splinterededge
New Member
- Messages
- 4
- Reaction score
- 2
Host: 26H2, build 26300.9457, Enterprise.
Removed Security > Code Integrity.
Everything else on the box is fine; this only shows up at servicing time.
Symptom: cumulative updates are staged then fail in the boot-time primitive operations phase and roll back.
This is not a permissions problem. I compared the ACL on Control\CI\Protected against a clean reference host: SYSTEM holds KEY_ALL_ACCESS on both, and a manual RegOpenKeyEx with KEY_SET_VALUE succeeds while the following RegSetValueEx returns ERROR_ACCESS_DENIED. The refusal is above the ACL layer, from the kernel CI callback that still guards the key after the component is gone.
Two supporting signs on the test box, both absent on the reference:
Win32_DeviceGuard provider load failure, 0x80041013 (provider removed)
CI\Policy\SAC_PreviousState -1, with SAC_EnforcementReason missing entirely
(reference: 2 and 5)
So the kernel-side control survives the removal while the state it validates does not, and any LCU that touches CI state cannot commit. Not recoverable afterwards either: the packages are out of the component store, so RestoreHealth has nothing to pull from.
Request: include Code Integrity under the "Windows Update" compatibility protection so it is held back when that option is on.
Notably, there were some odd permission at that key after removal, but my problem was solved by not removing Code Integrity and App Control.
Removed Security > Code Integrity.
Everything else on the box is fine; this only shows up at servicing time.
Symptom: cumulative updates are staged then fail in the boot-time primitive operations phase and roll back.
Code:
KB5127648 (LCU) 0x80070005
KB5127694 (.NET CU) 0x800F0922
CBS.log, at the reboot:
CSI (F) STATUS_ACCESS_DENIED from SysSetValueKey(
key = '\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Protected',
vn = 'VerifiedAndReputablePolicyStateMinValueSeen', data = 02000000)[gle=0xd0000022]
CBS Failure in poqexec.exe while processing updates. [0x80070005 - E_ACCESSDENIED]
CBS Startup: Primitive operations failed [0x800f0921 - CBS_E_PRIMITIVES_FAILED]
CBS Setting ExecuteState key to: CbsExecuteStateInitiateRollbackThis is not a permissions problem. I compared the ACL on Control\CI\Protected against a clean reference host: SYSTEM holds KEY_ALL_ACCESS on both, and a manual RegOpenKeyEx with KEY_SET_VALUE succeeds while the following RegSetValueEx returns ERROR_ACCESS_DENIED. The refusal is above the ACL layer, from the kernel CI callback that still guards the key after the component is gone.
Two supporting signs on the test box, both absent on the reference:
Win32_DeviceGuard provider load failure, 0x80041013 (provider removed)
CI\Policy\SAC_PreviousState -1, with SAC_EnforcementReason missing entirely
(reference: 2 and 5)
So the kernel-side control survives the removal while the state it validates does not, and any LCU that touches CI state cannot commit. Not recoverable afterwards either: the packages are out of the component store, so RestoreHealth has nothing to pull from.
Request: include Code Integrity under the "Windows Update" compatibility protection so it is held back when that option is on.
Notably, there were some odd permission at that key after removal, but my problem was solved by not removing Code Integrity and App Control.