Can't reinstall Windows Defender on Windows 2016 (payload removed) Error 0x800f081f

Thelmo Henrique Santos Mauleon 6 Reputation points
2021-04-06T14:53:27.927+00:00

Hi buddies,

After I removed Windows Defender with this command, it simply won't install again:
Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet

I know this command removes the payload, so I tried to enable it with an offline image (install.wim):
DISM.exe /Online /Enable-Feature /FeatureName:Windows-Defender /source:WIM:c:\temp\install.wim:1 /LimitAccess

The WIM image was generated using the latest Windows Server 2016 ISO downloaded from the Microsoft Portal.

The error that I have is this one:

Error in operation: source for package or file not found, ResolveSource() unsuccessful. (CBS HRESULT=0x800f081f)

If I try to install any other feature using the same command above, it works properly.

Also, I tried all these procedures without any success:

https://social.technet.microsoft.com/Forums/en-US/f0d7f604-b56d-4296-bbd1-ecd0044d4769/impossible-to-reinstall-defender-on-win-2016-bug?forum=ws2016

https://learn.microsoft.com/en-us/answers/questions/179052/the-source-files-not-found-running-dism-restorehea.html

https://www.wintips.org/fix-windows-defender-feature-installation-failed-source-files-could-not-be-found-in-server-2016/

I replicate the error in a VM, just to check that the problem wasn't on any GPO or configuration and the results are the same:

1º - Deployed a VM from scratch with Windows Server 2016 Datacenter with GUI

2º - Executed the following command in a CMD console with admin privileges:
Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet

3º - Restarted the machine and checked that Windows Defender was uninstalled.

4º - Tried to reinstall the feature using the wizard, indicating an alternative path (using the same ISO that I used to deploy the VM), and didn't work.

5º - Tried to use another Windows Server installation as a source, but the results were the same.

6º - Tried creating a WIM image, using the latest Windows Server 2016 ISO, and didn't work.

I believe that probably there is some kind of bug with the Windows-Defender package, as mentioned at this Forum:

https://social.technet.microsoft.com/Forums/en-US/f0d7f604-b56d-4296-bbd1-ecd0044d4769/impossible-to-reinstall-defender-on-win-2016-bug?forum=ws2016

Can anyone help me with this problem?

Thanks and BR,

Thelmo Mauleon

Windows for business | Windows Server | User experience | Other
0 comments No comments
{count} votes

5 answers

Sort by: Most helpful
  1. Thelmo Henrique Santos Mauleon 6 Reputation points
    2021-04-07T07:49:45.673+00:00

    I buddies,

    Today, looking at the CBS logs, I found a different error:

    2021-04-07 17:32:46, Info CBS Payload size invalid or too small, was not delta-compressed for file: \?\C:\Windows\CbsTemp\30878734_2983473591\amd64_windows-defender-service-cloudclean_31bf3856ad364e35_10.0.14393.0_none_b031e2b988aef036\SymSrv.yes
    2021-04-07 17:32:46, Info CBS Exec: Not able to find amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.14393.0_none_4b670b7c29a21bea\NisWfp.dll from directory local source
    2021-04-07 17:32:46, Info CBS Exec: Not able to find WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.14393.0_none_4b670b7c29a21bea\NisWfp.dll from directory local source

    Looking at another server with Windows Defender installed, I can see that I have the folder "amd64_windows-defender-service_31bf3856ad364e35" at the path C:\Windows>WinSxS.

    So I tried to reinstall Windows Defender with this command:

    dism /online /enable-feature /featurename:Windows-Defender /all /source:X:\Windows\WinSxS /LimitAccess

    Where X is a mapped drive of the "C:" from the server that has Windows Defender installed and the folder "amd64_windows-defender-service_31bf3856ad364e35", but didn't work too:

    Deployment Image Servicing and Management tool
    Version: 10.0.14393.0

    Image Version: 10.0.14393.0

    Enabling feature(s)
    [==========================100.0%==========================]

    Error: 0x800f081f

    The source files could not be found.
    Use the "Source" option to specify the location of the files that are required to restore the feature. For more information on specifying a source location, see http://go.microsoft.com/fwlink/?LinkId=243077.

