Your device is missing important security and quality fixes (in red on WU)

Topic

New Reply

Helping non technical friends remotely using TeamViewer(free)

windows 10 1909 os build 18363.720

Cumulative updates fail with 0x800706be all retries fail.
running sfc /scannow results in msg; windows resource protection could not start the repair.
Troubleshooter just finds Pending Restarts. Chkdsk yielded no errors.

Attached are a couple of snips of the only (visual) affects of the problem.

Also:

I created a windows.iso file on the problem computer, started the upgrade using “mount” option and also specified option to save apps and data.
The upgrade ran to the first 30% Complete then suddenly stopped and reverted to desktop, no indication of any errors whatsoever.

Also ran ResetWUeng and also cleared Windows Update cache before attemting a 2nd Upgrade that just stopped.

Would like to avoid clean install if possible.

Your help is requested in solving this problem.

Reply | Quote

Replies

Try this.
You need to be logged in with an Administrator account, not Standard.
+ If the User has used any third-party Windows Update blocker in the past, verify that it is off/settings removed.
+ Deactivate (temoprarly if you can) any third-party AV program(s).
+ Verify there is no active Pause or Deferral set and Metered connections are turned OFF.
+ Turn OFF Fast Startup (Control Panel\Power options).
+ Restart (not shutdown/turn on) the computer.

In an elevated command prompt, run these commands: (note any errors)
dism /online /Cleanup-Image /RevertPendingActions
dism /online /cleanup-image /restorehealth
sfc /scannow
Restart the computer.

After the computer has finished startup
In an elevated command prompt, run these commands: (note any errors)
net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
Ren C:\Windows\SoftwareDistribution SoftwareDistribution.2006
net start wuauserv
net start cryptSvc
net start bits
net start msiserver
Restart the computer

Use wushowhide.diagcab to show available updates. Hide any updates you don’t want to install.
If you had no errors, at this point, you can wait for Windows Update to scan for updates on its own and try to update again
Or
Download the current SSU and CU from the MS Catalog and try a manual install (SSU first, reboot, CU)
OR
If the ISO is a later Build than is installed, disconnect from the Interned (so you don’t get v2004 in the update it will try to do) and try mounting the ISO in the current system and run setup.exe

 

2 users thanked author for this post.

JohnS1606, Elly

Reply | Quote

Do I go right through or stop and report errors?

Reply | Quote

Stop and report errors.

Reply | Quote

Fast Startup was turned off before 1st restart

Dism and sfc messages attached.

restarted and did down to start msiserver (which was not running)  2 other attchmnts

Reply | Quote

It seems that msiserver started (it was stopped before)
Does this folder exist?
C:\Windows\SoftwareDistribution.2006? IF it does….

Try running this again
dism /online /Cleanup-Image /RevertPendingActions

If it is successful, run
dism /online /cleanup-image /restorehealth
sfc /scannow

Either way, let me know.

Reply | Quote

the Folder is there, att is Dism

Reply | Quote

Since DISM won’t run, I believe your image is damaged and recommend an “in-place upgrade.” (not Refresh your PC and not Reset your PC).
Make a backup of the User’s data and a full disk image first.
Be sure you have sufficient free disk space before you start.
Follow the instructions here.
Be sure you have the correct bittage (probably 64-bit), and language.
In Step 9, do NOT do any updates in the process and do not allow it anywhere else you are asked to update. (you will get v2004). You can even disconnect from the Internet to be sure.
Choose to save your Apps and your data – it tells you what you may lose.
When you finish, go through the settings and change any you find necessary (especially Windows Update settings).
Then you can connect to the Internet and do any updates necessary.

Reply | Quote

my problem is I’m running remotely to the problem computer, disconnecting and/or restarts cut me out.

 

Reply | Quote

Do I have to recreate the iso file (the one done was created June 24)?

In my first post 1 mentioned running upgrade from it twice that stopped on 30% complete,

will I be doing anything different, the only thing I didn’t do is Disable Secure Boot.

I’ll watch the video and double check backups.

Reply | Quote

June 24th ISO made from the Media Creation Tool will install v2004, not v1909.
Check the free disk space.
The procedure on TenForums (linked above) will explain – read it through.
And be sure you have a full disk image and a separate data backup BEFORE you start.

You need a v1909 ISO to reinstall v1909. You can download the “MS Windows and Office Download Tool” from Heidoc.net and run it on your PC. Download the v1909 ISO (I think Build 18383.592) and use that.

