Windows 10 and 11 Cumulative Update Failures - A cause and solution (0x800f0922)

[SYNACK]

I have been having a major issue with Windows updates for a month or so. Cumulative updates that would get almost all the way through then choke and revert at the last moment.

 

I thought this was due to Windows 11's obvious 'quality' but then it started effecting the fresh Windows 10 builds as well. After running all the DISM checks, SFS and clearing the Windows update cache the problem persisted.

 

Thankfully Windows 10 managed to provide an actual clue in its Windows update logs - helpfully left in ETL files till you run the Powershell command Get-WindowsUpdateLog .

 

Burried deep in those logs - Running a find from the bottom up for the exception (0x800f0922) eventually landed me here:

 

    Installer ID: {c5f0e9d7-e844-4507-89e4-701b5a747221}
   Installer name: 'Boot File Servicing (BFSVC) Installer'
2024-07-25 17:12:54, Info                  CSI    00000863 BFSVC: 'ServiceBootFiles MuiOnly:n Res:n Fonts:n BootMgrOvw:n BootStatOvw:n DbgTrn:n SuspendBDE:n Offline:n'

2024-07-25 17:12:54, Info                  CSI    00000864 BFSVC: 'Not using Ex bins.'

2024-07-25 17:12:54, Info                  CSI    00000865 BFSVC: 'Using source OS version a00004a610001'

2024-07-25 17:12:54, Info                  CSI    00000866 BFSVC: 'Copying boot files CopyBootManager(Yes) C:\Windows\boot\EFI -> \\?\GLOBALROOT\Device\HarddiskVolume1\EFI\Microsoft\Boot '

2024-07-25 17:12:54, Info                  CSI    00000867 BFSVC: 'Error creating \\?\GLOBALROOT\Device\HarddiskVolume1\EFI\Microsoft\Boot\es-ES\ path! Last Error = 0xb7'

2024-07-25 17:12:54, Info                  CSI    00000868 BFSVC: 'Error copying boot files from C:\Windows\boot\EFI to \\?\GLOBALROOT\Device\HarddiskVolume1\EFI\Microsoft\Boot! Last Error = 0xb7'

2024-07-25 17:12:54, Info                  CSI    00000869 BFSVC: 'ServicingBootFiles failed. Error = 0xb7'

2024-07-25 17:12:54, Info                  CBS    Progress: UI message updated. Operation type: Update. Stage: 1 out of 1. Percent progress: 94.
2024-07-25 17:12:54, Error                 CSI    0000086a@2024/7/25:05:12:54.647 (F) onecore\base\wcp\plugins\bfsvcai\bfsvcai.cpp(479): Error HRESULT_FROM_WIN32(14077) originated in function Windows::WCP::WCF::BfsvcInstaller::CommitChanges expression: Result
[gle=0x80004005]
2024-07-25 17:12:54, Info                  CBS    Could not get active session for current session file logging [hrESULT = 0x80004003 - E_POINTER]
2024-07-25 17:12:54, Info                  CBS    Could not get file name for current session file logging [hrESULT = 0x80004003 - E_POINTER]
2024-07-25 17:12:54, Info                  CBS    Added C:\Windows\Logs\CBS\CBS.log to WER report.
2024-07-25 17:12:54, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240724122557.log to WER report.
2024-07-25 17:12:54, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240724060753.cab to WER report.
2024-07-25 17:12:54, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240722200643.cab to WER report.
2024-07-25 17:12:54, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240719210636.cab to WER report.
2024-07-25 17:12:54, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240627004301.cab to WER report.
2024-07-25 17:12:54, Info                  CBS    Not able to add pending.xml.bad to Windows Error Report. [hrESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2024-07-25 17:12:54, Info                  CSI    0000086b@2024/7/25:05:12:54.937 CSI Advanced installer perf trace:
CSIPERF:AIDONE;{c5f0e9d7-e844-4507-89e4-701b5a747221};(null);903569us
2024-07-25 17:12:54, Info                  CSI    0000086c End executing advanced installer (sequence 0)
   Completion status: HRESULT_FROM_WIN32(14077) 

2024-07-25 17:12:54, Error      [0x018049] CSI    0000086d (F) Failed execution of queue item Installer: Boot File Servicing (BFSVC) Installer ({c5f0e9d7-e844-4507-89e4-701b5a747221}) with HRESULT HRESULT_FROM_WIN32(14077).  Failure will not be ignored: A rollback will be initiated after all the operations in the installer queue are completed; installer is reliable[gle=0x80004005]
2024-07-25 17:12:54, Info                  CBS    Could not get active session for current session file logging [hrESULT = 0x80004003 - E_POINTER]
2024-07-25 17:12:54, Info                  CBS    Could not get file name for current session file logging [hrESULT = 0x80004003 - E_POINTER]

 

Looked like it could not find or update the boot files. A quick trip into Windows RE and some failed attempts to run bootrec /fixboot telling me access was denied I eventually stumbled across this:

 

https://answers.microsoft.com/en-us/windows/forum/all/windows-10-bootrec-fixboot-access-is-denied/747c4180-7ff3-4bc2-b6cc-81e572d546df

 

diskpart
select disk 0 {or your boot disk}
List part
Select part 2 {whatever the 100MB or so UEFI partition is}
assign letter=v:
exit

format v: /FS:fat32
bcdboot c:\windows /s v: /f UEFI

 

This rebuilds the UEFI partition and then it can install updates again.

 

I believe this is down to my imaging method creating template VMs in Hyper-V then mounting the VHD and injecting drivers then capturing an FFU. This used to work fine but it seems something - the mounting of VHDs by Server 2022 or the DISM tool - has changed causing this lovely aberration and requiring this manual fix on all effected machines. My displeasure with Microsoft over this is incandescent.

 

EDIT: After much messing I figured out you can perform the fix on a live system (in seconds), it will not let you format the EFI partition but you can nuke and recreate it with admin privileges as below, just save as a .cmd or .bat file and runas Administrator:

mountvol x: /s
x:
rd /s /q EFI
attrib -a x:\EFI\Microsoft\Boot\BCD
bcdboot c:\windows /s x: /f UEFI
pause

Edited August 1, 2024 by SYNACK

[SYNACK]

Alright I'm just going to plug my own post as I have looked it up on here several times now for various problems with Windows 11 updates and imaging. I don't know who is in charge of the code that modifies the uefi partition but they need some more code review.

 

I have now had several machines that failed during major Windows updates that have been recovered by variations of this. It at least needs to be added into the startup repair tool remediations if they are going to keep cooking it.