Event ID 4385 — Update Installations or Removals

Applies To: Windows Server 2008

An update is a unit of a package that you can install individually. The update is installed based on the specifications in the package.

Event Details

Product: Windows Operating System
ID: 4385
Source: Microsoft-Windows-Servicing
Version: 6.0
Symbolic Name: CbsUpdateChangeStateFailure
Message: Windows Servicing failed to complete the process of changing update %1 from package %2(%3) into %4(%5) state


Check the logs

You have encountered a complex issue and you may need to call Customer Service and Support (CSS) in order to resolve the problem. If you want to try to determine the cause yourself, you can diagnose the Windows Update log (%windir%\WindowsUpdate.log),the Component-Based Servicing log (%windir%\logs\cbs\cbs.log), and driver logs. For information about diagnosing these logs, see http://go.microsoft.com/fwlink/?LinkId=84909.

If you do not want to diagnose the logs, you should call CSS and provide the following logs to them. For information about how to contact CSS, see Support Options from Microsoft Services (http://go.microsoft.com/fwlink/?LinkId=89446).

  • Windows Update log (%windir%\WindowsUpdate.log)
  • Component Based Servicing log (%windir%\logs\cbs\cbs.log)
  • Windows Side-by-Side Pending log (%windir%\winsxs\pending.xml)
  • Windows Side-by-Side Pending Bad log (%windir%\winsxs\pending.xml.bad)
  • Pending Operations Queue Exec log (%windir%\winsxs\poqexec.log)
  • DPX Setup Act log (%windir%\logs\DPX\setupact.log)


To verify that an update was successfully installed or uninstalled, use Event Viewer to verify that Component-Based Servicing (CBS) raised Event 4383: Windows Servicing completed the process of changing update <UpdateName> from package <PackageName> (<PackageReleaseType>) into <LocalizedUpdateInstallState>(<UpdateInstallState>) state).

Update Installations or Removals

Setup Infrastructure