    The DISM log file can be found at C:\Windows\Logs\DISM\dism.log

    Attached, I sent my CBS and DISM logs.

    Any Idea where could be the problem?

    Thanks and BR,

    Thelmo Mauleon

    85224-dism.txt85144-cbs.txt85145-defender.png

    1 person found this answer helpful.
    0 comments No comments

  2. Teemo Tang 11,471 Reputation points
    2021-04-07T02:19:25.187+00:00

    According to the error message: Error in operation: source for package or file not found, ResolveSource() unsuccessful. (CBS HRESULT=0x800f081f)
    I suspect that the wim file has something wrong when you execute dism command to enable defender offline, the image file in ISO file usually will be a esd file rather than wim file, we need to convert Install.ESD to Install.wim.

    -------------------------------------------------------------------------------------

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


  3. Juan Sobrado - MSFT 421 Reputation points Microsoft Employee
    2021-04-07T08:33:23.987+00:00

    Hello @Thelmo Henrique Santos Mauleon

    The missing files/payload of Windows Defender were successfully copied from X: drive. A total of 82 entries with a pattern as below:

    CBS Copied file \?\X:\Windows\WinSxS\amd64_windows-defender-drivers_31bf3856ad364e35_10.0.14393.0_none_1e417abb0bebd499\WdFilter.sys from directory path: \?\X:\Windows\WinSxS\amd64_windows-defender-drivers_31bf3856ad364e35_10.0.14393.0_none_1e417abb0bebd499\WdFilter.sys

    However there is payload missing for subpackages from KB4048953, hence the reason for error 0x800f081f - CBS_E_SOURCE_MISSING still showing up.

    Because you are using the /limitaccess switch machine will not got alternate location (i.e. Windows Update) to retrieve the rest of missing files.

    I recommend you momentarily enable policy: [Specify settings for optional component installation and component repair][1] with option to Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS)

    Run: "dism /online /cleanup-image /restorehealth"
    then: Sfc /scannow

    Try to install again.

    If error persists please share latest CBS log file.

    Regards,

    Juan Sobrado.

    ========================================================

    Please remember to upvote this answer should you find it helpful for your issue.


  4. Thelmo Henrique Santos Mauleon 6 Reputation points
    2021-04-08T08:05:42.72+00:00

    Hi Juan Sobrado,

    Let's try it:

    First, from the machine with problem, I checked and confirmed that I have access to the machine with a health CBS store and Defender:

    85654-image.png

    Then I executed the command indicated:

    85646-image.png

    According to the image, everything OK.

    Now I executed this command, but I got the same error:

    dism /online /enable-feature:Windows-Defender /all /source:\10.10.11.191\c$\Windows\WinSxS /limitAccess

    85685-image.png

    Any other idea?

    Thanks and BR,

    Thelmo Mauleon

    Attached, I85687-dism.txt85688-cbs.txt sent the latest CBS and DISM logs.


  5. Juan Sobrado - MSFT 421 Reputation points Microsoft Employee
    2021-04-13T04:16:16.977+00:00

    Hi @Thelmo Henrique Santos Mauleon

    Indeed the restore using alternate location replaced several missing files, a total of 164

    However some payload that is coming from KB4048953 is missing. This kb: https://support.microsoft.com/en-us/topic/november-14-2017-kb4048953-os-build-14393-1884-7c323ba8-6a63-fcc5-48ae-407a174656f3 Is no longer available.

    You can try using other machines in your network as alternate source. If none of these help, at this point, the least time consuming process would be to perform an IPU (in-place upgrade) of OS:

    https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/how-to-perform-an-in-place-upgrade-with-windows-10/7f0b236e-3c6c-4913-9691-c4baa2a6190a

    This will fix the CBS store and preserve your current settings.

    Note: if this machine runs as a domain controller it is not recommended to perform an IPU without demoting the role.

    Regards,

    Juan Sobrado

    ========================================================

    Please remember to upvote this answer should you find it helpful for your issue.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.