We had already updated a Windows 8.1 x64 machine with KB2919442 and was starting to install Windows8.1-KB2919355-x64.msu.
Firstly it was hanging for ages at the “Installing” phase with no progress…
Well that is normal. What is going on here? Using ProcMon (http://live.sysinternals.com/ProcMon.exe) we used the target icon and dragged it over the “Download and Install Updates” Window to monitor activity.
However there was no file or registry activity going on.
So I cleared the current filter and used Tools | File Summary… I then looked at the most Active File by Path and clicked it, to display it in ProcMon filter. From this we could see that TiWorker.exe the “Windows Modules Installer Worker” was busy extracting update contents into the following folders:
- C:\Windows\CbsTemp\
- C:\Windows\SoftwareDistribution\Download\
For this update this phase can take quite a while due to large size of update file. You will not see any progress bar during the extraction phase.
Based on this info we reset our filter and set to filter on Process Name is TiWorker.exe
Once we started to see progress we would see files being written into C:\Windows\WinSxS\Temp\PendingRenames and other locations. (The PendingRenames files are files that need to be installed on reboot)
We also were able to notice with ProcMon that a log file was being written to at
C:\Windows\Logs\CBS\CBS.log
However after some time update failed with this helpful message:
Some updates were not installed
The following updates were not installed:
Update for Windows (KB2919355)
Checking the Windows System Event log, and looking at Source WindowsUpdateClient we found a slightly more helpful error message:
Installation Failure: Windows failed to install the following update with error 0x80070003: Update for Windows (KB2919355)
The error message 0x80070003 refers to “PATH NOT FOUND” So what was NOT FOUND?
We can find TIWORKER failures by searching our ProcMon log for LastError
In the detail view we can see the Data value has our error message – in decimal instead of HEX. We also see the package name that failed. We also see writing to CBS.log.
If we work backwards from that in our ProcMon log we quickly see a pile of PATH NOT FOUND errors:
If we checked the CBS.log (you will need to open Notepad or other log viewer as Administrator to open this file –> in some cases you may need to copy it into another folder before you can open it)
2014-04-03 13:55:16, Info CSI 00000e25 Delete of a missing registry value detected in the registry installer!!
Registry value name: “[l:0]”””
2014-04-03 13:55:17, Error CSI 00000e26 (F) STATUS_OBJECT_PATH_NOT_FOUND #8659314# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowSharingViolation), handle = {provider=NULL, handle=0, name= (“null”)}, da = (SYNCHRONIZE|FILE_READ_ATTRIBUTES), oa = @0x64b7a4d9a8->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[64]”\??\ D:\Users\Default\AppData\Local\Microsoft\Windows\WinX \Group2″; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0x64b7a4d988, as = (null), fa = 0, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), cd = FILE_OPEN, co = (FILE_SYNCHRONOUS_IO_NONALERT|0x00004000), eab = NULL, eal = 0, disp = Invalid)
[gle=0xd000003a]
2014-04-03 13:55:17, Error CSI 00000e27@2014/4/3:02:55:17.825 (F) base\wcp\sil\merged\ntu\ntsystem.cpp(2155): Error STATUS_OBJECT_PATH_NOT_FOUND originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile expression: (null)
[gle=0x80004005]
2014-04-03 13:55:17, Info CBS Added C:\windows\Logs\CBS\CBS.log to WER report.
2014-04-03 13:55:17, Info CBS Added C:\windows\Logs\CBS\CbsPersist_20140403023755.log to WER report.
2014-04-03 13:55:17, Info CBS Added C:\windows\Logs\CBS\CbsPersist_20140403022331.log to WER report.
