Fixing Windows Update being unable to install updates while sfc and dism are unusable

At some point in the lifetime of my PC Desktop system I got two bluescreens in a row while playing video games. Following that I managed to stop the system from crashing by rewireing all hardware but for some reason any Windows updates that affected the System like the annual upgrade from 1803 to 1903 and a random update of the .NET framework to 4.8 for the 1803 version of windows kept failing to install. As they were not mandatory though I did pay them no mind as regular security updates to windows defender did still work. At some point I ran the Windows Update Troubleshooter that said they found some errors but a restart would run a fixing routine.

At some point I decided to get the updates to work again. The update failures were 0x8000ffff for the .NET update and 0x800700C12 for the Windows upgrade.

Searching for them you find a load of crap online as we all know that any and all windows errors are the perfect place to get vulnerable people to install malware.

Downloading the MediaCreationTool and telling it to do a manual upgrade to 1903 also failed with a "critical error" though it seemed nothing affected the system and it simply did not apply any changes. No logs though (THANKS MICROSOFT FOR THESE HELPFULL ERROR MESSAGES)

Dumping the Windows Update Log via the powershell command GetWindowsUpdateLog resulted in me finding out ... not much. Reading these error logs is tedious and complicated and the differentiation between errors and failiures as well as simply the fact that there are systems involved you will never have heared of during normal operation (at least in Linux you know what systems you use and install when setting up the system) did not help.

I then tried to do a manual installation of the .NET 4.8 Framework. It also failed from the normal installer but at least it dumped a searchable .xml in some random location of my drives (It for some reason dumped the install files into my slow 2TB storage HDD instead of somewhere on the SSD the system was installed in for example. But hey! Windows and temp files! What could go wrong if the temp files are never cleaned up?). So looking into that it came to my attention that some command line program executed during the final steps of installation failed and returned with the same 0x8000ffff error code: wusa.exe

Comparing error messages at least that is a common error during installation: The finalization part failes.

Looking into ways to fix windows update I found advice in trying to use:

sfc /scannow

and

dism.exe /online /cleanup-image /restorehealth 

sfc failed with the information that there are still changes to the system pending and that I should restart the PC. I did that for the past 6 months every day so that could not be the solution.

dism.exe failed at around 82.6% and at least gave me the hint that there are logs to find to look into. Even though they were also not very helpful in their format it also failed at some finalization step.

Looking into how to get sfc to work again I found a random forum post telling the user to delete the pending.xml in the WinSxS directory. Looking into that directory (for whatever it is used) I found the pending.xml - being almost 300MB big. Something doesn't seem right.

Deleting the file as an administrator does not work. I keep getting access denied errors. Even downloading the PSTools and opening the power shell as the SYSTEM user denies me rights to delete it. There are no processes holding a handle to the file.

How do I fix this mess and how are all these errors linked?

It turned out the whole thing seems to be an entangled mess of errors.

The bluescreen (the first one I got in about 10 years) I got while playing video games seemed to have happened while windows update was installing something in the background. If the update itself was responsible I do not know but I had to jump through some hoops to get my system running again as it reported the boot script to be corrupted. Back then I guess ran some basic command line tool from the troubleshoot advanced boot menu to fix the boot problem. Then I rewired everything because error logs told me that something wierd happened while writing to stuff to disk, so I thought that for some reason the wire connection to the system SSD was cut while the system was running. After that got fixed the system ran smoothly again but the updates didn't work anymore.

It turns out the "file corruption" went deeper. It seems like inside the pending.xml exists a list of updates that should be applied when the PC restarts. That .xml file was somehow broken though, not allowing Windows to READ its contents successfully but still allowing it to ADD to the broken file all updates it thought it should apply, thus reading an arbitrary amount of data from the file and then appending all that data to the back of it during every restart, bloating it up and up and up to almost GB proportions of metadata about pending updates.

As the windows upgrade and the .NET installer also want to tell the system "There needs something to be done upon the next restart of the device" during their finalization step, even the stand alone installers and the manual upgrade with the media creation tool, they also failed to parse and add to the pending.xml correctly. As this all was broken the ComponentBasedServicing seemed to be responsible for some programs so that was the CBS that cropped up here and there in error log files.

Now to the solution:

First I had to boot into the troubleshoot mode from an USB stick I set up with the media creation tool.

There I launched a command line and manually deleted the pending.xml in the WinSxS directory.

After that I was able to run an sfc /scannow to finaly get a report that some files were corrupted and some stuff was fixed, but not all.

After that I was able to run a dism /online /cleanup-image /restorehealth that failed not being able to find a source to clean up from.

After that I was able to run a dism /online /cleanup-image /startcomponentcleanup to clean up the component service

After that I was able to run another /restorehalth to success.

After that I was able to reset the Windows Update Cache and have it redownload all pending updates and upgrades.

After that I was able to install the 1903 upgrade as well as the .NET Framework update.

Now everything SEEMS fine.

I would love for Windows to give a user - not just a super user - clearer information about what is or is not broken in the system when ANYTHING breaks.

This search was hell. And I got out of it.