We had already updated a Windows 8.1 x64 machine with KB2919442 and was starting to install Windows8.1-KB2919355-x64.msu.

Firstly it was hanging for ages at the “Installing” phase with no progress…

Well that is normal. What is going on here? Using ProcMon (http://live.sysinternals.com/ProcMon.exe) we used the target icon and dragged it over the “Download and Install Updates” Window to monitor activity.

However there was no file or registry activity going on.

So I cleared the current filter and used Tools | File Summary… I then looked at the most Active File by Path and clicked it, to display it in ProcMon filter. From this we could see that TiWorker.exe the “Windows Modules Installer Worker” was busy extracting update contents into the following folders:

C:\Windows\CbsTemp\

C:\Windows\SoftwareDistribution\Download\

For this update this phase can take quite a while due to large size of update file. You will not see any progress bar during the extraction phase.

Based on this info we reset our filter and set to filter on Process Name is TiWorker.exe

Once we started to see progress we would see files being written into C:\Windows\WinSxS\Temp\PendingRenames and other locations. (The PendingRenames files are files that need to be installed on reboot)

We also were able to notice with ProcMon that a log file was being written to at

C:\Windows\Logs\CBS\CBS.log

However after some time update failed with this helpful message:

Some updates were not installed

The following updates were not installed:

Update for Windows (KB2919355)

Checking the Windows System Event log, and looking at Source WindowsUpdateClient we found a slightly more helpful error message:

Installation Failure: Windows failed to install the following update with error 0x80070003: Update for Windows (KB2919355)

The error message 0x80070003 refers to “PATH NOT FOUND” So what was NOT FOUND?

We can find TIWORKER failures by searching our ProcMon log for LastError

In the detail view we can see the Data value has our error message – in decimal instead of HEX. We also see the package name that failed. We also see writing to CBS.log.

If we work backwards from that in our ProcMon log we quickly see a pile of PATH NOT FOUND errors:

If we checked the CBS.log (you will need to open Notepad or other log viewer as Administrator to open this file –> in some cases you may need to copy it into another folder before you can open it)

2014-04-03 13:55:16, Info CSI 00000e25 Delete of a missing registry value detected in the registry installer!!

Registry value name: “[l:0]”””

2014-04-03 13:55:17, Error CSI 00000e26 (F) STATUS_OBJECT_PATH_NOT_FOUND #8659314# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowSharingViolation), handle = {provider=NULL, handle=0, name= (“null”)}, da = (SYNCHRONIZE|FILE_READ_ATTRIBUTES), oa = @0x64b7a4d9a8->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[64]”\??\ D:\Users\Default\AppData\Local\Microsoft\Windows\WinX \Group2″; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0x64b7a4d988, as = (null), fa = 0, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), cd = FILE_OPEN, co = (FILE_SYNCHRONOUS_IO_NONALERT|0x00004000), eab = NULL, eal = 0, disp = Invalid)

[gle=0xd000003a]

2014-04-03 13:55:17, Error CSI 00000e27@2014/4/3:02:55:17.825 (F) base\wcp\sil\merged

tu

tsystem.cpp(2155): Error STATUS_OBJECT_PATH_NOT_FOUND originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile expression: (null)

[gle=0x80004005]

2014-04-03 13:55:17, Info CBS Added C:\windows\Logs\CBS\CBS.log to WER report.

2014-04-03 13:55:17, Info CBS Added C:\windows\Logs\CBS\CbsPersist_20140403023755.log to WER report.

2014-04-03 13:55:17, Info CBS Added C:\windows\Logs\CBS\CbsPersist_20140403022331.log to WER report.

