Merge pull request #10142 from ryanberg-aquent/CI-8137

AB#8137: Troubleshoot Windows Update Error 0x8000FFFF

Author: ryanberg-aquent

support/azure/virtual-machines/windows/toc.yml

@@ -93,9 +93,9 @@ items:
       href: ../../../windows-server/installing-updates-features-roles/troubleshoot-error-shutdown-in-process.md?context=/troubleshoot/azure/virtual-machines/windows/context/context
     - name: Error Code 0x800f0831
       href: ../../../windows-server/installing-updates-features-roles/troubleshoot-windows-installation-error.md?context=/troubleshoot/azure/virtual-machines/windows/context/context
-    - name: Error code 0x80072f8f
-      href: ../../../windows-server/installing-updates-features-roles/troubleshoot-windows-update-error-0x80072f8f.md?context=/troubleshoot/azure/virtual-machines/windows/context/context
-  
+    - name: Error code 0x8000ffff
+      href: ../../../windows-server/installing-updates-features-roles/troubleshoot-windows-update-error-0x8000ffff.md?context=/troubleshoot/azure/virtual-machines/windows/context/context
+      
 - name: Uploading a VHD to Azure
   items:
   - name: Uploading a VHD to Azure
@@ -295,7 +295,7 @@ items:
     - name: Error Code 0x800f0831
       href: ../../../windows-server/installing-updates-features-roles/troubleshoot-windows-update-installation-error-corruption.md
     - name: Error Code 0x8007045b
-      href: ../../../windows-server/installing-updates-features-roles/troubleshoot-error-shutdown-in-process.md 
+      href: ../../../windows-server/installing-updates-features-roles/troubleshoot-error-shutdown-in-process.md
   - name: Overview
     href: /azure/virtual-machines/instance-metadata-service?context=/troubleshoot/azure/virtual-machines/windows/context/context
   - name: Certificate Issues

support/windows-server/installing-updates-features-roles/media/troubleshoot-windows-update-error-0x8000ffff/0x8000ffff-1.png

@@ -0,0 +1,44 @@
+---
+title: Troubleshoot Windows Update Error 0x8000FFFF
+description: Learn how to resolve Windows Update installation error 0x8000FFFF on Windows.
+manager: dcscontentpm
+audience: itpro
+ms.date: 11/6/2025
+ms.topic: troubleshooting
+ms.reviewer: scotro, mwesley, jarretr, v-ryanberg, v-gsitser
+ms.custom:
+- sap:windows servicing,updates and features on demand\windows update fails - Install errors starting with 0x800F (CBS E)
+- pcy:WinComm Devices Deploy
+appliesto:
+  - <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Supported versions of Windows Server</a>
+---
+
+#  Troubleshoot Windows Update error 0x8000FFFF
+
+**Applies to:** :heavy_check_mark: Windows VMs
+
+## Summary
+
+During a Windows Update installation, you receive error code 0x8000FFFF. This error is usually related to the`CryptCATAdminAddCatalog` function.
+
+## Prerequisites
+
+For Microsoft Azure virtual machines (VMs) that are running Windows, make sure that you back up the OS disk. For more information, see [About Azure Virtual Machine restore](/azure/backup/about-azure-vm-restore).
+
+## How to identify the issue
+
+ This error is visible in the `Event Setup` and `CBS` logs after a failed update occurs.
+
+:::image type="content" source="./media/troubleshoot-windows-update-error-0x8000ffff/0x8000ffff-1.png" alt-text="Example of Windows Update error 0x8000FFFF in the Event Setup log" lightbox="media/troubleshoot-windows-update-error-0x8000ffff/0x8000ffff-1.png":::
+
+Although this error occurs without store corruption, it usually indicates corruption in *C:\Windows\System32\catroot2*.
+
+## Cause 
+
+This error is generally unexpected, and is usually considered to indicate a catastrophic failure. The `CryptCATAdminAddCatalog` process can be affected by corruption in the system files or folders, such as the *catroot2* folder.
+
+## Resolution
+
+For Windows-based computers, perform an [in-place upgrade](/windows-server/get-started/perform-in-place-upgrade#perform-the-in-place-upgrade). 
+
+For VMs that are running Windows in Azure, see [in-place upgrade on the Windows virtual machine](/azure/virtual-machines/windows-in-place-upgrade).

support/windows-server/installing-updates-features-roles/troubleshoot-windows-update-error-0x8000ffff.md

