A possible cause for this kind of behavior is the amount of events that are queried and collected by the Server Manager.

The Windows Server 2012 Server Manager is querying and collecting different events types for different time intervals from different Server.

Should you observe the described behavior (ServerManager.exe using several GB of memory), here are some details and references to look at.

1. Isolation: From which server do we collect events?

How many/Which other server are added in the Server Manager under All Servers for monitoring?

If you remove these and restart the Server Manager, do you still see the same memory usage?

Reference: in a cluster environment all cluster nodes are added to the All Server list by default and can’t be removed.

2. Isolation: from which event-logs to we query/collect events?

Each view of the Events in the Server Manager brings events from different event-logs, depending on the specific view.

EVENTS : TASKS > Configure Data

This needs to be verified for the different views. Here are few examples:

-         Local Server > Events            brings events from Application, Setup, System and depending on the settings the Administrator configured possibly also from other eventlogs.

-         File and Storage Services > Servers:Events   brings events from the FailoverClustering-Diagnsotic eventlog.

The event views in the Server Manager are defined per Server by the Administrator and per Role.

3. Isolation: What event types are collected and for what time interval?

EVENTS : TASKS > Configure Event Data

To get extreme high number of events when using this default setting, it would mean that an extreme high number of Critical, Error and Warning events have been logged during the last 24 hours.

After performing the described isolation we should have a clearer view and better knowledge of what event types, for which time interval, from which eventlog and from which server are collected.

Should one of these eventlogs have an extreme high number of being queried by the Server Manager, you might see the high memory usage.

If you did not identify the corresponding eventlog yet, you might try and proceed in a preogressive way as follows for tightening down the events view in Server Manager:

• Select only Critical per Event view (or choose a shorter time for event collection) and restart the Server Manager.

• Once the memory usage is dropping considerably, you have identified the Events view in the Server Manager. After this you can set the other previously changed event views back to the defaults and restart the Server Manager once again to confirm that it is the only Events view causing the high memory usage.

At this point it should be easy to identify and confirm the corresponding event-log from eventvwr.msc

WHAT TO DO?

We can control the amount of events queried by the Server Manager in different ways:

1. Recommended: Analyze and solve the Error/Warning events from the identified event-log, so that these are not logged any more.
   They will most likely reference another underlying problem
2. Limit the queried Events for the specific event log by Severity (Critical, Error, Warning, Informational)
3. Limit the time interval for the queried Events for the specific event log

Reference

If we check the max size of the event-logs, the most event-logs are limited to 1MB, some as Application and System Eventlog to 20MB and herewith it is unlikely that the described memory usage scenario is met, as these do can not contain such an extreme high amount of events to cause several GB to be used by ServerManager.

The FailoverClustering-Diagnostic Log is though limited to 300MB and if there are extremely many errors or warnings logged here during the last 24 hours, this could cause the described behavior – this would then be the case I have been working on J

One quick step that could also lead to isolation would also be checking the event log files under C:\Windows\System32\winevt\Logs and sorting these by size. This way you would pretty fast identify the largest event-logs and then verify whether these correspond to a specific Events views in Server Manager.

Hope this helps.

Oni Sandru

Shared Nothing Live Migration is a new functionality introduced in Windows Server 2012, that allows you to live migrate the virtual workloads in a non-cluster environment.

If you would like to know more, please have a look at:

Configure and Use Live Migration on Non-clustered Virtual Machines

https://technet.microsoft.com/en-us/library/jj134199.aspx

Ok, so having this explained, I will go ahead and describe my customers problem. His environment consisted of 3 Hyper-V 2012 Host (Non-cluster) with some virtual workloads split up between them. Let’s simply call them S1, S2 and S3.

At some point, my customer couldn’t live migrate any virtual machine to S1. The live migration between S2 and S3 could be done successfully, but not on S1.

When performing the live migration to S1, we got:

Virtual machine migration operation failed at the migration source.

Failed to establish a connection with host ‘S1’: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (0x8007274C)

The first thing we did, was to check if Live Migration on S1 was checked in Hyper-V Settings. It was. We could also ping S1 from S2 and S3 and back. S1 was also restarted.

I wanted to see if this is happening only with the already configured virtual machine’s or with newly created ones also. We created a TestVM on S2 and tried to live migrate. It didn’t work.

We then went ahead and created a TestVM1 on S1 and tried to live migrate it to S2 and it worked, but couldn’t set it again on S1.

Taken into account that we have a communication problem with S1, I asked the customer to check if the Hyper-V rules from the Windows Firewall are the same with those from server S2. They were the same.

                    We then disabled the Windows Firewall on S1 and tried to do a live migration. This time it failed with another error:

 Virtual machine migration operation failed at migration source.

