Windows 10 22H2, KB5016616, KB5017308, KB5017380, KB5018410, KB5019959, KB5021233 hang on reboot after install

Anonymous

I'm trying to update to the latest Win10 update released on 8/8/22. Ever since that update was downloaded the machine hangs

on the required reboot after the install. I have disabled updates until I can find a fix. I've tried to download the update and install

manually but get the same results. Other updates, such as .NET, download and installed fine. Once the machine hangs it has to be rebooted

2 times to get to the automatic roll back. At least that works for now. I've run the Update trouble shooter and it doesn't fix anything.

Windows Update and BITS services are both set to automatic.

There is an error in the event log but I think its from the install abort from a forced shutdown.

Installation Failure: Windows failed to install the following update with error 0x800F0845: 2022-08 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5016616).

Update 10/5/22: KB-5017308, KB5017380, KB5018410 also FAIL in exactly the same manner as KB-5016616. Spinning dots on the reboot and the need to do a dual boot auto recovery. Title has been updated.

Any help would be appreciated.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

For me, the following solved the Problem:

Delete the Value data (all bytes) of

HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\NL$KM\CurrVal(Default)

and

HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\NL$KM\OldVal(Default)

One reboot and CurrVal(Default) should be filled again.

If you are not domain-joined, i would not expect any problems.

I'm not giving directions on how to access and delete the value data because i want skilled people who know what they are doing to test my solution.

0 comments

319 additional answers

Anonymous

2022-09-18T19:45:15+00:00
Still fails but more info. After the above cleaning I did a check for updates and sure enough KB2267602 (defender signature update) shows up. I'm convinced that this KB is used to send all defender signature updates because its versioned. Another look at the .etl logs shows something interesting. Update keeps trying to install a version of KB2267602 that has signature version 1.375.572.0; each time the same version. I already have version 1.375.584.0 from 9/18/22 installed. Im concluding that KB5016616 and KB5017308 have an old version of the defender signature file. I don't know if that's the problem but it keeps trying to install it. Here's the logs:
```
Deserialized installable update Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.375.572.0), UpdateID = {EA3EC620-E14D-4AF0-B697-30DD5595DFDA.200}, CallbackInfo cookie length = 0" 
```
Info="Downloading from http://au.download.windowsupdate.com/c/msdownload/update/software/defu/2022/09/am_delta_patch_1.375.529.0_274a4c8e16466d2b3ec7f036aeab991c8ed312d0.exe to C:\WINDOWS\SoftwareDistribution\Download\aefff227346bec0a02d732bcdac0dda9\274a4c8e16466d2b3ec7f036aeab991c8ed312d0 (full file)"

To see what version signature you have go to the Security Center and check for updates. Its on the update check page.
Was this answer helpful?

0 comments No comments
Anonymous

2022-09-18T14:57:36+00:00

So clearing the defender definitions did not work. KB5017308 still tries installing the defender update 3 times before the 1st reboot and 6 times after the recover reboot. I have 3 log files, one after running the install before the reboot, an empty one which I assume is the aborted attempt and one after the repair. And KB2267602 is not available from the MS Catalog site to try a manual install.

It would be good to know if anyone else is seeing this.
Was this answer helpful?

0 comments No comments
Anonymous

2022-09-18T14:16:19+00:00
"When you say you have seen the Defender message dozens of times - I assume you mean, separated, once every reboot, not dozens in succession"

@OldAJAS, no in succession. One after another. If you look at the log snippet I posted above, it was the end of the log file after recovery. There are maybe 6 more before I aborted the install and clean up. 2 other log files have more of the same in succession and I'm assuming those logs are from the first reboot attempt. I don't know how to post the logs so y'all can take a look at them.

Can you look at your update logs with PerfView to see if you have the same scenario? Open the .etl file the logs are under Events | WuTraceLogging.

Nothing of significance is in the Setup system logs.

I'm going out on a limb here but that update is from 2021 which means that Windows Defender has not updated since then? Others have had problems with this defender update and have cleared out the definitions to cure.

https://www.elevenforum.com/t/security-intelligence-update-for-microsoft-defender-antivirus-kb2267602-version-1-361-1370-0-install-error-0x80070643.5673/

https://learn.microsoft.com/en-us/answers/questions/343287/windows-10-updates-from-39ball-of-confusion39-to-f.html

Must be run as administrator:
```
cd %ProgramFiles%\Windows Defender

MpCmdRun.exe -removedefinitions -dynamicsignatures

MpCmdRun.exe -SignatureUpdate
```
Was this answer helpful?

0 comments No comments
Anonymous

2022-09-18T01:25:54+00:00

Hi glezbsg. Good one - you may have spotted something here.

FYI, you can see the logs (System log in this case) here:

Control panel all items/Administrative Tools/Event Viewer/Windows logs/System

When you say you have seen the Defender message dozens of times - I assume you mean, separated, once every reboot, not dozens in succession? And in that sense, Yes.. So KB 2267602 (Defender) is successfully installed - then freezes the system! But it then gets more interesting - clearly this is the precursor to the dots freeze. See the sequence below, with a pause in time before the hard restart shown.

(NB, the time sequence here is bottom up, as per the log. "=" between each message at this point.)

=

Then off & away on the reboot processes

=

23:11:31 The process C:\Windows\System32\RuntimeBroker.exe (AJAS8) has initiated the restart of computer AJAS8 on behalf of user AJAS8\andy for the following reason: Other (Unplanned)

Reason Code: 0x0

=

23:10:35 The start type of the Windows Modules Installer service was changed from demand start to auto start.

=

23:08:28 The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}

=

22:49:49 Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.373.1190.0) Reason Code: 0x0

=

Prior to this, long sequence of messages in rapid succession, as normal, but ending with 6 seconds to install KB2267602

=

SO - does that mean that Defender does not like 5016616 etc?

Next - so can Defender be made inactive? No time now - 02:25 here in UK

Final note to check more: KB2267602 is showing installed on my PC - but on the day (4/9) when 5016616 was no longer offered - and replacement KB5017308 not yet born. So I got through an Update cycle without freeze. VERY interesting. But I have not tried again since - have to actually use the PC sometimes.
Was this answer helpful?

0 comments No comments