Reports: Server 2008 R2 systems boot to recovery mode after January patches applied

Topic

New Reply

Not clear which patches are causing the problem, but I’m seeing multiple reports of a boot to recovery mode on Server 2008 R2 systems. Can anybody out
[See the full post at: Reports: Server 2008 R2 systems boot to recovery mode after January patches applied]

Reply | Quote

Replies

[matjazp72]

I had the same problem. The only way to recover server is to restore it from backup. Luckily for me it was an old SQL server with archaic databases – not in real production.

I then tried to make a clean install of Windows 2008 R2, applied all patches, including the latest one and I couldn’t reproduce the problem. Maybe some weird combination with existing patches prior to 2020-01 or 2019-12?

The simptom was – all patches have been successfully installed, reboot and then bang, straight into recovery mode. No way out from there…

Final result – new clean install, rebuild SQL server, copied all databases from old server.

• This reply was modified 5 years, 4 months ago by matjazp72.

2 users thanked author for this post.

woody, nazzy

Reply | Quote

Well that’s certainly one way of fixing the RD Gateway security vulnerability…….

1 user thanked author for this post.

doriel

Reply | Quote

We’re not seeing that issue here with 2008 R2 VMs on top of VMware – any idea if the affected systems are physical or virtual?

Reply | Quote

It’s affecting all 2008 R2 OS (not just physical).

Reply | Quote

seeing this on Vm on ESX hosts

Reply | Quote

Thanks. We’re running on ESXi 6.5.

Any common roles/features on the VMs that are failing? SQL? Terminal services?

I’m thinking snapshots prior to patch installation as a safety net…

Reply | Quote

A *potential* fix for physical servers (to avoid restoring from backup):

https://community.spiceworks.com/how_to/164887-after-windows-server-2008-r2-update-the-server-won-t-boot-how-did-i-fixed-it

 

 

 

Reply | Quote

That looks like a way around a patch failure from September, 2019.

Reply | Quote

[nazzy]

Which the method could possibly be useful for future patch failures. As a way to get around the “stuck in recovery mode” issue.

 

• This reply was modified 5 years, 4 months ago by nazzy.

1 user thanked author for this post.

jabeattyauditor

Reply | Quote

Just got done with around 60 across 25+ separate clients. No issues with them so far.

2 users thanked author for this post.

woody, jabeattyauditor

Reply | Quote

Hi:

is win7 January security only patch clean(ie: without telemetry or EOS notice)?  I already skip July,Sepetember,December. I hope this one can give win7 a happy ending.

Reply | Quote

@tbsky asked:

is win7 January security only patch clean(ie: without telemetry or EOS notice)?

No. KB4534314 (January 14, 2020 Security-only update) does not contain telemetry, but it contains a newer version of ‘EOSNotify.exe’ (the program that is responsible for displaying full-screen ‘End of Support’ notifications). It is mentioned in update description. You can also find some further details in file information (a *.csv file. Keyword: ‘EOSNotify’).

You can prevent those nagware from displaying notifications by simply disabling it in Task Scheduler. There are instructions, for example here on Askwoody.com.

1 user thanked author for this post.

tbsky

Reply | Quote

We’ve completed our non-prod patching yesterday morning, with 30+ Win2008R2’s.
Most will be VMs on VMware ESXi. We don’t have that much physical non-prod.

No problems whatsoever so far with this month’s patches…

1 user thanked author for this post.

jabeattyauditor

Reply | Quote

It seems to be a mixture of December and January patches that causes it to blue screen, I’ve had reports of it on Windows 7 machines as well.

1 user thanked author for this post.

woody

Reply | Quote

We just finished updates here; no issues with the remaining 2008/2008R2 VMs (other than the fact that there ARE remaining 2008/2008R2 VMs).

Reply | Quote

Had downloaded Windows updates for my 64 bit Windows 7 professional desktop. Last night when I turned the computer off it forced more updates and I had already been forced to update the night before. This morning the screen shows ” Configuring Windows update 100%complete Do not turn off your computer”. What should I do? I’ve already paid for the service from Harbor to receive extended updates. This is a small business computer.

Thank You in advance for any help you can give or suggestions.

<!–more–>

Reply | Quote

Look in the Update History and give us a list of the KB numbers for the patches that have been installed in the last three days (the ones you say were forced).

Reply | Quote

I’m still stuck with the screen”Configuring Windows updates 100% complete do not turn off your computer. ” I can’t access those KB numbers until the system completes this step but it’s been like this for one hour.

