Secure Boot Installer phase of update KB4541335 (and KB4551762) fails to install

I

i077

Hi,


I've been dealing with an update that has been repeatedly failing to install for a few days now. At first it was update KB4551762, which installed, made my computer restart, then rolled back changes after a part of the update failed. I looked the update up in the Microsoft catalog, and saw that it was superseded by update KB4541335, so I tried installing that instead, but the same thing happened. In Event Viewer, the Windows System logs claimed an error code of 0x800F0922. I then looked into the CBS.log log file in C:\Windows\Logs\CBS (both times), and searched for that error code. For both updates, I found:


2020-03-26 21:24:00, Info CSI 00000986 The queue has completed running, and AI failures have occured.
2020-03-26 21:24:00, Info CSI 00000987 ==Error Summary Start==
2020-03-26 21:24:00, Error CSI 00000988 (F) Installer: Secure Boot Installer Binary Name: securebootai.dll ErrorCode: 800b0100 Phase: 40 Mode: Install (upgrade) Component: Microsoft-Windows-SecureBoot-FirmwareUpdate, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS[gle=0x80004005]
2020-03-26 21:24:00, Info CSI 00000989 ==Error Summary End==
2020-03-26 21:24:00, Error CBS Startup: Failed to process advanced operation queue, startupPhase: 0. A rollback transaction will be created. [HRESULT = 0x800f0922 - CBS_E_INSTALLERS_FAILED]
2020-03-26 21:24:00, Info CBS Setting ExecuteState key to: CbsExecuteStateInitiateRollback | CbsExecuteStateFlagAdvancedInstallersFailed


Interesting. Looks like a Secure Boot Firmware Update is failing to apply? Weird, since I have Secure Boot disabled on this PC (and I double-checked my PC's firmware settings to be sure). I scrolled up looking for the specific error, and came up with this in the same log:


2020-03-26 21:23:58, Info CSI 00000966 Begin executing advanced installer phase 40 index 150 (sequence 191)
Old component: [l:165 ml:166]'Microsoft-Windows-SecureBoot-FirmwareUpdate, Culture=neutral, Version=10.0.18362.1, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS'
New component: [l:167 ml:168]'Microsoft-Windows-SecureBoot-FirmwareUpdate, Culture=neutral, Version=10.0.18362.411, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=amd64, versionScope=NonSxS'
Install mode: install
Smart installer: false
Installer ID: {3a4bacaa-c2db-4cf6-8a6b-7d9dfd5155f1}
Installer name: 'Secure Boot Installer'
2020-03-26 21:23:58, Info CSI 00000967 Loading installer DLL from explicit path: C:\WINDOWS\WinSxS\amd64_microsoft-windows-s..gstack-boot-onecore_31bf3856ad364e35_10.0.18362.710_none_abba9ac90200f4d6\securebootai.dll
2020-03-26 21:23:58, Info CSI 00000968 Performing 1 operations as follows:
(0) LockComponentPath: flags: 0 comp: {l:16 b:37b1c763d603d6019d0c0000b009f409} pathid: {l:16 b:37b1c763d603d6019e0c0000b009f409} path: [l:117]'\SystemRoot\WinSxS\amd64_microsoft-windows-s..boot-firmwareupdate_31bf3856ad364e35_10.0.18362.1_none_872390f682bad780' pid: 9b0 starttime: 132297458102454506
2020-03-26 21:23:58, Info CSI 00000969 Performing 1 operations as follows:
(0) LockComponentPath: flags: 0 comp: {l:16 b:f5ffc763d603d6019f0c0000b009f409} pathid: {l:16 b:f5ffc763d603d601a00c0000b009f409} path: [l:119]'\SystemRoot\WinSxS\amd64_microsoft-windows-s..boot-firmwareupdate_31bf3856ad364e35_10.0.18362.411_none_0aba928a9707779d' pid: 9b0 starttime: 132297458102454506
2020-03-26 21:23:58, Error CSI 0000096a@2020/3/27:01:23:58.618 (F) onecore\base\secureboot\servicing\advancedinstaller\securebootai.cpp(277): Error TRUST_E_NOSIGNATURE originated in function Windows::WCP::SecureBoot::BasicInstaller::Install expression: ApplySecureBootUpdate( dwAvailableUpdates)
[gle=0x80004005]



So some signature seems to be missing that the update is looking for. Again, Secure Boot is disabled on this PC so I do not know why it would be trying this (then again, maybe it just installs this update regardless). Either way, this is what was causing both the original and superseded update to fail. I've scoured the Internet (read: performed like 30 different searches) with no help. I did come across one (Russian) forum with someone around a week ago having the same problem, and with the help of Google Translate I found that a user suggested disabling Secure Boot, but the person with the problem did not respond, and that's already disabled on my PC anyways. That was the only thing I could find on this, so I'm hoping someone here can help me resolve this issue.


I should probably note that my PC has both Windows and a Linux distro (residing on separate disks), and an EFI System Partition with plenty of free space, like more than a gigabyte of free space. Given the error that's happening above, I don't think that's the problem.


This is what I've tried so far:

  • The generic "Windows Update won't work" stuff: Windows Update troubleshooter ("couldn't identify the problem"), sfc /scannow (more than a couple of times), dism to try to restore any corrupted stuff (of which there were none), stopping the bits, wuauserv, msiserver, and cryptSvc services and deleting updates before restarting them, etc.
  • Clean booting with just Microsoft services, then updating
  • Rebooting into Safe Mode, then updating

None of these things have worked, so I'm wondering if anyone here can help me out. Here is an upload of my CBS.log. The parts I mentioned are at lines 5670 and 5591, respectively.


Thanks.

Continue reading...
 
Back
Top Bottom