Failed to establish a connection with host ‘S1’: No connection could be made because the target machine actively refused it. (0x8007274D).

Knowing that system and application event log isn’t revealing any additional information about the above error message, we went ahead and looked in Microsoft-Windows-Hyper-V-VMMS-Admin and found the following:

 Log Name:      Microsoft-Windows-Hyper-V-VMMS-Admin

Source:        Microsoft-Windows-Hyper-V-VMMS

Date:          08.10.2012 09:48:47

Event ID:      20408

Task Category: None

Level:         Error

Keywords:     

User:          SYSTEM

Computer:      S1

Description:

The Virtual Machine Management Service failed to start the listener for Virtual Machine migration connections: The requested address is not valid in its context. (0x80072741).

I couldn’t find any information regarding this error whatsoever, therefore had a look in a network trace during the live migration failure also.  

The live migration is done on the port 6600 and the network trace showed us that the connection was simply reset-ed.

In a netstat –a, I could see that the process vmms.exe wasn’t listening on port 6600 on S1. S2 and S3 had the vmms process listening on port 6600.

With the above information, we could establish that this was our problem. We restarted the vmms process on S1 and then BINGO, a live migration was possible.

But wait...

The problem wasn’t gone. After S1 was restarted, my customer couldn’t do a live migration again. The vmms process didn’t listened on the port 6600.

What I would like to mention is, is that my customer used 2 NIC’s:

1 x Hyper-V Host NIC

1 x Teamed NIC

The IP for the live migration came from the Teamed NIC.

After discussing with one of my experienced virtualization colleague, we concluded that there seem to be a race condition when the server is restarted.

After setting the restart type for the process vmms.exe to Automatic “Delayed Start”, the problem didn’t appeared after a reboot of the server S1.

When the Virtual Machine Managment Service (vmms.exe) starts it tries to register this port to listen for incoming migration requests. When the underlying Network is not (yet) ready, the listening port cannot be registered.

This might happen on Teamed Networks that are not completely initalized during system startup.

Another workaround was to set the IP of the Hyper-V host for the live migration traffic.

Hope this will help you if you encounter the same simptoms.

Alex Mihai

GTSC Support Engineer

The logs relevant in these situations no matter if client or servers are:

1. C:\windows\logs\cbs\cbs.log

2. System Event log

3. C:\windows\logs\cbs\checksur.log (this is created after you run the System Update Readiness Tool)

The first log you need to analyze is the checksur.log:

If you see entries like:

Checking Package Manifests and Catalogs

(f)            CBS MUM Corrupt  0x00000000            servicing\Packages\Package_for_KB2479628_RTM~31bf3856ad364e35~amd64~~6.1.1.4.mum                     Expected file name Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.mum does not match the actual file name

Unavailable repair files:

                servicing\packages\Package_for_KB2479628_RTM~31bf3856ad364e35~amd64~~6.1.1.4.mum

                servicing\packages\Package_for_KB2479628_RTM~31bf3856ad364e35~amd64~~6.1.1.4.cat

Then you need to follow instructions from:

https://blogs.technet.com/b/roplatforms/archive/2010/05/12/how-to-fix-server-manager-errors-after-installing-updates-hresult-0x800f0818-hresult-0x800b0100.aspx

IF the log is clear, you move on to the CBS Log. Here you first want to search for “, error”. This will search only for Error entries. Focus on the day the installation attempt occurred.

Now to the examples:

Ex.1: Servers or clients kept being in a pending reboot state, even after they were rebooted!

2011-03-09 09:37:36, Info                  CSI    00000040 Pending transaction content must be resolved, cannot begin another transaction yet

2011-03-09 09:37:36, Info                  CBS    Failed to get transaction analysis because of pending operations. Disposition from Analyze: 0x1 [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info                  CBS    Failed to get inventory. [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info                  CSI    00000041@2011/3/9:08:37:36.532 CSI Transaction @0x268ee0 destroyed

2011-03-09 09:37:36, Info                  CBS    Failed to get inventory [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info                  CBS    Failed to load current component state [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info                  CBS    Failed to find or add the component family [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info                  CBS    ComponentAnalyzerEvaluateSelfUpdate call failed. [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info                  CBS    Failed to evaluate self update [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info                  CBS    Failed to evaluate non detect parent update [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info                  CBS    Failed to evaluate non parent [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info                  CBS    failed to evaluate single applicability [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info                  CBS    Failed to evaluate applicability [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

2011-03-09 09:37:36, Info                  CBS    Failed to get applicability on updates [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]

Cause:

======

The TrustedInstaller service was set to manual using Group Policy (GPO), which prevented him to start to complete pending operations.

