Solved Windows Update - Reverting Changes

[r44712]

Hi all,

I give up in frustration. I have three Windows Updates that will not install:

• 3003057 (IE11), Error 800F0826
• 3002885 ("Security Update"), Error 8007054F
• 3003743 ("Security Update"), Error 8007054F

I have utilised the System Readiness Update Tool, run that sfc command - no errors reported.

I've deleted the WU download folder, re-started the WU service.

I've tried installing them one at a time - no difference.

It seems to be any that require a reboot, that fail (although the AMD SATA driver did install).

Is there something I am missing?

I'll attach the CBS log in a minute - it seems to have gone missing!

 

[r44712]

I'll try and get the CBS Log File attached tomorrow.

It's too big and it's taking too long - in fact it looks like nothing's happening when I click "Upload File".

This is after splitting it into under 8Mb zip chunks.

 

[NoelDP]

It can take a few minutes to upload 8MB files, depending on your connection speed. be patient

 

[r44712]

Here we go, the CBS file.

Thanks in advance.

 

[NoelDP]

There appears to be a problem with your file - it won't extract at my end? It also appears to be too small for the size of file that is indicated. A 159MB CBS.log I would expect to come down to about 8MB on compression, rather than the indicated 760KB.

Please try again

 

[r44712]

There appears to be a problem with your file - it won't extract at my end? It also appears to be too small for the size of file that is indicated. A 159MB CBS.log I would expect to come down to about 8MB on compression, rather than the indicated 760KB.

Please try again

It was compressed (and un-compressed, to check) with 7-Zip, as I knew it made really small files.

Trying to do it with another ZIP tool now.

 

[r44712]

Re-compressed file attached.

I've split the CBS Log into two halves and created two zip files accordingly. I don't know how else to get it under the 8Mb limit.

Thanks.

 

[NoelDP]

Interesting log! - unfortunately it's all about the rollback, and not what went on in the install phase
Please post the CBSPersist files (you'll have to zip them, as the forum doesn't accept bare CAB files) and the CheckSUR logs

 

[r44712]

Here are the .cab files and CheckSUR Log.

 

[NoelDP]

Please open an Elevated Command Prompt and run the following commands...

REG QUERY HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
REG QUERY HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WABSyncProvider/Analytic
 
.

post the results...

Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[r44712]

Thanks for the reply, here are the details:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
MessageFileName REG_EXPAND_SZ %SystemRoot%\system32\PortableDeviceSyncProvider.dll


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-WABSyncProvider/Analytic
OwningPublisher REG_SZ {17f14a23-551d-40cc-a086-e4194d64ed4c}
Enabled REG_DWORD 0x0
Isolation REG_DWORD 0x1
ChannelAccess REG_SZ O:BAG:SYDA;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;
;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)
(A;;0x1;;;S-1-5-32-573)
Type REG_DWORD 0x2


I've attached another CBS log, too, having tried another update install....

 

[r44712]

Thanks for the reply, here are the details:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
MessageFileName REG_EXPAND_SZ %SystemRoot%\system32\PortableDeviceSyncProvider.dll

Interestingly, I ran the same command on my Win7 "Home Premium" Laptop and got 'more results', I'm guessing some registry keys are missing?:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{
17f14a23-551d-40cc-a086-e4194d64ed4c}
(Default) REG_SZ Microsoft-Windows-WABSyncProvider
ResourceFileName REG_EXPAND_SZ %SystemRoot%\system32\WABSyncProvider.d
ll
MessageFileName REG_EXPAND_SZ %SystemRoot%\system32\PortableDeviceSync
Provider.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{
17f14a23-551d-40cc-a086-e4194d64ed4c}\ChannelReferences


Incidentally, I'm a developer for a Microsoft stack product, so don't worry about simplifying your answers too much....

Thanks in advance.

 

[NoelDP]

There does appear to be data missing there...

Here's my output from the same commands...

C:\Users\Spare>reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
    (Default)    REG_SZ    Microsoft-Windows-WABSyncProvider
    ResourceFileName    REG_EXPAND_SZ    %SystemRoot%\system32\WABSyncProvider.dll
    MessageFileName    REG_EXPAND_SZ    %SystemRoot%\system32\PortableDeviceSyncProvider.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}\ChannelReferences
 
C:\Users\Spare>reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
    (Default)    REG_SZ    Microsoft-Windows-WABSyncProvider
    ResourceFileName    REG_EXPAND_SZ    %SystemRoot%\system32\WABSyncProvider.dll
    MessageFileName    REG_EXPAND_SZ    %SystemRoot%\system32\PortableDeviceSyncProvider.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}\ChannelReferences
    Count    REG_DWORD    0x1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}\ChannelReferences\0
    (Default)    REG_SZ    Microsoft-Windows-WABSyncProvider/Analytic
    Id    REG_DWORD    0x10
    Flags    REG_DWORD    0x0

I have to admit that this is an area I've not delved into before - so all bets are off

Perhaps copying the relevant data from the 'good' machine will work - but I can't be sure without extensive testing (and I don't have the proper baseline to work from )

 

[r44712]

There does appear to be data missing there...

Here's my output from the same commands...

C:\Users\Spare>reg query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}
    (Default)    REG_SZ    Microsoft-Windows-WABSyncProvider
    ResourceFileName    REG_EXPAND_SZ    %SystemRoot%\system32\WABSyncProvider.dll
    MessageFileName    REG_EXPAND_SZ    %SystemRoot%\system32\PortableDeviceSyncProvider.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{17f14a23-551d-40cc-a086-e4194d64ed4c}\ChannelReferences

I have to admit that this is an area I've not delved into before - so all bets are off

Perhaps copying the relevant data from the 'good' machine will work - but I can't be sure without extensive testing (and I don't have the proper baseline to work from )

I started with grafting them over from the good machine, but Googling {17f14a23-551d-40cc-a086-e4194d64ed4c} brought up a TechNet article, that suggested deleting all of the sub-entries in WINEVT (risky I know), but this did the trick. All up and running again, thanks!

Incidentally, what sort of events in the CBS Log should I be looking for in case that this happens again (thanks for any tips)?