|
| 1 | +--- |
| 2 | +title: Error 0x800719e4 (ERROR_LOG_FULL) when Windows update fails |
| 3 | +description: Discusses how to fix Windows Update failures that relate to to error code `0x800719e4 (ERROR_LOG_FULL)`. Typically, this error occurs on Azure-hosted Windows virtual machines (VMs). |
| 4 | +ms.date: 01/08/2026 |
| 5 | +manager: dcscontentpm |
| 6 | +audience: itpro |
| 7 | +ai.usage: ai-assisted |
| 8 | +ms.topic: troubleshooting |
| 9 | +ms.reviewer: kaushika, dougking, v-appelgatet |
| 10 | +ms.custom: |
| 11 | +- sap:Windows Servicing, Updates and Features on Demand\Windows Update - Install errors starting with 0x8007 (ERROR) |
| 12 | +- pcy:WinComm Devices Deploy |
| 13 | +appliesto: |
| 14 | +- ✅ <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Supported versions of Windows Server</a> |
| 15 | +- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Supported versions of Windows Client</a> |
| 16 | +- ✅ <a href=https://learn.microsoft.com/lifecycle/products/azure-virtual-machine target=_blank>Azure Virtual Machines</a> |
| 17 | +--- |
| 18 | +# Error 0x800719e4 (ERROR_LOG_FULL) when Windows update fails |
| 19 | + |
| 20 | +This article discusses how to fix Windows Update failures that relate to error code `0x800719e4 (ERROR_LOG_FULL)`. Typically, this error occurs on Azure-hosted Windows virtual machines (VMs). |
| 21 | + |
| 22 | +## Symptoms |
| 23 | + |
| 24 | +When you try to install an update, the installation fails with error code `0x800719e4 (ERROR_LOG_FULL)`. The update might appear to install, but after the computer restarts at the end of installation, the installation rolls back. The Windows Update history might list repeated failed installations. |
| 25 | + |
| 26 | +When you check the System log and the CBS log, you see errors that might include the following error messages: |
| 27 | + |
| 28 | +- `Failed uninstalling driver updates [HRESULT = 0x800719e4 - ERROR_LOG_FULL]` |
| 29 | +- `Startup: Failed while processing non-critical driver operations queue` |
| 30 | +- `patch not applicable` or `patch not reflecting after restart` |
| 31 | +- `0x80070002 (ERROR_FILE_NOT_FOUND)` |
| 32 | +- `0x800f0991 (PSFX_E_MISSING_PAYLOAD_FILE)` |
| 33 | +- `0x800f0982 (PSFX_E_MATCHING_COMPONENT_NOT_FOUND)` |
| 34 | +- `0x800F0920 (CBS_E_HANG_DETECTED)` |
| 35 | + |
| 36 | +## Cause |
| 37 | + |
| 38 | +Typically, this issue occurs during the installation or uninstallation of cumulative or driver-related updates. |
| 39 | + |
| 40 | +- **Transaction log exhaustion, corruption, or improper cleanup**. Windows transaction logs (.blf files and .regtrans-ms files in \Windows\System32\Config\TxR) become full or corrupted, blocking update processes. Improper cleaning of the transaction logs can lead to further system corruption and startup failures. |
| 41 | +- **"Ghosted" NICs or drivers**. VMs that are frequently deallocated and reallocated in Azure can accumulate replicas of network adapters or drivers (also known as "ghosted" or hidden devices that remain in the system registry but are no longer physically present). This behavior has been observed for Mellanox devices. When this occurs, driver update queues increase in size and logs eventually overflow. |
| 42 | +- **Misconfigured update orchestration**. Incorrect settings for update orchestration (such as not using the **Customer Managed** option) can contribute to update failures. |
| 43 | + |
| 44 | +## Resolution |
| 45 | + |
| 46 | +> [!IMPORTANT] |
| 47 | +> |
| 48 | +> - If the affected computer is a Windows virtual machine (VM) that can't restart correctly or that you can't access by using SSH, make sure that you can use the Azure Serial Console to access the VM. |
| 49 | +> - Before you troubleshoot this issue, back up the operating system disk. For information about this process for VMs, see [About Azure Virtual Machine restore](/azure/backup/about-azure-vm-restore). |
| 50 | +> - Use administrative permissions to run all of the commands and scripts in these steps. |
| 51 | +
|
| 52 | +### Step 1: Check the system health |
| 53 | + |
| 54 | +To check the system health, and make any necessary repairs, open an administrative Command Prompt window, and then run the following commands: |
| 55 | + |
| 56 | +```console |
| 57 | +DISM /Online /Cleanup-Image /RestoreHealth |
| 58 | +SFC /SCANNOW |
| 59 | +``` |
| 60 | + |
| 61 | +Review the output for errors or corruption. If these commands made repairs, try to again install the update. |
| 62 | + |
| 63 | +### Step 2: Clean up the transaction logs |
| 64 | + |
| 65 | +> [!IMPORTANT] |
| 66 | +> As mentioned previously in this article, incorrectly cleaning up transaction logs can cause additional issues. Follow these steps carefully. This section contains two procedures. In most cases, you should use Option A. Use Option B only in the case of VMs that can't start. |
| 67 | +
|
| 68 | +**Option A (Safer method): Rename the TxR and Windows Update folders** |
| 69 | + |
| 70 | +1. To stop the Windows Update service (WUauServ) and the Background Intelligent Transfer Service (BITS), run the following commands: |
| 71 | + |
| 72 | + ```console |
| 73 | + net stop wuauserv |
| 74 | + net stop bits |
| 75 | + ``` |
| 76 | + |
| 77 | +1. To rename the TxR and Windows Update folders, run the following commands: |
| 78 | + |
| 79 | + ```console |
| 80 | + ren C:\Windows\System32\Config\TxR TxR_old |
| 81 | + ren C:\Windows\SoftwareDistribution SoftwareDistribution.old |
| 82 | + ren C:\Windows\System32\catroot2 catroot2.old |
| 83 | + ren C:\Windows\winsxs\pending.xml pending.old |
| 84 | + ``` |
| 85 | + |
| 86 | +1. To restart the services, run the following commands: |
| 87 | + |
| 88 | + ```console |
| 89 | + net start wuauserv |
| 90 | + net start bits |
| 91 | + ``` |
| 92 | + |
| 93 | +1. Restart the computer, and then try again to install the update. |
| 94 | + |
| 95 | +**Option B (Use only on a VM that doesn't start): Use a rescue VM to remove files** |
| 96 | + |
| 97 | +1. Create a rescue VM, and then move the operating system disk from the affected VM to the rescue VM. |
| 98 | +1. On the rescue VM, in an administrative command prompt window, change the working directory to \<drive>:\Windows\System32\Config\TxR. |
| 99 | +1. To remove the system and hidden attributes from the transaction log files, run the following command: |
| 100 | + |
| 101 | + ```console |
| 102 | + attrib -h -s * |
| 103 | + ``` |
| 104 | + |
| 105 | +1. To delete the transaction log files, run the following commands: |
| 106 | + |
| 107 | + ```console |
| 108 | + del *.blf |
| 109 | + del *.regtrans-ms |
| 110 | + ``` |
| 111 | + |
| 112 | +1. Move the operating system disk back to the original VM. |
| 113 | + |
| 114 | +1. Start the VM, and then try again to install the update. |
| 115 | + |
| 116 | +### Step 3: Check for ghosted network adapters or drivers |
| 117 | + |
| 118 | +> [!NOTE] |
| 119 | +> A computer that accumulates ghosted network adapters or drivers might continue to do so. Consider checking for this issue periodically as part of regular maintenance. |
| 120 | +
|
| 121 | +1. Download the following scripts: |
| 122 | + |
| 123 | +- [Windows_GhostedNIC_Detection.ps1](https://github.com/Azure/azure-support-scripts/blob/master/RunCommand/Windows/Windows_GhostedNIC_Detection.ps1) |
| 124 | +- [Windows_GhostedNIC_Removal.ps1](https://github.com/Azure/azure-support-scripts/blob/master/RunCommand/Windows/Windows_GhostedNIC_Removal.ps1) |
| 125 | + |
| 126 | +1. To detect any ghosted network adapters or drivers, open an administrative Windows PowerShell Command Prompt window and then run the following commands: |
| 127 | + |
| 128 | + ```powershell |
| 129 | + Set-ExecutionPolicy Bypass -Force |
| 130 | + .\Windows_GhostedNIC_Detection.ps1 |
| 131 | + ``` |
| 132 | + |
| 133 | +1. If the script detects ghosted network adapters or drivers, run the following commands: |
| 134 | + |
| 135 | + ```powershell |
| 136 | + Set-ExecutionPolicy Bypass -Force |
| 137 | + .\Windows_GhostedNIC_Removal.ps1 |
| 138 | + ``` |
| 139 | + |
| 140 | +1. If the affected computer has a Mellanox adapter or driver, run the following commands: |
| 141 | + |
| 142 | + ```powershell |
| 143 | + Get-PnpDevice | Where-Object { $_.FriendlyName -like "*Mellanox*" } |
| 144 | + pnputil /remove-device <InstanceID> |
| 145 | + ``` |
| 146 | + |
| 147 | + > [!NOTE] |
| 148 | + > In this command, \<InstanceID> represents the instance ID number of the device. |
| 149 | +
|
| 150 | +1. Restart the computer, and then try again to install the update. |
| 151 | + |
| 152 | +## Data collection |
| 153 | + |
| 154 | +If issues persist, consider contacting Microsoft Support. Before you contact Microsoft Support for assistance, use the Trouble Shooting Script (TSS) diagnostic scripts to collect data, as described in [Collect data to analyze and troubleshoot Windows servicing, Updates, and Features on Demand scenarios](../windows-client/windows-tss/collect-data-analyze-troubleshoot-windows-servicing-scenarios?context=%2Ftroubleshoot%2Fwindows-server%2Fcontext%2Fcontext#scenario-failures-to-install-windows-updates-or-features-on-demand). Attach this information to your support request. |
| 155 | + |
| 156 | +## References |
| 157 | + |
| 158 | +- [Ghosted NIC Detection & Removal Scripts](https://github.com/Azure/azure-support-scripts) |
| 159 | +- [Introduction to TroubleShootingScript toolset (TSS)](../windows-client/windows-tss/introduction-to-troubleshootingscript-toolset-tss.md) |
0 commit comments