Failed to Apply Cumulative Update on Server 2016

These errors are always fun to track down. Last month, I had a Windows Server 2016 VM that would always roll back the latest cumulative update for the OS. I tried the usual tricks of running sfc /scannow, dism, safe mode, etc. and nothing worked. I gave up and moved on to something else. Now again this month I had even more servers doing the exact same thing.

After some Googling, I did a deep dive into the logs under C:\windows\logs\cbs\ and looked for the word “error” around the time I tried applying the update and then found this:

Error [0x01803e] CSI 000000f5 (F) Failed execution of queue item Installer: HTTP Installer ({86fee01a-954a-11df-bc0c-cea7dfd72085}) with HRESULT HRESULT_FROM_WIN32(1058). Failure will not be ignored: A rollback will be initiated after all the operations in the installer queue are completed; installer is reliable[gle=0x80004005]

This did ring a bell as months earlier I had found a dev box that would not patch and it ended up that http.sys was disabled on that VM as well (but it was enabled on the prod box???). The common thread between all 3 VMs was that they were all running Apache Tomcat. The web developer had disabled the http.sys driver as this can “hijack” programs from listening on port 80, so to prevent this they just disable it, which also causes PowerShell remote management, printer spooler and branchcache services not to run (because they all rely on the http.sys driver running).

The fix is simple: enable the http.sys driver, run the patches, then disable http.sys:

sc qc http
sc config http start= auto

After patching we can run these commands to set it back to disabled and restart again:

net stop http /y
sc config http start= disabled
sc qc http

Let me just rant and say Microsoft does a very poor job of telling us why the patches failed to apply. They don’t even give a hint of where to go look for the log files.

  • Soli Deo Gloria