Cant install defender feature role on server 2016

NP 441 Reputation points
2024-05-08T04:57:47.54+00:00

trying to install the Windows Defender Feature and getting this. The CBS log file isnt very helpful that i can see. the dism /online /cleanup-image /restorehealth or sfc /scannow find anything to repair. Is there anything else i can check or do?

User's image

2024-05-08 14:49:10, Info                  CBS    FLOW: Enter Installation Stage: Closure Analysis, Current Operation Stage: Installing
2024-05-08 14:49:10, Info                  CSI    00000043 Changelist winner missing files - Windows-Defender-Server-UI, version 10.0.14393.0, arch Host= amd64 Guest= x86, nonSxS, pkt {l:8 b:31bf3856ad364e35}
[l:12]'shellext.dll'
2024-05-08 14:49:10, Error                 CSI    00000044@2024/5/8:04:49:10.744 (F) onecore\base\wcp\componentstore\csd_winners.cpp(1288): Error STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE originated in function OriginateFilesMissingError expression: (null)
[gle=0x80004005]
2024-05-08 14:49:10, Info                  CBS    Added C:\Windows\Logs\CBS\CBS.log to WER report.
2024-05-08 14:49:10, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240508035014.log to WER report.
2024-05-08 14:49:10, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240508015507.log to WER report.
2024-05-08 14:49:10, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240506025949.log to WER report.
2024-05-08 14:49:10, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240506022040.log to WER report.
2024-05-08 14:49:10, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240505232203.cab to WER report.
2024-05-08 14:49:10, Info                  CBS    Not able to add pending.xml to Windows Error Report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2024-05-08 14:49:10, Info                  CBS    Not able to add pending.xml.bad to Windows Error Report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2024-05-08 14:49:10, Info                  CBS    Not able to add poqexec.log to Windows Error Report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2024-05-08 14:49:10, Info                  CBS    Not able to add SCM.EVM to Windows Error Report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2024-05-08 14:49:10, Error                 CSI    00000045 (F) STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE #7031176# from CCSDirectTransaction::PerformChangeAnalysis(...)[gle=0xd0150024]
2024-05-08 14:49:10, Error                 CSI    00000046 (F) STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE #7031175# from CCSDirectTransaction::PrepareForCommit(...)[gle=0xd0150024]
2024-05-08 14:49:10, Error                 CSI    00000047 (F) STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE #7031174# from CCSDirectTransaction::ExamineTransaction(...)[gle=0xd0150024]
2024-05-08 14:49:10, Error                 CSI    00000048 (F) STATUS_SXS_TRANSACTION_CLOSURE_INCOMPLETE #7031173# from CCSDirectTransaction_IRtlTransaction::ExamineTransaction(...)[gle=0xd0150024]
2024-05-08 14:49:10, Error                 CSI    00000049 (F) HRESULT_FROM_WIN32(ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE) #7027683# from Windows::COM::CPendingTransaction::IStorePendingTransaction_Analyze(...)[gle=0x8007371b]
2024-05-08 14:49:10, Error                 CSI    0000004a (F) HRESULT_FROM_WIN32(ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE) #7024108# from Windows::ServicingAPI::CCSITransaction::ICSITransaction_Commit(Flags = 102, pSink = NULL, disp = 0, coldpatching = FALSE)[gle=0x8007371b]
2024-05-08 14:49:10, Error                 CSI    0000004b (F) HRESULT_FROM_WIN32(ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE) #7024107# 139532 us from Windows::ServicingAPI::CCSITransaction_ICSITransaction::Commit(flags = 0x00000066, pSink = NULL, disp = 0)
[gle=0x8007371b]
2024-05-08 14:49:10, Info                  CBS    Setting ExecuteState key to: ExecuteStateNone
2024-05-08 14:49:10, Info                  CBS    Setting RollbackFailed flag to 0
2024-05-08 14:49:10, Info                  CBS    Clearing HangDetect value
2024-05-08 14:49:10, Info                  CBS    Saved last global progress. Current: 0, Limit: 1, ExecuteState: ExecuteStateNone
2024-05-08 14:49:10, Error                 CBS    Exec: Failed to commit CSI transaction to execute changes. [HRESULT = 0x8007371b - ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE]
2024-05-08 14:49:10, Info                  CBS    Perf: InstallUninstallChain complete.
2024-05-08 14:49:10, Info                  CSI    0000004c@2024/5/8:04:49:10.771 CSI Transaction @0x19ff33a92f0 destroyed
2024-05-08 14:49:10, Info                  CBS    Failed to execute execution chain. [HRESULT = 0x8007371b - ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE]
2024-05-08 14:49:10, Error                 CBS    Failed to process single phase execution. [HRESULT = 0x8007371b - ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE]
