Greetings fellow Windows enthusiasts,

I was asked to update our Windows 2008 R2 server from IE 10 to IE11, and it will not install properly.  I have looked up several solutions to this issue, so far nothing has worked.

I disabled McAfee HBSS in safe mode, restarted the PC and tried to run Windows Update managed by a WSUS server.  The update gets approved and pushed out to the 2008 R2 server.  It downloads IE11, tries to install, then fails/errors-out at the last second.   I have tried this a few times, rebooted and either get error code 9C47 or 9C49.  

Some of the fixes I have tried:

• I turned of internet connectivity and the anti-virus, that did not work
• I tried the Windows Update repair tool, that did not work  
• I tried the Windows System Readiness tool, that did not work   
• I tried to scan the system files for errors with sfc /scannow and that did not work  
• I tried installing the other updates first, restarting and it still fails 
• I removed the server from WSUS and re-added it and it will not update   
• I tried the stand-alone IE11 installer, and it fails at the very last step and then gives me an error with a link to troubleshoot IE installations   
• I have uninstalled IE10, and now am totally stuck with the absolutely horrible experience of IE9 
• SURT returns no errors
• SFC returns no errors

None of the recommendations have worked so far.  

If there is anyone who has any other suggestions, it would be much appreciated!

Thank you kindly!

Log below
2015-10-22 11:24:22, Info                  CSI    0000000b@2015/10/22:15:24:22.838 CSI Transaction @0x1be4050 initialized for deployment engine {d16d444c-56d8-11d5-882d-0080c847b195} with flags 00000002 and client id [117]"TI1.30477533_3071408372:2/Microsoft-Windows-InternetExplorer-Package-TopLevel~31bf3856ad364e35~amd64~~11.2.9600.16428"

2015-10-22 11:24:22, Info                  CBS    Exec: Resolving Package: Microsoft-Windows-InternetExplorer-VistaPlus-Update~31bf3856ad364e35~amd64~~11.2.9600.16428, Update: Internet-Explorer-amd64
2015-10-22 11:24:22, Info                  CBS    Exec: Resolving Package: Microsoft-Windows-InternetExplorer-VistaPlus-Update~31bf3856ad364e35~amd64~~11.2.9600.16428, Update: Internet-Explorer-amd64, PinDeployment: amd64_microsoft-windows-i..explorer-deployment_31bf3856ad364e35_11.2.9600.16428_none_301e62752e193974
2015-10-22 11:24:22, Info                  CSI    0000000c Performing 1 operations; 1 are not lock/unlock and follow:
  AddCat (14): flags: 0 catfile: @0x25b6518
2015-10-22 11:24:22, Info                  CSI    0000000d Performing 1 operations; 1 are not lock/unlock and follow:
  Stage (1): flags: 8 app: [Microsoft-Windows-InternetExplorer-Deployment, Version = 11.2.9600.16428, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) comp: (null) man: @0x25b6488
2015-10-22 11:24:22, Info                  CSI    0000000e Stage component failed, manifest does not match previously staged manifest for identity
2015-10-22 11:24:22, Error                 CSI    0000000f@2015/10/22:15:24:22.901 (F) d:\win7sp1_gdr\base\wcp\componentstore\csd_transact.cpp(1370): Error STATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT originated in function CCSDirectTransaction::StageComponent expression: (null)
[gle=0x80004005]
2015-10-22 11:24:22, Error                 CSI    00000010 (F) STATUS_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT #71296# from CCSDirectTransaction::OperateEnding at index 0 of 1 operations, disposition 2[gle=0xd015001c]
2015-10-22 11:24:22, Error                 CSI    00000011 (F) HRESULT_FROM_WIN32(ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT) #70672# from Windows::ServicingAPI::CCSITransaction::ICSITransaction_PinDeployment(Flags = 0, a = Microsoft-Windows-InternetExplorer-Deployment, Version = 11.2.9600.16428, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, cb = (null), s = (null), rid = [115]"Microsoft-Windows-InternetExplorer-VistaPlus-Update~31bf3856ad364e35~amd64~~11.2.9600.16428.Internet-Explorer-amd64", rah = (null), manpath = [188]"\\?\C:\Users\ADMINI~1\AppData\Local\Temp\E4553BC5-E188-42A1-ABAB-26327DF15B46\amd64_microsoft-windows-i..explorer-deployment_31bf3856ad364e35_11.2.9600.16428_none_301e62752e193974.manifest", catpath = [173]"\\?\C:\Users\ADMINI~1\AppData\Local\Temp\E4553BC5-E188-42A1-ABAB-26327DF15B46\Microsoft-Windows-InternetExplorer-VistaPlus-Update~31bf3856ad364e35~amd64~~11.2.9600.16428.cat", ed = 0, disp = 0)[gle=0x80073715]
2015-10-22 11:24:22, Info                  CBS    Failed to pin deployment while resolving Update: Internet-Explorer-amd64 from file: \\?\C:\Users\ADMINI~1\AppData\Local\Temp\E4553BC5-E188-42A1-ABAB-26327DF15B46\amd64_microsoft-windows-i..explorer-deployment_31bf3856ad364e35_11.2.9600.16428_none_301e62752e193974.manifest [HRESULT = 0x80073715 - ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT]
2015-10-22 11:24:22, Info                  CBS    Failed to resolve item[0] in Package: Microsoft-Windows-InternetExplorer-VistaPlus-Update~31bf3856ad364e35~amd64~~11.2.9600.16428, Update: Internet-Explorer-amd64 [HRESULT = 0x80073715 - ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT]
2015-10-22 11:24:22, Info                  CBS    Failed to resolve execution update. [HRESULT = 0x80073715 - ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT]
2015-10-22 11:24:22, Error                 CBS    Failed to resolve execution package: Microsoft-Windows-InternetExplorer-VistaPlus-Update~31bf3856ad364e35~amd64~~11.2.9600.16428 [HRESULT = 0x80073715 - ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT]
2015-10-22 11:24:22, Info                  CSI    00000012@2015/10/22:15:24:22.948 CSI Transaction @0x1be4050 destroyed
2015-10-22 11:24:22, Info                  CBS    Perf: Resolve chain complete.
2015-10-22 11:24:22, Info                  CBS    Failed to resolve execution chain. [HRESULT = 0x80073715 - ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT]
2015-10-22 11:24:22, Error                 CBS    Failed to process single phase execution. [HRESULT = 0x80073715 - ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT]
2015-10-22 11:24:22, Info                  CBS    WER: Generating failure report for package: Microsoft-Windows-InternetExplorer-Package-TopLevel~31bf3856ad364e35~amd64~~11.2.9600.16428, status: 0x80073715, failure source: Resolve, start state: Absent, target state: Installed, client id: DISM Package Manager Provider
2015-10-22 11:24:22, Info                  CBS    Failed to query DisableWerReporting flag.  Assuming not set... [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2015-10-22 11:24:22, Info                  CBS    Failed to add %windir%\winsxs\pending.xml to WER report because it is missing.  Continuing without it...
2015-10-22 11:24:22, Info                  CBS    Failed to add %windir%\winsxs\pending.xml.bad to WER report because it is missing.  Continuing without it...
2015-10-22 11:24:23, Info                  CBS    Reboot mark refs: 0

Hi..

We have the stage here where all of a sudden the sysvol data is not replicating to a DC across a VPN link. AD data is working fine.

I have checked

1.  DNS communication.

2 repadmin /showrepl does not show any problems.

The ntfrs log on the source DC shows these sort of failures to the target Server.

<SndCsMain:                     7744:   877: S0: 03:13:52> :SR: Cmd 003eaf70, CxtG ef15ea4b, WS ERROR_ACCESS_DENIED, To   OUHVDC1.i.omicron.de Len:  (308) [SndFail - rpc call]

<SndCsMain:                     7744:   904: S0: 03:13:52> :SR: Cmd 003eaf70, CxtG ef15ea4b, WS ERROR_ACCESS_DENIED, To   OUHVDC1.i.omicron.de Len:  (308) [SndFail - Send Penalty]

The ntfrs log on the target DC shows these sort of failures.

<FrsDsGetSubscriptions:        2036:  8952: S0: 13:06:12> :DS: No NTFRSSubscriptions object found under cn=ouhvdc1,ou=domain controllers,dc=i,dc=omicron,dc=de!.

The output of ntfrsutl ds command is on the target DC is

NTFRS CONFIGURATION IN THE DS

SUBSTITUTE DCINFO FOR DC

  FRS  DomainControllerName: (null)

  Computer Name           : OUHVDC1

  Computer DNS Name        : OUHVDC1.i.omicron.de

BINDING TO THE DS:

  ldap_connect     : OUHVDC1.i.omicron.de

  DsBind     : OUHVDC1.i.omicron.de

NAMING CONTEXTS:

  SitesDn    : CN=Sites,cn=configuration,dc=i,dc=omicron,dc=de

  ServicesDn : CN=Services,cn=configuration,dc=i,dc=omicron,dc=de

  DefaultNcDn: DC=i,DC=omicron,DC=de

  ComputersDn: CN=Computers,DC=i,DC=omicron,DC=de

  DomainCtlDn: OU=Domain Controllers,DC=i,DC=omicron,DC=de

  Fqdn       : CN=OUHVDC1,OU=Domain Controllers,DC=i,DC=omicron,DC=de

  Searching  : Fqdn

COMPUTER: OUHVDC1

  DN   : cn=ouhvdc1,ou=domain controllers,dc=i,dc=omicron,dc=de

  Guid : 08e600fe-5cd2-4f45-b2932d7258f5291e

  UAC  : 0x00082000

  Server BL : CN=OUHVDC1,CN=Servers,CN=OUHV,CN=Sites,CN=Configuration,DC=i,DC=omicron,DC=de

  Settings  : cn=ntds settings,cn=ouhvdc1,cn=servers,cn=ouhv,cn=sites,cn=configuration,dc=i,dc=omicron,dc=de

  DNS Name  : OUHVDC1.i.omicron.de

  WhenCreated  : 9/24/2012 10:6:1 GMT Standard Time GMT Daylight Time [0]

  WhenChanged  : 10/19/2015 13:55:54 GMT Standard Time GMT Daylight Time [0]

  OUHVDC1 IS NOT A MEMBER OF ANY SET!

DCdiag seems to show no errors.

Anyone any ideas ? I know a non restore can be done using the burflags entry but that probably wont fix the issue.

Could this reported No NTFRSSubscriptions object casue the access denied failures on the the source DC ?

Thanks for any replies.

Hi,

I need your help with Task Scheduler issue. I have configured application to start with system (option for not logged user has been checked). After server reboot, application is not starting automatically. Status of application is "Queueled". When I next run this task manually, then application start correctly. 

In Task Sceduler on "History" tab, there is info about Event ID 325 but I can't find nothing constructive about that. Did you met with something similar? Thank you for any advices.

P.S> Application which I trying start automatically, on other servers , starts normally. My server is Windows 2012 R2.

I have a 2008 R2 enterprise CA, that I am trying to 'move' to a 2012 R2 server. there aren't too many certificates issued by the existing CA, and our company has gone through an acquisition and a name change since the existing CA was stood up. the ca is named after our 'old' company name. so I am considering just bringing up a new CA on the 2012 server with the new company name, recreating all the existing certs, and then removing the old CA.

is there any concern or known caveats regarding (temporarily) having two CAs running in parallel in one windows domain?

I am posting this here as my Laptop has been turned into a Windows server without my consnet. I do have Group Policy setup but I have no control over the contents.

I need help with a serious hacker issue. Someone, somehow has complete control over my system. I have a Dell Vostro V13 laptop running Windows 7 Home Premium 64bit. Memory is 4 GB DDR301333MHz SDRAM, 1DIMM with Intel Core Processor ULV i30380UM (3M Cache, 1.33GHz, 800MHz FSB). It has a 500GB SATA Hard Drive. This issue has been going on for some time now (possibly up to 1 year) but it has gotten much worse as time has gone on and the hacker(s) have gained more control over my system. This actually started on a previous laptop I had.

The hackers have turned my machine into a server and are using it to either play games or to resell bootlegged software and or maybe to gain personal information on me. Not entirely certain of their motives but it has caused me many, many problems. At one point I found a reference to allowing up to 100 client connections into my new Dell server. Here are some of the odd things I see.

My OS Build Version shows 6.1.7600 Build 7600. When I run the Dell diagnostics utility is show something in the 4,000 range. This is the same build version I showed on my previous Laptop but it had the Home Starter Windows Package loaded.

My boot device is \device\Harddiskvolume1. I don´t know if this is strange or not. My hard disk is 0.

I have been placed into a domain and do not have complete administrative control over my system. I have admin rights but the domain server admin has more rights than I do and this person is the hacker.

Installed Physical Memory is 4GB
Total Physical Memory is 3.8GB. I believe the hacker has used some of my memory allocation to reside their malicious software.
Available Physical Memory is 3.35. This is after a safe boot load.
Total Virtual Memory is 7.6 GB. I have tried to uninstall the virtual memory but it keeps coming back.
Available Virtual Memory 7.14.
Page File Space 3.8GB. I have tried to delete the page file but I can´t. I also have what is called a hiberfil.sys file on my system and this is currently 4GB in size and I can not delete it.
Page File c:\pagefile.sys

I am now fairly convinced my problem is somewhere in the memory. I think a Ramdrive or Ramdisk loads at boot. I have a 500GB hard drive but I can only see 465BG. The remaining disk space is reserved for a X: drive that I can only see and navigate to when I get into a System Restore mode and get into the command prompt. Once I get into the z: drive I can see all sorts of files that I do not believe belong there. I have attempted to remove the files but they all recover at my next boot. I have even seen them recreate themselves before my very eyes after I deleted them. I can´t delete every file. Many are protected and I do not have the sufficient admin rights to delete them nor can I can gain those rights. I have tried to reformat the z: drive but I have been unsuccessful. I get a write protected error I have however been able to format the c: drive but this did not resolve the problem.  I have now reloaded the OS over 20 times in the past month and this is now becoming clear that it will never solve my problem. When I run the set command from the c: drive many of the settings are different than when I run that command from the z: drive. As an example the Computer Name is different. It is as if I have two computer´s and two OS ´running at the same time. One for the Domain Administrator (i.e, hacker) with complete control and one for me which allows the hacker to see everything I do and to prevent me from gaining access to my own machine.

I believe the hacker has a system image and has a CDROM capable reboot. I do not have the technical knowledge to understand how this all works but I do now this person is accessing my system at blinding speeds. He or she is somehow contacted every time I gain network access as the moment I get online they are in my system. I have tried to prevent this via the firewall but last night the hacker just deleted my firewall. They also took over my USB dongle I was using for Internet access. They change the PIN on one of my SIM Chips which prevented me from accessing the service. I had another SIM Chip with a PIN already programmed into it and they just modified the USB software to disallow the use of a PIN. I watched as this person had internet access via my system and I was denied access somehow. One thing that I am preplexed about is how this hacker is gaining access to my Laptop. They seem to be able to access it even when I am not connected to the internet. I have found hidden files that are called hiddenpbx. I do not know if this is a back door or not. I delete the files but they always come back.

When I look at my memory resources I see IRQ 81 to IRQ 190 reserved for a device called Microsoft ACPI Compliant System. This seems odd to me. This is a lot of upper memory reserved for something.

All my Dell devices that came reinstalled have been replaced with some generic devices of unknown origin or these so called Microsoft Compliant Devices. Every time I reinstall the devices they last a day and then are replaced.

Every time I reload the OS I run across strange log files that reference this x: drive. It appears as if the OS is actually being reloaded with some bogus or bootlegged OS vs the being loaded from the OS CD Dell sent to me.

There is all sorts of information I can provide, but I am not certain what would be most beneficial. I need to leave this up to the experts. So if someone could raise their hand and give me some help I would appreciate. I know someone out there in cyberspace can fix this problem without too much sweat, but I do know this issue has gone on for some time now and this hacker now has complete control over my system. I understand it may take some time to undo what this person or these people have spent many hours creating, but I need my system back. I would be willing to offer some sort of compensation to the person who can get my system back into my hands. I do not have much money but I will certainly offer what is deemed fair in this situation. I am at the point where I just want to throw this Laptop into the thrash can.

I can´t spend a lot of time speculating as to what may be the problem. I need to know what the problem is and to have it fixed. I currently am not using that machine to access the internet or to send this Post. I have to use an Internet Cafe so my access to the internet is much more restricted.

Thanks in advance for any help someone my be able to provide.

Hi,

We are using Windows Server 2008 R2 HyperV host (in general one per branch office) with typically as VM a DC, a file server, an Exchange server and a DPM backup server. the DC and the file server use DFSR as replication technology. We noticed that when the HyperV host enter his maintenance windows, install the update and reboot, sometime the VM's are not cleanly turned off leading our DFSR to a dirty state like described in this article : Understanding DFSR Dirty (Unexpected) Shutdown Recovery

What could be the best practice to be sure that the VM are cleanly turned off ? There are many "solutions" that I can figure out but they are all "ugly" and involve some scripting or reactivating the DFSR Autorecovery...

Is there any "magical" setting that could be set in SCCM or in HyperV to be sure that this problem doesn't occur anymore ?

Thanks !

I'm sure this is an obvious one but can't figure it out.

I have a Winserver 2008 Sp2 (x86) DC with a static IP address allocated to its only NIC.  It seems to have acquired a second 169.254.x.x address automatically which I can't get rid of and which intermittently causes DNS problems (and possibly other) problems.

ipconfig results are shown below:

-----------------------------------------------------------------------------

C:\Users\Administrator.STRATIS2>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : STRATIS-SVR02
   Primary Dns Suffix  . . . . . . . : stratis2.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : stratis2.local

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) PRO/1000 XT Network Connection
   Physical Address. . . . . . . . . : 00-0F-1F-67-B8-CE
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.11.128.1(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   IPv4 Address. . . . . . . . . . . : 169.254.140.227(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . : 10.11.128.99
   DNS Servers . . . . . . . . . . . : 10.11.128.1
                                       10.10.128.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Local Area Connection* 8:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : isatap.{D60B08E6-D119-4CB8-BD18-380B7ED48
771}
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 9:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 02-00-54-55-4E-01
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

-----------------------------------------------------------------------------

Any ideas as to how this might have happened and how I get rid of it (a simple re-boot doesn't do the job).

Hi Everybody,

Please help me on getting the location of workstation in AD in properties,  we are using server 2012

Can it be done by GPO or By ShellScript?

Thank you

Regards,

Chinmay

Hi Everyone,

I am having difficulty troubleshooting what is causing my RPC Service to crash. Unfortunately Event viewer is not so helpful, it just tells me the service crashed and the pc has restarted. The event logs before or after that also does not help too much they appear to be normal logs, nothing indicating any errors.

also a lot of people indicate that its related to viruses etc, but I am 100% sure there is no viruses on this server. 

Is there a way we can troubleshoot or switch on some kind of logging that will be able to tell me what is causing the RPC to fail, or at least to see what the last application\service is to call on the RPC Service etc?

Kind Regards,

Stuart 

Hi,

I have a requirement to setup a Superscope our domain because we have run out of IP addresses.

We are using RRAS on the Server to route traffic from our 192.168.100.0 network to our external10.0.40.0 network.

Because, we want the machines on the 192.168.100.0 network to get external internet access.

This all works fine.

But, I can't get it to work when I try to add a new range.

This is what I have done.

• The NIC that is dealing with the External traffic has been left the same. (No changes here)
• I have added an additional IP address to the Internal NIC. (Address 192.168.200.1)
• So the Internal NIC now has two addresses - 192.168.100.1 and192.168.200.1
• From a machine on the 192.168.100.0 network I can ping the external NIC address10.0.40.0 and the internet.
• From a machine on the 192.168.200.0 network I can ping the external NIC address10.0.40.0 but everything else doesn't respond.

So it appears that routing is taking place, as a host on the 192.168.200.0can get to the external interface of the server but not past it.

What could I be doing wrong?

Thanks

Hi,

Windows Server 2008 R2 SP1.

Try to install KB2577795.

get error 



i have installed JRE installed in my laptop

i am using window 7

I AM GETTING PROBLEM WHILE INSTALLING JDK

"A path semi-colon in it, is not supported for htis product

sorry for my english .I have questation about Windows update . If I set manual install Windows upates , etc. with gpo and install some updates . The updates inform about restart neceseary . But if I cancel restart request  , when is machine restarted ? Or after time is display information about restart ?

thanx

Falcon

Folder redirection is not working for recently migrated windows 10 pro clients in a win server 2008 R2 environment.  I have seen postings for other server versions which talk about WMI filters, but my folder redirect GP says it has no WMI filters set.

HELP!

Geeks,

I've created a task to be run manually on demand, where this task would execute a sql file on the local mysql database.

The below is the actions of this task-

Program to run

"C:\Program Files\MySQL\MySQL Server 5.6\bin\mysql.exe"

and their paramters-

-v -h dcw01 -u root -p******* < \\room.com\root-1\Scripts\Import_Nameslist.sql --tee=H:\desktop\imports.log

The task completes its execution successfully, but after its execution when i check the server, i dont see the sql file being executed.

The task history says-

Log Name:      Microsoft-Windows-TaskScheduler/Operational
Source:        Microsoft-Windows-TaskScheduler
Date:          10/26/2015 11:34:21
Event ID:      201
Task Category: Action completed
Level:         Information
Keywords:      
User:          ROOM\clus_svc
Computer:      dcw01.room.com
Description:
Task Scheduler successfully completed task "\Import Nameslist.sql" , instance "{0eb3325a-8996-4554-8b6f-044e0b801974}" , action "C:\Program Files\MySQL\MySQL Server 5.6\bin\mysql.exe" with return code 1.

Kindly suggest how can i make it exeute this sql file. Its very important for me to execute this file by automation.

Cheers, Alan.