2014-04-03 13:55:17, Info CBS Not able to add pending.xml to Windows Error Report. [HRESULT = 0x80070002 – ERROR_FILE_NOT_FOUND]

2014-04-03 13:55:17, Info CBS Not able to add pending.xml.bad to Windows Error Report. [HRESULT = 0x80070002 – ERROR_FILE_NOT_FOUND]

2014-04-03 13:55:17, Info CBS Not able to add SCM.EVM to Windows Error Report. [HRESULT = 0x80070002 – ERROR_FILE_NOT_FOUND]

2014-04-03 13:55:19, Error CSI 00000e28 (F) STATUS_OBJECT_PATH_NOT_FOUND #8659313# from Windows::Rtl::SystemImplementation::CSystemIsolationLayer_IRtlSystemIsolationLayerTearoff::OpenFilesystemDirectory(flags = 0, da = (FILE_ALL_ACCESS), dn = [ml:520{260},l:128{64}]”\??\D:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2″, sa = (FILE_SHARE_READ|FILE_SHARE_DELETE), oo = (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT), dir = NULL, disp = Invalid)

[gle=0xd000003a]

2014-04-03 13:55:19, Error CSI 00000e29 (F) STATUS_OBJECT_PATH_NOT_FOUND #8124892# from PrimitiveInstaller::CCoordinator::FinalizeChanges(…)[gle=0xd000003a]

2014-04-03 13:55:19, Info CSI 00000402 SMI Primitive Installer [done]

2014-04-03 13:55:19, Error CSI 00000e2a (F) STATUS_OBJECT_PATH_NOT_FOUND #6494085# from CCSDirectTransaction::PerformChangeAnalysis(…)[gle=0xd000003a]

2014-04-03 13:55:19, Error CSI 00000e2b (F) STATUS_OBJECT_PATH_NOT_FOUND #6494084# from CCSDirectTransaction::PrepareForCommit(…)[gle=0xd000003a]

2014-04-03 13:55:19, Error CSI 00000e2c (F) STATUS_OBJECT_PATH_NOT_FOUND #6494083# from CCSDirectTransaction::GenerateComponentChangeList(…)[gle=0xd000003a]

2014-04-03 13:55:19, Error CSI 00000e2d (F) STATUS_OBJECT_PATH_NOT_FOUND #6494082# from Windows::COM::CPendingTransaction::ExtractInformationFromRtlTransaction(…)[gle=0xd000003a]

2014-04-03 13:55:19, Error CSI 00000e2e (F) HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) #1764404# from Windows::COM::CPendingTransaction::IStorePendingTransaction_Analyze(…)[gle=0x80070003]

2014-04-03 13:55:20, Error CSI 00000e2f (F) HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) #1626198# from Windows::ServicingAPI::CCSITransaction::ICSITransaction_Commit(Flags = 47 (0x0000002f), pSink = NULL, disp = 0, coldpatching = FALSE)[gle=0x80070003]

2014-04-03 13:55:20, Error CSI 00000e30 (F) HRESULT_FROM_WIN32(ERROR_PATH_NOT_FOUND) #1626197# 313613458 us from

So why was D:\Users\Default folder missing?

This is because the User Profiles has been redirected using a registry key, instead of unattend.xml – Refer to “Relocation of the Users directory and the ProgramData directory to a drive other than the drive that contains the Windows directory” at http://support.microsoft.com/kb/949977

To summarize this KB article:

Using ProfilesDirectory to redirect folders to a drive other than the system volume blocks upgrades.

Using ProfilesDirectory to point to a directory that is not the system volume will block SKU upgrades and upgrades to future versions of Windows.

Microsoft recommends that you do not change the location of the user profile directories or program data folders.

Note If you use the unattend settings to set up the operating systems that are listed in this article, we will provide commercially reasonable efforts to support your scenario.

So to fix the machine we ran:

robocopy C:\Users\Default\ D:\Users\Default\ *.* /s

To prevent these type of issues in the future however it is best to keep ProfilesDirectory on the system volume (i.e. C:\ ) This issue may not have occurred if the unattend settings had been used to put the profile on D:\

After creating a copy of default profile under D:\Users\Default we re-ran Windows8.1-KB2919355-x64.msu and updated installed without an issue

Some other issues with this Windows update error message are also covered under these KB articles:

Windows Update error “0x80070002” or “0x80070003”

http://support.microsoft.com/kb/910336

Error message when you try to install updates by using the Windows Update or Microsoft Update Web site: “0x80070003”

http://support.microsoft.com/kb/956705/id-id