KB2732487 is unable to update - Error Code 800700B7

[ern815]

Hi there, I need help as I am unable to update a few updates for my Windows 7 Home Premium 64 Bit. But 1st I would like to try solving this update KB2732487 with the error code 800700B7.

I have attached the CBS log for your reference, I hope someone could assist me with the enquiries, thank you.

 

[Gary]

Windows Update Error 800700B7 - Microsoft Community

Try the above. It may help.

 

[NoelDP]

Please downloadand save the CheckSUR tool from http://support.microsoft.com/kb/947821

(you'll need tolook in the details for Windows 7, downloading from the Microsoft DownloadCenter)



Run it - The toolcan take anywhere from 5 mins to a couple of hours to run (or 'Install')depending on how much it has to do, and may exit silently - it may appear tofreeze for most of that time, but be patient.

The result islogged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file



Then zip theCheckSUR.log and attach it to your reply

 

[ern815]

Hi Gary, I tried that and it didn't work.

Hi Noel, I have attached the file as for your reference.

Thanks guys!

 

[NoelDP]

Interesting CheckSUR!

Unavailable repair files:
 servicing\packages\Package_2_for_KB2761451~31bf3856ad364e35~amd64~~9.4.1.0.mum
 servicing\packages\Package_2_for_KB2761451~31bf3856ad364e35~amd64~~9.4.1.0.cat
 
(w) Unable to open Event Log 0x000006BA Application  OpenEventLog failed: 0x000006BA - The RPC server is unavailable.
.
(w) Unable to open Event Log 0x000006BA System  OpenEventLog failed: 0x000006BA - The RPC server is unavailable.

We'll have to work on the Event Log first - it's going to cause problems otherwise.

 

[NoelDP]

Please open an Elevated Command Prompt, and run the following command...

REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"

post the results


Here are some instructions to make lifeeasier

1) To open anElevated Command Prompt Window (the ECP window), click on Start, All Programs,Accessories – then right-click on Command Prompt, and select Run asAdministrator. Accept the UAC prompt.

2) To run thecommands easier, highlight the block of commands, and right-click on thehighlight – select Copy. In the CP Window, click on the black/white icon at topleft – select Paste. The commands will run but may not complete the lastcommand, so hit the Enter Key once.

3) To copy theresults... click on the Black/White icon in the top left, and select Edit...'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to pasteit into your response.

 

[ern815]

Here you go Thanks for helping!

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\windows\system32>REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\
CurrentVersion\Winlogon"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
ReportBootOk REG_SZ 1
Shell REG_SZ explorer.exe
PreCreateKnownFolders REG_SZ {A520A1A4-1780-4FF6-BD18-167343C5AF16}
Userinit REG_SZ C:\Windows\system32\userinit.exe,
VMApplet REG_SZ SystemPropertiesPerformance.exe /pagefile
AutoRestartShell REG_DWORD 0x1
Background REG_SZ 0 0 0
CachedLogonsCount REG_SZ 10
DebugServerCommand REG_SZ no
ForceUnlockLogon REG_DWORD 0x0
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PasswordExpiryWarning REG_DWORD 0x5
PowerdownAfterShutdown REG_SZ 0
ShutdownWithoutLogon REG_SZ 0
WinStationsDisabled REG_SZ 0
DisableCAD REG_DWORD 0x1
scremoveoption REG_SZ 0
ShutdownFlags REG_DWORD 0x7
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExten
sions
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLog
onChecked
C:\windows\system32>

 

[NoelDP]

That knocks out the easy fix

The error message is in fact a little misleading - if the RPC server truly wasn't available, Windows wouldn't boot.
The real problem is that for some reason, the Event monitoring services are unable to communicate with it.

Let's check the services involved.
Please open an Elevated Command Prompt, and run the following commands - post the results.

SC QUERYEX EVENTLOG
SC QUERYEX EVENTSYSTEM
SC QUERYEX WECSVC
SC QUERYEX WERSVC
SC QC BITS
SC QC BFE
REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\eventlog

 

[ern815]

Here is the results:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\windows\system32>SC QUERYEX EVENTLOG
SERVICE_NAME: EVENTLOG
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 1352
FLAGS :
C:\windows\system32> SC QUERYEX EVENTSYSTEM
SERVICE_NAME: EVENTSYSTEM
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 1680
FLAGS :
C:\windows\system32> SC QUERYEX WECSVC
SERVICE_NAME: WECSVC
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1077 (0x435)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :
C:\windows\system32> SC QUERYEX WERSVC
SERVICE_NAME: WERSVC
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :
C:\windows\system32> SC QC BITS
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: BITS
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START (DELAYED)
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\windows\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Background Intelligent Transfer Service
DEPENDENCIES : RpcSs
: EventSystem
SERVICE_START_NAME : LocalSystem
C:\windows\system32> SC QC BFE
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: BFE
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\windows\system32\svchost.exe -k LocalServiceNoNe
twork
LOAD_ORDER_GROUP : NetworkProvider
TAG : 0
DISPLAY_NAME : Base Filtering Engine
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT AUTHORITY\LocalService
C:\windows\system32> REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\eventlog
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog
ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\wevtsvc.dll
ServiceMain REG_SZ ServiceMain
PlugPlayServiceType REG_DWORD 0x3
ServiceDllUnloadOnStop REG_DWORD 0x1
DisplayName REG_SZ @%SystemRoot%\system32\wevtsvc.dll,-200
Group REG_SZ Event Log
ImagePath REG_EXPAND_SZ %SystemRoot%\System32\svchost.exe -k LocalServ
iceNetworkRestricted
Description REG_SZ @%SystemRoot%\system32\wevtsvc.dll,-201
ObjectName REG_SZ NT AUTHORITY\LocalService
ErrorControl REG_DWORD 0x1
Start REG_DWORD 0x2
Type REG_DWORD 0x20
ServiceSidType REG_DWORD 0x1
RequiredPrivileges REG_MULTI_SZ SeChangeNotifyPrivilege\0SeImpersonate
Privilege
FailureActionsOnNonCrashFailures REG_DWORD 0x1
FailureActions REG_BINARY 80510100000000000000000003000000140000000100
000060EA000001000000C0D401000000000000000000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Application
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\HardwareEvents
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Internet Explorer
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Key Management Ser
vice
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Media Center
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\OAlerts
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\System
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog\Windows PowerShell

C:\windows\system32>
C:\windows\system32>

 

[NoelDP]

Those are all normal, so far as I can see.
Let's see what renaming the two log files does.

Please open an Elevated Command Prompt, and run the following commands.

SC QUERYEX SCHEDULE
REN C:\Windows\System32\winevt\logs\Application.evtx App.old
REN C:\Windows\System32\winevt\logs\System.evtx Sys.old

You may well get errors from the last two if the Scheduler task is running properly.

Post the results, and then try again from Safe Mode

 

[ern815]

The results seems to be the same for both:

Normal mode:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\windows\system32>SC QUERYEX SCHEDULE
SERVICE_NAME: SCHEDULE
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 1464
FLAGS :
C:\windows\system32> REN C:\Windows\System32\winevt\logs\Application.evtx App.ol
d
The process cannot access the file because it is being used by another process.
C:\windows\system32> REN C:\Windows\System32\winevt\logs\System.evtx Sys.old
The process cannot access the file because it is being used by another process.
C:\windows\system32>
C:\windows\system32>


Safe mode:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\user>SC QUERYEX SCHEDULE
SERVICE_NAME: SCHEDULE
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1084 (0x43c)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :
C:\Users\user> REN C:\Windows\System32\winevt\logs\Application.evtx App.old
The process cannot access the file because it is being used by another process.
C:\Users\user> REN C:\Windows\System32\winevt\logs\System.evtx Sys.old
The process cannot access the file because it is being used by another process.
C:\Users\user>

 

[NoelDP]

Bother!-
Boot to safe mode, then run the following commands.

