question

ThelmoHenriqueSantosMauleon-9395 avatar image
0 Votes"
ThelmoHenriqueSantosMauleon-9395 asked JuanSobrado-3258 answered

Can't reinstall Windows Defender on Windows 2016 (payload removed) Error 0x800f081f

Hi buddies,

After I removed Windows Defender with this command, it simply won't install again:
Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet

I know this command removes the payload, so I tried to enable it with an offline image (install.wim):
DISM.exe /Online /Enable-Feature /FeatureName:Windows-Defender /source:WIM:c:\temp\install.wim:1 /LimitAccess

The WIM image was generated using the latest Windows Server 2016 ISO downloaded from the Microsoft Portal.

The error that I have is this one:

Error in operation: source for package or file not found, ResolveSource() unsuccessful. (CBS HRESULT=0x800f081f)

If I try to install any other feature using the same command above, it works properly.

Also, I tried all these procedures without any success:

https://social.technet.microsoft.com/Forums/en-US/f0d7f604-b56d-4296-bbd1-ecd0044d4769/impossible-to-reinstall-defender-on-win-2016-bug?forum=ws2016

https://docs.microsoft.com/en-us/answers/questions/179052/the-source-files-not-found-running-dism-restorehea.html

https://www.wintips.org/fix-windows-defender-feature-installation-failed-source-files-could-not-be-found-in-server-2016/

I replicate the error in a VM, just to check that the problem wasn't on any GPO or configuration and the results are the same:

1º - Deployed a VM from scratch with Windows Server 2016 Datacenter with GUI

2º - Executed the following command in a CMD console with admin privileges:
Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet

3º - Restarted the machine and checked that Windows Defender was uninstalled.

4º - Tried to reinstall the feature using the wizard, indicating an alternative path (using the same ISO that I used to deploy the VM), and didn't work.

5º - Tried to use another Windows Server installation as a source, but the results were the same.

6º - Tried creating a WIM image, using the latest Windows Server 2016 ISO, and didn't work.

I believe that probably there is some kind of bug with the Windows-Defender package, as mentioned at this Forum:

https://social.technet.microsoft.com/Forums/en-US/f0d7f604-b56d-4296-bbd1-ecd0044d4769/impossible-to-reinstall-defender-on-win-2016-bug?forum=ws2016

Can anyone help me with this problem?

Thanks and BR,

Thelmo Mauleon

windows-server
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

TeemoTang-MSFT avatar image
0 Votes"
TeemoTang-MSFT answered ThelmoHenriqueSantosMauleon-9395 edited

According to the error message: Error in operation: source for package or file not found, ResolveSource() unsuccessful. (CBS HRESULT=0x800f081f)
I suspect that the wim file has something wrong when you execute dism command to enable defender offline, the image file in ISO file usually will be a esd file rather than wim file, we need to convert Install.ESD to Install.wim.


If the Answer is helpful, please click "Accept Answer" and upvote it.
Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi TeemoTang-MSFT !

Thanks for the answer. Can you help me with the procedure?
How can I do it?

What I did was extract the Windows Server 2016 ISO in a folder and then, I used the install.wim from this ISO.
Also, I create a new install.wim from this ISO, with the latest updates too, and didn't work.

With an .esd I never tried and I don't know how to do it. Are you sure Windows 2016 Server has an install.esd file inside the ISO? I searched for this file and I can't find it. I only have an install.wim inside my source folder.

Thanks and BR,

Thelmo Mauleon

0 Votes 0 ·
ThelmoHenriqueSantosMauleon-9395 avatar image
0 Votes"
ThelmoHenriqueSantosMauleon-9395 answered

I buddies,

Today, looking at the CBS logs, I found a different error:

2021-04-07 17:32:46, Info CBS Payload size invalid or too small, was not delta-compressed for file: \\?\C:\Windows\CbsTemp\30878734_2983473591\amd64_windows-defender-service-cloudclean_31bf3856ad364e35_10.0.14393.0_none_b031e2b988aef036\SymSrv.yes
2021-04-07 17:32:46, Info CBS Exec: Not able to find amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.14393.0_none_4b670b7c29a21bea\NisWfp.dll from directory local source
2021-04-07 17:32:46, Info CBS Exec: Not able to find WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.14393.0_none_4b670b7c29a21bea\NisWfp.dll from directory local source

Looking at another server with Windows Defender installed, I can see that I have the folder "amd64_windows-defender-service_31bf3856ad364e35" at the path C:\Windows>WinSxS.

So I tried to reinstall Windows Defender with this command:

dism /online /enable-feature /featurename:Windows-Defender /all /source:X:\Windows\WinSxS /LimitAccess

Where X is a mapped drive of the "C:" from the server that has Windows Defender installed and the folder "amd64_windows-defender-service_31bf3856ad364e35", but didn't work too:

Deployment Image Servicing and Management tool
Version: 10.0.14393.0

Image Version: 10.0.14393.0

Enabling feature(s)
[==========================100.0%==========================]

Error: 0x800f081f

The source files could not be found.
Use the "Source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see http://go.microsoft.com/fwlink/?LinkId=243077.

