Unable to install Service Pack 1 onto Windows Server 2008 R2

Problem

You have a Windows Server 2008 R2 server that currently does not have SP1 installed:

You proceed to download Windows Server 2008 R2 SP1 and run the install:

windows6.1-KB976932-X64.exe

… but it fails with the following error message:

Installation was not successful

An unknown error has occurred. (Details)

Error: 0x800f0818

Reviewing the CBS.log log located in the directory:

C:\Windows\Logs\CBS

Reveals the following error messages:

2019-01-25 15:16:10, Info CBS Mark store corruption flag because there is a mismatch between package identity and its content on package: Package_for_KB2618444_RTM~31bf3856ad364e35~amd64~~6.1.1.2. [HRESULT = 0x00000000 - S_OK]

2019-01-25 15:16:10, Info CBS Identity mismatch: Specified Identity: Package_for_KB2618444_RTM~31bf3856ad364e35~amd64~~6.1.1.2, actual package Identity: Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385 [HRESULT = 0x800f0818 - CBS_E_IDENTITY_MISMATCH]

2019-01-25 15:16:10, Info CBS Failed to resolve package [HRESULT = 0x800f0818 - CBS_E_IDENTITY_MISMATCH]

2019-01-25 15:16:10, Info CBS Failed to populate children. [HRESULT = 0x800f0818 - CBS_E_IDENTITY_MISMATCH]

2019-01-25 15:16:10, Info CBS Failed to initialize package: Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~amd64~~8.0.7600.16385, from path: \\?\C:\Windows\Servicing\Packages\Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~amd64~~8.0.7600.16385.mum, existing package: 1 [HRESULT = 0x800f0818 - CBS_E_IDENTITY_MISMATCH]

2019-01-25 15:16:10, Info CBS Failed to resolve package [HRESULT = 0x800f0818 - CBS_E_IDENTITY_MISMATCH]

2019-01-25 15:16:10, Info CBS Failed to populate children. [HRESULT = 0x800f0818 - CBS_E_IDENTITY_MISMATCH]

2019-01-25 15:16:10, Info CBS Failed to initialize internal package [HRESULT = 0x800f0818 - CBS_E_IDENTITY_MISMATCH]

2019-01-25 15:16:10, Info CBS Failed to create package. [HRESULT = 0x800f0818 - CBS_E_IDENTITY_MISMATCH]

2019-01-25 15:16:10, Error CBS Failed to internally open package. [HRESULT = 0x800f0818 - CBS_E_IDENTITY_MISMATCH]

2019-01-25 15:16:10, Error CBS SPI: (CSPICbsClient::EnumPackages:156)Failed to open package hr=0x800f0818

2019-01-25 15:16:10, Error CBS SPI: (CSystem::EnumerateCbsPackages:360)Failed to populate CBS package list hr=0x800f0818

2019-01-25 15:16:10, Info CBS Session: 30717154_1779796761 finalized. Reboot required: no [HRESULT = 0x00000000 - S_OK]

2019-01-25 15:16:10, Info CBS SPI: Failed enumerating CBS packages

2019-01-25 15:16:10, Error CBS SPI: (GetLatestVersionFromCBSStore:131)ATL exception hr=0x800f0818

2019-01-25 15:16:10, Error CBS SPI: (CSPCInstallTask::ApplicabilityScan:632)Failed to get latest version of Package_for_KB976902~31bf3856ad364e35~amd64~~6.1.1.17514 from the store hr=0x800f0818

2019-01-25 15:16:10, Error CBS SPI: (CSPInstall::CompatibilityApplicabilityScan:1303)Failed in applicability check of task hr=0x800f0818

2019-01-25 15:16:10, Info CBS SPI: Ending Compatibility\Applicability scan

2019-01-25 15:16:10, Error CBS SPI: (PerformSPInstallation:833)Failed to install SP using UI hr=0x800f0818

2019-01-25 15:16:10, Error CBS SPI: (wmain:1105)Failed to perform SP installation hr=0x800f0818

2019-01-25 15:16:10, Info CBS SPI: Reporting Failed event

You navigate the directory C:\Windows\servicing\Packages and can confirm that the Package_for_KB2618444_RTM~31bf3856ad364e35~amd64~~6.1.1.2. exists.

Searching for this error message results in recommendations to install the:

System Update Readiness Tool for Windows Server 2008 R2 x64 Edition (KB947821) [October 2014]

https://www.microsoft.com/en-us/download/details.aspx?id=14668

Windows6.1-KB947821-v34-x64.msu

You proceed to install the package:

Then attempt to install SP1 again but now receive the following error:

Installation was not successful

A required certificate is not twithin its validity period when verifying against the current system clock or the timestampe in the signed file.