The TrustedInstaller service changes the default service startup type of Manual (3) to Automatic (2), when it encounters an update that has to process a transaction after a restart. When the value is set back to Manual before the restart the transaction that has to be applied after restart cannot be applied.  This transaction will be pended. It will block all other update installations that might come up.

Resolution:

==========

The resolution is explained in the KB below. The reason I decided to also blog about it, is because the errors above are not described in the article, and it might be a bit hard to find if you run into it.

https://support.microsoft.com/kb/968440

Changing the policy back to default fixes the issue.

Ex.2: Here no installation worked anymore.

The CBS Log was full of errors, but none that would pinpoint the cause. So looking at the system.log we find:

Faulting application name: TrustedInstaller.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc4b0

Faulting module name: ntdll.dll, version: 6.1.7600.16385, time stamp: 0x4a5be02b

Exception code: 0xc00000fd

Fault offset: 0x00000000000529f0

Faulting process id: 0x1368

Faulting application start time: 0x01cbdfd0e12ca3d6

Faulting application path: C:\Windows\servicing\TrustedInstaller.exe

Faulting module path: C:\Windows\SYSTEM32\ntdll.dll

Report Id: 27f28558-4bc4-11e0-9960-005056833879

Since the TrustedInstaller is the process that handles all installations, this is crucial for any installation. It was crashing. Ideally you will run the System Update Readiness Tool and find the files you need to replace in order for the TrustedInstaller to run again, but there are cases where the Manifest and Catalog files have not yet been merged into the Checksur Tool (System Updated Readiness Tool). In this case no missing mum/cat files will be found. I`m afraid here only a IDNA Trace and debugging will reveal which mum/cat files is missing.

Resolution:

==========

Run Checksur Tool (KB947821)

Ex.3: Error 0x800f081f when trying to install SP1 for Windows 2k8 R2

Here this was the premise: Error 0x800f081f. Looking at the CBS log very carefully we can find the highlighted area:

Line 2225: 2011-03-03 08:09:42, Info                  CBS    Failed to get session package state for package: Package_6_for_KB2482017~31bf3856ad364e35~amd64~~6.1.1.1 [HRESULT = 0x80070490 - ERROR_NOT_FOUND]

Line 2288: 2011-03-03 08:09:42, Info                  CBS    Failed to get session package state for package: Package_7_for_KB2482017~31bf3856ad364e35~amd64~~6.1.1.1 [HRESULT = 0x80070490 - ERROR_NOT_FOUND]

Line 2411: 2011-03-03 08:09:42, Info                  CBS    Failed to get session package state for package: Package_6_for_KB2482017~31bf3856ad364e35~amd64~~6.1.1.1 [HRESULT = 0x80070490 - ERROR_NOT_FOUND]

2011-03-02 15:36:18, Info                  CBS    Calling client to resolve source, cannot find file 'TsUsbGD.sys' at path: \\?\C:\Windows\Servicing\Packages\amd64_tsgenericusbdriver.inf_31bf3856ad364e35_6.1.7601.17514_none_9872c8452ac8f816\TsUsbGD.sys
2011-03-02 15:36:18, Error                 CBS    Exec: Failed to pre-stage package: Package_for_KB976933~31bf3856ad364e35~amd64~cs-CZ~6.1.7601.17514, file: TsUsbGD.sys, source: \\?\C:\Windows\Servicing\Packages\amd64_tsgenericusbdriver.inf_31bf3856ad364e35_6.1.7601.17514_none_9872c8452ac8f816\TsUsbGD.sys

Cause:
======

KB976933 contained corrupted components which caused SP1 to crash on installation.

Although the checksur.log was clean and there might be other errors in the CBS Log you can remember to search for “failed to pre-stage” errors. If these appear then you have the most likely cause!

Resolution:

==========

We used the following command to uninstall the package that was causing the issue:

dism /online /remove-package /packagename:Package_for_KB976932~31bf3856ad364e35~amd64~~6.1.1.17514

Ex.4: 0x8007007f after installing SP1. System is in an inconsistent state. Shell Errors

This example is the case where the installation did go through (SP1 in my case) but after this different components sopped working. CBS Log shows

CBS Log:

2011-04-13 08:24:58, Info                  CBS    SQM: Failed to start upload with file pattern: C:\Windows\servicing\sqm\*_std.sqm, flags: 0x2 [HRESULT = 0x8007007f - ERROR_PROC_NOT_FOUND]

2011-04-13 08:24:58, Info                  CBS    SQM: Failed to start standard sample upload. [HRESULT = 0x8007007f - ERROR_PROC_NOT_FOUND]