2024-05-08 14:49:10, Info                  CBS    WER: Generating failure report for package: Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~10.0.14393.0, status: 0x8007371b, failure source: Execute, start state: Installed, target state: Installed, client id: DISM Package Manager Provider
2024-05-08 14:49:10, Info                  CBS    Not able to query DisableWerReporting flag.  Assuming not set... [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2024-05-08 14:49:10, Info                  CBS    Added C:\Windows\Logs\CBS\CBS.log to WER report.
2024-05-08 14:49:10, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240508035014.log to WER report.
2024-05-08 14:49:10, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240508015507.log to WER report.
2024-05-08 14:49:10, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240506025949.log to WER report.
2024-05-08 14:49:10, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240506022040.log to WER report.
2024-05-08 14:49:10, Info                  CBS    Added C:\Windows\Logs\CBS\CbsPersist_20240505232203.cab to WER report.
2024-05-08 14:49:10, Info                  CBS    Not able to add %windir%\winsxs\poqexec.log to WER report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2024-05-08 14:49:10, Info                  CBS    Not able to add %windir%\winsxs\pending.xml to WER report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2024-05-08 14:49:10, Info                  CBS    Not able to add %windir%\winsxs\pending.xml.bad to WER report. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2024-05-08 14:49:10, Info                  CBS    Reboot mark cleared
2024-05-08 14:49:10, Info                  CBS    Winlogon: Simplifying Winlogon CreateSession notifications
2024-05-08 14:49:10, Info                  CBS    Winlogon: Deregistering for CreateSession notifications
2024-05-08 14:49:10, Info                  CBS    FinalCommitPackagesState: Started persisting state of packages
2024-05-08 14:49:10, Info                  CBS    TI: CBS has queried the current reboot required state: 0
2024-05-08 14:49:10, Info                  CBS    Reporting selectable update change for package: Windows-Defender-Server-Core-Package~31bf3856ad364e35~amd64~~10.0.14393.0, update: Windows-Defender-Features, start: Staged, applicable: Installed, target: Installed, client id: DISM Package Manager Provider, initiated offline: False, execution sequence: 393, first merged sequence: 393, download source: 0, download time (secs): 4294967295, download status: 0x0 (S_OK),reboot required: False, overall result:0x8007371b (ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE)
2024-05-08 14:49:10, Info                  CBS    SQM: Update change report datapoints not populated because SQM is not initialized or not running online.
2024-05-08 14:49:10, Info                  CBS    TI: CBS has queried the current reboot required state: 0
2024-05-08 14:49:10, Info                  CBS    Reporting selectable update change for package: Windows-Defender-Server-Core-Package~31bf3856ad364e35~amd64~~10.0.14393.0, update: Windows-Defender, start: Staged, applicable: Installed, target: Installed, client id: DISM Package Manager Provider, initiated offline: False, execution sequence: 393, first merged sequence: 393, download source: 0, download time (secs): 4294967295, download status: 0x0 (S_OK),reboot required: False, overall result:0x8007371b (ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE)
2024-05-08 14:49:10, Info                  CBS    SQM: Update change report datapoints not populated because SQM is not initialized or not running online.
2024-05-08 14:49:10, Info                  CBS    Reporting package change for package: Windows-Defender-Server-Core-Package~31bf3856ad364e35~amd64~~10.0.14393.0, current: Installed, pending: Default, start: Installed, applicable: Installed, target: Installed, limit: Installed, hotpatch status: StillGoing, status: 0x0, failure source: Execute, reboot required: False, client id: DISM Package Manager Provider, initiated offline: False, execution sequence: 393, first merged sequence: 393, reboot reason: REBOOT_NOT_REQUIRED, RM App session: -1, RM App name: N/A, FileName in use: N/A, release type: Feature Pack, release quality: final, OC operation: True, download source: 0, download time (secs): 4294967295, download status: 0x0 (S_OK), Express download: False, Download Size: 0
2024-05-08 14:49:10, Info                  CBS    SQM: Package change report datapoints not populated because SQM is not initialized or not running online.
2024-05-08 14:49:10, Info                  CBS    Reporting package change completion for package: Windows-Defender-Server-Core-Package~31bf3856ad364e35~amd64~~10.0.14393.0, current: Installed, original: Installed, target: Installed, status: 0x8007371b, failure source: Execute, failure details: "(null)", client id: DISM Package Manager Provider, initiated offline: False, execution sequence: 393, first merged sequence: 393, pending decision: InteractiveInstallFailed, primitive execution context: Interactive Flight: False