Error: CERT_E_EXPIRED(0x800b0101)

Proceeding to review the SP1 install logs reveal the following:

2019-01-25 15:58:21, Info CBS WinVerifyTrust failed [HRESULT = 0x800b0101 - CERT_E_EXPIRED]

2019-01-25 15:58:21, Error CBS Failed to verify if catalog file \\?\C:\Windows\Servicing\Packages\Package_15_for_KB2722913~31bf3856ad364e35~amd64~~6.1.1.0.cat is valid. [HRESULT = 0x800b0101 - CERT_E_EXPIRED]

2019-01-25 15:58:21, Info CBS Failed to initialize package: Package_15_for_KB2722913~31bf3856ad364e35~amd64~~6.1.1.0, from path: \\?\C:\Windows\Servicing\Packages\Package_15_for_KB2722913~31bf3856ad364e35~amd64~~6.1.1.0.mum, existing package: 1 [HRESULT = 0x800b0101 - CERT_E_EXPIRED]

2019-01-25 15:58:21, Info CBS Failed to resolve package [HRESULT = 0x800b0101 - CERT_E_EXPIRED]

2019-01-25 15:58:21, Info CBS Failed to populate children. [HRESULT = 0x800b0101 - CERT_E_EXPIRED]

2019-01-25 15:58:21, Info CBS Failed to initialize package: Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~amd64~~8.0.7600.16385, from path: \\?\C:\Windows\Servicing\Packages\Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~amd64~~8.0.7600.16385.mum, existing package: 1 [HRESULT = 0x800b0101 - CERT_E_EXPIRED]

2019-01-25 15:58:21, Info CBS Failed to resolve package [HRESULT = 0x800b0101 - CERT_E_EXPIRED]

2019-01-25 15:58:21, Info CBS Failed to populate children. [HRESULT = 0x800b0101 - CERT_E_EXPIRED]

2019-01-25 15:58:21, Info CBS Failed to initialize internal package [HRESULT = 0x800b0101 - CERT_E_EXPIRED]

2019-01-25 15:58:21, Info CBS Failed to create package. [HRESULT = 0x800b0101 - CERT_E_EXPIRED]

2019-01-25 15:58:21, Error CBS Failed to internally open package. [HRESULT = 0x800b0101 - CERT_E_EXPIRED]

2019-01-25 15:58:21, Error CBS SPI: (CSPICbsClient::EnumPackages:156)Failed to open package hr=0x800b0101

2019-01-25 15:58:21, Error CBS SPI: (CSystem::EnumerateCbsPackages:360)Failed to populate CBS package list hr=0x800b0101

2019-01-25 15:58:21, Info CBS Session: 30717160_1382002389 finalized. Reboot required: no [HRESULT = 0x00000000 - S_OK]

2019-01-25 15:58:21, Info CBS SPI: Failed enumerating CBS packages

2019-01-25 15:58:21, Error CBS SPI: (GetLatestVersionFromCBSStore:131)ATL exception hr=0x800b0101

2019-01-25 15:58:21, Error CBS SPI: (CSPCInstallTask::ApplicabilityScan:632)Failed to get latest version of Package_for_KB976902~31bf3856ad364e35~amd64~~6.1.1.17514 from the store hr=0x800b0101

2019-01-25 15:58:21, Error CBS SPI: (CSPInstall::CompatibilityApplicabilityScan:1303)Failed in applicability check of task hr=0x800b0101

2019-01-25 15:58:21, Info CBS SPI: Ending Compatibility\Applicability scan

2019-01-25 15:58:21, Error CBS SPI: (PerformSPInstallation:833)Failed to install SP using UI hr=0x800b0101

2019-01-25 15:58:21, Error CBS SPI: (wmain:1105)Failed to perform SP installation hr=0x800b0101

2019-01-25 15:58:21, Info CBS SPI: Reporting Failed event

Further research shows that rolling back the clock would allow for the install:

CERT_E_EXPIRED(0x800b0101)

https://social.technet.microsoft.com/Forums/Lync/en-US/5c95bd6f-041e-4d68-b19b-304c5162aa27/certeexpired0x800b0101?forum=w7itproSP

Doing so did not work for this situation. A bit more digging in the logs revealed this line referencing this package:

2019-01-25 14:50:28, Info CBS Read out cached package applicability for package: WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256, ApplicableState: 112, CurrentState:112

Locating the file and opening the package confirmed that the WUClient-SelfUpdate-Core~31bf3856ad364e35~amd64~~7.6.7600.256.cat had a timestamp dating back to June 2, 2012 (it’s 2019 right now):

Another line in the logs that actually referenced a certificate was the following:

CBS Failed to verify if catalog file \\?\C:\Windows\Servicing\Packages\Package_15_for_KB2722913~31bf3856ad364e35~amd64~~6.1.1.0.cat is valid. [HRESULT = 0x800b0101 - CERT_E_EXPIRED]

Locating this package and viewing its properties confirmed that the Digital Signature had expired on June 28, 2012:

Solution

It took a bit of time but the solution to this issue was to install the following update to correct the signatures before installing SP1:

Microsoft Security Advisory: Compatibility issues affecting signed Microsoft binaries: November 13, 2012

https://support.microsoft.com/en-us/help/2749655/microsoft-security-advisory-compatibility-issues-affecting-signed-micr

Logging into Windows displays the system tray message: “You’ve been signed in with a temporary profile.”