Reply | Quote

Just fyi – not sure if applies to your case – I had the same windows update error message and was unable to obtain May’s update for 1909 PRO. In my case I was a few months behind on updates and had to disable the GP business windows updates for feature and monthly security updates even though it was set to 0 days for both. I remember tinkering with this setting when the gui settings disappeared. Once I disabled the setting and rebooted the error message went away and I was able to obtain May’s update.

Reply | Quote

I assumed he read #2275689 but always good to double check.

+ Verify there is no active Pause or Deferral set and Metered connections are turned OFF.

Reply | Quote

Thank you PKCano, I only mentioned because when I saw my settings to 0 days, I assumed that was the same as being off. Not sure if others may have the wrong idea as I did.

Reply | Quote

WU is so crazy. And MS wobbling is even worse. Their reasoning doesn’t make sense. I just think they do whatever they want to do and try to think up some bafflegab to go along.

One thing in the past, I recommended leaving all but the one setting in GP (“2” notify) not configured. Saved a lot of bacon.

3 users thanked author for this post.

Cybertooth, Elly, Sueska

Reply | Quote

how do I make full disk image?

the metered connection if OFF, where I check; no active Pause or Deferral set?

what free space? drive C or what?

 

Reply | Quote

how do I make full disk image?

You will need an external USB drive for backing up the computer.
Use backup software to make a full disk image. Some good free ones are Macrium Reflect Free, EaseUS Todo Backup Free and Aomei Backupper Free. (There are also paid versions of each). Making a full disk backup allows you to restore OS, programs, and data in case you have a major problem, so you don’t have to reinstall everything one at a time from scratch.

the metered connection if OFF, where I check; no active Pause or Deferral set?

If you have the Home Edition, Pause is set in the User interface (GUI) in Windows Update and also under the Advanced options link there.
If you have the Pro Edition, Pause is set in the same place as Home PLUS deferral pulldowns under Advanced options, and in Group Policy (gpedit.msc). For Group Policy see the screenshots at the bottom of AKB2000016.

what free space? drive C or what?

Free space on the drive the OS is install on. Read through the TenForums procedure. It will tell you the MINIMUM space you need. Better to have more.

Reply | Quote

somebody hijacking?

 

Reply | Quote

Nope. Somebody giving you more information to clarify things.

2 users thanked author for this post.

Sueska, Elly

Reply | Quote

Have put media creation tool for 1909(Nov) on the desktop, as well downloaded 1909 .iso.

Attempted to create Boot USB for this level, (in case) while connected to the internet

and windows immediately asks to download latest version. Is the only option to get offline

and run it? I may be able to talk them through that but other things required offline are not so easy; ie Disable secure boot and the actual in place upgrade. Our covid travel restrictions only come off Jul 3 and I’m considering making a trip (5 hrs) to do those. Other things are pretty much in place, data backups and system image copy. Your thoughts.

Reply | Quote

Any use of the Media Creation Tool (even if it “says” 1909) now to create an ISO will give you v2004 because that is what is online at MS to download.
If you want v1909, you will have to download the ISO from Heidoc.net labeled v1909 on their site.
The only way, then, is to use the ISO disconnected from you network/Internet so you are not upgraded to v2004 in the process of installation. Do not connect to the Internet after installation until you have gone through the Settings and at least changed WU to protect you from surprise upgrade.

To do the in-place upgrade repair from bootable media (DVD/USB), you do NOT boot from the bootable media (DVD/USB). You insert the media in the running computer, and run setup.exe from the media using File Explorer or the command line specifying the drive letter of the media. You do not have to disable Secure Boot b/c you are not booting from the media. But you can mount the ISO on the running computer instead, and run setup.exe, thus  eliminating the need for making bootable media.
If you boot from DVD/USB media, it will do a clean install.

Reply | Quote

To create a bootable USB/DVD download Rufus and select the ISO as the source.

cheers, Paul

Reply | Quote

was unable to run 1909 Media Creation even after Disabling network.

instead of get latest version, now it says there was a problem, make sure you’re connected to internet and try again. can we get around this somehow? Got this ver from Heidoc.net and selected the Nov 2019.  The file version in Properties Details is: 10.0.18362.418

 

Reply | Quote

Please read #2275991.

The Media Creation Tool downloads from MS to create the ISO on the PC. You cannot use the Media Creation Tool disconnected from the Internet.

