If you had WSUS (or SCCM) running tonight with auto approval on you might have woken up this morning to virtual machines that can boot anymore.
Great, another update gone wrong. Time to restore from backup as that can be the fasted way to restore services when in a pickle and if you have a good solutions for that in place. For the others you can do what I did is below. Actually a couple of us MVPs were on this issue at a number of sites as our fist task this morning. But first the root cause.
Well read this link Express update delivery ISV support and you have all you need. Basically the delta and the full cumulative update of October (KB4041691 – https://support.microsoft.com/en-us/help/4041691) ended up in WSUS without you explicitly putting it there. That should not happen, normally the delta is not published for it to be downloaded and heaven forbid auto approved. You could also have manually approved everything without really knowing what and why. Not a great idea at all.
So your VM get’s offered both of them and that is BAD!
Normally you get into this pickle if you some how managed to install both of these yourself or via other tools (see the link above), which you shouldn’t do.
Now if you don’t have decent restore capabilities from backups or snapshots there is another way out by removing the updates.
Boot into the problematic VM and select troubleshoot
Select to open the command prompt and stay away from any other auto repair options.
Microsoft advises to get rid of the SessionsPending reg key. To do so load the software registry hive as follows:
reg load hklm\temp c:\windows\system32\config\software
Delete the SessionsPending registry key, if it exists by running:
reg delete “HKLM\temp\Microsoft\Windows\CurrentVersion\Component Based Servicing\SessionsPending” /v Exclusive
Unload the software registry hive:
reg unload HKLM\temp
Run dism /image:c:\ /get-packages to find the updates installed that caused the issue
The yellow one are the ones of interest and you can see the first one never even got an install time/
We now use DISM to remove these updates. Do first create the C:\Temp folder with MD temp if it doesn’t exist yet!
dism /image:c:\ /remove-package /packagename:myproblematicpackagetoremove /scratchdir:c:\temp
When done, close the command prompt, shut down the VM and then start it.
It will take a while but if will succeed and you’ll be greeted by a logon screen. Good luck!
Important: Do not try any other repair options or removing the updates with DISM might fail. We choose to remove all 3 updates from tonight to make sure. It might suffice to remove the delta one alone but we wanted to have an VM back as it was last night so more testing can be done before it is deployed again.
So, basically, don’t auto approve updates blindly, but test, validate & roll out in phases. Have great backup and TESTED restores. All by all we were only bitten in the lab, a couple of test/dev VMs and some of our infra VMs. Most of these are redundant and are patched stagger so our services were never badly effected. That gave us time to trouble shoot and investigate and warn our colleagues. As you can see here the issue was a delta update that made it into WSUS and was installed together with the full CU. Just manually downloading the CU and testing it would not have given you the heads up. About an issue. This is a reminder you need to test your real live situation and processes as realistically as possible. When you’re done with testing and cleaning up any fallout of this issue, make sure to patch your systems again!
Update: this also goes for Windows 10 Updates
- KB4041676: https://support.microsoft.com/en-us/help/4041676
- KB4000824: https://support.microsoft.com/en-us/help/4000824
Also see fellow MVP Mikael Nystrom blog post https://deploymentbunny.com/2017/10/11/the-october-2017-update-inaccessible-boot-device/
Update: we now also have the official MSFT response & fix for each and every scenario right here https://support.microsoft.com/en-us/help/4049094/windows-devices-may-fail-to-boot-after-installing-october-10-version-o
Pingback: October 17 Delta patch problem - WSUS/SCCM - Peter Egerton - WMUG - WMUG
Pingback: Windows 10 V1703: Update KB4041676 install issues | Born's Tech and Windows World
Hi,
This has worked on one of our servers, but on a couple we are getting the error:
Processing 1 of 1 – Removing package Package_for_RollupFix~31bf3856ad364e35~amd64~~14393.1715.1.10
An error occurred – Package_for_RollupFix Error: 0x8007371b
Error: 14107
One or more required members of the transaction are not present.
Did you see this error on any of your servers?
Regards
Jay
We had one were we tried other methods as an experiment, and that one failed but with a different error message. We recovered it from Veeam backups.
Try this: https://deploymentbunny.com/2017/10/11/the-october-2017-update-inaccessible-boot-device/ find “other ways to fixe this is:” which leveraged renaming the WindowsAppFolder
We have also learned that the VM needs more memory in WinPE/WinRM, so for a few servers we added more memory (at least 3GB) and then it worked.
Interesting. I’m curious now, where those were fixed memory VMs or also dynamic ones?
Jay T, did you ever resolve this specific issue? We’re running into this problem with our main backup control server running server 2016, and can’t get around the same 14107 error you listed here. Any help you can post will be greatly appreciated.
At try to use dism for package….An error occured – package_for_rollupfix error: 0x800f082f
DISM failed…
Does anybody know what next?
THX
the one I had like that I restored from backup. But you can try the other ways of recovering mentioned https://deploymentbunny.com/2017/10/11/the-october-2017-update-inaccessible-boot-device/ ==> find “other ways to fixe this is:” which leveraged renaming the WindowsAppFolder
Many thanks, it works 🙂
I just want to say THANK YOU, this is what we walked into this morning on a handful of our Windows 10 machines. It worked perfectly and I’m so thankful to you guys. 🙂 Keep up the good work.
You are most welcome Natalie 🙂
I am always getting the message “Unable to get the image. Make sure that the image……..”
What image is it looking for?
Regards
Eric
your installed OS, normally that’s on C:\ check if it is.
Hi, It is a Server 2016 and after booting to Advanced options > Command Prompt I get a drive X:.