2014-04-03 13:55:17, Info CBS Not able to add pending.xml to Windows Error Report. [HRESULT = 0x80070002 – ERROR_FILE_NOT_FOUND]
2014-04-03 13:55:17, Info CBS Not able to add pending.xml.bad to Windows Error Report. [HRESULT = 0x80070002 – ERROR_FILE_NOT_FOUND]
2014-04-03 13:55:17, Info CBS Not able to add SCM.EVM to Windows Error Report. [HRESULT = 0x80070002 – ERROR_FILE_NOT_FOUND]
2014-04-03 13:55:19, Error CSI 00000e28 (F) STATUS_OBJECT_PATH_NOT_FOUND #8659313# from Windows::Rtl::SystemImplementation::CSystemIsolationLayer_IRtlSystemIsolationLayerTearoff::OpenFilesystemDirectory(flags = 0, da = (FILE_ALL_ACCESS), dn = [ml:520{260},l:128{64}]”\??\D:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2″, sa = (FILE_SHARE_READ|FILE_SHARE_DELETE), oo = (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT), dir = NULL, disp = Invalid)
[gle=0xd000003a]
2014-04-03 13:55:19, Error CSI 00000e29 (F) STATUS_OBJECT_PATH_NOT_FOUND #8124892# from PrimitiveInstaller::CCoordinator::FinalizeChanges(…)[gle=0xd000003a]
2014-04-03 13:55:19, Info CSI 00000402 SMI Primitive Installer [done]
2014-04-03 13:55:19, Error CSI 00000e2a (F) STATUS_OBJECT_PATH_NOT_FOUND #6494085# from CCSDirectTransaction::PerformChangeAnalysis(…)[gle=0xd000003a]
2014-04-03 13:55:19, Error CSI 00000e2b (F) STATUS_OBJECT_PATH_NOT_FOUND #6494084# from CCSDirectTransaction::PrepareForCommit(…)[gle=0xd000003a]
2014-04-03 13:55:19, Error CSI 00000e2c (F) STATUS_OBJECT_PATH_NOT_FOUND #6494083# from CCSDirectTransaction::GenerateComponentChangeList(…)[gle=0xd000003a]
2014-04-03 13:55:19, Error CSI 00000e2d (F) STATUS_OBJECT_PATH_NOT_FOUND #6494082# from Windows::COM::CPendingTransaction::ExtractInformationFromRtlTransaction(…)[gle=0xd000003a]
2014-04-03 13:55:19, Error CSI 00000e2e (F) HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) #1764404# from Windows::COM::CPendingTransaction::IStorePendingTransaction_Analyze(…)[gle=0x80070003]
2014-04-03 13:55:20, Error CSI 00000e2f (F) HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) #1626198# from Windows::ServicingAPI::CCSITransaction::ICSITransaction_Commit(Flags = 47 (0x0000002f), pSink = NULL, disp = 0, coldpatching = FALSE)[gle=0x80070003]
2014-04-03 13:55:20, Error CSI 00000e30 (F) HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) #1626197# 313613458 us from
So why was D:\Users\Default folder missing?
This is because the User Profiles has been redirected using a registry key, instead of unattend.xml – Refer to “Relocation of the Users directory and the ProgramData directory to a drive other than the drive that contains the Windows directory” at http://support.microsoft.com/kb/949977
To summarize this KB article:
- Using ProfilesDirectory to redirect folders to a drive other than the system volume blocks upgrades.
- Using ProfilesDirectory to point to a directory that is not the system volume will block SKU upgrades and upgrades to future versions of Windows.
- Microsoft recommends that you do not change the location of the user profile directories or program data folders.
- Note If you use the unattend settings to set up the operating systems that are listed in this article, we will provide commercially reasonable efforts to support your scenario.