Heidoc.net provides the ISO directly. There should be a later one than the one you downloaded. It should say v1909 Build 18363.592. It is dated somewhere between Feb and maybe Apr 2020. It is better to use this one.

It is the INSTALL that needs to be done offline.

Reply | Quote

There is information here on how to use the ISO to do the install directly without creating bootable media.

There is information here on one way to make bootable media. Or use Rufus as @Paul-T suggests. The media you create should be inserted into the running PC (do not boot from it) and then run setup.exe

Reply | Quote

Paul T wrote:

To create a bootable USB/DVD download Rufus and select the ISO as the source.

cheers, Paul

you’re ahead of me, thanks

 

Reply | Quote

PKCano wrote:

Please read #2275991.

The Media Creation Tool downloads from MS to create the ISO on the PC. You cannot use the Media Creation Tool disconnected from the Internet.

Heidoc.net provides the ISO directly. There should be a later one than the one you downloaded. It should say v1909 Build 18363.592. It is dated somewhere between Feb and maybe Apr 2020. It is better to use this one.

It is the INSTALL that needs to be done offline.

the latest iso is 2004, the one before that is the one I downloaded, would they have removed the 18363.592 or am I not searching correctly?

Reply | Quote

[PKCano]

I have not look myself, but I have seen a screenshot within the last couple of weeks with that Build in the list above the one you downloaded.

See #2266834.

My bad, that is v2004. I guess yours IS the latest.

• This reply was modified 4 years, 10 months ago by PKCano.

Reply | Quote

I guess we’ll just have more updates to eventually apply.

I did a test run of Rufus with the iso I have so I guess the results are what to go with.

There was a warning message at the end saying Disable Secure boot was necessary but I’d like to believe your theory, that since it won’t be booting, Secure boot is ok.

I’m also assuming that a copy of Macrium Reflect should also be put on the backup with the image copy, in case a restore is necessary (hope not though).

Reply | Quote

I think the only thing on the install media is the Win10 installer. I think you will have to make a Macrium Rescue Disk/USB as a separate thing. There may be a download on the website to create the Rescue disk (I use Acronis paid and EaseUS Todo Free, so I’m not familiar) or you will have to install Reflect on the PC and create the Rescue Disk through the program. There should be instructions in a manual or within the program.

Reply | Quote

Macrium rescue USB is created from within Macrium (Other Tasks > Create rescue media).

cheers, Paul

1 user thanked author for this post.

PFC

Reply | Quote

Paul T wrote:

Macrium rescue USB is created from within Macrium (Other Tasks > Create rescue media).

cheers, Paul

Ran on problem machine, Windows RE: shows Release 1903 64 bit should I not see 1909 64 bit, which is current level?

Another question, is there a way to verify this rescue media, ie exit before actually doing recovery?

Thanks

 

Reply | Quote

Booting from the Macrium Rescue media should take you to the Macrium program running off the Rescue media. In the program you should have the option to backup or restore. Providing your backup is good (you should verify the backup when you make it), if tyou can boot from the Rescue disk you should be good.
Windows will not be active.

Win10 v1903 and v1909 have the same core. The difference is only in v1909 the Feature update is turned ON (not a different core). If you downloaded the ISO from Heidoc labled v1909, you should be good.

Caution: If you do the install connected to the Internet, it will upgrade you to v2004 in the process. Don’t allow it to update during the install – there will be more than one request.

1 user thanked author for this post.

Elly

Reply | Quote

Windows Recovery Environment (WinRE) is a subset of Windows designed to run enough of the hardware to allow you to recover from disaster. The version is irrelevant.

cheers, Paul

Reply | Quote

Spend much time ensuring system images and user data were backed up.

Took Canada day off.

Today started V1909 .iso mount Upgrade as per TenForums guide and got exactly same results as I posted when I got here. Kicked out at first 30% complete and thrown back to desktop. Frustrating to say the least.

What are my options.

Reply | Quote

You have a full disk backup and a separate data backup, right?

Go through this list again:
+ If the User has used any third-party Windows Update blocker in the past, verify that it is off/settings removed. That includes something like GWX Control Panel (puts an upgrade block in the Registry) if it was an upgrade from Win7.
+ Deactivate or uninstall (temporarily if you can) any third-party AV program(s).
+ Verify there is no active Pause or Deferral set (or the upgrade is blocked) in Group Policy if Pro, and Metered connections are turned OFF.
+ Turn OFF Fast Startup (Control Panel\Power options).
+ (New) Look in Device Manager and see if you have any problem hardware. If so, resolve the problem. (In the screenshot, it shows MS replaced a driver – what was it and when?)