If I do a dir I get
Program Files
Program Files (x86)
sources
users
windows
that’s your boot environment, your OS install should by defautl is on C: where you point to as image to work on.
dism /image:c:\ /remove-package /packagename:myproblematicpackagetoremove /scratchdir:c:\temp
Check if this applies your install
It was on drive D:
It is working now
Thank’s a lot
When I TYPE dism /image:c:\ /get-packages i get:
Error: 1639
The command-line is missing a required servicing command.
for more informatyion, refer to the help by running dism.exe
Any Idea?
try typing it instead of copy/past, you might have hidden characters in the command
I’m typing not pasting 🙁 and Error: 1639 appears
Are you running it from the X: prompt ?
i too here have the same problem. only that i am running on the X: prompt. what do i do?
Hi, I would also like to thank you for this great find and fix. Got in the office this morning in a rush only to find about 10-15 computers crashing. At first dism did not work but then I realized we had more then 2 partitions on some of our computers.
Also the method with renaming WindowsApps that another user suggested worked on 2 of our machines.
still having this issue. When attempting to remove package, I am presented with the following error. Any ideas on how to fix this please?
An error occurred – Package_for_RollupFix Error: 0X80073701
Error: 14081
The referenced assembly could not be found.
There an issue with the component it seems. Can be for various reasons. Easiest /fastest would be a restore from backup or lacking that a “in place upgrade” to the same OS of cause with retention of settings and data which equals a “repair install” functionally. You can go and try DISM to restore the health. Depends on how much time and need you have to throw eeforts into this.
tired the /restorehealth but no luck. Also, cannot do an in-place upgrade without first getting the system to boot. I cannot even get into Safe Mode. Looks like I may have to just rebuild unless there is another option I can try.
No backups, storage snapshots, VSS snapshots somewhere to leverage? Did you try the method with renaming WindowsApps as mentioned in the link to Mikaelsblog? Also see his note on having enough memory for a VM.
Nope, brand new server that was just built. Backup agents not configured on it yet. Tired renaming that as well and still no luck. Would rather not need to rebuild, but if that’s my only option at this point then I’ll have to settle being that nothing is running on it yet.
Well you could spend hours trying to find the solution and a reinstall will probably be less. There is only so much blog comments can help & do for you.
Pingback: Windows-Updates im Oktober 2017 können zu Bluescreens führen - michael wessel Blog
Pingback: Windows-Updates im Oktober 2017 können zu Bluescreens führen | faq-o-matic.net
Is the Delta update supposed to be removed from WSUS somehow? We weren’t impacted by the release but it is still showing up when I do a search for “Delta” in wsus and I’d like it to be gone for good so it isn’t approved accidentally..or at least just some reassurance that it can’t be approved. The MS site suggest that doing a sync is enough, and when I search it says it is expired and “cannot be approved”. Am I being overly cautious?
Thanks for the info!
if it’s expired /declined you should be good. On top of that you can take a peek at what updates your clients see, if the delta doesn’t show there either you’re good.
Hi, I was able to remove the 3 packages by using dism, however, after a restart I still get the blue screen on Win 2016 Core. Any additional thing I could do?
Read the link to the MSFT article, they advise to remove the related registry keys as well, I did not find this to be needed on the systems I dealt with but it might help you out. https://support.microsoft.com/en-us/help/4049094/windows-devices-may-fail-to-boot-after-installing-october-10-version-o
I tried to enter the reg load hklm\temp c:\windows\system32\config\software but recieved an Error: The system was unable to find the specified registry key or value,
PLEASE HELP
Check your paths to make sure it’s really C: where Windows resides etc. If you need more help check the Microsoft forums or contact support.
I have recovered 4 PCs with the instructions above but I have one that all 3 showing as installed rather than pending. I have managed to remove two but the last one won’t budge so I am resorting to other method for this one.
Hello, I have a problem with Cumulative Update for Windows 10 Version 1709 for amd64-based Systems (KB4043961) in Fall Creative October update (17.10.2017)
My procesor is: Intel Core i5 4460.
The computer is unable to install the update (BSOD) and runs restart, diagnostics and repair system.
Show error code: 0x800f0845
How remove this update?
At the moment, in the windows update settings, I checked the delayed update option.
Best regards,
Aleksandar
Uninstalling the AntiVirus software problem is solved.
Hi…. First of all… THANK YOU! This was great information!
However… I’d like to see if you can reproduce the problem again, and then try a suggestion. See…I’ve been dealing with this for the past week or two.
In my case… all I had to do was reboot once into safe mode. Get to the start menu, and reboot. Problem gone. No more errors for “inaccessable boot device”.
Now more detail for the tl/dr version. I don’t know if this will help or shed any light on why or when the problem happens, but knowing what caused it for me, and what resolved it might help to narrow it down to something less complicated than sorting through all the DISM stuff.
Of course, there is almost a certainty that your drivers or scenario may very well be different from mine, I was having the problem on hardware, not a VM (yet). But I reliably resolved it every time like this.
I built a new machine that has Intel Optane memory on it. So the Intel Rapid Storage drivers are there, and once you enable the Optane chip, it combines it with your hard drive…. essentially making it the equivalent of an SSHD… but with higher performance. Well… while working on the first build, there were times when I would disable the Optane chip, which breaks the combination volume, and makes them individual devices again. However, something is broken there as the disable process doesn’t remember to tell the system that it is booting off the standalone disk at that point.
So… after rebooting, I get the same blue screen… Inaccessible Boot Device.
Reboot… into recovery mode… start safe mode… log in… reboot. Done
Let me know if that extra info helps at all, or if anyone reproduces it on a VM and if this solution helps or is just completely off base. I’ve been known to be wrong before. I can take it. 😉
Pingback: Windows 10: Update KB4056892 kills AMD systems (Error 0x800f0845) | Born's Tech and Windows World
We got this guy going around blowing up boxes and didn’t know how to recover. Your process saved my ass!
Thanks!