The DISM log file can be found at C:\Windows\Logs\DISM\dism.log

Attached, I sent my CBS and DISM logs.

Any Idea where could be the problem?

Thanks and BR,

Thelmo Mauleon

85224-dism.txt85144-cbs.txt85145-defender.png



dism.txt (39.0 KiB)
cbs.txt (333.7 KiB)
defender.png (88.5 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JuanSobrado-3258 avatar image
0 Votes"
JuanSobrado-3258 answered JuanSobrado-3258 commented

Hello @ThelmoHenriqueSantosMauleon-9395

The missing files/payload of Windows Defender were successfully copied from X: drive. A total of 82 entries with a pattern as below:

CBS Copied file \\?\X:\Windows\WinSxS\amd64_windows-defender-drivers_31bf3856ad364e35_10.0.14393.0_none_1e417abb0bebd499\WdFilter.sys from directory path: \\?\X:\Windows\WinSxS\amd64_windows-defender-drivers_31bf3856ad364e35_10.0.14393.0_none_1e417abb0bebd499\WdFilter.sys

However there is payload missing for subpackages from KB4048953, hence the reason for error 0x800f081f - CBS_E_SOURCE_MISSING still showing up.

Because you are using the /limitaccess switch machine will not got alternate location (i.e. Windows Update) to retrieve the rest of missing files.

I recommend you momentarily enable policy: [Specify settings for optional component installation and component repair][1] with option to Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS)

Run: "dism /online /cleanup-image /restorehealth"
then: Sfc /scannow

Try to install again.

If error persists please share latest CBS log file.

Regards,

Juan Sobrado.

========================================================
Please remember to upvote this answer should you find it helpful for your issue.


· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi JuanSobrado-3258, thanks for the answer.

I could do it, but the problem is that these servers cannot be connected to the Internet. I am working on a project where one of the requests is that the server cannot be connected to the Internet never.

That's why I have to do it all offline. Include, where I have these servers running, I don't have any router or switch providing an internet connection.

Any suggestion on how can I solve this problem?

Thanks and BR,

Thelmo Mauleon




0 Votes 0 ·
JuanSobrado-3258 avatar image JuanSobrado-3258 ThelmoHenriqueSantosMauleon-9395 ·

Hi @ThelmoHenriqueSantosMauleon-9395

You can try the following alternate method::

1) use a machine that has a healthy CBS store and Defender already installed. You can point the /source argument to the remote machine:

Dism /Online /Cleanup-Image /RestoreHealth /Source:\\localhost\C$\Windows\WinSxS /LimitAccess

I recommend this method vs using a mapped drive.

Let me know your comments and the results of this procedure.

Regards,

Juan Sobrado

========================================================
Please remember to upvote this answer should you find it helpful for your issue.




















·

0 Votes 0 ·
ThelmoHenriqueSantosMauleon-9395 avatar image
0 Votes"
ThelmoHenriqueSantosMauleon-9395 answered ThelmoHenriqueSantosMauleon-9395 edited

Hi Juan Sobrado,

Let's try it:

First, from the machine with problem, I checked and confirmed that I have access to the machine with a health CBS store and Defender:


85654-image.png

Then I executed the command indicated:


85646-image.png

According to the image, everything OK.

Now I executed this command, but I got the same error:

dism /online /enable-feature:Windows-Defender /all /source:\\10.10.11.191\c$\Windows\WinSxS /limitAccess


85685-image.png

Any other idea?


Thanks and BR,

Thelmo Mauleon



Attached, I85687-dism.txt85688-cbs.txt sent the latest CBS and DISM logs.



image.png (58.4 KiB)
image.png (29.9 KiB)
image.png (88.4 KiB)
dism.txt (870.4 KiB)
cbs.txt (719.6 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JuanSobrado-3258 avatar image
0 Votes"
JuanSobrado-3258 answered

Hi @ThelmoHenriqueSantosMauleon-9395

Indeed the restore using alternate location replaced several missing files, a total of 164

However some payload that is coming from KB4048953 is missing. This kb: https://support.microsoft.com/en-us/topic/november-14-2017-kb4048953-os-build-14393-1884-7c323ba8-6a63-fcc5-48ae-407a174656f3 Is no longer available.

You can try using other machines in your network as alternate source. If none of these help, at this point, the least time consuming process would be to perform an IPU (in-place upgrade) of OS:

https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/how-to-perform-an-in-place-upgrade-with-windows-10/7f0b236e-3c6c-4913-9691-c4baa2a6190a

This will fix the CBS store and preserve your current settings.

Note: if this machine runs as a domain controller it is not recommended to perform an IPU without demoting the role.

Regards,

Juan Sobrado

========================================================
Please remember to upvote this answer should you find it helpful for your issue.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.