Windows MSU Patch Installation Fails at 94% Post-Restart with “Undoing Changes” – No Errors in CBS Logs (Tried DISM Extraction & Step-by-Step Install)

by

Summary

The issue at hand involves the failure of a Windows MSU patch installation at 94% during the post-restart phase, with the system displaying “Undoing Changes” and no apparent errors in the CBS logs. Key symptoms include:

  • Failure to install MSU patches using WUSA on Windows 10
  • Installation reaches 94% after restart and then fails
  • No errors in CBS.log, WindowsUpdate.log, or SetupAPI.dev.log
  • System health checks pass without issues
  • Manual installation via PowerShell script also fails

Root Cause

The root cause of this issue is likely related to:

  • Corrupted system files or registry issues that are not detected by system health checks
  • Incompatibility between the patch and the system’s current state
  • Servicing Stack or WinSxS issues that are not immediately apparent
  • Missing dependencies or prerequisites for the patch

Why This Happens in Real Systems

This issue can occur in real systems due to:

  • Inconsistent system updates, leading to a mismatch between the system’s current state and the patch’s requirements
  • Third-party software interference, even if no third-party AV is installed
  • Disk space issues, even if there is plenty of free space on the C: drive
  • Corrupted or incomplete patch downloads

Real-World Impact

The real-world impact of this issue includes:

  • Security vulnerabilities if the patch is not installed
  • System instability if the patch is not applied correctly
  • Increased support requests and downtime due to repeated installation attempts
  • Potential data loss if the system becomes unstable or corrupted

Example or Code

# Example PowerShell script to extract and install MSU patch
$msuPath = "path\to\msu\file.msu"
$extractPath = "path\to\extract\folder"

# Extract MSU file
expand.exe -F:* $msuPath $extractPath

# Identify SSU and main CABs
$ssuCab = Get-ChildItem -Path $extractPath -Filter *.cab | Where-Object {$_.Name -like "SSU*"}
$mainCab = Get-ChildItem -Path $extractPath -Filter *.cab | Where-Object {$_.Name -notlike "SSU*"}

# Check if SSU and main CABs are already installed
$ssuInstalled = Get-Hotfix | Where-Object {$_.HotFixID -eq $ssuCab.Name}
$mainInstalled = Get-Hotfix | Where-Object {$_.HotFixID -eq $mainCab.Name}

# Install SSU and main CABs
if (!$ssuInstalled) {
    dism.exe /Add-Package /PackagePath:$ssuCab.FullName
}
if (!$mainInstalled) {
    dism.exe /Add-Package /PackagePath:$mainCab.FullName
}

How Senior Engineers Fix It

Senior engineers fix this issue by:

  • Carefully analyzing system logs and CBS logs to identify potential issues
  • Running system health checks to detect any corrupted system files or registry issues
  • Manually installing patches using a PowerShell script or DISM
  • Verifying patch dependencies and prerequisites before installation
  • Using troubleshooting tools such as Process Monitor or DebugView to monitor system activity during installation

Why Juniors Miss It

Juniors may miss this issue due to:

  • Lack of experience with Windows patching and troubleshooting
  • Insufficient knowledge of system logs and CBS logs
  • Inadequate understanding of system health checks and troubleshooting tools
  • Failure to verify patch dependencies and prerequisites before installation
  • Rushing through the troubleshooting process without carefully analyzing system activity and logs