2011-04-13 08:24:58, Info                  CBS    SQM: Failed to start upload with file pattern: C:\Windows\servicing\sqm\*_all.sqm, flags: 0x6 [HRESULT = 0x8007007f - ERROR_PROC_NOT_FOUND]

2011-04-13 08:24:58, Info                  CBS    SQM: Failed to start always sample upload. [HRESULT = 0x8007007f - ERROR_PROC_NOT_FOUND]

2011-04-13 08:24:58, Info                  CBS    SQM: Warning: Failed to upload all unsent reports. [HRESULT = 0x8007007f - ERROR_PROC_NOT_FOUND]

Resolution:

==========

The solution here is not that easy.

1. Either uninstall and reinstall SP1 (this might fail)

2. Perform an inplace Upgrade

These are the more uncommon issues that might occur. Below I included several KB’s that all are solution to installation issues or CBS corruption problems: 

Your computer may freeze or restart to a black screen that has a "0xc0000034" error message after you install Service Pack 1 on Windows 7 or Windows 2008 R2
https://support.microsoft.com/kb/975484

Error code 0x800f081f (CBS_E_SOURCE_MISSING)
https://blogs.technet.com/b/joscon/archive/2011/02/14/you-receive-exit-code-0x800f081f-when-attempting-to-install-sp1-for-win7-r2.aspx

Error code 0x800f0a12
https://blogs.technet.com/b/joscon/archive/2011/02/17/windows-7-2008-r2-service-pack-1-fails-with-0x800f0a12.aspx

Error code 0x8004a029
https://blogs.technet.com/b/joscon/archive/2011/02/21/windows-7-service-pack-1-fails-with-error-code-0x8004a029.aspx

Tudor Dimboianu
Platforms Core Team

This was possible back then by using the setting TargetPath in the Unattend.txt.

Starting with Windows Vista / Windows Server 2008, this has changed and you can not change the Windows folder anymore. The hard-coded directory where  the operating system is now installed is "Windows ".

In the WAIK documentation the "TargetPath" entry is now addressed as “deprecated”:

Stefan Chivu

Platforms Core Team

Symptom:

Your Windows 7 Dell Latitude E6510 systems are running in STOP 0x6B, although KB981833 is already installed.

Even if you delete the C:\Windows\system32\CodeIntegrity\bootcat.cache fie, the crashes persist.

Cause:

We found out that this is the result of some specific installation routines of an audio driver update with other system update components (not yet identified which exactly).

If a pack of several patches is installed, including Device IDT_92HDXXX-HD-AUDIO_A17_R278544.exe driver, the bootcat.cache might get corrupted (~11KB is size) and the systems run in STOP 0x6B.

If the pack is installed without the above mentioned driver, and the driver is installed only in the end, the system can be restarted successfully and the bootcat.cache file is updated accordingly.

Hint:

Should the system not boot after deleting the bootcat.cache file, try to copy the bootcat.cache file from an older backup image of the system. This might bring the system up.

If this article has helped, please add a comment.

Oni Sandru
Platforms Core Team

You have a WSUS Server in your environment and you are installing new Windows XP SP3 machines with Microsoft Office 2007.

You notice that after the first update installation cycle finishes, following window pops up:

No installation logs (KBxxxxxx.log) have been created under C:\Windows for these 2 Updates.

The 2 Office Updates are then never reoffered again or reported as missing.

After analyzing the Issue we were able to find out why these 2 Office Updates (KB974561 and KB981715) would get offered, downloaded but then failed when installing.

In the same Detectioncycle are also 2 newer Office Updates that replace the same files as the above mentioned updates, but with newer versions: KB982312 and KB2251419

So in a nutshell, what happends is:

Both the old and the new updates are offered since in the beginning the fresh WinXP Machine has old versions of all these files, both the 2 old and the 2 new updates are downloaded, then the newer 2 updates are installed first, and then (obviously) the installation of the other 2 older update fails since the system already has newer versions than the ones these 2 updates intend to install.