NET STOP EVENTLOG
REN C:\Windows\System32\winevt\logs\Application.evtx App.old
REN C:\Windows\System32\winevt\logs\System.evtx Sys.old

(I forgot that even though the Task Scheduler doesn't run in Safe Mode, the Event Log service does )

 

[ern815]

Here it is, thanks!

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\user>SC QUERYEX SCHEDULE
SERVICE_NAME: SCHEDULE
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1084 (0x43c)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :
C:\Users\user> REN C:\Windows\System32\winevt\logs\Application.evtx App.old
The process cannot access the file because it is being used by another process.
C:\Users\user> REN C:\Windows\System32\winevt\logs\System.evtx Sys.old
The process cannot access the file because it is being used by another process.
C:\Users\user>
C:\Users\user>

 

[ern815]

Sorry, I think this should be the correct one:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\user>NET STOP EVENTLOG
The Windows Event Log service is stopping.
The Windows Event Log service was stopped successfully.

C:\Users\user> REN C:\Windows\System32\winevt\logs\Application.evtx App.old
C:\Users\user> REN C:\Windows\System32\winevt\logs\System.evtx Sys.old
C:\Users\user>REN C:\Windows\System32\winevt\logs\Application.evtx App.old
The system cannot find the file specified.
C:\Users\user> REN C:\Windows\System32\winevt\logs\System.evtx Sys.old
The system cannot find the file specified.

 

[NoelDP]

OK
Now please run the following commands in Normal Mode, and post the results, then run another CheckSUR report and post the results.

DIR C:\Windows\System32\winevt\logs\app*.*
DIR C:\Windows\System32\winevt\logs\sys*.*

 

[ern815]

Done, here it is:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\windows\system32>DIR C:\Windows\System32\winevt\logs\app*.*
Volume in drive C is S3A5912D001
Volume Serial Number is 5461-260C
Directory of C:\Windows\System32\winevt\logs
15/03/2013 09:17 PM 20,975,616 App.old
15/03/2013 10:00 PM 69,632 Application.evtx
2 File(s) 21,045,248 bytes
0 Dir(s) 260,619,030,528 bytes free
C:\windows\system32> DIR C:\Windows\System32\winevt\logs\sys*.*
Volume in drive C is S3A5912D001
Volume Serial Number is 5461-260C
Directory of C:\Windows\System32\winevt\logs
15/03/2013 09:17 PM 20,975,616 Sys.old
15/03/2013 10:06 PM 1,118,208 System.evtx
2 File(s) 22,093,824 bytes
0 Dir(s) 260,619,030,528 bytes free
C:\windows\system32>

 

[NoelDP]

Great- that's cleared the Event log errors from the CheckSUR, so at least you'll be able to read the event logs properly from here on in


I've uploaded afile - ernaa.zip - to my SkyDrive at Noel's SkyDrive

Please downloadand save it.

Right-click onthe downloaded file, and select Extract all…

Extract to thedefault location - which will create a new folder ernaain the same place.

Open this folder- there should be one folders inside it (Packages)



Copy the content of the Packages folder to thefolder

C:\Windows\Temp\CheckSur\Servicing\Packages


Nowrun the CheckSUR tool again (it may take a while)



Postthe new CheckSUR.log file, and the CheckSUR.persist.log file.

 

[ern815]

Yes, here are the attached files! Seems like it's going the right way!

 

[NoelDP]

Good - that's cleared the CheckSUR log.
Now go to Windows Update, and do a Check for Updates.
What's listed?
Just try to install the oldest update at first - does it work? if not, what error message do you get?

 

[ern815]

Unfortunately the updates did not work. I tried updating the earliest 1st but it still failed. Here are the files pending for updates (from earliest to latest)

KB2719857 - 11/09/2012
KB2732487 - 09/10/2012
KB2791765 - 12/03/2013
KB2807986 - 12/03/2013
KB2809289 - 12/03/2013
Internet Explorer 10 -12/03/2013

Error code remains the same - 8007007B00700B7