@@ -0,0 +1,61 @@
+---
+title: Troubleshoot Windows Update Error 0x80070bc9
+description: Learn how to resolve the Windows Update error 0x80070bc9 on Windows.
+manager: dcscontentpm
+audience: itpro
+ms.date: 11/6/2025
+ms.topic: troubleshooting
+ms.reviewer: scotro, mwesley, jarretr, v-ryanberg, v-gsitser
+ms.custom:
+- sap:windows servicing,updates and features on demand\windows update fails - installation stops with error\Windows Update - Install errors starting with 0x8007 (ERROR)
+- pcy:WinComm Devices Deploy
+appliesto:
+  - <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Supported versions of Windows Server</a>
+---
+
+# Troubleshoot Windows Update Error 0x80070bc9
+
+**Applies to:** :heavy_check_mark: Windows VMs
+
+## Summary
+
+The Windows Update error 0x80070bc9 occurs when the OS is stuck in a pending servicing state and the TrustedInstaller service can't clear it due to corruption in the *Transactional Entries* folder.
+
+## Prerequisites
+
+For virtual machines (VMs) running Windows in Azure, make sure that you back up the OS disk. For more information, see [About Azure Virtual Machine restore](/azure/backup/about-azure-vm-restore).
+
+## How to identify the issue
+
+Check the `CBS.log` file located at *C:\Windows\Logs\CBS\CBS.log* for entries indicating this error (0x80070bc9) similar to the following one:
+
+```output
+2025-04-02 07:15:53, Info  CBS    Session: 31171520_2564643148 initialized by client DISM Package Manager Provider.
+2025-04-02 07:15:53, Info  CBS    Enumerating Foundation package: Microsoft-Windows-ServerCore-Package~31bf3856ad364e35~amd64~~6.2.9200.16384, this could be slow
+2025-04-02 07:15:55, Info  CSI    00000003 CSI Store 616570675040 (0x0000008f8e79df60) initialized
+2025-04-02 07:15:55, Info  CSI    00000004 Transaction merge required, do-not-merge flag passed.
+2025-04-02 07:15:55, Info  CSI    00000005@2025/4/2:11:15:55.656 CSI Transaction @0x8f8fa30210 initialized for deployment engine {d16d444c-56d8-11d5-882d-0080c847b195} with flags 00000002 and client id [26]"TI5.31171520_2564643148:1/"
+2025-04-02 07:15:55, Info  CSI    00000006 Pending transaction content must be resolved, cannot begin another transaction yet
+2025-04-02 07:15:55, Info  CBS    <span style="color:red"><b>Failed to get transaction analysis because of pending operations. Disposition from Analyze: 0x1 [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]</b></span>
+2025-04-02 07:15:55, Info  CBS    Failed to get inventory. [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]
+2025-04-02 07:15:55, Info  CSI    00000007@2025/4/2:11:15:55.658 CSI Transaction @0x8f8fa30210 destroyed
+2025-04-02 07:15:55, Info  CBS    <span style="color:red"><b>Failed to get CSI Inventory [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]</b></span>
+2025-04-02 07:15:55, Info  CBS    Failed to get component state. [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]
+2025-04-02 07:15:55, Info  CBS    Failed to get current state of the deployment [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]
+2025-04-02 07:15:55, Info  CBS    <span style="color:red"><b>Failed to get Transaction State for package: Microsoft-Windows-NetFx3-Server-OC-Package~31bf3856ad364e35~amd64~~6.2.9200.16384, update: NetFx3 [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]</b></span>
+2025-04-02 07:15:55, Error CBS    Failed to get store state [HRESULT = 0x80070bc9 - ERROR_FAIL_REBOOT_REQUIRED]
+2025-04-02 07:17:55, Info  CBS    Trusted Installer successfully registered to be restarted for pre-shutdown
+2025-04-02 07:17:55, Info  CBS    Trusted Installer is shutting down because: SHUTDOWN_REASON_AUTOSTOP
+2025-04-02 07:17:55, Info  CBS    Stopping Winlogon CreateSession notifications
+2025-04-02 07:17:55, Info  CBS    Unloading SysNotify DLL
+```
+
+## Root cause 
+
+This error occurs because the OS is in a pending servicing state and the TrustedInstaller service can't clear it due to corruption in the *Transactional Entries* folder. This corruption prevents the completion of update installations and requires a system reboot to roll changes back.
+
+## Resolution
+
+For Windows-based computers, perform an [in-place upgrade](/windows-server/get-started/perform-in-place-upgrade#perform-the-in-place-upgrade). 
+
+For VMs running Windows in Azure, see [in-place upgrade on the Windows virtual machine](/azure/virtual-machines/windows-in-place-upgrade).

support/windows-server/installing-updates-features-roles/troubleshoot-windows-update-error-0x80070bc9.md

@@ -41,7 +41,7 @@ Windows Update fails and returns error 0x80072f8f. Check the `WindowsUpdate.log`
 
 ### Symptom 2
 
-When you try to download updates from Windows Update, you see no progress. The `WindowsUpdate.log` shows failures on WinHTTP requests to `SLS.Update.Microsoft.com`:
+When you download updates from Windows Update, you see no progress. The `WindowsUpdate.log` shows failures on WinHTTP requests to `SLS.Update.Microsoft.com`:
 
 ```output
 2032 2248 ComApi * START * Federated Search ClientId = Device Driver Retrieval Client (cV: xXbBtDYuUUOnH3AK.1.0)
@@ -65,14 +65,8 @@ When you check for updates from Windows Update, you see no progress. The `Window
 This error is usually caused by one of the following issues:
 
 - **Out-of-sync clock**: If the clock settings on the computer are incorrect, SSL negotiation fails. You can quickly verify clock accuracy from `WindowsUpdate.log` that always prints traces in local time.
-- **Untrusted SSL certificate**: This issue occurs in the following managed scenarios:
-    -  For Windows Server Update Services (WSUS).
-    -  For Configuration Manager that's configured over SSL and includes self-generated or signed SSL certificates.
-
-In these scenarios, the scan fails if the client doesn't trust the certificate chain.
+- **Untrusted SSL certificate**:  In managed scenarios for Windows Server Update Services (WSUS) or Configuration Manager that's configured over SSL and includes self-generated or signed SSL certificates, the scan fails if the client doesn't trust the certificate chain.
 
 ## Resolution
 
-For Windows-based computers, perform an [in-place upgrade](/windows-server/get-started/perform-in-place-upgrade#perform-the-in-place-upgrade). 
-
-For VMs running Windows in Azure, see [in-place upgrade on the Windows virtual machine](/azure/virtual-machines/windows-in-place-upgrade).
+Perform an [in-place upgrade](/azure/virtual-machines/windows-in-place-upgrade) on the Windows virtual machine (VM).