We see that the new updates are being installed before the old ones are installed:

2010-09-23 10:05:07:166  876 c4c Agent *************

2010-09-23 10:05:07:166  876 c4c Agent ** START **  Agent: Installing updates [CallerId = AutomaticUpdates]

2010-09-23 10:05:07:182  876 c4c Agent *********

2010-09-23 10:05:07:182  876 c4c Agent   * Updates to install = 67

2010-09-23 10:05:07:636  876 c4c Agent   *   Title = Security Update for Microsoft Office Word 2007 (KB2251419)

2010-09-23 10:05:07:636  876 c4c Agent   *   UpdateId = {D9F49D05-AC6D-4A2A-8150-D2B4B730DEED}.100

2010-09-23 10:05:07:636  876 c4c Agent   *     Bundles 1 updates:

2010-09-23 10:05:07:636  876 c4c Agent   *       {799B38A3-2BEE-4040-A391-FB3A54B87040}.100

2010-09-23 10:05:07:714  876 c4c Agent   *   Title = Security Update for the 2007 Microsoft Office System (KB982312)

2010-09-23 10:05:07:714  876 c4c Agent   *   UpdateId = {330D3AC6-6D35-4F03-9483-AFBA749884FB}.100

2010-09-23 10:05:07:714  876 c4c Agent   *     Bundles 1 updates:

2010-09-23 10:05:07:714  876 c4c Agent   *       {F4EDE0D0-1DC7-488F-9290-1542FB99B30F}.100

2010-09-23 10:05:07:714  876 c4c Agent   *   Title = Update for Microsoft Office PowerPoint 2007 Help (KB963669)

2010-09-23 10:05:07:714  876 c4c Agent   *   UpdateId = {DDA60FCC-6280-458F-BE92-D400947094CC}.103

2010-09-23 10:05:07:714  876 c4c Agent   *     Bundles 4 updates:

2010-09-23 10:05:07:714  876 c4c Agent   *       {5686E931-30D0-4E6A-A750-3CB333C0DD07}.103

2010-09-23 10:05:07:714  876 c4c Agent   *       {943E39FA-3F8E-4571-A674-14008394F353}.103

2010-09-23 10:05:07:714  876 c4c Agent   *       {EAC21B7D-26F7-4784-8E9F-020FA5A519B3}.103

2010-09-23 10:05:07:714  876 c4c Agent   *       {94AA4564-A1B3-4C86-A9CA-131154CBD847}.103

2010-09-23 10:05:07:714  876 c4c Agent   *   Title = Security Update for Windows XP (KB2115168)

2010-09-23 10:05:07:714  876 c4c Agent   *   UpdateId = {872236CF-BCDD-413C-AA70-F1EF4DE58294}.102

2010-09-23 10:05:07:714  876 c4c Agent   *     Bundles 1 updates:

2010-09-23 10:05:07:714  876 c4c Agent   *       {B5F24232-B8E2-429C-BAFF-0DFF3D1B7722}.102

2010-09-23 10:05:07:714  876 c4c Agent   *   Title = Microsoft .NET Framework 1.1 SP1 Security Update for Windows 2000 and Windows XP (KB979906)

2010-09-23 10:05:07:714  876 c4c Agent   *   UpdateId = {18072BD1-84D7-4CEF-A069-808512A8A76D}.108

2010-09-23 10:05:07:714  876 c4c Agent   *     Bundles 1 updates:

2010-09-23 10:05:07:714  876 c4c Agent   *       {C3486200-3186-4B48-A012-A2DDABE91034}.108

2010-09-23 10:05:07:714  876 c4c Agent   *   Title = Cumulative Security Update for ActiveX Killbits for Windows XP (KB980195)

2010-09-23 10:05:07:714  876 c4c Agent   *   UpdateId = {185315D8-AA13-43C9-AB29-0CCB562471DC}.107

2010-09-23 10:05:07:714  876 c4c Agent   *     Bundles 1 updates:

2010-09-23 10:05:07:714  876 c4c Agent   *       {74D2347B-682E-4F68-B881-1E9FA7B45FFD}.104

2010-09-23 10:05:07:729  876 c4c Agent   *   Title = Update for Microsoft Office Word 2007 (KB974561)

2010-09-23 10:05:07:729  876 c4c Agent   *   UpdateId = {9452E2DD-399E-430C-A7F6-81065B8BD447}.105

2010-09-23 10:05:07:729  876 c4c Agent   *     Bundles 1 updates:

2010-09-23 10:05:07:729  876 c4c Agent   *       {CEBBE511-0B1D-493F-B9B0-32FFABD36B46}.105

2010-09-23 10:05:07:729  876 c4c Agent   *   Title = Update for the 2007 Microsoft Office System (KB981715)

2010-09-23 10:05:07:729  876 c4c Agent   *   UpdateId = {AC4180ED-FA59-470C-B7BE-9C94A878634E}.101

2010-09-23 10:05:07:729  876 c4c Agent   *     Bundles 1 updates:

2010-09-23 10:05:07:729  876 c4c Agent   *       {E21FB04E-716E-45A3-BC0A-47D83182010D}.101

Installation of the 2 old updates then fails with:

KB981715:

-------------

2010-09-14 17:39:51:550  828 bac DnldMgr Preparing update for install, updateId = {E21FB04E-716E-45A3-BC0A-47D83182010D}.101.