Search the Internet (if you haven’t already) with the make and model to see if anyone is having problems upgrading that particular PC.

Back up the drivers. I also like to run Belarc Advisor (free) so I have a list of the hardware and software in case I have to go hunting.

You could try the upgrade using “keep User data ONLY.” You will have to reinstall all the third-party software, a real pain. That should be done OFFLINE until the install is complete and you have gone through all the Settings (particularly WU).

The other option is a Clean Install. You have the image to go back to if you have problems and the data backup to restore if it succeeds.

Reply | Quote

[PFC]

thanks, I’ll follow that trail.

This problem system is owned by elderly people and  nothing has been altered since

they got it as a Windows 8/8.1 machine some 5 years ago. It’s as vanila as they come,

a few photo handling things and the likes. Wouldn’t even know about changing settings.

I have the identical machine purchased about a month after them.

On another note, if you notice my profile picture in previous post, I may not have logged

in, shows me as Guest. No biggy now.

• This reply was modified 4 years, 10 months ago by PFC.

Reply | Quote

When you don’t log in, sometimes we put your ID under the picture, but we can’t make it your actual ID so it shows “Guest”

1 user thanked author for this post.

PFC

Reply | Quote

[PFC]

Not finished your new shopping list yet but a couple of questions in the meantime.

1. would there be anything in log files that an experienced person might be able to look at and determine what upgrade was doing and where he failed?
2.  attached is a Partition snip from Macrium, might there be an area not big enough?
3. why can’t windows resource protection start the repair service in sfc /scannow?

• This reply was modified 4 years, 10 months ago by PFC.

Reply | Quote

Can you go into Control Panel\Administrative Tools\Computer Management\Disk Management and make a screenshot of the disk?
Maybe that would give a better idea of what the partitions were.

Reply | Quote

The C: volume (partition) has over a terabyte of room left, way more than Windows would ever need for an update, and that’s the one that would need space to perform the update.  All of the other partitions combined only take up about 10 GB, which is pretty small compared to the 1.81 TB size of the C: volume.

I would say that whatever is causing the update to fail is probably related to why sfc /scannow does not work.  I’ve not got much experience with Windows 10, so I am not really sure what that might be.

Were you able to use Reflect to make the system image? At least having that ensures that if something goes wrong (worse than it already has), you can get back to the starting point.  As PKCano wrote, you can boot the rescue USB drive to make sure it works, and you can even perform the backup from there if needed. Most of the space on the drive is empty, so the image should be small.

 

Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)

1 user thanked author for this post.

PFC

Reply | Quote

attached:

Reply | Quote

My W8.1 machine wouldn’t repair using DISM/SFC recently and the only fix was a full re-install. I used an ISO and mounted it in Explorer, then ran setup.exe.

The painful bit was restoring the data and installing /setting up programs.

cheers, Paul

1 user thanked author for this post.

PFC

Reply | Quote

PKCano wrote:

You have a full disk backup and a separate data backup, right?

Go through this list again:
+ If the User has used any third-party Windows Update blocker in the past, verify that it is off/settings removed. That includes something like GWX Control Panel (puts an upgrade block in the Registry) if it was an upgrade from Win7.
+ Deactivate or uninstall (temporarily if you can) any third-party AV program(s).
+ Verify there is no active Pause or Deferral set (or the upgrade is blocked) in Group Policy if Pro, and Metered connections are turned OFF.
+ Turn OFF Fast Startup (Control Panel\Power options).
+ (New) Look in Device Manager and see if you have any problem hardware. If so, resolve the problem. (In the screenshot, it shows MS replaced a driver – what was it and when?)

Search the Internet (if you haven’t already) with the make and model to see if anyone is having problems upgrading that particular PC.

Back up the drivers. I also like to run Belarc Advisor (free) so I have a list of the hardware and software in case I have to go hunting.

You could try the upgrade using “keep User data ONLY.” You will have to reinstall all the third-party software, a real pain. That should be done OFFLINE until the install is complete and you have gone through all the Settings (particularly WU).

The other option is a Clean Install. You have the image to go back to if you have problems and the data backup to restore if it succeeds.

yes I have my backups.

