Windows Updates are not getting installed with error 0x800f0922

When you upgrade a Windows Server 2008 SP2 ->Windows Server 2008R2 ->Windows Server 2012 R2 -> Windows Server 2016, Windows Update may fail with error 0x800f0922 – “Processing advanced installers and generic commands failed.”

Setup logs show:

In the CBS logs you would see the failure occurs when the Events installer is in action:

2021-02-05 01:21:35, Info CSI 000005d3 Begin executing advanced installer phase 31 index 0 (sequence 0)
Old component: [l:0]”
New component: [l:0]”
Install mode: delta
Smart installer: TRUE
Installer ID: {3bb9fd2b-351e-4b9c-b1fc-ed0758805998}
Installer name: ‘Events’
2021-02-05 01:21:35, Info CSI 000005d4 Registry root HKLM\Software: HKLM\Software
2021-02-05 01:21:35, Info CSI 000005d5 Registry root HKLM\System: HKLM\System
2021-02-05 01:21:35, Info CBS Progress: UI message updated. Operation type: Update. Stage: 1 out of 1. Percent progress: 75.
2021-02-05 01:21:43, Error CSI 000005d6 (F) Error HRESULT_FROM_WIN32(234) from InstrumentationManifestAssert at onecore\admin\wmi\events\util\reghelp.cpp line 27, online=TRUE
[gle=0x80004005]
2021-02-05 01:21:43, Error CSI 000005d7 (F) Error HRESULT_FROM_WIN32(234) in eventsXml:
This channel contains analytic events from the SEM.
2021-02-05 01:21:43, Info CSI 000005da Performing 1 operations as follows:
(0) LockComponentPath: flags: 0 comp: {l:16 b:8a9c321e44fbd6018a040000e8051806} pathid: {l:16 b:8a9c321e44fbd6018b040000e8051806} path: [l:115]’\SystemRoot\WinSxS\x86_microsoft.windows.s..ation.badcomponents_31bf3856ad364e35_10.0.14393.0_none_09e78f632173f4c5′ pid: 5e8 starttime: 132569508490660250
2021-02-05 01:21:43, Error [0x01802b] CSI 000005db (F) Failed execution of queue item Installer: Events ({3bb9fd2b-351e-4b9c-b1fc-ed0758805998}) with HRESULT HRESULT_FROM_WIN32(234). Failure will not be ignored: A rollback will be initiated after all the operations in the installer queue are completed; installer is reliable[gle=0x80004005]

This happens when the installer reads unexpected value of 01400000 for the below registry keys. This value persists from Windows Server 2008 and does not change during in-place upgrade:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application: MaxSize DWORD value 01400000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System: MaxSize DWORD value 01400000

Resolution:

Please open regedit then change the MaxSize value from 01400000 to ed0000 in below keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System

Reboot the system then install update.

Leave a Reply

%d bloggers like this: