Steps I use to narrow down an OS update installation failure on Windows Vista and higher

A while back, I wrote a blog post describing a specific error that can occur when trying to install the .NET Framework 3.5 or 3.5 SP1 on Windows Vista and Windows Server 2008.  In that post, I talked at a high level about some of the steps I take to narrow down this type of error.  Those troubleshooting steps are useful in more scenarios than just the one in that blog post, and they are hard to find in a search currently because of the post that they’re currently located in.  As a result, I decided to write a standalone post that describes the steps I follow when trying to narrow down an OS update installation failure on Windows Vista and Windows Server 2008.  I am going to write this post from the perspective of troubleshooting a .NET Framework 3.5 and 3.5 SP1 installation failure on Windows Vista, but the same techniques are typically valid for other OS update installation failures on Windows Vista and higher.

It is important to keep in mind that the .NET Framework 3.5 and 3.5 SP1 both install updates to the .NET Framework 2.0 and 3.0 behind the scenes.  On Windows Vista and higher, the .NET Framework 2.0 and 3.0 are installed as OS components, so that means that the updates to 2.0 and 3.0 are OS update packages.  This means that failures in the .NET Framework 3.5 and 3.5 SP1 setups on Windows Vista and higher can possibly be caused by problems with the OS update engine.

Find the error in the .NET Framework setup log file

If I am investigating an error installing the .NET Framework 3.5 or 3.5 SP1, I start by opening the log file named %temp%\dd_dotnetfx35install.txt and searching for the string ***errorlog event***.  If the problem is in an OS update, then the error in the log will indicate a failure installing the component named Microsoft .NET Framework 2.0SP1 (CBS) or Microsoft .NET Framework 3.0SP1 (CBS).

If one of these components is the cause of the failure, there will be lines in dd_dotnetfx35install.txt directly above the ***errorlog event*** that look like the following:

[03/03/09,11:11:11] Microsoft .NET Framework 3.0SP1 (CBS): C:\Windows\system32\WUSA.exe exited with return value 2148468760
[03/03/09,11:11:11] InstallReturnValue: GFN_MID NET Framework 3.0SP1 (CBS), 0x800f0818

The name of the component and the HRESULT value listed for the InstallReturnValue will vary depending on the root cause of the failure, but the process name will always be WUSA.exe – this is the Windows Update Standalone Installer that is used to install OS updates on Windows Vista and later.

Find the error in the OS update installation engine log file (cbs.log)

One I have determined that the root cause of the failure is an OS update, I proceed to look at the log file at %windir%\logs\cbs\cbs.log.  This is the verbose log file for the OS update installation engine on Windows Vista and higher.  This log file is typically very large, and there are a couple of different ways I try to narrow down the error in this log:

  1. Search for the value listed in the InstallReturnValue entry from the dd_dotnetfx35install.txt log file in cbs.log.  For the above example, I would search for 0x800f0818.

  2. Search for the string generating failure report in cbs.log.

For the above example, text appears in cbs.log that looks like the following:

2009-03-03 11:11:11, Info                  CBS    WER: Generating failure report for package: Package_for_KB948610~31bf3856ad364e35~x86~~6.0.6001.2123, status: 0x800f0818, failure source: Execute, start state: 4, target state: 7

Determine the meaning of the error and possible workarounds

From here, the next step I take depends on what data appears in cbs.log.  Some of the information I look for is the following:

  1. Does the same error code occur for multiple different OS update packages?  If so, that typically means that there is a problem with the OS update engine itself as opposed to with the update that is failing.

  2. Does the error code appear in the System Update Readiness Tool knowledge base article?  If so, I typically try to use the tool available in that knowledge base article and/or the steps in this blog post.

  3. Does the error code appear in the table of common CBS error codes?  If so, I try the workaround suggested there for the error code that I found in cbs.log.

  4. If the error code does not appear in either of the above articles, then I try to use the err.exe tool to determine more detailed information about the cause of the error.

Sometimes, no error code information will appear in cbs.log.  In those cases, I also look for the error code in %windir%\WindowsUpdate.log.  There is a table of Windows Update Agent error codes that can be useful for error codes that appear in WindowsUpdate.log.

For additional information

While researching this blog post, I found a useful link on TechNet –  This link contains more details about how to read and interpret the following log files:

  • %windir%\WindowsUpdate.log

  • %windir%\logs\cbs\cbs.log

It includes a table of common errors that can appear in a cbs.log along with possible resolutions or workarounds.

<update date=”12/2/2009″> Added a link to a table of Windows Update Agent error codes that can appear in %windir%\WindowsUpdate.log and can be helpful in troubleshooting OS update installation issues in some cases. </update>


Comments (33)

  1. paulmcdaniel says:

    I’m actually hitting this same problem you talk about here (0x800f0818) .  how did you solve this final problem ?

  2. Hi Paul_mcdaniel – That particular issue that I quoted in this example was from one of my co-workers here at Microsoft.  It ended up being the result of some problem with the OEM OS image that was pre-installed on their system.  What is the exact make and model of your computer?

  3. TerryCheng says:

    Hi Aaron, I scanned Windows server 2008 after imaging with the image craeted in Janaury 2009.  KB951847 keeps showing up.  Please forgive my ignorance for not being able to find it anywhere.  Do you have happen to have that lkink handy?  many thanks.

  4. Hi TerryCheng – I’m not sure I understand your question here.  KB951847 is the knowledge base article for the .NET Framework 3.5 SP1 (  Are you looking for the download link for the .NET 3.5 SP1 installer?  If so, you can find that at  Hopefully this helps.

  5. Neal Thomson says:

    Hi, I checked the install log and got this error:

    [04/02/10,22:56:25] Microsoft .NET Framework 3.0SP1 (CBS): ***ERRORLOG EVENT*** : Error: Installation failed for component Microsoft .NET Framework 3.0SP1 (CBS). MSI returned error code 38

    It was repeated several times in the log. However, I did try to install several times so it may be once per install.

    I also had the following at the end of the log:

    04/03/10,09:21:08] WapUI: ***ERRORLOG EVENT*** : DepCheck indicates Microsoft .NET Framework 3.0SP1 (CBS) is not installed.

  6. Neal Thomson says:

    Here is the data from the cbs log:

    0-04-03 09:20:19, Info                  CBS    WER: Generating failure report for package: Package_for_KB948610~31bf3856ad364e35~x86~~6.0.6001.2123, status: 0x80070026, failure source: Execute, start state: 4, target state: 7

  7. Hi Neal Thomson – I’d suggest trying the tool and the 3 steps listed at the end of the blog post at to see if they help you resolve this error.

  8. Neal Thomson says:

    Ok, I ran the system update readiness program. It found 3 errors in package manifests and catalogs (fixed all three plus replaced the paired files, , 13 errors in the component store and fixed 11 of them. Here is what was left:

    Unavailable repair files:



    So what next? delete the registry references to these? The only way I have ever edited my registry is with hijack this. Is it ok to use that here?

  9. Neal Thomson says:

    Good news, ran the tool, it fixed a bunch of stuff. There were two things it could not fix, but the turn features on and off screen was no longer blank so I tried patching the .net 3.5 SP1 and it worked. I then was able to download a windows vista SP2 I was never offered before. I’m running fine now and Turbotax loaded finally 🙂

    Thanks, your fix was the ONLY one that worked!

  10. Hi Neal Thomson – I’m glad to hear that you were able to finally get Windows Vista SP2 and TurboTax to install correctly, but I’m very sorry for all of the hassles that these issues caused for you.  Please don’t hesitate to contact me if you run into any additional issues in the future.

  11. System Update Readiness Tool says:

    I came across this today and it helped me install Win7 64bit SP1 update. Before I ran the toll the updat ekept crashing with 80070005 error.


    What is the System Update Readiness Tool?

    The System Update Readiness Tool can help fix problems that might prevent Windows updates and service packs from installing. For example, an update might not install if a damaged system file prevents the update from recognizing the version of Windows that's running on your computer.

    If your computer is having problems installing an update or a service pack, download and install the tool, which runs automatically. Then, try installing the update or service pack again.

  12. Seth says:

    i dont even know what to do…………

    never done this before……………..


  13. Hi Seth – Can you please use the tool described at…/6458047.aspx to collect all of your setup log files, upload the file named that this tool will create to a file server (such as, and then reply back here and post a link that I can use to download your log files and take a closer look?

  14. Seth says:

    Sure, thanks, i really suck at this.

    best help ive gotten in a whole week

  15. Hi Seth – This is the error that is causing the VC++ redistributable to fail to install on your computer:

    Error 1935.An error occurred during the installation of assembly 'Microsoft.VC90.ATL,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32"'. Please refer to Help and Support for more information. HRESULT: 0x800736B3. assembly interface: IAssemblyCacheItem, function: Commit, component: {CE3230AC-E72E-3EDF-8A57-87FCE1CF2629}

    Error code 0x800736B3 means "The referenced assembly is not installed on your system."  For this type of error, I suggest trying the following steps:

    1.  Install the latest Windows service pack if you haven't yet.

    2.  Try to use SFC to repair the files that are a part of your OS by using the steps at…/how-to-repair-the-net-framework-2-0-and-3-0-on-windows-vista.aspx.

    3.  Try downloading and running the System Update Readiness Tool from…/947821.

    4.  If none of the above help, it might be necessary to repair/re-install Windows to solve this type of problem.

  16. Seth says:

    1)tried, it failed with error 7×80070643

    2)ran the commmand, it worked. however, i got this:

    Verification 100% complete.

    Windows Resource Protection found corrupt files but was unable to fix some of them.

    details are included in the CBS.Log windirLogsCBSCBS.log. For example C:WindowsLogsCBSCBS.log


    3)updater downloaded and installed correctly, found out i had 94 something updates that needed to be installed. even after downloading and running system update readiness tool, it still did did not help them install(also restarted, didn't help).

    4)did that a somewhat earlier, didn't resolve it(did resolve some unrelated wonky stuff).

    no idea what to make of it all. maybe my computer just sucks….

  17. Hi Seth – Based on these results, it sounds like your OS is in a state where no updates can be installed.  There are some steps listed in the knowledge base article at…/929833 that might help you repair the files that SFC was not able to repair in step 2.

    If that doesn't help, then I think you will need to repair/re-install Windows to solve this problem.  I haven't yet seen a case where repairing/re-installing Windows didn't help solve this problem, so I'm not sure what exactly you did in step 4 previously that caused it to not fix this issue.  I think you may need to try that step again.

  18. Seth says:

    alright, down to the command:

    "TAKEOWN /f" C:WindowsSystem32tcpmon.ini

    and i get:

    The system cannot find the path specified.

    in scfdetails.txt, it states(at least i think) the path as being C:

    any ideas?

  19. Hi Seth – Do you have that tcpmon.ini file at that path on your computer?  If not, I'd suggest doing a search to see if you have it anywhere else on your computer, and if you don't have it anywhere else, you might need to copy it from your original Windows installation disc or from another computer.

  20. Seth says:

    tracked the file down through two paths, it was there in both instances, yet it still "could not find the specified path"

    how would i copy it from my  installation disc without reinstalling windows?

  21. Seth says:

    Tried the takeown command on another computer(i do not own this one) and im pretty sure that that computer is perfectly fine(not sure though), it said it could not find the path specified, just like on my computer.

  22. Hi Seth – If you're getting the same "couldn not find the specified path" error on a computer where that file is correctly installed, then I think that is probably a false positive and not the actual root cause of the errors you're seeing.

    In previous versions of Windows, SFC would prompt you for your original OS installation disc if it needed to re-install missing files.  However, it doesn't do that on Windows Vista and higher, so I'm not sure how to copy from the installation disc.  You might have to try to copy missing files from a working computer that is running the same version of Windows that is on your non-working computer.

    You might also want to try to contact Microsoft technical support for additional troubleshooting assistance with this issue.  You can find contact information for them at

  23. Seth says:

    still have not come up with anything x_x.

    i do however think that if my computer becomes able to install updates a lot of problems would become fixed…

    since it is probably not tcpmon.ini etc…., where and what do you think the problem file(s) is/are? i'll try to look for it and try the same thing as with the tcpmon.ini

    i also think i might know a possible way to get the files from the installation disk.. possibly….

    any help is greatly appreciated. thanks!

  24. Hi Seth – The exact files that are causing problems should be listed in cbs.log after running SFC.exe, and you should be able to find them by using the steps listed in the knowledge base article at…/929833.

    If that doesn't help, then I think you'll need to repair/re-install Windows or contact Microsoft technical support to solve this type of problem.

  25. Seth says:

    is remote assistance an option?

    then you could directly look at my computer, easily see for yourself what you are looking for, and make fixes.

  26. Hi Seth – I'm sorry, but I'm not able to provide remote assistance support via my blog.  That is something that the Microsoft support team can provide though, so I encourage you to look at the information at for support options for this issue.

  27. Seth says:

    alright, thank you for your help, it has been absolutely AWESOME in helping me narrow down on my solutions.

    before RA, i might try to request microsoft to mail me a hard copy(i do not currently have a copy on disk) of windows 7 home premium(i have a product key for the preinstalled W7HP on my computer) as i read recently while searching that in order for scf to actually fix corrupt or missing files, the installation disk must be inserted into the drive.

  28. Hi Seth – If you bought a computer with Windows 7 pre-installed on it, I think you'll need to contact your computer manufacturer (as opposed to Microsoft) to get an installation disc.

    SFC used to prompt for the original OS installation disc on older versions of Windows (such as Windows XP and earlier).  I'm not sure it prompts for the OS installation disc on Windows Vista or Windows 7 though.  If you don't have the installation disc, you might need to try to copy the files from another Windows 7 computer or get copies of them from somewhere else, like what is described at…/929833.

  29. Seth says:

    alright, but does it need a prompt if the disk is already in the drive?

    just disable autoplay for the disk?

  30. Hi Seth – I'm not sure what the behavior is if the disc is in the drive.  Based on the information in that knowledge base article, I don't think it will automatically pick up the files from there though.  I think you will have to manually copy over the files that it reports are missing.

  31. Seth says:

    okay, getting some support from the windows forums, link here if you would like to read. thank you for all your help, it might actually be possible to bring my computer out of the stone age.…/18dfb0c0-70eb-4583-b89b-e54a42215c35

  32. Hi Seth – Thank you for the link back, and thank you for the kind words from you and from the MVP who is helping you.  I will keep an eye on that thread, and hopefully you'll be able to resolve this issue shortly.