2024-05-08 14:49:10, Info                  CBS    The store corruption status report is incomplete. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2024-05-08 14:49:10, Info                  CBS    Execute time performance datapoint is invalid. [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
2024-05-08 14:49:10, Info                  CBS    SQM: Package change report datapoints not populated because SQM is not initialized or not running online.
2024-05-08 14:49:10, Info                  CBS    TI: CBS has queried the current reboot required state: 0
2024-05-08 14:49:10, Info                  CBS    Reporting selectable update change for package: Windows-Defender-Server-GuiInstalled-Package~31bf3856ad364e35~amd64~~10.0.14393.0, update: Windows-Defender-Gui, start: Staged, applicable: Installed, target: Installed, client id: DISM Package Manager Provider, initiated offline: False, execution sequence: 393, first merged sequence: 393, download source: 0, download time (secs): 4294967295, download status: 0x0 (S_OK),reboot required: False, overall result:0x8007371b (ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE)
2024-05-08 14:49:10, Info                  CBS    SQM: Update change report datapoints not populated because SQM is not initialized or not running online.
2024-05-08 14:49:10, Info                  CBS    Reporting package change for package: Windows-Defender-Server-GuiInstalled-Package~31bf3856ad364e35~amd64~~10.0.14393.0, current: Installed, pending: Default, start: Installed, applicable: Installed, target: Installed, limit: Installed, hotpatch status: StillGoing, status: 0x0, failure source: Execute, reboot required: False, client id: DISM Package Manager Provider, initiated offline: False, execution sequence: 393, first merged sequence: 393, reboot reason: REBOOT_NOT_REQUIRED, RM App session: -1, RM App name: N/A, FileName in use: N/A, release type: Feature Pack, release quality: final, OC operation: True, download source: 0, download time (secs): 4294967295, download status: 0x0 (S_OK), Express download: False, Download Size: 0
2024-05-08 14:49:10, Info                  CBS    SQM: Package change report datapoints not populated because SQM is not initialized or not running online.
2024-05-08 14:49:10, Info                  CBS    Reporting package change completion for package: Windows-Defender-Server-GuiInstalled-Package~31bf3856ad364e35~amd64~~10.0.14393.0, current: Installed, original: Installed, target: Installed, status: 0x8007371b, failure source: Execute, failure details: "(null)", client id: DISM Package Manager Provider, initiated offline: False, execution sequence: 393, first merged sequence: 393, pending decision: InteractiveInstallFailed, primitive execution context: Interactive Flight: False
2024-05-08 14:49:10, Info                  CBS    The store corruption status report is incomplete. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2024-05-08 14:49:10, Info                  CBS    Execute time performance datapoint is invalid. [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
2024-05-08 14:49:10, Info                  CBS    SQM: Package change report datapoints not populated because SQM is not initialized or not running online.
2024-05-08 14:49:10, Info                  CBS    FinalCommitPackagesState: Completed persisting state of packages
2024-05-08 14:49:10, Info                  CBS    Enabling LKG boot option
2024-05-08 14:49:10, Info                  CBS    Exec: Processing complete.  Session: 31105278_3859897459, Package: Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~10.0.14393.0 [HRESULT = 0x8007371b - ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE]
2024-05-08 14:49:11, Error                 CBS    Failed to perform operation.  [HRESULT = 0x8007371b - ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE]
2024-05-08 14:49:11, Info                  CBS    Session: 31105278_3859897459 finalized. Reboot required: no [HRESULT = 0x8007371b - ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE]
2024-05-08 14:49:11, Info                  CBS    Failed to FinalizeEx using worker session [HRESULT = 0x8007371b]
2024-05-08 14:49:11, Info                  CBS    Session: 31105283_300488346 initialized by client DISM Package Manager Provider, external staging directory: (null), external registry directory: (null
Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,429 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Hania Lian 10,931 Reputation points Microsoft Vendor
    2024-05-09T06:55:41.7333333+00:00

    Hello,

    You could try to check the system event log related error message.

    Before this, I suggest that check for update firstly, if any security update could be found, install them then install Windows defender feature again.

    If still could not work, I suggest that perform an-in place upgrade to repair system files.

    How to do an in-place upgrade - Windows Server | Microsoft Learn

    Best Regards,

    Hania Lian

    0 comments No comments