windows server 2016 issues patching Domain Controllers

Question

I have two domain controllers where windows updates have begun to fail. The first failed update from "update History" was KB5013952 it does not show up now on check for new updates list. The second and third failed updates are KB5014026 and KB5014702

Here is the list if fixes I tried to date:

After retrying several times I tried to download and install them from the update catalogue, manually. With no luck.
I ran the update troubleshooter which identified a problem that the troubleshooter was unable to fix.

Then I stopped the windows update service and tries to delete the contents of the windows\softwaredistribution\datastore folder and was not able to due to an "folder is in use by another process" error

I tried the rum the recommended dsim command from an administrator command window the 1st tow ran fine when I ran the final command:
dism /online /cleanup-image /restorehealth
I got the error Not enough storage is available to complete this operation.

Then I tried to run the sfc /scannow command
and got the following error service cannot start

I tried to manually restart the service it reported as restarted but the sfc /scannow command failed with the same error.

Please note that when I tried to start the "Windows Modules Installer Services" earlier in the troubleshooting, it was not present on the services list.

I do not know what to try next, this rabbit hole has me stumped. Can someone help me unravel this one.

Thanks

Steve Weatherbee
Cumberland Public Libraries

Answer 1

I have limited resources and old server(s) and no reserve equipment

Well, yes it is a simple approach. You have all the hardware (assumes its certified for Server 2019 otherwise just reinstall 2016) Move roles to one server while doing rebuild on other server. This should only take an hour or so per server with no domain downtime.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

I can do an upgrade to server 2019

The much clean / simpler / safer method is to rebuild them one at a time. Move roles off before rebuild.

The two prerequisites to introducing the first 2019 or 2022 domain controller are that domain functional level needs to be 2008 or higher and older sysvol FRS replication needs to have been migrated to DFSR
https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Streamlined-Migration-of-FRS-to-DFSR-SYSVOL/ba-p/425405

I'd use dcdiag / repadmin tools to verify health correcting all errors found before starting any operations. Then stand up the new 2019 or 2022, patch it fully, license it, join existing domain, add active directory domain services, promote it also making it a GC (recommended), transfer FSMO roles over (optional), transfer pdc emulator role (optional), use dcdiag / repadmin tools to again verify health, when all is good you can move on to next one.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

0x80073701 = ERROR_SXS_ASSEMBLY_MISSING which means there are some system files are missing, which caused the installation failure. You can also try a repair install by running setup.exe from the root of the install.

I wouldn't hold much hope for this, better time may be spent standing up a new one, patch it fully and migrate the roles or applications over to it.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

The much simpler / safer method may be to stand up a new one for replacement.

I'd use dcdiag / repadmin tools to verify health correcting all errors found before starting any operations. Then stand up the new 2016, patch it fully, license it, join existing domain, add active directory domain services, promote it also making it a GC (recommended), transfer FSMO roles over (optional), transfer pdc emulator role (optional), use dcdiag / repadmin tools to again verify health, when all is good you can decommission / demote old one.

--please don't forget to upvote and Accept as answer if the reply is helpful--