Re-doing the old list found nothing again. I had turned off Fast Startup, metered connection was OFF, nothing else applied.

On the show/hide of updates. On restarts, there are 4 KB’s that keep failing and retries always seemed to do them out of chronological order. I tried hiding 3 and doing the oldest only, thinking maybe there were dependencies, no such luck.

In the new list, Device Manager showed no problems. Not sure what screenshot or driver you were referring to.

Dell Community has lots of XPS 2720 related issues, most seemed related to upgrading hardware. Other searches were fruitless.

I will try the upgrade using “keep User data ONLY.”  (hopefully today). You should have referred to it as “pain” because I’m sure the Clean Install is “pain”. This covid life is preventing me from physically getting to the computer. Remote assistance only goes so far.

Reply | Quote

I suspect that keeping only the User data may be easier. You can try that first. Otherwise, the instructions below for a clean install.
If you can update drivers (from your research), do so first. If you have the Service Code for the PC, Dell is really good about having a list of whatever drivers. I have had mostly Dells and it has come in handy.

The Clean Install may be impossible in your situation, but would probably give the best long-term results.

Reply | Quote

PFC wrote:

In the new list, Device Manager showed no problems. Not sure what screenshot or driver you were referring to.

The Update History 1 screenshot in your original post, at the bottom, shows WU installed 1 driver.

1 user thanked author for this post.

PFC

Reply | Quote

Sorry, I got tied up last night as the only gatekeeper here.

I agree. Neither DISM or sfc will run. The multiple recovery partitions are probably the result of the Win8/Win8.1 ->Win10 upgrade and the Win10 upgrade attempts. All things considered, I think it best to go ahead with the Clean install. Even it’s a pain now, you will have less trouble in the long run.

What you need before you start:
+ A printout (or .PDF, etc) of the system h/w and s/w (Belarc Advisor, Speccy, or other) in case you need drivers, s/w information.
+ The bootable Macrium Rescue CD/USB – in case you have to restore the image. Verify you can boot from it.
+ The verified full disk image on an external drive.
+ The data backup on an external drive.
+ A bootable Windows Rescue CD/USB – verify you can boot from it. Control Panel\Troubleshooting\Recovery (lower left corner) Create a Recovery drive.
+ The bootable install media.

+ Disconnect from the Internet/network – don’t reconnect until the install is complete and you have gone through all the settings, particularly Windows Update.
+ Boot from the install media. If it asks, keep nothing.
+ When you have taken care of the settings, connect to the internet and let it update v1909. You should probably run wushowhide first and hide any updates you don’t want.

 

Reply | Quote

well folks, plan B “keep User data ONLY.” has worked, my [painful] schedule has started.

First thing I was able to do was get Teamviewer going,  pc owners are happy.

More to follow.

2 users thanked author for this post.

Paul T, PKCano

Reply | Quote

Great!
At least you won’t have to wrestle with the User data too!

Reply | Quote

Here’s the More to Follow.

As soon as I could after the upgrade I paused updates for 7 days. Some driver updates (11),  had been re-installed.  Build was at 18363.418. I think that’s consistant with the last 1909 update.

Today, during active hours for the system (thinking updates don’t get done) I remove Pause to see what may be waiting and low and behold there are 4 updates waiting and the updating begins. Had to face it sometime; more good news they finish and bring the build up to 18363.900 and news about V2004 is there, and the red warning is gone. Pause back ON.

There could be more to follow.

 

Reply | Quote

[PKCano]

If that is Pro, use the settings in Section 4 of AKB2000016. That will allow you to update manually whenever you want to .

If that is Home, set the Pause out 35 days – you can click Pause up to x5, 7 days/per click. That ought to get you to DEFCON-3 or above. Mark the day on your calendar!
If it doesn’t get you to DEFCON, there is a way to cheat Pause if you have to.

Remember – if you use Pause and the time runs out or you “Resume updates” (and you don’t cheat Pause), the updates will download/install, not respecting any other settings.

• This reply was modified 4 years, 10 months ago by PKCano.

1 user thanked author for this post.

PFC

Reply | Quote

The rest is recovery so I feel your assistance has solved our problem.

Thanks to all the contributors. The advise and suggestions, the tools you pointed me to for future are much appreciated. Looking forward to reading your newsletters and articles.

Time to visit the donation booth.

Thanks for now.

1 user thanked author for this post.

PKCano

Reply | Quote