Steps I use to narrow down an OS update installation failure on Windows Vista and higher

A while back, I wrote a blog post describing a specific error that can occur when trying to install the .NET Framework 3.5 or 3.5 SP1 on Windows Vista and Windows Server 2008.  In that post, I talked at a high level about some of the steps I take to narrow down this type of error.  Those troubleshooting steps are useful in more scenarios than just the one in that blog post, and they are hard to find in a search currently because of the post that they're currently located in.  As a result, I decided to write a standalone post that describes the steps I follow when trying to narrow down an OS update installation failure on Windows Vista and Windows Server 2008.  I am going to write this post from the perspective of troubleshooting a .NET Framework 3.5 and 3.5 SP1 installation failure on Windows Vista, but the same techniques are typically valid for other OS update installation failures on Windows Vista and higher.

It is important to keep in mind that the .NET Framework 3.5 and 3.5 SP1 both install updates to the .NET Framework 2.0 and 3.0 behind the scenes.  On Windows Vista and higher, the .NET Framework 2.0 and 3.0 are installed as OS components, so that means that the updates to 2.0 and 3.0 are OS update packages.  This means that failures in the .NET Framework 3.5 and 3.5 SP1 setups on Windows Vista and higher can possibly be caused by problems with the OS update engine.

Find the error in the .NET Framework setup log file

If I am investigating an error installing the .NET Framework 3.5 or 3.5 SP1, I start by opening the log file named %temp%\dd_dotnetfx35install.txt and searching for the string ***errorlog event*** .  If the problem is in an OS update, then the error in the log will indicate a failure installing the component named Microsoft .NET Framework 2.0SP1 (CBS) or Microsoft .NET Framework 3.0SP1 (CBS) .

If one of these components is the cause of the failure, there will be lines in dd_dotnetfx35install.txt directly above the ***errorlog event*** that look like the following:

[03/03/09,11:11:11] Microsoft .NET Framework 3.0SP1 (CBS): C:\Windows\system32\WUSA.exe exited with return value 2148468760
[03/03/09,11:11:11] InstallReturnValue: GFN_MID NET Framework 3.0SP1 (CBS), 0x800f0818

The name of the component and the HRESULT value listed for the InstallReturnValue will vary depending on the root cause of the failure, but the process name will always be WUSA.exe - this is the Windows Update Standalone Installer that is used to install OS updates on Windows Vista and later.

Find the error in the OS update installation engine log file (cbs.log)

One I have determined that the root cause of the failure is an OS update, I proceed to look at the log file at %windir%\logs\cbs\cbs.log.  This is the verbose log file for the OS update installation engine on Windows Vista and higher.  This log file is typically very large, and there are a couple of different ways I try to narrow down the error in this log:

  1. Search for the value listed in the InstallReturnValue entry from the dd_dotnetfx35install.txt log file in cbs.log.  For the above example, I would search for 0x800f0818.
  2. Search for the string generating failure report in cbs.log.

For the above example, text appears in cbs.log that looks like the following:

2009-03-03 11:11:11, Info                  CBS    WER: Generating failure report for package: Package_for_KB948610~31bf3856ad364e35~x86~~6.0.6001.2123, status: 0x800f0818, failure source: Execute, start state: 4, target state: 7

Determine the meaning of the error and possible workarounds

From here, the next step I take depends on what data appears in cbs.log.  Some of the information I look for is the following:

  1. Does the same error code occur for multiple different OS update packages?  If so, that typically means that there is a problem with the OS update engine itself as opposed to with the update that is failing.
  2. Does the error code appear in the System Update Readiness Tool knowledge base article?  If so, I typically try to use the tool available in that knowledge base article and/or the steps in this blog post.
  3. Does the error code appear in the table of common CBS error codes?  If so, I try the workaround suggested there for the error code that I found in cbs.log.
  4. If the error code does not appear in either of the above articles, then I try to use the err.exe tool to determine more detailed information about the cause of the error.

Sometimes, no error code information will appear in cbs.log.  In those cases, I also look for the error code in %windir%\WindowsUpdate.log.  There is a table of Windows Update Agent error codes that can be useful for error codes that appear in WindowsUpdate.log.

For additional information

While researching this blog post, I found a useful link on TechNet -  This link contains more details about how to read and interpret the following log files:

  • %windir%\WindowsUpdate.log
  • %windir%\logs\cbs\cbs.log

It includes a table of common errors that can appear in a cbs.log along with possible resolutions or workarounds.

<update date="12/2/2009"> Added a link to a table of Windows Update Agent error codes that can appear in %windir%\WindowsUpdate.log and can be helpful in troubleshooting OS update installation issues in some cases. </update>