Windows 2008 stuck on Configuring updates Stage 3 of 3

windowswindows-server-2008windows-update

I am having problems with my Windows 2008 Enterprise Server box. It is a VM set up as a file Server.

I did some Windows updates on few of my VMs today and they all ran fine, except this one, after a reboot, it is stuck on "Configuring updates: State 3 of 3 – 100% complete." I have read many people with this problem but theirs are stuck on 0%. This one is 100% and also, I can ping the server, access all the shares from the network, even browse to the C$ and do whatever I want. It is just stuck on that "Configuing updates…….100%"

When I browse to the C$ share and go to \Windows\winxsx I see pending.xml there, I can not delete it or take ownership.

I tried booting from the Windows 2008 DVD and go to command prompt, navigate to \Windows\winxsx but pending.xml is NOT there!!

My server shares are working, but I can not use the server

Best Answer

I have seen this state often but never where it persists beyond 1 or 2 reboots which from your answer it sounds like you have already tried.

Have you tried booting into SafeMode? IF you can get into safemode it may allow the update to complete (depending on why its failing).

If that doesn't work I would say you are looking at more drastic solutions. If this is only a fileshare server personally I would probably create a new VM to take over from it and then mount the old servers VHD to the new server so you still have files available.

If you need to persist in trying to get this server booting properly I would take a look at this article: http://pcsupport.about.com/od/findbysymptom/a/windows-update-frozen.htm

Personally however I would carefully weigh up the time it would take to build a replacement server (a known quantity) versus the unknown amount of time you could spend trying to fix this one!

Related Solutions

How to Assign Permissions to ApplicationPoolIdentity Account

Update: The original question was for Windows Server 2008, but the solution is easier for Windows Server 2008 R2 and Windows Server 2012 (and Windows 7 and 8). You can add the user through the NTFS UI by typing it in directly. The name is in the format of IIS APPPOOL\{app pool name}. For example: IIS APPPOOL\DefaultAppPool.

IIS APPPOOL\{app pool name}

Note: Per comments below, there are two things to be aware of:

Enter the string directly into the "Select User or Group" and not in the search field.
In a domain environment you need to set the Location to your local computer first.

Reference to Microsoft Docs article: Application Pool Identities > Securing Resources

Original response: (for Windows Server 2008) This is a great feature, but as you mentioned it's not fully implemented yet. You can add the app pool identity from the command prompt with something like icacls, then you can manage it from the GUI. For example, run something like this from the command prompt:

icacls c:\inetpub\wwwroot /grant "IIS APPPOOL\DefaultAppPool":(OI)(CI)(RX)

Then, in Windows Explorer, go to the wwwroot folder and edit the security permissions. You will see what looks like a group (the group icon) called DefaultAppPool. You can now edit the permissions.

However, you don't need to use this at all. It's a bonus that you can use if you want. You can use the old way of creating a custom user per app pool and assigning the custom user to disk. That has full UI support.

This SID injection method is nice because it allows you to use a single user but fully isolate each site from each other without having to create unique users for each app pool. Pretty impressive, and it will be even better with UI support.

Note: If you are unable to find the application pool user, check to see if the Windows service called Application Host Helper Service is running. It's the service that maps application pool users to Windows accounts.

Windows Updates Fails Server 2008 0x80070490

I happened to be researching this same error code this morning, and came across this MSDN blog post that might help: How to overcome error 0x80070490 when installing updates in Windows Vista/Server 2008

I was not able to get it working again by following his step-by-step, but the following did:

Open %windir%\logs\cbs\cbs.log. You'll likely need to run Notepad as Administrator in order to view it.
Go to the bottom of the log and do a find for "Error", making sure you choose up for the direction
This should bring you to one or more errors like the following:

2008-09-27 15:53:29, Error
CBS Failed to resolve Package: Package_for_KB905866~31bf3856ad364e35~x86~~6.0.22.0. hr: 0x80070490
Do a web search for the KB number of the update that failed (KB905866 in this case), which should bring you to a Microsoft page where you can download the stand-alone installer for this issue's patch
Download and install the appropriate version (32-bit, 64-bit, etc.)
The next time you run Windows Update, it will recognize that the update was installed.

Best Answer

Related Solutions

How to Assign Permissions to ApplicationPoolIdentity Account

Windows Updates Fails Server 2008 0x80070490

Related Topic