2010-09-14 17:39:51:566 2240 e80 Handler :::::::::::::

2010-09-14 17:39:51:566 2240 e80 Handler :: START ::  Handler: MSI Install

2010-09-14 17:39:51:566 2240 e80 Handler :::::::::

2010-09-14 17:39:51:566 2240 e80 Handler   : Updates to install = 1

2010-09-14 17:39:51:597 2240 e80 Handler Extracting MSP file stored in CAB mso.cab

2010-09-14 17:39:52:097 2240 e80 Handler MSP update {00000000-0000-0000-0000-000000000000}.0 using full-file patch

2010-09-14 17:39:52:097 2240 e80 Handler   : Batch installing 1 updates

2010-09-14 17:39:54:581 2240 e80 Handler   : WARNING: Operation failed at update 0, Exit code = 0x80240017

2010-09-14 17:39:54:581 2240 e80 Handler :::::::::

2010-09-14 17:39:54:581 2240 e80 Handler ::  END  ::  Handler: MSI Install

2010-09-14 17:39:54:581  828 264 AU >>##  RESUMED  ## AU: Installing update [UpdateId = {AC4180ED-FA59-470C-B7BE-9C94A878634E}]

2010-09-14 17:39:54:581 2240 e80 Handler :::::::::::::

2010-09-14 17:39:54:581  828 264 AU   # WARNING: Install failed, error = 0x80240017 / 0x00000000

KB974561:

--------------

2010-09-14 17:38:57:034  828 bac DnldMgr Preparing update for install, updateId = {CEBBE511-0B1D-493F-B9B0-32FFABD36B46}.105.

2010-09-14 17:38:57:066 2240 e80 Handler :::::::::::::

2010-09-14 17:38:57:066 2240 e80 Handler :: START ::  Handler: MSI Install

2010-09-14 17:38:57:066 2240 e80 Handler :::::::::

2010-09-14 17:38:57:066 2240 e80 Handler   : Updates to install = 1

2010-09-14 17:38:57:097 2240 e80 Handler Extracting MSP file stored in CAB word.cab

2010-09-14 17:38:57:738 2240 e80 Handler MSP update {00000000-0000-0000-0000-000000000000}.0 using full-file patch

2010-09-14 17:38:57:738 2240 e80 Handler   : Batch installing 1 updates

2010-09-14 17:38:59:706 2240 e80 Handler   : WARNING: Operation failed at update 0, Exit code = 0x80240017

2010-09-14 17:38:59:706 2240 e80 Handler :::::::::

2010-09-14 17:38:59:706  828 264 AU >>##  RESUMED  ## AU: Installing update [UpdateId = {9452E2DD-399E-430C-A7F6-81065B8BD447}]

2010-09-14 17:38:59:722  828 264 AU   # WARNING: Install failed, error = 0x80240017 / 0x00000000

After discussing the issue with our product group we were informed that they didn’t supersede these Non-security Updates (KB974561 and KB981715) with the next security updates (KB982312 and KB2251419), so both updates will be shown as applicable on a machine with older files if both pairs of updates are approved on the WSUS Server.

Workaround: On the WSUS Server decline KB974561 and KB981715

Solution: We’re currently in progress of resolving KB981715 issue in the November release. KB974561’s fix is scheduled to be released in February 2011.

Stefan Chivu

Platforms Core Team

1. Settings on the host machine
(Windows Server 2008 SP2 or Windows 2008 Server R2)

- The latest hardware drivers should be installed on the host machine (Chip set, storage, network, etc.). Please check the website of the vendor for the latest updates.
- Check for updates for the hypervisor component and update if available
- Install the latest storage driver
- Install the chip set drivers
- If possible set up the storage on which the virtual machine hard disks are located as a stripe set (Raid 0). Windows should be installed on a disk which is separated from those disks on which the virtual machine disks are located
- If virtual machines are running there should be at least 1 GB Memory of available physical memory left for the operating system.

Here is an example (see picture 1)

On this machine there is 8 GB of physical RAM installed. At the moment the screenshot was taken 1.02 GB of physical RAM were allocated to various processes. This is the amount of memory consumed by Windows 2008 R2 when there are no other processes running apart from the OS processes. As more and more virtual machines are started up on a host machine the more physical memory is consumed. When an amount of approx. 7 GB is consumed by processes one will see that the performance of the host AND guest machines will become sluggish as the operating system starts to make more and more use of the page file which will drive down the performance of all processes. It might get to the point where the guest machines do not run properly anymore.

If the amount of available memory drops below 1 GB one should turn off all virtual machines which are not needed until the amount of available memory rise above 1 GB.

 
Picture1: Memory consumption on Windows 2008 R2 OS

2. Settings on the virtual machines (guest machines)

For all Guest machines:

- Turn off the screensaver!

2.1.) Settings for Windows 2003 Server:

- Tools –> Folder Option –> View –> Advances Settings –> Uncheck the "Automatically search for network folders and printers” option

- Display properties –> Settings –> Advanced –> Troubleshoot –> Hardware acceleration –> Set to Full and check “Enable Write combining”

- Control Panel –> Power Options –> Power Schemes –> Set Power scheme to "Presentation"
- Turn off monitor –> Set to "Never"



- Start –> Settings –> Control Panel –> System –> Advanced System Settings –> Advanced tab –> Performance -> Visual effects –> select and check "Adjust for best performance"

- Start –> Settings –> Control Panel –> System –> Advanced System Settings –> Advanced tab –> Performance –> Processor Scheduling –> Adjust for best performance of  "Background services" (see image below)

2.2.) Windows Server 2008 / Windows Server 2008 R2

- Turn off the screensaver 
- Control Panel –> Power Settings –> Set power plan to "High Performance"
- Start –> Settings –> Control Panel –> System –> Advanced System Settings –> Advanced tab –> Performance -> Visual effects –> select and check "Adjust for best performance"
- Start –> Settings –> Control Panel –> System –> Advanced System Settings –> Advanced tab –> Performance –> Processor Scheduling –> Adjust for best performance of  "Background services" (same as image above)

2.3.) Windows XP

- Turn off the screensaver
- Tools –> Folder Option –> View –> Advances Settings –> Uncheck the "Automatically search for network folders and printers” option
- Display properties –> Settings –> Advanced –> Troubleshoot –> Hardware acceleration –> Set to Full and check “Enable Write combining”
- Control Panel –> Power Options –> Power Schemes –> Set Power scheme to "Presentation"
- Turn off monitor –> Set to "Never"

- Disable the balloon tips:

Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Name: EnableBalloonTips
Type: REG_DWORD –> set the value to 0

2.4.) Recommendation for all Hyper-V guest machines:

Ensure that the latest Hyper-V integration services are being installed on the guest machines.

Open a Virtual machine connection to a guest machine. Go to the menu of the Virtual Machine connection window and select: Action –> Insert integration services setup disk. If the integration services on the guest machine are outdated you will get this pop-up.

Run the installation and reboot the guest machine in order to finalize the installation of the updated integration services. 

Windows Server services packs and updates do include upgrades to the integration services. These upgraded integration services result in substantial performance improvements of the guest machines. When older guest machines/virtual disks are integrated into a Windows 2008 R2 Hypervisor Host machine the update of the integration services will result in a significant performance improvement. The hyper-V integration services in Windows Server 2008 R2 have the version number 6.1.7600.16385. This can be checked in “Add or remove programs” in the control panel.

*** The following procedure will show no-longer-connected devices in Device Manager for Server 2008 ***

- Open a command window with elevated privileges (Start –> Right-click "Command Prompt", select "Run as Administrator")
- In the command window, execute the following command:

SET DEVMGR_SHOW_NONPRESENT_DEVICES=1

Start –> type DEVMGMT.MSC
Go to View –> Show hidden devices
Under Network Adapters uninstall any network cards that are no longer used.

Last but not least, you need to correctly configure your antivirus software on the host machine to exclude the Hyper-V processes as well as VHD / ISO / Configuration files and folders from real-time scan. These are the processes and file types you need to add to the exclusion list:

Inspectvhddialog.exe
Vmconnect.exe
Vmms.exe
Vmwp.exe

File types : *.iso, *.vhd, *.avhd

Thanks and i hope you found this article useful!

Florian Alin Noaghea
- Support engineer / Enterprise Messaging (Exchange) team

Resolution

First you run the Microsoft Update Readiness Tool located here: https://support.microsoft.com/kb/947821
After the scan has completed check: C:\Windows\logs\CBS\Checksur.log. You should see the following errors:

Checking Package Manifests and Catalogs
(f) CBS MUM Corrupt 0x00000000 servicing\Packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum  Expected file name Package_for_KB978601_server~31bf3856ad364e35~amd64~~6.0.1.0.mum does not match the actual file name
(f) CBS MUM Corrupt 0x00000000 servicing\Packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.mum  Expected file name Package_for_KB979309_server~31bf3856ad364e35~amd64~~6.0.1.0.mum does not match the actual file name

Or 

(f) CBS MUM Corrupt 0x800B0100 servicing\Packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum servicing\Packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.cat Package manifest cannot be validated by the corresponding catalog
(f) CBS MUM Corrupt 0x800B0100 servicing\Packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.mum servicing\Packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.cat Package manifest cannot be validated by the corresponding catalog

Or

(f) CBS MUM Missing 0x00000002 servicing\packages\Package_114_for_KB955839~31bf3856ad364e35~amd64~~6.0.1.0.mum
(f) CBS MUM Missing 0x00000002 servicing\packages\Package_83_for_KB955839~31bf3856ad364e35~amd64~~6.0.1.0.mum

Further down you will see:

Unavailable repair files:
servicing\packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum
servicing\packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.mum
servicing\packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.cat
servicing\packages\Package_for_KB979309~31bf3856ad364e35~amd64~~6.0.1.0.cat

These files need to be copied into: %systemroot\Windows\Servicing\Packages

1. You first need to gain control over that folder. In order to do this use the following commands:

This makes the current logged on user (needs to have Administrative privileges) owner of that folder:
takeown /F c:\Windows\Servicing\Packages /D y /R

Then assign full control using:
cacls c:\Windows\Servicing\Packages /E /T /C /G "UserName":F

This will grant you full control over the directory.

Optionally you can download this ZIP. Inside you have 2 REG Files. If you install TakeOwnership.reg you will have a handy Take Ownership entry in the right click menu every time you use it on a Folder.

2. Now you need to gather the missing or corrupted files from the checksur log:

- Download the KB Files for the missing files:
servicing\packages\Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum

- Unpack them using the following command:
Expand -F:* UpdateKBXXXX.msu x:\DestinationDirectory

After you expand you will see a UpdateKBXXXX.cab File. Expand it as well:
Expand -F:* UpdateKBXXXX.CAB x:\DestinationDirectoryCAB

Inside of this cab you will need to grab 2 files: update.mum and update.cat

3. Rename the gathered update.mum and update.cab files exactly as they are specified in the checksur.log:
Ex.: update.mum for KB978601 will be:

Package_for_KB978601~31bf3856ad364e35~amd64~~6.0.1.0.mum

Do the same for all the other missing/corrupt files and place them into the directory specified in checksur.log (/servicing/packages)
After these steps the problem should be fixed. No reboot required.

If the Server Manager is not working even after doing these steps, run the Update Readiness Tool again and double-check the steps described above.

This workaround will be provided “as-is”, with no support whatsoever or liability from Microsoft. For use in a productive environment, we recommend you to install the x64 version of SQL Server especially when running on a x64 OS.

First let’s take a look at the two scenarios:

Windows SBS 2008 x64 with SQL Server 2005 SP2 x86 installed by default

- You can see that by default, there are two SQL Server processes running, one 64bit the other 32bit.

- The x64 Process is running from this directory:

- The x86 process is running from here:

- You can see here the two Services associated with the two SQL Processes:

The x86 service is MSSQL$SBSMONITORING and the x64 service is MSSQL$MICROSOFT##SSEE

- The SQL Performance counters are stored in a DLL called sqlctr90.dll.
Here you see that on a SBS 2008 server, there are two DLLs installed by default: one 32bit in c:\windows\syswow64 and 64bit in c:\windows\system32

Windows Server 2008 SP2 x64 with SQL Server 2005 SP3 x86

- You see that there is only one 32bit SQL Server process running (no 64bit process running like on SBS 2008)

- We see here the file location of the running process:

- We see only one SQL Service running, named after the test instance I created on the virtual machine (TEST32)

- If we search now for the sqlctr90.dll, we only see one file: the 32bit version in c:\windows\syswow64

The workaround is to simply copy the 64bit version of “sqlctr90.dll” from another machine running a x64 SQL instance, to the “c:\windows\system32” directory of the Server 2008 x64 OS machine running SQL Server 2005 x86. We recommend using the DLL from similar SP levels of SQL Server (SP3 since SP2 is actually not supported any more!)

Once you copy the DLL, you can proceed with creating a custom DCS with SQL Server 32bit counters:

1. Choose a name for the DCS and select “create manually (advanced)”

2. Choose “Performance counter” and click “Next”

3. Choose any SQL related counters (here you see General Statistics for example):

4. Here you select the location, wrap up the DCS creation and start the collection.
After a chosen amount of time, you can stop the collection.

5. To view the counters, in Perfmon you select and open the created BLG file of the custom DCS

6. You now select which objects you would like to see displayed:

7. As you can see, sample collection works fine.

As always, i hope you find this post useful and feel free to rate it or drop some comments, we love to hear back from you!

Bogdan Palos
- Technical Lead / Enterprise Platforms Support (Core)