Microsoft Updates Blue Screen: Recovering After a Crash

So Microsoft have done it again, released a batch of updates and our machines start to blue screen!

Problem Updates

From what we have experienced so far are that the following updates are the culprits and should be uninstalled where possible:

• KB4015217
• KB4041676
• KB4041691

Removing the Updates

If you still have access to Windows, open up an elevated command prompt and run these following commands in turn:

dism.exe /online /remove-package /packagename:Package_for_RollupFix~31bf3856ad364e35~amd64~~14393.1715.1.10 /norestart

dism.exe /online /remove-package /packagename:Package_for_RollupFix_Wrapper~31bf3856ad364e35~amd64~~14393.1770.1.6 /norestart

dism.exe /online /remove-package /packagename:Package_for_KB4014329~31bf3856ad364e35~amd64~~10.0.1.0 /norestart

Once these have been removed, reboot your server and it should go back into Windows.

Clearing Pending Updates

If this does not work for you, but you still have access to Windows, Microsoft advise putting the following script into a batch file and running it from an elevated command prompt:

@echo off

REM Stop all update related services
net stop usosvc
net stop wuauserv
net stop trustedinstaller

REM Delete pending.xml if it exists
takeown /f %windir%\winsxs\pending.xml >NUL 2>&1
icacls %windir%\winsxs\pending.xml /grant Everyone:F >NUL 2>&1
del %windir%\winsxs\pending.xml >NUL 2>&1

REM Modify the components hive
reg unload HKLMComponents >NUL 2>&1
reg load HKLMComponentsHive %windir%\system32\config\COMPONENTS
reg delete /f HKLMComponentsHive /v PendingXmlIdentifier >NUL 2>&1
reg delete /f HKLMComponentsHive /v PoqexecFailure >NUL 2>&1
reg delete /f HKLMComponentsHive /v ExecutionState >NUL 2>&1
reg delete /f HKLMComponentsHive /v RepairTransactionPended >NUL 2>&1
reg delete /f HKLMComponentsHive /v AIFailureInformation >NUL 2>&1
reg delete /f HKLMComponentsHiveInstallersRegKeySDTable /v Install >NUL 2>&1
reg delete /f HKLMComponentsHiveInstallersRegKeySDTable /v Uninstall >NUL 2>&1
reg delete /f HKLMComponentsHiveInstallersRegKeySDTable /v Uninstall >NUL 2>&1
reg unload HKLMComponentsHive

REM Stop Poqexec from running
reg delete /f HKLMSoftwareMicrosoftWindowsCurrentVersionSideBySideConfiguration /v DontRunPoqexecInSmss >NUL 2>&1
reg delete /f HKLMSoftwareMicrosoftWindowsCurrentVersionSideBySideConfiguration /v PoqexecCmdline >NUL 2>&1
reg delete /f "HKLMSystemCurrentControlSetControlSession Manager" /v SETUPEXECUTE >NUL 2>&1
REG ADD "HKLMSystemCurrentControlSetControlSession Manager" /v SETUPEXECUTE /t REG_MULTI_SZ /d  /f

dism /online /remove-package /PackageName:Package_for_RollupFix_Wrapper~31bf3856ad364e35~amd64~~15063.674.1.8 /norestart >NUL 2>&1
dism /online /remove-package /PackageName:Package_for_RollupFix_Wrapper~31bf3856ad364e35~x86~~15063.674.1.8 /norestart >NUL 2>&1
dism /online /remove-package /PackageName:Package_for_RollupFix_Wrapper~31bf3856ad364e35~amd64~~14393.1770.1.6 /norestart >NUL 2>&1
dism /online /remove-package /PackageName:Package_for_RollupFix_Wrapper~31bf3856ad364e35~x86~~14393.1770.1.6 /norestart >NUL 2>&1

Blue Screened Machines (BSOD)

What if your machine is already screwed and you are getting the blue screen? Well, you will need to get into the advanced options after your machine has blue screened. When it tries to boot up again you should get a message like this: Click on the Advanced options button which will take you to the Advanced options screen: Go ahead and click on the Command Prompt. Once the command prompt launches, run the following to load the software registry hive:

reg load hklmtemp c:\windows\system32\config\software

Run the following command to delete the SessionsPending registry key. If the registry value does not exist, proceed to the next step:

reg delete “HKLMtempMicrosoftWindowsCurrentVersionComponent Based ServicingSessionsPending” /v Exclusive

Run the following to unload the registry:

reg unload HKLMtemp

Run the following command, which will list all pending updates:

Example: dism.exe /image:c: /Get-Packages

Run the following command for each packages where “State = Install Pending”:

dism.exe /image:c: /remove-package /packagename:<package name>

Example:

dism.exe /image:c: /remove-package /packagename:Package_for_RollupFix_Wrapper~31bf3856ad364e35~amd64~~14393.1770.1.6

Close the Command Prompt and click Continue to exit the recovery environment. Go ahead and reboot your machine and you should hopefully get yourself back into Windows. Remember if you are in a corporate environment and using WSUS/SUP/SCCM, do not approve these updates until Microsoft have put their house in order!

Free eBook

Download this guide as a free eBook by clicking the button below: Windows Updates Fix eBook

Comments

If you have any questions on our guide or if you have any feedback at all, please feel free to scroll to the bottom of our site and leave us a message below in the comments section.