Enterprise Guide: Windows Servicing & Update Troubleshooting 

📚 Table of Contents

1. What Is Windows Servicing?
2. Windows Update Internals (Stack, Components)
3. Servicing Stack Updates (SSU) & Failure Symptoms
4. Local vs Enterprise Update Flow (WSUS/Intune)
5. Understanding Update Types
6. Component Store, Assemblies, Manifests, Registry Mapping
7. Common Update Failures & What They Mean
8. CBS.log – In-Depth Analysis
9. DISM & SFC – Full Command Logic
10. ISO Matching & Repair With install.wim/.esd
11. File Version Matching, KB Sourcing, and Safe Manual Replacement
12. TrustedInstaller Permissions and ACL Reset
13. WindowsUpdate.log Analysis
14. Delivery Optimization – Logs, Disabling, and Peer Troubles
15. Group Policy & Intune Conflicts
16. TSS Logs – Placeholder (for Log Collection and Analysis)
17. Registry Hive Dumping and Comparison
18. Strategic Troubleshooting Flow
19. Anti-patterns (What Not To Do)
20. Microsoft Tools, Scripts & References

---

1. 🧩 What Is Windows Servicing?
Servicing refers to the process of updating Windows through cumulative security, quality, and feature updates. Failures typically stem from:

* Component corruption (CBS)
* SSU/LCU mismatch
* Network issues (e.g., DO, WSUS)
* Policy misconfiguration
Modern Windows uses a cumulative model where updates are atomic and include prior fixes.

2. ⚙️ Windows Update Internals
Key components:

* TrustedInstaller.exe – Enforces ownership and installs protected updates.
* CBS (Component-Based Servicing) – Handles manifests and component logic.
* TiWorker.exe – Background servicing tasks.
* WUSA.exe – Installs .msu packages.
* Windows Update Agent (WUA) – Interfaces with WSUS/Intune/cloud.

3. 🧱 Servicing Stack Updates (SSUs)
If SSU is missing or outdated:

* LCUs may fail or silently skip
* Error codes: 0x800f0823, 0x800f081f

🔍 Note: SSUs are not labeled clearly in Get-HotFix output. You must check Microsoft Catalog or Windows Release Health documentation to verify which KB is the SSU for your OS build.

How to confirm SSU manually:
Use DISM /Online /Get-Packages and look for entries like:

```
Package_for_ServicingStack_XXXX~31bf3856ad364e35~amd64~~
```

It’s normal to see multiple SSUs listed as Installed. Older SSUs may remain listed for rollback or compatibility reasons.
Windows does not remove older SSUs but only uses the latest one during servicing.

Example:

* Package\_for\_ServicingStack\_3764\~...\~\~26100.3764.1.0 → Older SSU
* Package\_for\_ServicingStack\_4193\~...\~\~26100.4193.1.5 → Newer SSU (currently active)

RollupFix packages represent LCUs — e.g.:

* Package\_for\_RollupFix\~...\~\~26100.4351.1.0 → Current LCU

These map directly to monthly KBs like KB5063060, which are visible in Get-HotFix, whereas SSUs often are not.

🔬 Get-HotFix vs DISM Differences:

| Tool | Shows | Comments |
| ---------- | ----------------------------- | ----------------------------------- |
| Get-HotFix | Mostly LCUs and security KBs | Easy to use, lacks SSUs visibility |
| DISM | Full package state (SSU, LCU) | Shows installed, staged, superseded |

📝 Note: Registry might store timestamps inconsistently across builds, so version parsing is safer.
Update via Microsoft Catalog: [https://catalog.update.microsoft.com](https://catalog.update.microsoft.com)

4. 🏢 Local vs Enterprise Update Flow (WSUS/Intune)
Common Enterprise Paths:

* WSUS – May deliver outdated metadata or fail due to sync gaps.
* Intune – Enforces Windows Update for Business (WUfB) policies.
* Delivery Optimization (DO) – May attempt peer-sharing instead of HTTP.

Symptoms:

* “Up to date” status while behind
* DO logs show peer failures
* Update ring policies pause or defer LCU installs

5. 🔄 Understanding Update Types
\| Type | Description |
\|----------------|------------------------------------|
\| SSU | Updates servicing logic itself |
\| LCU | Latest cumulative update |
\| Security-only | Select security fixes only |
\| Feature Update | OS upgrades (e.g., 21H2 → 22H2) |
\| Preview | Optional/test updates |

Unified packages may combine SSU+LCU in Windows 10+.