So to fix the machine we ran:
robocopy C:\Users\Default\ D:\Users\Default\ *.* /s
To prevent these type of issues in the future however it is best to keep ProfilesDirectory on the system volume (i.e. C:\ ) This issue may not have occurred if the unattend settings had been used to put the profile on D:\
After creating a copy of default profile under D:\Users\Default we re-ran Windows8.1-KB2919355-x64.msu and updated installed without an issue
Some other issues with this Windows update error message are also covered under these KB articles:
Windows Update error “0x80070002” or “0x80070003”
http://support.microsoft.com/kb/910336
Error message when you try to install updates by using the Windows Update or Microsoft Update Web site: “0x80070003”
chentiangemalc 
Wow, what a nice job You’ve done. Cudos for that. Although my error was that I deleted a “System Tools” folder from the start menu. But this guide helped me anyway.
I also deleted that folder. Can you tell me where to put it back?
Got it! I needed to apply the fix here AND restore the System Tools folder (after the first fix I got 0x80070002 instead of 0x80070003). Just added an empty folder back to “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools”
Thanks ! I never knew system tools would affect updates ! this solved my problems
Interesting how Microsoft messed up here. It is pretty common to move the personal folders to another volume. This will probably fix it, trying now.
Same problem with “System Tools” in my case. I relocated my “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools” one level deeper to “…\Programs\Accessories\System Tools”. Since “System Tools” was missing from its original location, the update was failing. After I created an empty “System Tools” directory in the original location, the update installed without any problems. This is actually rather preposterous that such an “innocent” change breaks such an important update. Windows Updater should be able to work around such issues by itself.
Same ‘System Tools’ problem for me as well; blog entry from Andrey:
http://atarasevich.blogspot.com/2014/04/error-0x80070002-when-installing-new.html
Guys I had diffrent cause, but the same result… KB2919355 failed with error 0x80070002
– In C:\Windows\Logs\CBS\CBS.log was error about
“C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools”
– So I have executed
mkdir “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools”
– And next installation worked!
same problem here… but… I can’t create an empty “System Tools” folder. I tried to trick the system and made a “System Tool” and then changing the name to System ToolS. Look what happened: https://onedrive.live.com/redir?resid=567154B9725C9A3!4360&authkey=!AICuAslm1ptjTjM&v=3&ithint=photo%2c.PNG
I think Windows 8 team really screwed the OS. They are completely out of control.
“I think Windows 8 team really screwed the OS. They are completely out of control.”
That’s an understatement and I’m an MS fan. I read somewhere that Windows 8.1 Update was never tested outside of Microsoft. I have a feeling they won’t make that mistake again.
I think in your case issue is not System Tools is missing but it is Administrative Tools. Trying running cmd as admin and use mkdir “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools”
I have that same error, can’t create a System Tools folder and I DO have an Administrative Tools folder, complete with items in it, still no go.
how do you set yourself as admin
figured it out. My cmd prompt says windows32 but it should say 64 I believe
My 0×80070003 error was caused by a missing
C:\Users\Default\AppData\Local\Microsoft\Windows\WinX subfolder.
This guide helped me find the problem. Nice work.
TL;DR: Several months ago I renamed the WinX subfolder to WinX.jic in all users’ subfolders. (Long story – I thought they were put there by the WinX DVD program.)
When I figured out that doing so broke my Windows 8 Win-X menu, I changed the folder name back in my own profile but never changed the others back.
KB2919355 would not install until I restored the name of the WinX folder under the Default user.
Please add /RJ to the ROBOCOPY command. Otherwise it will follow junctions – and create an infinite subdirectory tree which you cannot simply delete (you can with Total Commander for example, if you did this and are in trouble now).
It’s /XJ, not /RJ, sorry
Thanks!
Wow, for anyone else chasing this problem: I’ve tried everything above and others without success and *finally * found a working solution for myself.
While trying to update Win8.1 Pro x64 to “Update 1”, (particularly KB2919355) I received error 80073712. ProcMon tracing, ‘System Tool’ and Default folder creation, etc did not reveal the solution. A post on this page of the Microsoft community forum by ‘MrBill666’ worked for me, which involved:
– Run CMD as administrator (Go to start screen, all apps, search CMD, right-click and select run as administrator)
– Enter the command: dism /online /remove-package /packagename:Package_for_KB2919355~31bf3856ad364e35~amd64~~6.3.1.14
Once step 2 has completed, enter the command: dism /online /cleanup-image /startcomponentcleanup
– Retry the update.
Hopefully this works for others!
Credit: http://andrew-b.com/view/article/46
Problem solved. I had same error (0xE5E03FA) in event viewer.
Refer to the details on https://medium.com/technical-series/a2a5d4b24d55
The solution is simple (ensure you have backup), on a elevated command prompt (after agreeing to UAC prompt), run the following statements:
* net stop cryptsvc
* ren %systemroot%\system32\catroot2\edb.log *.tst
* net start cryptsvc
* exit
Now start the update.
I was getting an error 0x8E5E03FA in event viewer.
Solution at https://medium.com/technical-series/a2a5d4b24d55
Thank you for your hard work! Copying Appdata back to my alternate drive worked…. until a brand new problem came up. Now I have a black screen instead of the logon screen. Nothing but the mouse cursor shows. No safe-mode either.
This is ridiculous. I give up on Update 1. I have never seen MS botch an update this bad. I’ll just re-image back to “Win8.1.0”
I’m only using Win8 to keep my tech knowledge up to date. I really don’t see any improvements, other than Task Manager. The UAC annoyances, in particular, have turned me off for good. It’s like Mary Poppins on crack!
You’ve got to apply Update 1 to keep receiving updates in the future. As painful as it may be, if you’re using Win8 to keep your tech knowledge up to date, then figuring out what needs to be done to apply Update 1 is a good exercise,
Sean C, thanx, After clean up the update worked, though it took ages. For those looking for the solution, it is;
– Run CMD as administrator (Go to start screen, all apps, search CMD, right-click and select run as administrator)
– Enter the command: dism /online /remove-package /packagename:Package_for_KB2919355~31bf3856ad364e35~amd64~~6.3.1.14
Once step 2 has completed, enter the command: dism /online /cleanup-image /startcomponentcleanup
– Retry the update.
Also if you use “Windows Enabler 1.1” to copy over the Default profile, this doesn’t copy all the files over that are need for this update.
In my case it was missing the “winx” folder under C:\Users\Default\AppData\Local\Microsoft\Windows
I just copied the winx folder from the “administrator” account and I was back in business.
I have a different issue after installing KB2919355. In IE advanced options, I like to check the option “Warn if changing from secure to not secure mode”. I have done it for years. And as far as current issue is concerned, I checked both IE9 and IE11.
After installing KB2919355 and with above IE setting (regardless of any other settings), IE stops showing secured pages (https:) Only options are to either opt out of the warning or uninstall KB2919355 update!! I have faced and resolved this on three different systems.
You can switch off in Advanced Internet settings “Use SPDY/3” typically fixes this issue. A bug is logged here https://connect.microsoft.com/IE/feedback/details/813993/ie11-sites-that-support-spdy-do-not-load-first-time-when-ie-is-configured-to-use-a-proxy-server-and-spdy-is-enabled
Thanks for this figuring this out! I gave up on installing the update before. Everthing worked fine after copying the default profile to my user profile folder on the different drive.
Thank a lot! amazing Troubleshooting ;)
KB2971850 throw error 0x80070003 when folder “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC” is missing.
– Create empty one, and update will work
KB3000850 throw error 0×80070002 when any of folders
“C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility”
“C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools” is missing.
– Create empty ones, and update will work
I have error 0×80070002 when installing KB2919355. I have completed the path as above mentioned but it is still showing this error….. pls help…
It is usefull software for copy, delete, long path files.
Please try “Long Path Tool” program.
while installing KB2919355 i m getting 0x8E5E0147 error and i haven’t seen any solution on any single website pls help me if someone resolved above number error.
Now this is a complete answer to a problem. Thank you very much for sharing.