Problem with DISM Image Session

Question

Hi all, we encountered an odd problem with DISM on some of our servers.

Short summary on how our environment is setup:

We got multiple Windows Server 2022 (Version 21H2/OS Build 20348.3692), which aren't domain joined for security reasons and for hardening purposes the following settings have been changed:

-

• Disabled local "Configure Automatic Updates" GPO
• Disabled Microsoft Edge Update Services (edgeupdate and edgeupdatem)
• Disabled Remote Desktop Service (termservice)
• Disabled Remote Registry Service (remoteregistry)
• Disabled Windows Remote Management Service (winrm)
• Disabled WinHTTP Web Proxy Auto Discovery Service and IP Helper as we manually added our Proxy Configuration
• Disabled SSL 2.0/ SSL 3.0 and TLS 1.0/ TLS 1.1 Protocols
• Disabled Windows Script Host
• Disabeld Link Local Multicast Name Resolution (LLMNR)
• Enabled SMBv3 signing
• Enabled Local Security Authority Server Service (LSASS) as protected Service

All Servers were deployed with the same vSphere VM Template (OS Build 20348.2700) and were updated via our SCCM environment to OS Build 20348.3692. All mentioned hardening settings are part of the template and are set before any updates are installed. Additionally with the updates, SCCM deploys the latest Cortex XDR and Guardicore Builds.

Even considering that the Windows Remote Management Service must be reactivated to add Windows features or roles (which it was on every test), we are encountering the following problem after the update:

Installation of any Windows Feature or Role over the Server Manager fails with a DISM Error: 0x80010111 / Failed to create Dism Image Session in host.

The same error occurs if we use a DISM cmdlet, like dism /online /get-packages via cmd (5 out of 10 tries fails).

When the server is directly deployed from the Template and no other updates or software like Cortex and Guardicore are installed, any Windows Feature or Role can be installed via the Server Manager without a problem.

First, we thought that the installation of the updates did affect the DISM components and corrupted them, so we removed each of the installed updates individually and tested the functionality of DISM with the error still occuring.

The same tests where done with the additional software cortex and guardicore, sadly with the same effect. The error persistet even though the server was restored to base VM Template settings.

At last we tested each hardening setting we configured in the template, with an updated server and a server with removed update. The results where the same, the DISM error persistet in the Server Manager and the DISM cmdlets behaved in the same manner as the previous tests.

Furthermore to check all DISM components for any corruption, we ran all DISM /online /cleanup check cmdlets (/scanhealth, /checkhealth, /restorehealth) and sfc /scannow cmdlet without it being able to detect any corrupted files.

For the checks we also attached a clean ISO as source to reference to.

Answer 1

Hi Richi50

Thanks for your advice. I've posted the question in the Q&A section of MS.

Best Regards,

Sascha

Answer 2

Hallo,

du bist hier in der Community für die Endanwender. Stelle deine Frage bitte im Q&A Forum von MS.

https://learn.microsoft.com/de-de/answers/questions/

https://learn.microsoft.com/en-us/answers/questions/