menu, I changed the folder name back in my own profile but never changed the others back.
    KB2919355 would not install until I restored the name of the WinX folder under the Default user.

  8. PacMani says:

    Please add /RJ to the ROBOCOPY command. Otherwise it will follow junctions – and create an infinite subdirectory tree which you cannot simply delete (you can with Total Commander for example, if you did this and are in trouble now).

  9. Sean C. says:

    Wow, for anyone else chasing this problem: I’ve tried everything above and others without success and *finally * found a working solution for myself.

    While trying to update Win8.1 Pro x64 to “Update 1″, (particularly KB2919355) I received error 80073712. ProcMon tracing, ‘System Tool’ and Default folder creation, etc did not reveal the solution. A post on this page of the Microsoft community forum by ‘MrBill666′ worked for me, which involved:

    – Run CMD as administrator (Go to start screen, all apps, search CMD, right-click and select run as administrator)
    – Enter the command: dism /online /remove-package /packagename:Package_for_KB2919355~31bf3856ad364e35~amd64~~6.3.1.14
    Once step 2 has completed, enter the command: dism /online /cleanup-image /startcomponentcleanup
    – Retry the update.

    Hopefully this works for others!

    Credit: http://andrew-b.com/view/article/46

  10. Abhijit says:

    Problem solved. I had same error (0xE5E03FA) in event viewer.

    Refer to the details on https://medium.com/technical-series/a2a5d4b24d55

    The solution is simple (ensure you have backup), on a elevated command prompt (after agreeing to UAC prompt), run the following statements:

    * net stop cryptsvc
    * ren %systemroot%\system32\catroot2\edb.log *.tst
    * net start cryptsvc
    * exit
    Now start the update.

  11. Abhijit says:

    I was getting an error 0x8E5E03FA in event viewer.
    Solution at https://medium.com/technical-series/a2a5d4b24d55

  12. gggirlgeek says:

    Thank you for your hard work! Copying Appdata back to my alternate drive worked…. until a brand new problem came up. Now I have a black screen instead of the logon screen. Nothing but the mouse cursor shows. No safe-mode either.

    This is ridiculous. I give up on Update 1. I have never seen MS botch an update this bad. I’ll just re-image back to “Win8.1.0″

    I’m only using Win8 to keep my tech knowledge up to date. I really don’t see any improvements, other than Task Manager. The UAC annoyances, in particular, have turned me off for good. It’s like Mary Poppins on crack!

    • lotsofmail says:

      You’ve got to apply Update 1 to keep receiving updates in the future. As painful as it may be, if you’re using Win8 to keep your tech knowledge up to date, then figuring out what needs to be done to apply Update 1 is a good exercise,

  13. Mwenda SIlumesii says:

    Sean C, thanx, After clean up the update worked, though it took ages. For those looking for the solution, it is;

    – Run CMD as administrator (Go to start screen, all apps, search CMD, right-click and select run as administrator)
    – Enter the command: dism /online /remove-package /packagename:Package_for_KB2919355~31bf3856ad364e35~amd64~~6.3.1.14
    Once step 2 has completed, enter the command: dism /online /cleanup-image /startcomponentcleanup
    – Retry the update.

  14. Pauly says:

    Also if you use “Windows Enabler 1.1″ to copy over the Default profile, this doesn’t copy all the files over that are need for this update.

    In my case it was missing the “winx” folder under C:\Users\Default\AppData\Local\Microsoft\Windows

    I just copied the winx folder from the “administrator” account and I was back in business.

  15. Justine says:

    I have a different issue after installing KB2919355. In IE advanced options, I like to check the option “Warn if changing from secure to not secure mode”. I have done it for years. And as far as current issue is concerned, I checked both IE9 and IE11.

    After installing KB2919355 and with above IE setting (regardless of any other settings), IE stops showing secured pages (https:) Only options are to either opt out of the warning or uninstall KB2919355 update!! I have faced and resolved this on three different systems.

  16. Marco says:

    Thanks for this figuring this out! I gave up on installing the update before. Everthing worked fine after copying the default profile to my user profile folder on the different drive.

  17. Spider3 says:

    Thank a lot! amazing Troubleshooting ;)

  18. Junk says:

    KB2971850 throw error 0x80070003 when folder “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC” is missing.
    – Create empty one, and update will work

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s