One of my biggest pet peeves when asking fellow colleagues to delete a user’s profile on a desktop or server is when they do so by launching Windows Explorer, navigate to the C:\Users folder then deletes the folder because that almost always causes the following message to be displayed for the deleted user:

You've been signed in with a temporary profile.

You can’t access your files, and files created in this profile will be deleted when you sign out. To fix this, sign out and try signing in later. Please see the event log for details or contact your system administrator.

This also happens to be one of the causes of profiles to not work with VMware Horizon View Virtual Desktop profile disks because the deleted profile isn’t cleanly removed from the Windows OS and thus a new profile cannot be created properly.

To delete a user’s profile correctly, navigate to the User Profiles menu by clicking on Advanced system settings within the System window:

Then the Settings… button under the User Profiles section in the System Properties:

Remove the profile by selecting it from the list and clicking on the Delete button:

To correct the issue when a profile was deleted incorrectly causing the message shown above to be displayed every time the user logs in, simply launch the registry editor on the server and navigate to:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Then locate the folder that represents the deleted user by finding one with the corresponding ProfileImagePath directory:

Make a note of the Guid and remove the corresponding key located in the path HKLM\Software\Microsoft\WindowsNT\CurrentVersion\ProfileGuid.

With the key identified by the Guid of the profile deleted, proceed to remove key of the deleted user in the path HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.

Attempting to expand a Windows 2012 R2 ReFS drive fails with the error message: “There is not enough space available on the disk(s) to complete this operation.”

Problem

You have a Windows 2012 R2 server virtual machine with multiple disks that is formatted with the ReFS file system and you have just one of the disks at the hypervisor level then proceed to extend it within Disk Management:

Attempting to complete the Extend Volume Wizard throws the following error:

Disk Management

There is not enough space available on the disk(s) to complete this operation.

The expansion of the disk fails.  You attempt to use diskpart but receive the same error:

Virtual Disk Service error:

There is not enough usable space for this operation.

You attempt to expand the disk by 1MB but the results are the same:

Solution

I’m not sure whether this is a bug in the earlier versions of Windows 2012 R2 and ReFS but expanding the disk by 1000MB completes successfully:

10000MB also works:

Sames goes for 100000MB:

With 52.60GB of Unallocated space left, leaving the Select the amount of space in MB as the default (maximum) completes successfully:

Hide Favorites, Libraries, Network and redirected local drives for Citrix and RDS published RemoteApp applications

One of the most common questions I’ve been asked by clients with Microsoft RDS deployments is how to hide the Library, Favorites and redirected local drives for RDS published RemoteApp applications.  The reason for this is because many administrators have noticed that users are unable to differentiate the Desktop, Downloads and Recent Places folders listed in the Save As dialog box for RemoteApp applications, which reside on the RDS server, and ones located on their local desktop:

This isn’t the users fault so to avoid this confusion, it is best to hide these folders and the following demonstrates how to accomplish this.

Taking Ownership and Granting Permissions to Registry Keys

Note that all of the registry keys mentioned below will require taking ownership and granting permissions to the account making the changes because only the TrustedInstaller has permissions to the keys. I won’t go into the details but I’ll include screenshots of what the process looks like:

Hiding the Favorites Menu

Hiding the favorites menu as shown in the screenshot below:

… requires modifying registry keys as shown in the following:

For 32-bit applications

Navigate to the following key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E}\ShellFolder]

Modify the DWord Attributes to a9400100:

For 64-bit applications

Navigate to the following key:

[HKEY_CLASSES_ROOT\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E}\ShellFolder]

Modify the DWord Attributes to a9400100:

Hiding the Libraries Menu

Hiding the libraries menu as shown in the screenshot below:

… requires modifying registry keys as shown in the following:

For 32-bit applications

Navigate to the following key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\ShellFolder]

Modify the DWord Attributes to b090010d:

For 64-bit applications

Navigate to the following key:

[HKEY_CLASSES_ROOT\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\ShellFolder]

Modify the DWord Attributes to b090010d:

Hiding the Network Menu

Hiding the libraries menu as shown in the screenshot below:

… requires modifying registry keys as shown in the following:

For 32-bit applications

Navigate to the following key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\ShellFolder]

Modify the DWord Attributes to b0940064:

For 64-bit applications

Navigate to the following key:

[HKEY_CLASSES_ROOT\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\ShellFolder]

Modify the DWord Attributes to b0940064:

Hiding the Favorites Menu

Hiding the redirected local drives as shown in the screenshot below:

… requires applying the following group policy configuration to the server object:

Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection

Enabling Do not allow drive redirection will prevent the local redirected drives from being accessible: