question

EMR-7475 avatar image
2 Votes"
EMR-7475 asked marcolopes answered

Windows Server KB4535680 Stuck

I am running Windows Server 2019 Standard Edition but Windows Update is stuck on KB4535680. It always fails to install, and I can't get past it to check for new updates. I ran the Windows Update Troubleshooter, cleared the Windows Softwware Distribution folder to no avail. How can I fix this? Thanks.

windows-server
· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Have you tried to download the Patch-file manually from the MS Update Catalog and the install the patch by running the file manually (double clicking on it to run)? Try That.

https://www.catalog.update.microsoft.com/Search.aspx?q=KB4535680

1 Vote 1 ·

I have run across this type of issue in the past when I tried to enable .NET 3.5. The error messages indicated missing files but I could not figure out exactly what was missing or how I was going to restore them. Strangely, I was able to enable .NET 3.5 on our other servers without issue. I tried various DISM commands, clearing update history, resetting update caches, manual update installs, etc.

What I ended up doing was copying the Windows\SxS directory from a known good fully patched server. Then I retried installing the updates and they installed without a problem. This was a last resort but I figured it was worth a shot since I really didn't want to set up another server. If you decide to try this, I would make a copy of your current SxS directory first.

1 Vote 1 ·

Anyone found a way of REMOVING this update?

I need to install OTHER updates, and this one if interfering with with (i had to install one update manually, but now i'm stuck again with other updates ready to install, including THIS ONE, that is giving me problems)

0 Votes 0 ·
Andr-4083 avatar image
0 Votes"
Andr-4083 answered Andr-4083 edited

Same here on ACER Aspire.

CbsPersist_<ts>.log:

2021-03-12 23:20:25, Info CSI 00000883 The queue has completed running, and AI failures have occured.
2021-03-12 23:20:25, Info CSI 00000884 ==Error Summary Start==
2021-03-12 23:20:25, Error CSI 00000885 (F) Installer: Secure Boot Installer Binary Name: securebootai.dll ErrorCode: 80070005 Phase: 40 Mode: Install (upgrade) Component: Microsoft-Windows-SecureBoot-FirmwareUpdate, Culture=neutral, PublicKeyToken=***, ProcessorArchitecture=amd64, versionScope=NonSxS[gle=0x80004005]
2021-03-12 23:20:25, Info CSI 00000886 ==Error Summary End==

So 0x80004005 is a permission issue with securebootai.dll, right?
I gave it several tries, some as admin. They all fail after reboot at 98%.
After reboot the account used to the start the update doesn't matter any more, right?


Update
Looks like this is a permission issue:

Error CSI 0000086a@2021/3/16:16:52:46.845 (F) onecore\base\secureboot\servicing\advancedinstaller\securebootai.cpp(277): Error HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED) originated in function Windows::WCP::SecureBoot::BasicInstaller::Install expression: ApplySecureBootUpdate( dwAvailableUpdates)
Error [0x018059] CSI 0000086c (F) Failed execution of queue item Installer: Secure Boot Installer () with HRESULT HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED). Failure will not be ignored: A rollback will be initiated after all the operations in the installer queue are completed; installer is reliable[gle=0x80004005]
Error CSI 00000885 (F) Installer: Secure Boot Installer Binary Name: securebootai.dll ErrorCode: 80070005 Phase: 40 Mode: Install (upgrade) Component: Microsoft-Windows-SecureBoot-FirmwareUpdate, Culture=neutral, PublicKeyToken=
, ProcessorArchitecture=amd64, versionScope=NonSxS[gle=0x80004005]
Error CBS Startup: Failed to process advanced operation queue, startupPhase: 0. A rollback transaction will be created. [HRESULT = 0x800f0922 - CBS_E_INSTALLERS_FAILED]
Error CSI 00000887 (F) Installer: Secure Boot Installer Binary Name: securebootai.dll ErrorCode: 80070005 Phase: 40 Mode: Install (upgrade) Component: Microsoft-Windows-SecureBoot-FirmwareUpdate, Culture=neutral, PublicKeyToken=, ProcessorArchitecture=amd64, versionScope=NonSxS[gle=0x80004005]
Error CSI 00000869@2021/3/16:16:59:35.499 (F) onecore\base\secureboot\servicing\advancedinstaller\securebootai.cpp(277): Error HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED) originated in function Windows::WCP::SecureBoot::BasicInstaller::Install expression: ApplySecureBootUpdate( dwAvailableUpdates)
Error [0x018059] CSI 0000086b (F) Failed execution of queue item Installer: Secure Boot Installer (
) with HRESULT HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED). Failure will be ignored: The failure was encountered during rollback; installer is reliable[gle=0x80004005]

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

marcolopes avatar image
0 Votes"
marcolopes answered marcolopes edited

SAME problem here, but windows 10 1909

"Installation Failure: Windows failed to install the following update with error 0x800F0922: Security Update for Windows 10 Version 1909 for x64-based Systems (KB4535680)."

Tried many solutions at no avail... and the this update failure is stopping other updates from installing! (i had to literally wait for this install to fail, STOP windows update service, and INSTALL other pending update manually. But now i have a HUGE update - Feature update to Windows 10, version 2004 and i cannot disable the KB4535680 install, so BOTH will fail!!! This os nonsense!!!)

MICROSOFT, any ideas?

The UPDATE is this one (and YES, it has to do with BOOT!) https://support.microsoft.com/en-us/topic/kb4535680-security-update-for-secure-boot-dbx-january-12-2021-f08c6b00-a850-e595-6147-d0c32ead81e2

MICROSOFT, please correct this!

HERE is the LOG!

 2021/03/24 13:58:01.2521904 19664 9720  Handler         CBS called Terminate
 2021/03/24 13:58:01.2613142 19664 13180 Handler         Completed install of CBS update with type=0, requiresReboot=0, installerError=1, hr=0x800f0922
 2021/03/24 13:58:01.2644155 19664 13180 Handler         * END *   CBS Install
 2021/03/24 13:58:01.2650142 19452 9956  Agent           ***FAILED* [8024200B] Method failed [CAgentUpdateManager::InstallUpdate:11561]**
 2021/03/24 13:58:01.2661031 19452 9956  Handler         Loaded state: cCompleteIterations: 1, pt: SelfContainedNoExpressPayload, nNextRequestID: 1

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

marcolopes avatar image
0 Votes"
marcolopes answered marcolopes published
 2021-05-29 06:47:12, Info                  CSI    0000001d Performing 1 operations as follows:
   (0)  LockComponentPath: flags: 0 comp: {l:16 b:3ac7a6124e54d7010f0000007077e81f} pathid: {l:16 b:3ac7a6124e54d701100000007077e81f} path: [l:120]'\SystemRoot\WinSxS\amd64_microsoft-windows-s..gstack-boot-onecore_31bf3856ad364e35_10.0.18362.1497_none_635d973bd35f851d' pid: 7770 starttime: 132667408039980728
 2021-05-29 06:47:12, Info                  CSI    0000001e Loading installer DLL from explicit path: C:\WINDOWS\WinSxS\amd64_microsoft-windows-s..gstack-boot-onecore_31bf3856ad364e35_10.0.18362.1497_none_635d973bd35f851d\securebootai.dll
 2021-05-29 06:47:12, Info                  CSI    0000001f Performing 1 operations as follows:
   (0)  LockComponentPath: flags: 0 comp: {l:16 b:668aa7124e54d701110000007077e81f} pathid: {l:16 b:668aa7124e54d701120000007077e81f} path: [l:117]'\SystemRoot\WinSxS\amd64_microsoft-windows-s..boot-firmwareupdate_31bf3856ad364e35_10.0.18362.1_none_872390f682bad780' pid: 7770 starttime: 132667408039980728
 2021-05-29 06:47:12, Info                  CSI    00000020 Performing 1 operations as follows:
   (0)  LockComponentPath: flags: 0 comp: {l:16 b:12f7a7124e54d701130000007077e81f} pathid: {l:16 b:12f7a7124e54d701140000007077e81f} path: [l:119]'\SystemRoot\WinSxS\amd64_microsoft-windows-s..boot-firmwareupdate_31bf3856ad364e35_10.0.18362.411_none_0aba928a9707779d' pid: 7770 starttime: 132667408039980728
 2021-05-29 06:47:12, Error                 CSI    00000021@2021/5/29:05:47:12.852 (F) onecore\base\secureboot\servicing\advancedinstaller\securebootai.cpp(277): Error HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED) originated in function Windows::WCP::SecureBoot::BasicInstaller::Install expression: ApplySecureBootUpdate( dwAvailableUpdates)
 [gle=0x80004005]


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

marcolopes avatar image
0 Votes"
marcolopes answered

For everyone still having this problem:

1) I tried, without success (still having the same error) the SCRIPT used here: https://www.dell.com/community/PowerEdge-Hardware-General/Windows-Update-KB-KB4535680-failed-to-install-to-Server-2016/td-p/7806198/highlight/true/page/3

2) I DISABLED the update, so that OHTER updates could be installed without being reverted by this update (i was having a lot of troubles trying to install other updates except this one!). I used a m$ tool that is no longer available: https://web.archive.org/web/20210101181956/http://download.microsoft.com/download/F/2/2/F22D5FDB-59CD-4275-8C95-1BE17BF70B21/wushowhide.diagcab

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.