Reply | Quote

We had one 2008 R2 server (same basic system as Windows 7) take over 45 minutes at this stage. Let it sit a while longer – it may just be taking its sweet time to complete the update.

Reply | Quote

Give it a couple of hours.  If it still doesn’t go, do a hard reboot.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Thank You all for your helpful responses! The system finally came up ok after taking over and hour and then showing a clean up message. Thank You again!!!

Reply | Quote

Had 1 windows 7 64 bit pro go into startup repair after todays’ updates.

Bypassed it by hitting F8 as the PC booted and chose Safe mode with networking. Doamin login screen loaded immediately. Then I succeeded in logging in and did a reboot into normal safe mode.

1 user thanked author for this post.

wmelonman

Reply | Quote

We did experiance 2 cases where Windows 2008 R2 servers would boot to recovery mode after the patches were applied. In both cases, they were FAX servers running in a vmware environment. Any idea which patch(es) may be causing this?

Reply | Quote

To all of you how experienced the fault with a virtual machine and can rollback to before January patch install: Have you tried to do a SFC /scannow and then install again? I think maybe it is some system file corruption that causes the patch to fail – and not some other patch or software by merely coexisting.

I have one SBS 2011 at a customer’s and did not dare to install yet. But SFC /verifyonly did show some issues which I will definitly try to fix before jumping…

Reply | Quote

just got done with MS support. I have had a few 2008r2  vm servers do this. He rolled back patches for them to fix. Said it is caused by us missing a req patches. The error was winload.exe Windows cannot verify the digital signature

Reply | Quote

Had the issue of booting to recovery mode on a 2008R2 machine last Friday, and a second machine today.

The majority of our estate is patched on an automatic schedule every month, and none of these have displayed any issues.

The 2 affected machines aren’t patched automatically monthly, but manually every 3 months.

This makes me think that there is a clash between the January patches and the patches from December or November, so backing up Guy’s comment from the 21st

Reply | Quote

I’ve managed to identify the cause of this.

The latest kb4474419 (September 10th 2019) must be installed and the server rebooted before installing January’s patches.

The patch specifically deals with sha-2 signing of bootloader files and is listed as a prerequisite for January’s fixes.

Installing it first in a batch including January’s still causes the issue, so it must be installed individually.

Hope this helps someone avoid this issue

1 user thanked author for this post.

Paul T

Reply | Quote

Had this problem on two servers. Click command line option in recovery:

dism.exe /image:C:\ /cleanup-image / revertpendingactions
Replace c: with whatever your windows install is on according to diskpart

saved mine.

Reply | Quote

Thank you for saving my live!

Reply | Quote

Can confirm this works.

Reply | Quote

Serveral 2008r2 vm’s on esxi had the recovery mode after patch installation and rebooting.

I had to load up the pvscsi drivers from the vmware tools iso into to the recovery mode. Then i was able to access the windows installtion on the vm disks and do a simple startup repair. VM booted again and finished installing the patches. Startup repair reported that the root cause was a corrupt boot manager…

Reply | Quote

Same boot issue here of Win2k8 R2 and i was able to reproduce the issue on Hyper-V VM by installing only KB4534314. A repair process which worked is to boot from Win2k8 R2 installation media and running StartRep.exe

Reply | Quote

Will Susan Bradley be able to tell us at what point it will be safe to install all the WS2008R2 patches which have stacked up, waiting?

Thanks!

BATcher

Plethora means a lot to me.

Reply | Quote

What a/v do you have running and when did you apply the SSU?  Webroot is one trigger.  As long as you don’t have that a/v I’m personally not seeing any issues here.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Hi friends

This command  solve the problem

dism.exe /image:C:\ /cleanup-image /revertpendingactions

Thanks!!!!!

Reply | Quote

hello, reverting pending actions (patch installation) helped me:

Server in the reboot loop mostly due to patching – fix via recovery cmd
Open cmd in recovery mode
Navigate to
x:\sources
Find on what drive is windows located
Dir c:
DISM /Image:C:\ /Cleanup-Image /RevertPendingActions

Reply | Quote

Yesterday (Sunday) I allowed through the five-or-so WS2008R2SP1 patches from January, and had no problems with the subsequent reboot.  A further update then, well, updated but required no reboot.  And the server runs Webroot!

BATcher

Plethora means a lot to me.

1 user thanked author for this post.

Paul T

Reply | Quote