6. 🗃️ Component Store, Assemblies, Registry
**WinSxS (C:\Windows\WinSxS)**:

* All component versions
* .mui, .cat, .manifest

**Registry Mapping**:

| Hive | Description |
| --------------------------------------------------------------------------------- | ------------------------- |
| HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages | Package list and states |
| HKLM\COMPONENTS (hidden) | Component-to-file mapping |
| HKLM...\VersionedComponents | Maps DLLs to assemblies |

**Package States**:

* Absent – Not present
* Staged – Queued but not installed
* Installed – Fully applied

Use:

```bash
Dism /Online /Get-Packages /Format:Table
```

7. 🚨 Common Update Failures
\| Code | Meaning | Resolution |
\|-------------|----------------------|------------------------------------|
\| 0x800f081f | Missing source | Use ISO with DISM, or replace file |
\| 0x80073701 | Manifest mismatch | Extract missing DLL from ISO |
\| 0x800f0922 | Recovery partition | Resize recovery, fix BCD |
\| 0x8024200D | Corrupted payload | Clear SoftwareDistribution |
\| 0x80070005 | Access denied | Use icacls, takeown |

8. 📜 CBS.log – In-Depth Analysis
Focus on lines containing:

* “Cannot repair member file”
* “Hash mismatch”

Quick parse:

```bash
findstr /c:"error" CBS.log > errors.txt
```

Cross-reference component and file in update catalog or ISO.

9. 🛠 DISM & SFC

```bash
Dism /Online /Cleanup-Image /ScanHealth
Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /RestoreHealth
```

With ISO:

```bash
/Source:D:\sources\install.wim:1 /LimitAccess
```

Follow with:

```bash
sfc /scannow
```

10. 📀 ISO Matching
Check image version:

```bash
dism /Get-WimInfo /WimFile:D:\sources\install.wim
```

Match:

* Build number (compare to winver)
* Language
* Architecture

Sources:

* Microsoft Software Download
* uupdump.net

11. 🧩 Manual File Replacement
Steps:
12. Extract DLL from ISO or working system
13. Use WinPE or PS remoting to copy
14. Reset permissions:

```bash
takeown /f file.dll
icacls file.dll /grant administrators:F
icacls file.dll /setowner "NT SERVICE\TrustedInstaller"
```

12. 🔐 Permissions & TrustedInstaller
Use `takeown` and `icacls` to adjust ownership.
Advanced cases: use `SetACL.exe`.

13. 📝 WindowsUpdate.log (Win10+)

```powershell
Get-WindowsUpdateLog
```

Search for:

* IsWUfBEnabled
* *FAILED*
* Metadata errors
* Agent handler logs

14. 🚚 Delivery Optimization (DO)
Disable via:

* GPO – Admin Templates → Delivery Optimization
* Registry:

```reg
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config
"DownloadMode"=dword:00000000
```

* Intune – Settings Catalog
* GUI – Windows Update → Advanced → Disable P2P

Logs:

```powershell
Get-DeliveryOptimizationStatus
```

TSS collects DO logs in TSS\_Output\DO

15. 🧾 Group Policy vs Intune
\| Policy Engine | Registry Path |
\|---------------|---------------|
\| GPO | HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate |
\| Intune MDM | HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Update |

Conflicts may silently override GPO.
Check with:

```powershell
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
reg query "HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Update"
Get-WindowsUpdateLog | Select-String -Pattern "IsWUfBEnabled"
```

16. 📦 TSS Logs – Placeholder
To be added:

* CBS.log
* DISM.log
* COMPONENTS hive
* DO logs
* WMI system info

17. 🧪 Registry Hive Dumping

```powershell
reg save HKLM\COMPONENTS C:\COMPONENTS.hiv
reg load HKLM\TempCOMP C:\COMPONENTS.hiv
```

18. 🧭 Troubleshooting Flow

19. Check error in CBS.log, Event Viewer

20. Run DISM & SFC

21. Match ISO to system

22. Extract or repair files

23. Confirm GPO/Intune/DO

24. Use TSS for full context

25. Escalate with evidence

26. ❌ Anti-patterns to Avoid
\| Action | Why Dangerous |
\|------------------------|----------------------------------|
\| Deleting pending.xml | Breaks update sequencing |
\| Injecting wrong KB | Corrupts servicing chain |
\| Replacing DLL with mismatch | Breaks manifest validation |
\| Skipping SSU before LCU| Blocks install silently |
\| Ignoring logs on escalation | Delays accurate triage |

27. 🧰 Scripts & Tools
**Commands**:

* `Get-HotFix`
* `wmic qfe list`
* `Dism /Online /Get-Packages`
* `Get-WindowsUpdateLog`

**Tools**:

* TSSv2
* SetupDiag (excluded here)
* uupdump, Rufus for ISOs