SP 1 fails - CBS MUM Corrupt 0x800F0900

Sorry about the delays - still trying to fit a job in around my posting habits! :)
I was hoping to find a surgical procedure to repair the damage, rather than our more usual sledgehammer approach of simply deleting the affected registry entries.
The problem is that the users (even as Admin) don't have permissions to be able to do the necessary editing without taking ownership first - which introduces complexity to the issue, and increases the chances of something going wrong.


For the record (and so I don't have to download the CheckSUR file yet again!), here are the errors that we need to try and fix

Code:

Checking Package Watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-Foundation-Package~31bf3856ad364e35~x86~~0.0.0.0 WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~~7.6.7600.256 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 Microsoft-Windows-ServerCore-Package~31bf3856ad364e35~x86~~0.0.0.0 WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~~7.6.7600.256 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Package Missing 0x80070002 WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~~0.0.0.0 WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~en-US~7.6.7600.256 Package registry presence failed, possibly an orphaned package on package watchlist
Checking Component Watchlist
(f) CBS Watchlist Component Missing 0x80070002 x86_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_0.0.0.0_en-us_d25e1fcba1051e33 WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~en-US~7.6.7600.256 Package registry presence failed, possibly an orphaned package on package watchlist
(f) CBS Watchlist Component Missing 0x80070002 x86_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_0.0.0.0_none_b8cd8ce205840e6a WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~~7.6.7600.256 Package registry presence failed, possibly an orphaned package on package watchlist

You'll notice that they are all concerned with the same update. This is actually the self-update to the Windows Update Agent, so is kinda important! :)

To be honest, I'm never certain as to which to fix first - the Component, or the Package errors.
To give you a relatively easy start, we'll go for the Package errors, and do one on its own before attempting anything else.

First create a System Restore Point - just in case things go wrong.

Then open Regedit
Navigate in the left pane to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~x86~~0.0.0.0

Right-click on the key name in the left pane, and select Export - save as 'edit1.reg'
(it's an additional safety measure :))
Now right-click on the key name, and select Permissions
Click on the Advanced button, then select the Owner tab
Highlight the 'Administrators' entry in the list, and put a tick in the 'Replace Owner on ....' box
Click Apply
Click on the Permissions tab
Click on the Add button
in the box, type Administrators and click OK
put a tick in the Allow/Full Control box - all the other boxes in that column should auto-tick.
put a tick in the 'Apply these permissions...' box, and click OK
Click OK again (it may take a few seconds to apply the changes)
Click OK
Now in the right pane, search for the following value

WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~~7.6.7600.256

Highlight it, and then right-click on it and select Delete
Close Regedit, and run CheckSUR again, and post the new result - this will show whether we got it right or not :) , and whether we can proceed with the rest.


..and that's the first one done :)

P

That worked fine - but you did the operation on a different key to the one I asked you to!

Luckily there's no harm done, as that was the second in the list, anyhow. :) -
Microsoft-Windows-ServerCore-Package~31bf3856ad364e35~x86~~0.0.0.0
as opposed to
Microsoft-Windows-Foundation-Package~31bf3856ad364e35~x86~~0.0.0.0



Please be very careful in the registry - it's possible to make the system unrepairable very easily.


Now we need to set permissions back the way they started...
Open Regedit again, and navigate to the key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect\Microsoft-Windows-ServerCore-Package~31bf3856ad364e35~x86~~0.0.0.0
(it may well open there automatically)

right-click on the Key and select Permissions.
Click on the Advanced button
There should be two entries for Administrators in the list.
highlight the one that shows <not inherited> and click Remove
Click Apply
Click on the Owner tab
Click the 'Other users or groups...' button
In the box, type SYSTEM and click OK
Highlight the new SYSTEM entry in the 'Change owner' box, and put a tick in the 'Replace owner...' box, then click OK
Click OK again to get back into Regedit - and that completes the first edit of the 5 needed :)


How do you feel now? up for the other four??

I'll provide abbreviated instructions for the other two Package errors now - if you need more detail, post back

Go to the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect\Microsoft-Windows-Foundation-Package~31bf3856ad364e35~x86~~0.0.0.0

key and change permissions there as above in post #12
Again, look for the
WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~~7.6.7600.256
value and delete that, then set the permissions back as above, in this post.


Then go to the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\PackageDetect\WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~~0.0.0.0
key, and change permissions as in post #12.
Look for the
WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~en-US~7.6.7600.256
value and delete that (double-check that you've got the correct one there!) then set the permissions back as above in this post.

Once you've done those, run CheckSUR again so we can check the results, before we go on to the slightly more complex Components errors. - post the new log.

So far, so good :)
Now things may get a little complicated, as the key names in the ComponentDetect listing aren't the same as the names in the CheckSUR report (trust MS to make life difficult!)

Open Regedit, and navigate to the following keys - change their permissions as in post #12 and delete the value under each (in italics), then return the permissions to normal as in post #14

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\ComponentDetect\x86_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_0.0.0.0_none_b8cd8ce205840e6a

WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~~7.6.7600.256.Aux

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\ComponentDetect\x86_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_0.0.0.0_en-us_d25e1fcba1051e33

WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~~7.6.7600.256.Aux


once complete, run CheckSUR again, and post the results.
Hopefully, it will be clear this time.
Reboot, and do a manual check for Windows Updates - what is found? (with any luck you'll be told that the Update system itself needs to be updated)
DO NOT attempt to install anything yet, unless you are offered the compulsory update to the update system.
If you are offered it, accept it, reboot, and then run CheckSUR again - post that log as well.

OK
Cross fingers and toes, and go for the SP1 update.
I'm off to bed now - so I'll see the results in the morning.

Great!

Just to check, please run new SFC /SCANNOW and CheckSUR scans, and post the CBS.log and CheckSUR.log files.